Solved Not sure if I'm infected, but it can't hurt to check ...

Malnutrition · Jul 20, 2019

Download Quick Diag to your desktop.
Very Important!! -- Make sure program is on your desktop.
Disable your Antivirus/Antispyware prior to scanning.
Right Click Run as Administrator.
Select the Quick Scan.

Post the log that is generated in your next post.

Malnutrition · Jul 20, 2019

Drive c: () (Fixed) (Total:200 GB) (Free:14.41 GB) NTFS

Time to free up some space on your HDD, windows needs at least 15% free space....

How Much Free Space Should You Leave on Your Windows PC?

It's a bad idea to fill a Windows system drive completely full, and this could cause a variety of problems.

www.howtogeek.com

Fla_Panther · Jul 20, 2019

Re: C drive ... yes, I know. I just bought a 512GB SSD two weeks ago and cloned my drive over to it. Haven't had time to extend the partition yet. And I came home last night to find my bathroom sink's faucet is broken, so that's taken priority. It's always something, isn't it?

--------------- QuickDiag | g3n-h@ckm@n | V5_27.02.19.1 ---------------

----- XP | Vista | 7 | 8 | 8.1 | 10 - 32/64 bits ----- - Start 15/07/2019 10:40:00

Updated 27/02/2019 | 11:10 (GMT) by g3n-h@ckm@n
Contact : http://www.sosvirus.net/

Time Zone : (UTC-05:00) Eastern Time (US & Canada)
[******** (Administrator)] - [********-PC] (S-1-5-21-3206243102-205974907-2145499838-1000)

System: Microsoft Windows 7 Professional - Service Pack 1 - (6.1.7601) - BuildType: Multiprocessor Free -

OSLanguage: 1033 (0409) -> ()
System: AutoReboot: True - DebugFilePath: %SystemRoot%\MEMORY.DMP - KernelDumpOnly: False -

OverwriteExistingDebugFile: True - WriteDebugInfo: True - WriteToSystemLog: True
Boot : Microsoft Windows 7 Professional |C:\Windows|\Device\Harddisk0\Partition2
Boot : Normal boot
PC: Latitude E6430 - Dell Inc. - IdNumber: JS7MTW1 - UUID: 4C4C4544-0053-3710-804D-CAC04F545731
Processor : X64 - 2890 Mhz - Intel(R) Core(TM) i7-3520M CPU @ 2.90GHz
BIOS Date: 12/13/12 20:36:48 Ver: A09.00 - en|US|iso8859-1 - Dell Inc. - S/N: JS7MTW1 - A09 - DELL - 1072009
CoreTemp : 63.5 Celsius

----------| Quick

---------- | SoundDevice

Akai EIE Pro Audio - WDM 2.9.30 - Status: OK - Manufacturer: Akai Professional - PNPDeviceID: MEDIA

\AKAI_EIE_AUDIOADAPTER\8&1EF45D8F&0&ID01
Intel(R) Display Audio - Status: OK - Manufacturer: Intel(R) Corporation - PNPDeviceID: HDAUDIO

\FUNC_01&VEN_8086&DEV_2806&SUBSYS_80860101&REV_1000\4&1A5CB910&0&0301
IDT High Definition Audio CODEC - Status: OK - Manufacturer: IDT - PNPDeviceID: HDAUDIO

\FUNC_01&VEN_111D&DEV_76DF&SUBSYS_10280534&REV_1002\4&1A5CB910&0&0001

---------- | Video

Intel(R) HD Graphics 4000 - Resolution: 1280x1024 - Colors: 4294967296 - RefreshRate: 60 - 32 Bits Per Pixel -

DeviceID: VideoController1 - Drivers:

igdumdim64.dll,igd10iumd64.dll,igd10iumd64.dll,igdumdim32,igd10iumd32,igd10iumd32 - PNPDeviceID: PCI

\VEN_8086&DEV_0166&SUBSYS_05341028&REV_09\3&11583659&0&10 - AdapterCompatibility: Intel Corporation - RAM: -

2080374784
Inegrated Video Chipset DeviceName: Intel(R) HD Graphics 4000 - DriverVersion: 10.18.10.4425 -

SpecificationVersion: 1025

---------- | Codecs

c:\windows\system32\imaadp32.acm - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 22016 -

Manufacturer: Microsoft Corporation - Status: OK
c:\windows\system32\msadp32.acm - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 24064 - Manufacturer:

Microsoft Corporation - Status: OK
c:\windows\system32\iyuv_32.dll - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 54272 - Manufacturer:

Microsoft Corporation - Status: OK
c:\windows\system32\tsbyuv.dll - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 14848 - Manufacturer:

Microsoft Corporation - Status: OK
c:\windows\system32\msgsm32.acm - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 29184 - Manufacturer:

Microsoft Corporation - Status: OK
c:\windows\system32\l3codeca.acm - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 81408 -

Manufacturer: Fraunhofer Institut Integrierte Schaltungen IIS - Status: OK
c:\windows\system32\msrle32.dll - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 16384 - Manufacturer:

Microsoft Corporation - Status: OK
c:\windows\system32\msg711.acm - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 14848 - Manufacturer:

Microsoft Corporation - Status: OK
c:\windows\system32\msvidc32.dll - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 38912 -

Manufacturer: Microsoft Corporation - Status: OK
c:\windows\system32\msyuv.dll - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 25600 - Manufacturer:

Microsoft Corporation - Status: OK

---------- | CPU

CPU #1 value:6 %
CPU #2 value:18 %
CPU #3 value:0 %
CPU #4 value:6 %
Total Overall CPU Usage value:7 %

---------- | Network

Intel[R] 82579LM Gigabit Network Connection : SENT:0 bytes/sec / RECVD:0 bytes/sec
Intel[R] Centrino[R] Advanced-N 6205 : SENT:0 bytes/sec / RECVD:0 bytes/sec
Microsoft Virtual WiFi Miniport Adapter : SENT:0 bytes/sec / RECVD:0 bytes/sec
Microsoft Virtual WiFi Miniport Adapter _2 : SENT:0 bytes/sec / RECVD:0 bytes/sec
isatap.{41B84864-2D3D-4D17-B09E-E347F560F7F7} : SENT:0 bytes/sec / RECVD:0 bytes/sec
isatap.{3D0D15B6-5A19-4873-88B7-D9B5B9D67406} : SENT:0 bytes/sec / RECVD:0 bytes/sec
isatap.{AFE20685-E901-42C7-A0EA-94EC69D7938C} : SENT:0 bytes/sec / RECVD:0 bytes/sec
isatap.mifi.local : SENT:0 bytes/sec / RECVD:0 bytes/sec

Overall -> SEND Maxium:7 bytes/sec, / RECEIVE Maximum:0 bytes/sec

WAN Miniport (SSTP) - - Microsoft - Status: - PnPID : ROOT\MS_SSTPMINIPORT\0000
WAN Miniport (IKEv2) - - Microsoft - Status: - PnPID : ROOT\MS_AGILEVPNMINIPORT\0000
WAN Miniport (L2TP) - - Microsoft - Status: - PnPID : ROOT\MS_L2TPMINIPORT\0000
WAN Miniport (PPTP) - - Microsoft - Status: - PnPID : ROOT\MS_PPTPMINIPORT\0000
WAN Miniport (PPPOE) - - Microsoft - Status: - PnPID : ROOT\MS_PPPOEMINIPORT\0000
WAN Miniport (IPv6) - - Microsoft - Status: - PnPID : ROOT\MS_NDISWANIPV6\0000
WAN Miniport (Network Monitor) - - Microsoft - Status: - PnPID : ROOT\MS_NDISWANBH\0000
Realtek USB GBE Family Controller - - - Status: - PnPID :
WAN Miniport (IP) - - Microsoft - Status: - PnPID : ROOT\MS_NDISWANIP\0000
Microsoft ISATAP Adapter - Tunnel - Microsoft - Status: - PnPID : ROOT\*ISATAP\0000
RAS Async Adapter - - - Status: - PnPID :
Microsoft 6to4 Adapter - Tunnel - Microsoft - Status: - PnPID : ROOT\*6TO4MP\0000
Intel(R) 82579LM Gigabit Network Connection - Ethernet 802.3 - Intel - Status: - PnPID : PCI

\VEN_8086&DEV_1502&SUBSYS_05341028&REV_04\3&11583659&0&C8
Microsoft ISATAP Adapter #2 - Tunnel - Microsoft - Status: - PnPID : ROOT\*ISATAP\0001
Intel(R) Centrino(R) Advanced-N 6205 - Ethernet 802.3 - Intel Corporation - Status: - PnPID : PCI

\VEN_8086&DEV_0082&SUBSYS_13218086&REV_34\4&752EA02&0&00E1
Microsoft ISATAP Adapter #3 - Tunnel - Microsoft - Status: - PnPID : ROOT\*ISATAP\0002
Microsoft Virtual WiFi Miniport Adapter - Ethernet 802.3 - Microsoft - Status: - PnPID : {5D624F94-8850-40C3-

A3FA-A4FD2080BAF3}\VWIFIMP\5&424B243&0&01
Microsoft Virtual WiFi Miniport Adapter #2 - Ethernet 802.3 - Microsoft - Status: - PnPID : {5D624F94-8850-

40C3-A3FA-A4FD2080BAF3}\VWIFIMP\5&424B243&0&02
Microsoft ISATAP Adapter #5 - Tunnel - Microsoft - Status: - PnPID : ROOT\*ISATAP\0004

---------- | Memory

RAM = Total (MB) : 16645 | Free (MB) : 11248
Pagefile = Total (MB) : 33288 | Free (MB) : 27351
Virtual = Total (MB) : 4194 | Free (MB) : 3966

Physical Memory 0 : Capacity: 8589934592 - ChannelA-DIMM0 - Posit.: 1 - Manufacturer: Samsung - PartNumber:

M471B1G73QH0-YK0 - S/N: 16D8CB97
Physical Memory 1 : Capacity: 8589934592 - ChannelB-DIMM0 - Posit.: 2 - Manufacturer: Samsung - PartNumber:

M471B1G73QH0-YK0 - S/N: 16D8CB97

---------- | SID Users

Administrator : [S-1-5-21-3206243102-205974907-2145499838-500]
Guest : [S-1-5-21-3206243102-205974907-2145499838-501]
HomeGroupUser$ : [S-1-5-21-3206243102-205974907-2145499838-1002]
******** : [S-1-5-21-3206243102-205974907-2145499838-1000]
Administrators : [S-1-5-32-544]
Backup Operators : [S-1-5-32-551]
Cryptographic Operators : [S-1-5-32-569]
Distributed COM Users : [S-1-5-32-562]
Event Log Readers : [S-1-5-32-573]
Guests : [S-1-5-32-546]
IIS_IUSRS : [S-1-5-32-568]
Network Configuration Operators : [S-1-5-32-556]
Performance Log Users : [S-1-5-32-559]
Performance Monitor Users : [S-1-5-32-558]
Power Users : [S-1-5-32-547]
Remote Desktop Users : [S-1-5-32-555]
Replicator : [S-1-5-32-552]
Users : [S-1-5-32-545]
HomeUsers : [S-1-5-21-3206243102-205974907-2145499838-1001]

---------- | SystemAccounts

Name: Everyone - SID: S-1-1-0 - SIDType: 5 - Status: OK
Name: LOCAL - SID: S-1-2-0 - SIDType: 5 - Status: OK
Name: CREATOR OWNER - SID: S-1-3-0 - SIDType: 5 - Status: OK
Name: CREATOR GROUP - SID: S-1-3-1 - SIDType: 5 - Status: OK
Name: CREATOR OWNER SERVER - SID: S-1-3-2 - SIDType: 5 - Status: OK
Name: CREATOR GROUP SERVER - SID: S-1-3-3 - SIDType: 5 - Status: OK
Name: OWNER RIGHTS - SID: S-1-3-4 - SIDType: 5 - Status: OK
Name: DIALUP - SID: S-1-5-1 - SIDType: 5 - Status: OK
Name: NETWORK - SID: S-1-5-2 - SIDType: 5 - Status: OK
Name: BATCH - SID: S-1-5-3 - SIDType: 5 - Status: OK
Name: INTERACTIVE - SID: S-1-5-4 - SIDType: 5 - Status: OK
Name: SERVICE - SID: S-1-5-6 - SIDType: 5 - Status: OK
Name: ANONYMOUS LOGON - SID: S-1-5-7 - SIDType: 5 - Status: OK
Name: PROXY - SID: S-1-5-8 - SIDType: 5 - Status: OK
Name: SYSTEM - SID: S-1-5-18 - SIDType: 5 - Status: OK
Name: ENTERPRISE DOMAIN CONTROLLERS - SID: S-1-5-9 - SIDType: 5 - Status: OK
Name: SELF - SID: S-1-5-10 - SIDType: 5 - Status: OK
Name: Authenticated Users - SID: S-1-5-11 - SIDType: 5 - Status: OK
Name: RESTRICTED - SID: S-1-5-12 - SIDType: 5 - Status: OK
Name: TERMINAL SERVER USER - SID: S-1-5-13 - SIDType: 5 - Status: OK
Name: REMOTE INTERACTIVE LOGON - SID: S-1-5-14 - SIDType: 5 - Status: OK
Name: IUSR - SID: S-1-5-17 - SIDType: 5 - Status: OK
Name: LOCAL SERVICE - SID: S-1-5-19 - SIDType: 5 - Status: OK
Name: NETWORK SERVICE - SID: S-1-5-20 - SIDType: 5 - Status: OK
Name: BUILTIN - SID: S-1-5-32 - SIDType: 3 - Status: OK

---------- | Drives

C:\ -> [Fixed] | [] | Total : 200 Go | Free : 14.19 Go -> NTFS (SSD) [RAID]
F:\ -> [Fixed] | [New Volume] | Total : 97.99 Go | Free : 31.2 Go -> NTFS (SSD) [RAID]

Disk Usage Information [1 total Physical Disks]

Physical Drive #0 [C:, F:] : Read:0 bytes/sec, Written:0 bytes/sec Max Read:0 bytes/sec, Max Write:0 bytes/sec

Overall - Read Maximum:0 bytes/sec, Write Maximum:0 bytes/sec

DeviceID: \\.\PHYSICALDRIVE0 - Status: OK - SCSI - Fixed hard disk media - 3 Part. - PnPID : IDE

\DISKSANDISK_SD7SB2Q-512G-1006_______________X2180006\4&241BACD1&0&0.0.0

---------- | Windows updates - Activation - License

W.A.T :

Last detection : 2019-07-15 00:12:22
Downloaded last ones : 2019-07-15 00:29:24
Installed last ones : 2019-07-15 00:30:27
Next search : 2019-07-15 21:18:22

Test 1 : Windows Is Activated

Volume License

---------- | Browsers

IE : 11.0.9600.19404 (© Microsoft Corporation.)
GC : 75.0.3770.142 (Copyright 2019 Google LLC.)

Default : "C:\Program Files\Internet Explorer\iexplore.exe"

---------- | FlashPlayer

FlashPlayer ActiveX : 32.0.0.142
FlashPlayer Plugin : 29.0.0.171

---------- | Security

AV :
AS : Windows Defender Disabled
FW : WINDOWS Firewall
WMI : OK
WU: Windows Update Service [Auto(2)] = Running
AS: Windows Defender [Manual(3)] = stopped
WMI: Windows Management Instrumentation [Auto(2)] = Running

---------- | Running processes

296 | [Owner : SYSTEM | Parent : 4(System) | 1.37 Mo] - (.Microsoft Corporation - Windows Session Manager.) -

(6.1.7601.24499) = C:\Windows\System32\smss.exe [12/07/2019 15:59:26] CPU Usage:0 %
404 | [Owner : SYSTEM | Parent : 372() | 5.02 Mo] - (.Microsoft Corporation - Client Server Runtime Process.)

- (6.1.7600.16385) = C:\Windows\System32\csrss.exe [13/07/2009 19:19:49] CPU Usage:0 %
448 | [Owner : SYSTEM | Parent : 372() | 4.86 Mo] - (.Microsoft Corporation - Windows Start-Up Application.) -

(6.1.7600.16385) = C:\Windows\System32\wininit.exe [13/07/2009 19:52:37] CPU Usage:0 %
464 | [Owner : SYSTEM | Parent : 456() | 56.34 Mo] - (.Microsoft Corporation - Client Server Runtime Process.)

- (6.1.7600.16385) = C:\Windows\System32\csrss.exe [13/07/2009 19:19:49] CPU Usage:0 %
512 | [Owner : SYSTEM | Parent : 448(wininit.exe) | 10.82 Mo] - (.Microsoft Corporation - Services and

Controller app.) - (6.1.7601.18829) = C:\Windows\System32\services.exe [26/06/2018 11:46:30] CPU

Usage:0 %
536 | [Owner : SYSTEM | Parent : 448(wininit.exe) | 13.86 Mo] - (.Microsoft Corporation - Local Security

Authority Process.) - (6.1.7601.24499) = C:\Windows\System32\lsass.exe [12/07/2019 15:59:25] CPU

Usage:0 %
544 | [Owner : SYSTEM | Parent : 448(wininit.exe) | 4.8 Mo] - (.Microsoft Corporation - Local Session Manager

Service.) - (6.1.7601.17514) = C:\Windows\System32\lsm.exe [20/11/2010 23:23:53] CPU Usage:0 %
592 | [Owner : SYSTEM | Parent : 456() | 8.74 Mo] - (.Microsoft Corporation - Windows Logon Application.) -

(6.1.7601.24000) = C:\Windows\System32\winlogon.exe [26/06/2018 09:56:04] CPU Usage:0 %
688 | [Owner : SYSTEM | Parent : 512(services.exe) | 11.06 Mo] - (.Microsoft Corporation - Host Process for

Windows Services.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [13/07/2009 19:31:13] CPU

Usage:0 %
768 | [Owner : NETWORK SERVICE | Parent : 512(services.exe) | 9.94 Mo] - (.Microsoft Corporation - Host

Process for Windows Services.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [13/07/2009 19:31:13]

CPU Usage:0 %
864 | [Owner : LOCAL SERVICE | Parent : 512(services.exe) | 24.56 Mo] - (.Microsoft Corporation - Host Process

for Windows Services.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [13/07/2009 19:31:13] CPU

Usage:0 %
904 | [Owner : SYSTEM | Parent : 512(services.exe) | 24.12 Mo] - (.Microsoft Corporation - Host Process for

Windows Services.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [13/07/2009 19:31:13] CPU

Usage:0 %
944 | [Owner : LOCAL SERVICE | Parent : 512(services.exe) | 20.06 Mo] - (.Microsoft Corporation - Host Process

for Windows Services.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [13/07/2009 19:31:13] CPU

Usage:0 %
976 | [Owner : SYSTEM | Parent : 512(services.exe) | 50.88 Mo] - (.Microsoft Corporation - Host Process for

Windows Services.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [13/07/2009 19:31:13] CPU

Usage:0 %
116 | [Owner : SYSTEM | Parent : 512(services.exe) | 8.67 Mo] - (.IDT, Inc. - IDT PC Audio.) - (1.0.6491.0) =

C:\Program Files\IDT\WDM\stacsv64.exe [26/06/2018 13:41:19] CPU Usage:0 %
972 | [Owner : SYSTEM | Parent : 512(services.exe) | 8.26 Mo] - (.Microsoft Corporation - Host Process for

Windows Services.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [13/07/2009 19:31:13] CPU

Usage:0 %
1120 | [Owner : SYSTEM | Parent : 512(services.exe) | 7.54 Mo] - (.Intel Corporation - igfxCUIService Module.)

- (6.15.10.4425) = C:\Windows\System32\igfxCUIService.exe [02/06/2016 13:40:40] CPU Usage:0 %
1260 | [Owner : NETWORK SERVICE | Parent : 512(services.exe) | 18.54 Mo] - (.Microsoft Corporation - Host

Process for Windows Services.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [13/07/2009 19:31:13]

CPU Usage:0 %
1348 | [Owner : SYSTEM | Parent : 904(svchost.exe) | 17.05 Mo] - (.Microsoft Corporation - Windows Wireless

LAN 802.11 Extensibility Framework.) - (6.1.7600.16385) = C:\Windows\System32\wlanext.exe [13/07/2009

20:07:15] CPU Usage:0 %
1360 | [Owner : SYSTEM | Parent : 404(csrss.exe) | 3.11 Mo] - (.Microsoft Corporation - Console Window Host.)

- (6.1.7601.24499) = C:\Windows\System32\conhost.exe [12/07/2019 15:59:25] CPU Usage:0 %
1448 | [Owner : SYSTEM | Parent : 512(services.exe) | 14.36 Mo] - (.Microsoft Corporation - Spooler SubSystem

App.) - (6.1.7601.24000) = C:\Windows\System32\spoolsv.exe [26/06/2018 09:55:35] CPU Usage:0 %
1476 | [Owner : LOCAL SERVICE | Parent : 512(services.exe) | 16.89 Mo] - (.Microsoft Corporation - Host

Process for Windows Services.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [13/07/2009 19:31:13]

CPU Usage:0 %
1572 | [Owner : SYSTEM | Parent : 512(services.exe) | 7.95 Mo] - (.Microsoft Corporation - Host Process for

Windows Services.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [13/07/2009 19:31:13] CPU

Usage:0 %
1616 | [Owner : SYSTEM | Parent : 512(services.exe) | 14.79 Mo] - (.Intel(R) Corporation - Intel(R)

PROSet/Wireless Event Log Service.) - (16.1.0.0) = C:\Program Files\Intel\WiFi\bin\EvtEng.exe [17/07/2013

11:50:08] CPU Usage:0 %
1784 | [Owner : SYSTEM | Parent : 512(services.exe) | 6.14 Mo] - (.Intel(R) Corporation - Intel(R) Capability

Licensing Service Interface.) - (1.31.8.1) = C:\Program Files\Intel\iCLS Client\HeciServer.exe [27/08/2013

14:32:14] CPU Usage:0 %
1856 | [Owner : SYSTEM | Parent : 512(services.exe) | 8.1 Mo] - (.Intel(R) Corporation - Intel(R)

PROSet/Wireless Registry Service.) - (16.1.0.0) = C:\Program Files\Common Files\Intel\WirelessCommon

\RegSrvc.exe [17/07/2013 11:49:16] CPU Usage:0 %
1912 | [Owner : SYSTEM | Parent : 512(services.exe) | 7 Mo] - (.Visioneer Inc. - RoadWarrior 3 Series HAL.) -

(5.1.216.4184) = C:\Program Files\Visioneer\RWAR3\RWAR3HV_0001_0.EXE [29/10/2018 20:46:48] CPU Usage:0

%
1976 | [Owner : SYSTEM | Parent : 512(services.exe) | 6.88 Mo] - (.Visioneer Inc. - RoadWarrior 3 Series

Monitor.) - (5.1.216.4185) = C:\Program Files\Visioneer\RWAR3\RWAR3Monitor.exe [29/10/2018 20:45:37]

CPU Usage:0 %
2004 | [Owner : LOCAL SERVICE | Parent : 512(services.exe) | 6.51 Mo] - (.Microsoft Corporation - Host Process

for Windows Services.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [13/07/2009 19:31:13] CPU

Usage:0 %
2028 | [Owner : SYSTEM | Parent : 512(services.exe) | 22.2 Mo] - (.Intel® Corporation - Intel® PROSet/Wireless

Zero Configure Service.) - (16.1.0.0) = C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [17/07/2013

11:51:24] CPU Usage:0 %
1288 | [Owner : SYSTEM | Parent : 688(svchost.exe) | 5.92 Mo] - (.Microsoft Corporation - Sink to receive

asynchronous callbacks for WMI client application.) - (6.1.7600.16385) = C:\Windows\System32\wbem\unsecapp.exe

[13/07/2009 19:47:12] CPU Usage:0 %
384 | [Owner : SYSTEM | Parent : 688(svchost.exe) | 26.62 Mo] - (.Microsoft Corporation - WMI Provider Host.)

- (6.1.7601.17514) = C:\Windows\System32\wbem\WmiPrvSE.exe [20/11/2010 23:24:15] CPU Usage:0 %
2304 | [Owner : LOCAL SERVICE | Parent : 904(svchost.exe) | 5.42 Mo] - (.Microsoft Corporation - Windows

Driver Foundation - User-mode Driver Framework Host Process.) - (6.2.9200.16384) = C:\Windows

\System32\WUDFHost.exe [26/06/2018 11:04:20] CPU Usage:0 %
3012 | [Owner : ******** | Parent : 904(svchost.exe) | 33.7 Mo] - (.Microsoft Corporation - Desktop Window

Manager.) - (6.1.7600.16385) = C:\Windows\System32\dwm.exe [13/07/2009 19:37:38] CPU Usage:2 %
3020 | [Owner : LOCAL SERVICE | Parent : 512(services.exe) | 21.48 Mo] - (.Microsoft Corporation -

PresentationFontCache.exe.) - (3.0.6920.5011) = C:\Windows\Microsoft.NET\Framework64\v3.0\WPF

\PresentationFontCache.exe [20/11/2010 23:24:52] CPU Usage:0 %
2232 | [Owner : ******** | Parent : 512(services.exe) | 16.02 Mo] - (.Microsoft Corporation - Host Process for

Windows Tasks.) - (6.1.7601.18010) = C:\Windows\System32\taskhost.exe [26/06/2018 11:00:30] CPU Usage:0

%
2236 | [Owner : ******** | Parent : 2988() | 82.91 Mo] - (.Microsoft Corporation - Windows Explorer.) -

(6.1.7601.23537) = C:\Windows\explorer.exe [26/06/2018 11:02:30] CPU Usage:0 %
2784 | [Owner : ******** | Parent : 2752() | 12.94 Mo] - (.Intel Corporation - igfxEM Module.) -

(6.15.10.4425) = C:\Windows\System32\igfxEM.exe [02/06/2016 13:40:52] CPU Usage:0 %
2864 | [Owner : ******** | Parent : 2752() | 10.18 Mo] - (.Intel Corporation - igfxHK Module.) -

(6.15.10.4425) = C:\Windows\System32\igfxHK.exe [02/06/2016 13:40:58] CPU Usage:0 %
2884 | [Owner : ******** | Parent : 2752() | 12.18 Mo] - (.Intel Corporation - igfxTray Module.) -

(6.15.10.4425) = C:\Windows\System32\igfxTray.exe [02/06/2016 13:41:06] CPU Usage:0 %
1188 | [Owner : ******** | Parent : 2236(explorer.exe) | 11.17 Mo] - (.IDT, Inc. - IDT PC Audio.) -

(1.0.6491.0) = C:\Program Files\IDT\WDM\sttray64.exe [26/06/2018 13:41:19] CPU Usage:0 %
2744 | [Owner : ******** | Parent : 2236(explorer.exe) | 21.52 Mo] - (.Intel(R) Corporation - Intel(R)

PROSet/Wireless Framework.) - (16.1.0.0) = C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe

[17/07/2013 11:48:56] CPU Usage:0 %
2700 | [Owner : ******** | Parent : 2236(explorer.exe) | 11.07 Mo] - (.Alps Electric Co., Ltd. - Alps

Pointing-device Driver.) - (8.1.101.178) = C:\Program Files\DellTPad\Apoint.exe [26/06/2018 13:44:55]

CPU Usage:0 %
3336 | [Owner : ******** | Parent : 688(svchost.exe) | 6.82 Mo] - (.Microsoft Corporation - Sink to receive

asynchronous callbacks for WMI client application.) - (6.1.7600.16385) = C:\Windows\System32\wbem\unsecapp.exe

[13/07/2009 19:47:12] CPU Usage:0 %
3404 | [Owner : ******** | Parent : 2700(Apoint.exe) | 6.12 Mo] - (.Alps Electric Co., Ltd. - ApMsgFwd.) -

(8.0.0.39) = C:\Program Files\DellTPad\ApMsgFwd.exe [26/06/2018 13:44:55] CPU Usage:0 %
3460 | [Owner : ******** | Parent : 2700(Apoint.exe) | 5.04 Mo] - (.Alps Electric Co., Ltd. - Alps Pointing-

device Driver.) - (7.0.0.30) = C:\Program Files\DellTPad\hidfind.exe [26/06/2018 13:44:55] CPU Usage:0

%
3468 | [Owner : ******** | Parent : 3452() | 5.92 Mo] - (.Alps Electric Co., Ltd. - Alps Pointing-device

Driver for Windows NT/2000/XP/Vista.) - (7.0.1.33) = C:\Program Files\DellTPad\ApntEx.exe [26/06/2018

13:44:55] CPU Usage:0 %
3484 | [Owner : ******** | Parent : 464(csrss.exe) | 5.14 Mo] - (.Microsoft Corporation - Console Window

Host.) - (6.1.7601.24499) = C:\Windows\System32\conhost.exe [12/07/2019 15:59:25] CPU Usage:0 %
3840 | [Owner : SYSTEM | Parent : 512(services.exe) | 54.46 Mo] - (.Microsoft Corporation - Microsoft Windows

Search Indexer.) - (7.0.7601.24275) = C:\Windows\System32\SearchIndexer.exe [10/12/2018 23:07:41] CPU

Usage:0 %
3932 | [Owner : NETWORK SERVICE | Parent : 512(services.exe) | 11.72 Mo] - (.Microsoft Corporation - Windows

Media Player Network Sharing Service.) - (12.0.7601.17514) = C:\Program Files\Windows Media Player

\wmpnetwk.exe [20/11/2010 23:25:05] CPU Usage:0 %
3212 | [Owner : LOCAL SERVICE | Parent : 512(services.exe) | 14.23 Mo] - (.Microsoft Corporation - Host

Process for Windows Services.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [13/07/2009 19:31:13]

CPU Usage:0 %
3168 | [Owner : LOCAL SERVICE | Parent : 512(services.exe) | 16.07 Mo] - (.Microsoft Corporation - Host

Process for Windows Services.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [13/07/2009 19:31:13]

CPU Usage:2 %
3712 | [Owner : NETWORK SERVICE | Parent : 688(svchost.exe) | 19.28 Mo] - (.Microsoft Corporation - WMI

Provider Host.) - (6.1.7601.17514) = C:\Windows\System32\wbem\WmiPrvSE.exe [20/11/2010 23:24:15] CPU

Usage:0 %
4504 | [Owner : ******** | Parent : 2236(explorer.exe) | 197.93 Mo] - (.Google LLC - Google Chrome.) -

(75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

Usage:2 %
5024 | [Owner : ******** | Parent : 4504(chrome.exe) | 6.1 Mo] - (.Google LLC - Google Chrome.) -

(75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

Usage:0 %
4584 | [Owner : ******** | Parent : 4504(chrome.exe) | 6.85 Mo] - (.Google LLC - Google Chrome.) -

(75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

Usage:0 %
5004 | [Owner : ******** | Parent : 4504(chrome.exe) | 675.98 Mo] - (.Google LLC - Google Chrome.) -

(75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

Usage:0 %
1768 | [Owner : ******** | Parent : 4504(chrome.exe) | 48.85 Mo] - (.Google LLC - Google Chrome.) -

(75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

Usage:0 %
5844 | [Owner : SYSTEM | Parent : 512(services.exe) | 11.98 Mo] - (.Dell Inc. - Dell Data Vault Rules

Processor.) - (5.2.8.103) = C:\Program Files\Dell\DellDataVault\DDVRulesProcessor.exe [28/02/2019

11:26:18] CPU Usage:0 %
5900 | [Owner : SYSTEM | Parent : 512(services.exe) | 63.44 Mo] - (.PC-Doctor, Inc. - PC-Doctor Dell

SupportAssist API.) - (6.0.7033.2285) = C:\Program Files\Dell\SupportAssistAgent\PCDr\SupportAssist

\6.0.7033.2285\DSAPI.exe [30/05/2019 09:49:45] CPU Usage:0 %
5988 | [Owner : SYSTEM | Parent : 5900(DSAPI.exe) | 149.06 Mo] - (.PC-Doctor, Inc. - PC-Doctor Communications

Manager.) - (6.0.7033.2285) = C:\Program Files\Dell\SupportAssistAgent\PCDr\SupportAssist

\6.0.7033.2285\pcdrwi.exe [30/05/2019 09:49:49] CPU Usage:0 %
5996 | [Owner : SYSTEM | Parent : 404(csrss.exe) | 3.15 Mo] - (.Microsoft Corporation - Console Window Host.)

- (6.1.7601.24499) = C:\Windows\System32\conhost.exe [12/07/2019 15:59:25] CPU Usage:0 %
2360 | [Owner : SYSTEM | Parent : 512(services.exe) | 4.73 Mo] - (.Intel Corporation - Intel(R) Dynamic

Application Loader Host Interface.) - (9.5.12.1682) = C:\Program Files (x86)\Intel\Intel(R) Management Engine

Components\DAL\jhi_service.exe [26/06/2018 13:41:04] CPU Usage:0 %
5520 | [Owner : SYSTEM | Parent : 512(services.exe) | 11.07 Mo] - (.Intel Corporation - Intel(R) Local

Management Service.) - (9.5.10.1628) = C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS

\LMS.exe [26/06/2018 13:40:29] CPU Usage:0 %
5152 | [Owner : SYSTEM | Parent : 512(services.exe) | 95.64 Mo] - (.Dell Inc. - Service.) - (3.2.2.119) = C:

\Program Files\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe [24/05/2019 07:01:56] CPU Usage:0 %
7128 | [Owner : SYSTEM | Parent : 512(services.exe) | 27.77 Mo] - (.Dell Inc. - Dell Data Vault Data Collector

Service.) - (5.2.8.103) = C:\Program Files\Dell\DellDataVault\DDVDataCollector.exe [28/02/2019 11:28:26]

CPU Usage:0 %
2520 | [Owner : SYSTEM | Parent : 512(services.exe) | 5.43 Mo] - (.Dell Inc. - Dell Data Vault Data Collector

Service API.) - (5.2.8.103) = C:\Program Files\Dell\DellDataVault\DDVCollectorSvcApi.exe [28/02/2019

11:28:48] CPU Usage:0 %
6816 | [Owner : LOCAL SERVICE | Parent : 688(svchost.exe) | 10.99 Mo] - (.Microsoft Corporation - WMI Provider

Host.) - (6.1.7601.17514) = C:\Windows\System32\wbem\WmiPrvSE.exe [20/11/2010 23:24:15] CPU Usage:0 %
4076 | [Owner : ******** | Parent : 4504(chrome.exe) | 1541.13 Mo] - (.Google LLC - Google Chrome.) -

(75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

Usage:31 %
4844 | [Owner : ******** | Parent : 4504(chrome.exe) | 69.72 Mo] - (.Google LLC - Google Chrome.) -

(75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

Usage:0 %
5580 | [Owner : ******** | Parent : 4504(chrome.exe) | 188.56 Mo] - (.Google LLC - Google Chrome.) -

(75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

Usage:0 %
612 | [Owner : ******** | Parent : 4504(chrome.exe) | 87.94 Mo] - (.Google LLC - Google Chrome.) -

(75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

Usage:0 %
5408 | [Owner : ******** | Parent : 4504(chrome.exe) | 208.28 Mo] - (.Google LLC - Google Chrome.) -

(75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

Usage:0 %
4284 | [Owner : ******** | Parent : 4504(chrome.exe) | 59.38 Mo] - (.Google LLC - Google Chrome.) -

(75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

Usage:0 %
2256 | [Owner : ******** | Parent : 4504(chrome.exe) | 83.75 Mo] - (.Google LLC - Google Chrome.) -

(75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

Usage:2 %
5432 | [Owner : ******** | Parent : 4504(chrome.exe) | 129.48 Mo] - (.Google LLC - Google Chrome.) -

(75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

Usage:0 %
6332 | [Owner : LOCAL SERVICE | Parent : 864(svchost.exe) | ?????] - (.Microsoft Corporation - Windows Audio

Device Graph Isolation.) - (6.1.7601.24499) = C:\Windows\System32\audiodg.exe [12/07/2019 15:59:26] CPU

Usage:0 %
6304 | [Owner : ******** | Parent : 2236(explorer.exe) | 15.35 Mo] - (.Microsoft Corporation - Windows

Defender User Interface.) - (6.1.7600.16385) = C:\Program Files\Windows Defender\MSASCui.exe [13/07/2009

19:53:49] CPU Usage:0 %
1868 | [Owner : ******** | Parent : 4504(chrome.exe) | 21.53 Mo] - (.Google LLC - Google Chrome.) -

(75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

Usage:0 %
5940 | [Owner : ******** | Parent : 2236(explorer.exe) | 51.28 Mo] - (.SosVirus - QuickDiag.) - (27.2.19.1) =

C:\Users\********\Desktop\quickdiag_V5_27.02.19.1.exe [15/07/2019 10:23:54] CPU Usage:0 %
3508 | [Owner : SYSTEM | Parent : 3840(SearchIndexer.exe) | 10.08 Mo] - (.Microsoft Corporation - Microsoft

Windows Search Protocol Host.) - (7.0.7601.24275) = C:\Windows\System32\SearchProtocolHost.exe [10/12/2018

23:07:40] CPU Usage:0 %
4348 | [Owner : SYSTEM | Parent : 3840(SearchIndexer.exe) | 8.21 Mo] - (.Microsoft Corporation - Microsoft

Windows Search Filter Host.) - (7.0.7601.24275) = C:\Windows\System32\SearchFilterHost.exe [10/12/2018

23:07:39] CPU Usage:0 %
3644 | [Owner : NETWORK SERVICE | Parent : 688(svchost.exe) | 7.48 Mo] - (.Microsoft Corporation - WMI

Provider Host.) - (6.1.7601.17514) = C:\Windows\SysWOW64\wbem\WmiPrvSE.exe [20/11/2010 23:24:27] CPU

Usage:0 %
3608 | [Owner : NETWORK SERVICE | Parent : 512(services.exe) | 9.02 Mo] - (.Microsoft Corporation - Microsoft

Software Protection Platform Service.) - (6.1.7601.17514) = C:\Windows\System32\sppsvc.exe [20/11/2010

23:23:56] CPU Usage:0 %

---------- | Locked Applications

---------- | Explorer.exe Modules (Microsoft Files Whitelisted)

(.Igor Pavlov.-.7-Zip Shell Extension.) - (18.5.0.0) -- C:\Program Files\7-Zip\7-zip.dll
(.Intel Corporation.-.igfxDTCM Module.) - (6.15.10.4425) -- C:\Windows\system32\igfxDTCM.dll
(.Intel Corporation.-.igfxDH Module.) - (6.15.10.4425) -- C:\Windows\system32\igfxDH.dll
(.Intel Corporation.-.igfxLHM Module.) - (6.15.10.4425) -- C:\Windows\system32\igfxLHM.dll
(.Intel Corporation.-.igfxDI Module.) - (6.15.10.4425) -- C:\Windows\system32\igfxDI.dll
(.Foxit Software Inc..-.ConvertToPDFShellExtension.) - (9.4.0.1491) -- C:\Program Files (x86)\Foxit Software

\Foxit Reader\plugins\ConvertToPDFShellExtension_x64.dll
(..-.ShellHandler for Notepad++ (64 bit).) - (0.1.0.0) -- C:\Program Files (x86)\Notepad++\NppShell_06.dll

---------- | Winlogon.exe Modules (Microsoft Files Whitelisted)

---------- | svchost.exe Modules (Microsoft Files Whitelisted)

---------- | ZeroAccess Check

[HKLM\Software\Classes\CLSID\{1108BE51-F58A-4CDA-BB99-7A0227D11D5E}\InProcServer32] : %systemroot%

\system32\wbem\fastprox.dll
[HKLM\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] : %SystemRoot%

\system32\shell32.dll
[HKLM\Software\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] : %systemroot%

\system32\wbem\fastprox.dll
[HKLM\Software\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] : %systemroot%

\system32\wbem\wbemess.dll
[HKLM\Software\Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] : %SystemRoot%

\system32\shell32.dll
[HKLM\Software\WOW6432Node\Classes\CLSID\{1108BE51-F58A-4CDA-BB99-7A0227D11D5E}\InProcServer32] : %systemroot

%\system32\wbem\fastprox.dll
[HKLM\Software\WOW6432Node\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] : %SystemRoot

%\system32\shell32.dll
[HKLM\Software\WOW6432Node\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] : %systemroot

%\system32\wbem\fastprox.dll
[HKLM\Software\WOW6432Node\Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] : %SystemRoot

%\system32\shell32.dll

---------- | Startings up

Sidebar - (%ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun [HKU\S-1-5-19\SOFTWARE\...\Run]) - User: NT

AUTHORITY\LOCAL SERVICE
Sidebar - (%ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun [HKU\S-1-5-20\SOFTWARE\...\Run]) - User: NT

AUTHORITY\NETWORK SERVICE
SysTrayApp - (C:\Program Files\IDT\WDM\sttray64.exe [HKLM\SOFTWARE\...\Run]) - User: Public
IntelPROSet - ("C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel PROSet/Wireless

[HKLM\SOFTWARE\...\Run]) - User: Public
Apoint - (C:\Program Files\DellTPad\Apoint.exe [HKLM\SOFTWARE\...\Run]) - User: Public

[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Command Processor]
"CompletionChar"=9
"DefaultColor"=0
"EnableExtensions"=1
"PathCompletionChar"=9

[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRU]
"a"=cmd\1
"MRUList"=ab
"b"=regedit\1

[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"UserSelectedDefault"=1
"Device"=Foxit Reader PDF Printer,winspool,Ne02:

[HKLM\Software\Microsoft\Command Processor]
"CompletionChar"=64
"DefaultColor"=0
"EnableExtensions"=1
"PathCompletionChar"=64

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
"SysTrayApp"=C:\Program Files\IDT\WDM\sttray64.exe [26/06/2018 13:41:19]
"IntelPROSet"="C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel PROSet/Wireless
"Apoint"=C:\Program Files\DellTPad\Apoint.exe [26/06/2018 13:44:55]

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"IconServiceLib"=IconCodecService.dll
"DdeSendTimeout"=0
"DesktopHeapLogging"=1
"GDIProcessHandleQuota"=10000
"ShutdownWarningDialogTimeout"=4294967295
"USERNestedWindowLimit"=50
"USERPostMessageLimit"=10000
"USERProcessHandleQuota"=10000
""=mnmsrvc
"DeviceNotSelectedTimeout"=15
"Spooler"=yes
"TransmissionRetryTimeout"=90
"AppInit_DLLs"=
"LoadAppInit_DLLs"=0

[HKLM\Software\WOW6432Node\Microsoft\Command Processor]
"CompletionChar"=64
"DefaultColor"=0
"EnableExtensions"=1
"PathCompletionChar"=64

[HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run]
"IMSS"="C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe"
"KeePass 2 PreLoad"="C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe" --preload

[HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows]
"IconServiceLib"=IconCodecService.dll
"DdeSendTimeout"=0
"DesktopHeapLogging"=1
"GDIProcessHandleQuota"=10000
"ShutdownWarningDialogTimeout"=4294967295
"USERNestedWindowLimit"=50
"USERPostMessageLimit"=10000
"USERProcessHandleQuota"=10000
""=mnmsrvc
"DeviceNotSelectedTimeout"=15
"Spooler"=yes
"TransmissionRetryTimeout"=90
"AppInit_DLLs"=
"LoadAppInit_DLLs"=0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"WebCheck"={E6FB5E20-DE35-11CF-9C87-00AA005127ED}

---------- | Win.ini :

---------- | System.ini :

---------- | Tasks List

Dell SupportAssistAgent AutoUpdate
GoogleUpdateTaskMachineCore
GoogleUpdateTaskMachineUA
{EE1BEB1A-D10C-43A0-9D62-B7BBC4690C0E}

---------- | Startings up registry ¦ Folder

---------- | Control - lsa - SecurityProviders - Session Manager - Terminal Server

[HKLM\System\CurrentControlSet\Control]
"PreshutdownOrder"=wuauserv
gpsvc
trustedinstaller
"WaitToKillServiceTimeout"=2000
"CurrentUser"=USERNAME
"BootDriverFlags"=0
"ServiceControlManagerExtension"=%systemroot%\system32\scext.dll
"SystemStartOptions"= NOEXECUTE=OPTIN
"SystemBootDevice"=multi(0)disk(0)rdisk(0)partition(2)
"FirmwareBootDevice"=multi(0)disk(0)rdisk(0)partition(1)
"ServicesPipeTimeout"=60000

[HKLM\System\CurrentControlSet\Control\lsa]
"auditbaseobjects"=0
"auditbasedirectories"=0
"crashonauditfail"=0
"fullprivilegeauditing"=0x00
"Bounds"=0x0030000000200000
"LimitBlankPasswordUse"=1
"NoLmHash"=1
"Notification Packages"=scecli
"Security Packages"=kerberos
msv1_0
schannel
wdigest
tspkg
pku2u
"Authentication Packages"=msv1_0
"LsaPid"=536
"SecureBoot"=1
"ProductType"=6
"disabledomaincreds"=0
"everyoneincludesanonymous"=0
"forceguest"=0
"restrictanonymous"=1
"restrictanonymoussam"=1

[HKLM\System\CurrentControlSet\Control\SecurityProviders]
"SecurityProviders"=credssp.dll

[HKLM\System\CurrentControlSet\Control\Session Manager]
"CriticalSectionTimeout"=2592000
"GlobalFlag"=0
"HeapDeCommitFreeBlockThreshold"=0
"HeapDeCommitTotalFreeThreshold"=0
"HeapSegmentCommit"=0
"HeapSegmentReserve"=0
"ProcessorControl"=2
"ResourceTimeoutCount"=648000
"BootExecute"=autocheck autochk *
"ExcludeFromKnownDlls"=
"ObjectDirectories"=\Windows
\RPC Control
"ProtectionMode"=1
"NumberOfInitialSessions"=2
"SetupExecute"=
"PendingFileRenameOperations"=\??\C:\Windows\system32\DRIVERS\pfdytcnk.sys

\??\C:\Users\********\AppData\Local

\Microsoft\Windows\Temporary Internet Files\counters.dat

\??\C:\Users\********\AppData\Local\Mozilla\Firefox

\Profiles\54mhv969.default-1563029380061\OfflineCache\index.sqlite

\??\C:\Users\********\AppData\Local\Mozilla

\Firefox\Profiles\54mhv969.default-1563029380061\OfflineCache

[HKLM\System\CurrentControlSet\Control\Terminal Server]
"RCDependentServices"=CertPropSvc
SessionEnv
"NotificationTimeOut"=0
"SnapshotMonitors"=1
"ProductVersion"=5.1
"AllowRemoteRPC"=0
"DelayConMgrTimeout"=0
"fDenyTSConnections"=1
"StartRCM"=0
"TSAdvertise"=0
"DeleteTempDirsOnExit"=1
"fSingleSessionPerUser"=1
"PerSessionTempDir"=0
"TSUserEnabled"=0
"InstanceID"=92d0cf0d-6ab8-4c98-8a4c-6c2c027
"fCredentialLessLogonSupportedTSS"=1
"fCredentialLessLogonSupported"=1
"fCredentialLessLogonSupportedKMRDP"=1

---------- | .LNK with Arguments

---------- | AppCertDlls

---------- | Dnsapi.dll

C:\Windows\System32\dnsapi.dll -> OK : \drivers\etc\hosts
C:\Windows\SysWOW64\dnsapi.dll -> OK : \drivers\etc\hosts

---------- | Policies | Registry

[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Control Panel\Desktop]
"ScreenSaveActive"=1
"ActiveWndTrackTimeout"=0
"BlockSendInputResets"=0
"CaretWidth"=1
"ClickLockTime"=1200
"CoolSwitchColumns"=7
"CoolSwitchRows"=3
"CursorBlinkRate"=530
"DockMoving"=1
"DragFromMaximize"=1
"DragFullWindows"=1
"DragHeight"=4
"DragWidth"=4
"FocusBorderHeight"=1
"FocusBorderWidth"=1
"FontSmoothing"=2
"FontSmoothingGamma"=0
"FontSmoothingOrientation"=1
"FontSmoothingType"=2
"ForegroundFlashCount"=7
"ForegroundLockTimeout"=200000
"LeftOverlapChars"=3
"MenuShowDelay"=400
"PaintDesktopVersion"=0
"RightOverlapChars"=3
"SnapSizing"=1
"TileWallpaper"=0
"WallpaperOriginX"=0
"WallpaperOriginY"=0
"WallpaperStyle"=10
"WheelScrollChars"=3
"WheelScrollLines"=3
"WindowArrangementActive"=1
"UserPreferencesMask"=0x9E3E078012000000
"Wallpaper"=
"Pattern Upgrade"=TRUE
"WaitToKillAppTimeout"=2000
"HungAppTimeout"=2000

[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer

\HideDesktopIcons\NewStartPanel]
"{20D04FE0-3AEA-1069-A2D8-08002B30309D}"=0

[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer]
"ExplorerStartupTraceRecorded"=1
"ShellState"=0x240000003028000000000000000000000000000001000000120000000000000022000000
"CleanShutdown"=0
"Browse For Folder Width"=318
"Browse For Folder Height"=288
"link"=0x1D000000

[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer

\Advanced]
"Start_SearchFiles"=2
"ServerAdminUI"=0
"Hidden"=2
"ShowCompColor"=1
"HideFileExt"=0
"DontPrettyPath"=0
"ShowInfoTip"=1
"HideIcons"=0
"MapNetDrvBtn"=0
"WebView"=1
"Filter"=0
"SuperHidden"=0
"SeparateProcess"=0
"AutoCheckSelect"=0
"IconsOnly"=0
"ShowTypeOverlay"=1
"ListviewAlphaSelect"=1
"ListviewShadow"=1
"TaskbarAnimations"=1
"StartMenuInit"=4
"Start_ShowMyGames"=0
""=0
"TaskbarSizeMove"=0
"DisablePreviewDesktop"=0
"TaskbarSmallIcons"=1
"TaskbarGlomLevel"=2
"Start_PowerButtonAction"=16
"Start_ShowControlPanel"=2
"Start_ShowMyDocs"=1
"Start_ShowMyMusic"=1
"Start_ShowNetPlaces"=1
"Start_ShowUser"=0
"Start_ShowMyPics"=1
"Start_LargeMFUIcons"=0
"Start_MinMFU"=10
"Start_JumpListItems"=10
"Start_AdminToolsRoot"=2
"StartMenuAdminTools"=1

[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer

\WordWheelQuery]
"MRUListEx"=0x080000000700000006000000050000000400000003000000020000000100000000000000FFFFFFFF
"0"=0x73006E00690070000000
"1"=0x7200680065006C000000
"2"=0x3200350031000000
"3"=0x6E006F006E0061006D0065000000
"4"=0x310036000000
"5"=0x66006900720065002000620075006E000000
"6"=0x640061006400640079006F000000
"7"=0x7300690065007200720061000000
"8"=0x2A002E006D00700033000000

[HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers]
"authenticodeenabled"=0

[HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableInstallerDetection"=1
"EnableLUA"=1
"EnableSecureUIAPaths"=1
"EnableUIADesktopToggle"=0
"EnableVirtualization"=1
"PromptOnSecureDesktop"=1
"ValidateAdminCodeSignatures"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"scforceoption"=0
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"FilterAdministratorToken"=0
"SlowLinkDetectEnabled"=1

[HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop]
"NoAddingComponents"=1
"NoComponents"=1

[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel]
"{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}"=1
"{20D04FE0-3AEA-1069-A2D8-08002B30309D}"=1
"{208D2C60-3AEA-1069-A2D7-08002B30309D}"=1
"{871C5380-42A0-1069-A2EA-08002B30309D}"=1
"{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}"=1
"{59031a47-3f72-44a7-89c5-5595fe6b30ee}"=1
"{031E4825-7B94-4dc3-B131-E946B44C8DD5}"=1
"{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}"=1
"{9343812e-1c37-4a49-a12e-4b2d810d956b}"=1

[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu]
"{871C5380-42A0-1069-A2EA-08002B30309D}.default"=0
"{9343812e-1c37-4a49-a12e-4b2d810d956b}"=1

[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"RegPath"=Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
"Text"=@shell32.dll,-30500
"Type"=radio
"CheckedValue"=1
"ValueName"=Hidden
"DefaultValue"=2
"HKeyRoot"=2147483649
"HelpID"=shell.hlp#51105

[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer]
"ListViewPopupControl"={8be9f5ea-e746-4e47-ad57-3fb191ca1eed}
"BrowserCFCreator"={57f8510b-a5e2-41da-a8f0-8a5ae85dfffd}
"GlobalFolderSettings"={EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}
"LVPopupSearchControl"={fccf70c8-f4d7-4d8b-8c17-cd6715e37fff}
"FileOpenDialog"={DC1C5A9C-E88A-4dde-A5A1-60F82A20AEF7}
"IconUnderline"=2
"GlobalAssocChangedCounter"=24

[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"TaskbarSizeMove"=0

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations]
"Application"=http://go.microsoft.com/fwlink/?LinkId=57426&Ext=%s

[HKLM\Software\WOW6432Node\Policies\Microsoft\Windows\Safer\CodeIdentifiers]
"authenticodeenabled"=0

[HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableInstallerDetection"=1
"EnableLUA"=1
"EnableSecureUIAPaths"=1
"EnableUIADesktopToggle"=0
"EnableVirtualization"=1
"PromptOnSecureDesktop"=1
"ValidateAdminCodeSignatures"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"scforceoption"=0
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"FilterAdministratorToken"=0
"SlowLinkDetectEnabled"=1

[HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop]
"NoAddingComponents"=1
"NoComponents"=1

[HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel]
"{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}"=1
"{20D04FE0-3AEA-1069-A2D8-08002B30309D}"=1
"{208D2C60-3AEA-1069-A2D7-08002B30309D}"=1
"{871C5380-42A0-1069-A2EA-08002B30309D}"=1
"{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}"=1
"{59031a47-3f72-44a7-89c5-5595fe6b30ee}"=1
"{031E4825-7B94-4dc3-B131-E946B44C8DD5}"=1
"{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}"=1
"{9343812e-1c37-4a49-a12e-4b2d810d956b}"=1

[HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu]
"{871C5380-42A0-1069-A2EA-08002B30309D}.default"=0
"{9343812e-1c37-4a49-a12e-4b2d810d956b}"=1

[HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"RegPath"=Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
"Text"=@shell32.dll,-30500
"Type"=radio
"CheckedValue"=1
"ValueName"=Hidden
"DefaultValue"=2
"HKeyRoot"=2147483649
"HelpID"=shell.hlp#51105

[HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer]
"ListViewPopupControl"={8be9f5ea-e746-4e47-ad57-3fb191ca1eed}
"BrowserCFCreator"={57f8510b-a5e2-41da-a8f0-8a5ae85dfffd}
"GlobalFolderSettings"={EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}
"LVPopupSearchControl"={fccf70c8-f4d7-4d8b-8c17-cd6715e37fff}
"FileOpenDialog"={DC1C5A9C-E88A-4dde-A5A1-60F82A20AEF7}
"IconUnderline"=2
"GlobalAssocChangedCounter"=32

[HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"TaskbarSizeMove"=0

[HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Associations]
"Application"=http://go.microsoft.com/fwlink/?LinkId=57426&Ext=%s

---------- | Winlogon

[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"ExcludeProfileDirs"=AppData\Local;AppData\LocalLow;$Recycle.Bin
"BuildNumber"=7601
"FirstLogon"=0
"ParseAutoexec"=1

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"ReportBootOk"=1
"Shell"=explorer.exe
"PreCreateKnownFolders"={A520A1A4-1780-4FF6-BD18-167343C5AF16}
"Userinit"=C:\Windows\system32\userinit.exe,
"VMApplet"=SystemPropertiesPerformance.exe /pagefile
"AutoRestartShell"=1
"Background"=0 0 0
"CachedLogonsCount"=10
"DebugServerCommand"=no
"ForceUnlockLogon"=0
"LegalNoticeCaption"=
"LegalNoticeText"=
"PasswordExpiryWarning"=5
"PowerdownAfterShutdown"=0
"ShutdownWithoutLogon"=0
"WinStationsDisabled"=0
"DisableCAD"=1
"scremoveoption"=0
"ShutdownFlags"=39
"AutoAdminLogon"=0
"DefaultUserName"=********

[HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon]
"ReportBootOk"=1
"Shell"=explorer.exe
"PreCreateKnownFolders"={A520A1A4-1780-4FF6-BD18-167343C5AF16}
"DefaultDomainName"=
"DefaultUserName"=
"Userinit"=userinit.exe
"VMApplet"=SystemPropertiesPerformance.exe /pagefile

---------- | Associations

[HKLM\Software\Classes\.exe]
""=exefile
"Content Type"=application/x-msdownload

[HKLM\Software\Classes\exefile\Shell\Open\Command]
""="%1" %*
"IsolatedCommand"="%1" %*

[HKLM\Software\Classes\.com]
""=comfile

[HKLM\Software\Classes\comfile\Shell\Open\Command]
""="%1" %*

[HKLM\Software\Classes\.reg]
""=regfile

[HKLM\Software\Classes\regfile\Shell\Open\Command]
""=regedit.exe "%1"

[HKLM\Software\Classes\.scr]
""=scrfile

[HKLM\Software\Classes\scrfile\Shell\Open\Command]
""="%1" /S

[HKLM\Software\Classes\.bat]
""=batfile

[HKLM\Software\Classes\batfile\Shell\Open\Command]
""="%1" %*

[HKLM\Software\Classes\.cmd]
""=cmdfile

[HKLM\Software\Classes\cmdfile\Shell\Open\Command]
""="%1" %*

[HKLM\Software\Classes\.pif]
""=piffile

[HKLM\Software\Classes\piffile\Shell\Open\Command]
""="%1" %*

[HKLM\Software\Classes\.inf]
""=inffile

[HKLM\Software\Classes\inffile\Shell\Open\Command]
""=%SystemRoot%\system32\NOTEPAD.EXE %1

[HKLM\Software\Classes\.url]
""=InternetShortcut

[HKLM\Software\Classes\.lnk]
""=lnkfile

[HKLM\Software\Classes\.hta]
"PerceivedType"=text
""=htafile
"Content Type"=application/hta

[HKLM\Software\Classes\htafile\Shell\Open\Command]
""=C:\Windows\SysWOW64\mshta.exe "%1" %*

[HKLM\Software\Classes\InternetShortcut]
"NeverShowExt"=
"InfoTip"=prop:System.Link.TargetUrl;System.Rating;System.Link.Description;System.Link.Comment
"EditFlags"=2
"FullDetails"=prop:System.Link.TargetUrl;System.Rating;System.Link.Description;System.Link.Comment
"IsShortcut"=
"FriendlyTypeName"=@C:\Windows\System32\ieframe.dll,-10046
"PreviewDetails"=prop:System.Link.TargetUrl;System.Rating;System.History.VisitCount;System.History.DateChanged

;System.Link.DateVisited;System.Link.Description;System.Link.Comment

[HKLM\Software\Classes\Application.Manifest]
""=Application Manifest
"EditFlags"=65536
"BrowserFlags"=4096
"FriendlyTypeName"=@dfshim.dll,-200

[HKLM\Software\Classes\Application.Reference]
"NeverShowExt"=
""=Application Reference
"IsShortcut"=
"EditFlags"=131072
"FriendlyTypeName"=@dfshim.dll,-201

[HKLM\Software\Classes\Folder]
"ContentViewModeLayoutPatternForBrowse"=delta
"ContentViewModeForBrowse"=prop:~System.ItemNameDisplay;~System.LayoutPattern.PlaceHolder;~System.LayoutPatter

n.PlaceHolder;~System.LayoutPattern.PlaceHolder;System.DateModified
"ContentViewModeLayoutPatternForSearch"=alpha
"ContentViewModeForSearch"=prop:~System.ItemNameDisplay;System.DateModified;~System.ItemFolderPathDisplay
""=Folder
"EditFlags"=0xD2030000
"FullDetails"=prop:System.PropGroup.Description;System.ItemNameDisplay;System.ItemTypeText;System.Size
"NoRecentDocs"=
"ThumbnailCutoff"=0
"TileInfo"=prop:System.Title;System.ItemTypeText

[HKLM\Software\WOW6432Node\Classes\.exe]
""=exefile
"Content Type"=application/x-msdownload

[HKLM\Software\WOW6432Node\Classes\exefile\Shell\Open\Command]
""="%1" %*
"IsolatedCommand"="%1" %*

[HKLM\Software\WOW6432Node\Classes\.com]
""=comfile

[HKLM\Software\WOW6432Node\Classes\comfile\Shell\Open\Command]
""="%1" %*

[HKLM\Software\WOW6432Node\Classes\.reg]
""=regfile

[HKLM\Software\WOW6432Node\Classes\regfile\Shell\Open\Command]
""=regedit.exe "%1"

[HKLM\Software\WOW6432Node\Classes\.scr]
""=scrfile

[HKLM\Software\WOW6432Node\Classes\scrfile\Shell\Open\Command]
""="%1" /S

[HKLM\Software\WOW6432Node\Classes\.bat]
""=batfile

[HKLM\Software\WOW6432Node\Classes\batfile\Shell\Open\Command]
""="%1" %*

[HKLM\Software\WOW6432Node\Classes\.cmd]
""=cmdfile

[HKLM\Software\WOW6432Node\Classes\cmdfile\Shell\Open\Command]
""="%1" %*

[HKLM\Software\WOW6432Node\Classes\.pif]
""=piffile

[HKLM\Software\WOW6432Node\Classes\piffile\Shell\Open\Command]
""="%1" %*

[HKLM\Software\WOW6432Node\Classes\.inf]
""=inffile

[HKLM\Software\WOW6432Node\Classes\inffile\Shell\Open\Command]
""=%SystemRoot%\system32\NOTEPAD.EXE %1

[HKLM\Software\WOW6432Node\Classes\.url]
""=InternetShortcut

[HKLM\Software\WOW6432Node\Classes\.lnk]
""=lnkfile

[HKLM\Software\WOW6432Node\Classes\.hta]
"PerceivedType"=text
""=htafile
"Content Type"=application/hta

[HKLM\Software\WOW6432Node\Classes\htafile\Shell\Open\Command]
""=C:\Windows\SysWOW64\mshta.exe "%1" %*

[HKLM\Software\WOW6432Node\Classes\InternetShortcut]
"NeverShowExt"=
"InfoTip"=prop:System.Link.TargetUrl;System.Rating;System.Link.Description;System.Link.Comment
"EditFlags"=2
"FullDetails"=prop:System.Link.TargetUrl;System.Rating;System.Link.Description;System.Link.Comment
"IsShortcut"=
"FriendlyTypeName"=@C:\Windows\System32\ieframe.dll,-10046
"PreviewDetails"=prop:System.Link.TargetUrl;System.Rating;System.History.VisitCount;System.History.DateChanged

;System.Link.DateVisited;System.Link.Description;System.Link.Comment

[HKLM\Software\WOW6432Node\Classes\Application.Manifest]
""=Application Manifest
"EditFlags"=65536
"BrowserFlags"=4096
"FriendlyTypeName"=@dfshim.dll,-200

[HKLM\Software\WOW6432Node\Classes\Application.Reference]
"NeverShowExt"=
""=Application Reference
"IsShortcut"=
"EditFlags"=131072
"FriendlyTypeName"=@dfshim.dll,-201

[HKLM\Software\WOW6432Node\Classes\Folder]
"ContentViewModeLayoutPatternForBrowse"=delta
"ContentViewModeForBrowse"=prop:~System.ItemNameDisplay;~System.LayoutPattern.PlaceHolder;~System.LayoutPatter

n.PlaceHolder;~System.LayoutPattern.PlaceHolder;System.DateModified
"ContentViewModeLayoutPatternForSearch"=alpha
"ContentViewModeForSearch"=prop:~System.ItemNameDisplay;System.DateModified;~System.ItemFolderPathDisplay
""=Folder
"EditFlags"=0xD2030000
"FullDetails"=prop:System.PropGroup.Description;System.ItemNameDisplay;System.ItemTypeText;System.Size
"NoRecentDocs"=
"ThumbnailCutoff"=0
"TileInfo"=prop:System.Title;System.ItemTypeText

[HKLM\Software\Clients\StartMenuInternet\Firefox-308046B0AF4A39CB\Shell\open\Command]
""="C:\Program Files\Mozilla Firefox\firefox.exe"
[HKLM\Software\Clients\StartMenuInternet\Firefox-308046B0AF4A39CB\InstallInfo]
"ReinstallCommand"="C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppGlobal

[HKLM\Software\Clients\StartMenuInternet\Google Chrome\Shell\open\Command]
""="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
[HKLM\Software\Clients\StartMenuInternet\Google Chrome\InstallInfo]
"ReinstallCommand"="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --make-default-browser

[HKLM\Software\Clients\StartMenuInternet\IEXPLORE.EXE\Shell\open\Command]
""=C:\Program Files\Internet Explorer\iexplore.exe [14/07/2019 20:29:18]
[HKLM\Software\Clients\StartMenuInternet\IEXPLORE.EXE\InstallInfo]
"ReinstallCommand"="C:\Windows\System32\ie4uinit.exe" -reinstall

[HKLM\Software\WOW6432Node\Clients\StartMenuInternet\Firefox-308046B0AF4A39CB\Shell\open\Command]
""="C:\Program Files\Mozilla Firefox\firefox.exe"
[HKLM\Software\WOW6432Node\Clients\StartMenuInternet\Firefox-308046B0AF4A39CB\InstallInfo]
"ReinstallCommand"="C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppGlobal

[HKLM\Software\WOW6432Node\Clients\StartMenuInternet\Google Chrome\Shell\open\Command]
""="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
[HKLM\Software\WOW6432Node\Clients\StartMenuInternet\Google Chrome\InstallInfo]
"ReinstallCommand"="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --make-default-browser

[HKLM\Software\WOW6432Node\Clients\StartMenuInternet\IEXPLORE.EXE\Shell\open\Command]
""=C:\Program Files\Internet Explorer\iexplore.exe [14/07/2019 20:29:18]
[HKLM\Software\WOW6432Node\Clients\StartMenuInternet\IEXPLORE.EXE\InstallInfo]
"ReinstallCommand"="C:\Windows\System32\ie4uinit.exe" -reinstall

---------- | AppcompatFlags

[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion

\AppCompatFlags\Compatibility Assistant\Persisted]
"C:\Users\********\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FCXADT0B

\SupportAssistLauncher.exe"=1
"SIGN.MEDIA=71426 SETUP.EXE"=1
"C:\Users\********\Desktop\Reason\Install Reason 8.exe"=1
"C:\Users\********\Desktop\audacity-win-2.2.2.exe"=1
"C:\Users\********\Desktop\KeePass-2.39.1-Setup.exe"=1
"C:\Users\********\Desktop\vs_community.exe"=1
"C:\Users\********\Desktop\Skype-8.29.0.50.exe"=1
"C:\Users\********\Desktop\out_lame.binf_v164.exe"=1
"C:\Users\********\Desktop\Lame_v3.99.3_for_Windows.exe"=1
"C:\Users\********\Desktop\RW3_5.1.216.4185.XX_.exe"=1
"C:\Users\********\Desktop\temp\PL2303-Prolific_DriverInstaller_v1200.exe"=1
"C:\Users\********\Desktop\EuropaSetup.exe"=1
"C:\Users\********\Desktop\MixMeister Pro 5.1.2.0 + Serial\mmp5all.exe"=1
"C:\Users\********\AppData\Local\Temp\is-45LNO.tmp\CountInstallation.exe"=1
"C:\Users\********\Desktop\FoxitReader941_enu_Setup_Prom.exe"=1
"C:\Users\********\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FCXADT0B

\flashplayer32ax_ra_install.exe"=1
"C:\Users\********\AppData\Roaming\Foxit Software\Addon\Foxit Reader\FoxitReaderUpdater.exe"=1
"C:\Users\********\Desktop\New folder\Install Reason 10.exe"=1
"C:\Users\********\Desktop\uTorrent.exe"=1
"C:\Users\********\Downloads\iZotope Ozone 8 and Neutron 2 Advanced WIN x64x86\iZotope Ozone Advanced v8

00\iZotope_Ozone_Advanced_v8_00.exe"=1
"C:\Users\********\Downloads\iZotope Ozone 8 and Neutron 2 Advanced WIN x64x86\iZotope Neutron Advanced v2

00\iZotope_Neutron_Advanced_v2_00.exe"=1
"C:\Users\********\Desktop\vlc-3.0.6-win64.exe"=1
"C:\Users\********\Desktop\PandaCloudCleaner.exe"=1
"C:\Users\********\Desktop\ChromeSetup.exe"=1
"C:\Users\********\Downloads\Firefox Installer.exe"=1

---------- | IFEO

---------- | Mountpoints2

[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer

\Mountpoints2\{a08823cb-795d-11e8-b725-e41f28566541}] : E:\RTK_NIC_DRIVER_INSTALLER.sfx.exe (AutoRun)

---------- | Windows

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\win.ini\Windows]
"MouseSpeed"=#USR:Control Panel\Mouse
"MouseThreshold1"=#USR:Control Panel\Mouse
"MouseThreshold2"=#USR:Control Panel\Mouse
"SwapMouseButtons"=#USR:Control Panel\Mouse
"Beep"=#USR:Control Panel\Sound
"DoubleClickSpeed"=#USR:Control Panel\Mouse
"CoolSwitch"=USR:Control Panel\Desktop
"DoubleClickHeight"=#USR:Control Panel\Mouse
"DoubleClickWidth"=#USR:Control Panel\Mouse
"DragFullWindows"=USR:Control Panel\Desktop
"InitialKeyboardIndicators"=USR:Control Panel\Keyboard
"LowPowerActive"=#USR:Control Panel\Desktop
"LowPowerTimeOut"=#USR:Control Panel\Desktop
"PowerOffActive"=#USR:Control Panel\Desktop
"PowerOffTimeOut"=#USR:Control Panel\Desktop
"ScreenSaveActive"=#USR:Control Panel\Desktop
"ScreenSaveTimeOut"=#USR:Control Panel\Desktop
"SnapToDefaultButton"=#USR:Control Panel\Mouse
""=USR:Software\Microsoft\Windows NT\CurrentVersion\Windows
"Spooler"=#SYS:Microsoft\Windows NT\CurrentVersion\Windows
"TRANSMISSIONRETRYTIMEOUT"=#SYS:MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS
"DEFAULTSEPARATEVDM"=\\REGISTRY\\MACHINE\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\WOW
"APPINIT_DLLS"=SYS:MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS
"DEVICENOTSELECTEDTIMEOUT"=#SYS:MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS
"SWAPDISK"=SYS:MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\system.ini\Boot]
""=SYS:Microsoft\Windows NT\CurrentVersion\WOW\boot
"ScreenSaverActive"=USR:Control Panel\Desktop
"ScreenSaverIsSecure"=USR:Control Panel\Desktop
"SCRNSAVE.EXE"=USR:Control Panel\Desktop
"Shell"=SYS:Microsoft\Windows NT\CurrentVersion\Winlogon

[HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\IniFileMapping\win.ini\Windows]
"MouseSpeed"=#USR:Control Panel\Mouse
"MouseThreshold1"=#USR:Control Panel\Mouse
"MouseThreshold2"=#USR:Control Panel\Mouse
"SwapMouseButtons"=#USR:Control Panel\Mouse
"Beep"=#USR:Control Panel\Sound
"DoubleClickSpeed"=#USR:Control Panel\Mouse
"CoolSwitch"=USR:Control Panel\Desktop
"DoubleClickHeight"=#USR:Control Panel\Mouse
"DoubleClickWidth"=#USR:Control Panel\Mouse
"DragFullWindows"=USR:Control Panel\Desktop
"InitialKeyboardIndicators"=USR:Control Panel\Keyboard
"LowPowerActive"=#USR:Control Panel\Desktop
"LowPowerTimeOut"=#USR:Control Panel\Desktop
"PowerOffActive"=#USR:Control Panel\Desktop
"PowerOffTimeOut"=#USR:Control Panel\Desktop
"ScreenSaveActive"=#USR:Control Panel\Desktop
"ScreenSaveTimeOut"=#USR:Control Panel\Desktop
"SnapToDefaultButton"=#USR:Control Panel\Mouse
"TRANSMISSIONRETRYTIMEOUT"=#SYS:MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS
"DEFAULTSEPARATEVDM"=\\REGISTRY\\MACHINE\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\WOW
"APPINIT_DLLS"=SYS:MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS
"DEVICENOTSELECTEDTIMEOUT"=#SYS:MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS
"SWAPDISK"=SYS:MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS

[HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\IniFileMapping\system.ini\Boot]
""=SYS:Microsoft\Windows NT\CurrentVersion\WOW\boot
"ScreenSaverActive"=USR:Control Panel\Desktop
"ScreenSaverIsSecure"=USR:Control Panel\Desktop
"SCRNSAVE.EXE"=USR:Control Panel\Desktop
"Shell"=SYS:Microsoft\Windows NT\CurrentVersion\Winlogon

[HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems]
"windows"=%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On

SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3

ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

---------- | Security center

[HKLM\SOFTWARE\Microsoft\Security Center]
"cval"=1

[HKLM\SOFTWARE\Microsoft\Security Center\svc]
"VistaSp1"=128920218544262440
"AntiVirusOverride"=0
"AntiSpywareOverride"=0
"FirewallOverride"=0

[HKLM\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=1
"DisableRoutinelyTakingAction"=1
"ProductStatus"=0
"InstallTime"=0x00FA25256A0DD401

[HKLM\Software\WOW6432Node\Microsoft\Windows Defender]
"DisableAntiSpyware"=0
"DisableRoutinelyTakingAction"=1

[HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall"=1

[HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=1

[HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall"=1

---------- | Safeboot

[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppMgmt]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Base]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Boot Bus Extender]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Boot file system]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CryptSvc]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\DcomLaunch]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\EFS]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\EventLog]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\File system]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Filter]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HelpSvc]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Netlogon]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PCI Configuration]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PlugPlay]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PNP Filter]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Power]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Primary disk]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RpcEptMapper]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RpcSs]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SCSI Class]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sermouse.sys]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\System Bus Extender]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vga.sys]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vgasave.sys]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vmms]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinMgmt]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfPf]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfRd]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{36FC9E60-C465-11CF-8056-444553540000}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E965-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E969-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E977-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97B-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E980-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AFD]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AppInfo]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AppMgmt]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Base]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\BFE]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Boot Bus Extender]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Boot file system]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\bowser]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Browser]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CryptSvc]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\DcomLaunch]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\dfsc]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Dhcp]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\DnsCache]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Dot3Svc]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Eaphost]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\EFS]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\EventLog]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\File system]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Filter]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\HelpSvc]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\IKEEXT]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ipnat.sys]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\KeyIso]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\LanmanServer]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\LanmanWorkstation]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\LmHosts]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Messenger]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MPSDrv]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MPSSvc]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mrxsmb]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mrxsmb10]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mrxsmb20]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NativeWifiP]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NDIS]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NDIS Wrapper]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ndiscap]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Ndisuio]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetBIOS]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetBIOSGroup]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetBT]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetDDEGroup]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Netlogon]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetMan]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\netprofm]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Network]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetworkProvider]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NlaSvc]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Nsi]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\nsiproxy.sys]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NTDS]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PCI Configuration]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PlugPlay]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PNP Filter]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PNP_TDI]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PolicyAgent]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Power]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Primary disk]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ProfSvc]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\rdbss]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\rdpencdd.sys]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\rdsessmgr]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\RpcEptMapper]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\RpcSs]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\sacsvr]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SCardSvr]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SCSI Class]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\sermouse.sys]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SharedAccess]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Streams Drivers]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SWPRV]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\System Bus Extender]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\TabletInputService]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\TBS]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Tcpip]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\TDI]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\TrustedInstaller]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\VaultSvc]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\VDS]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vga.sys]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vgasave.sys]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vmms]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\volmgr.sys]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\volmgrx.sys]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinMgmt]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wlansvc]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WudfPf]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WudfRd]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WudfSvc]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WudfUsbccidDriver]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{36FC9E60-C465-11CF-8056-444553540000}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E965-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E969-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E96A-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E96B-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E96F-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E973-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E974-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E975-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E977-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E97B-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E97D-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E980-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{50DD5230-BA8A-11D1-BF5D-0000F805F530}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]

---------- | Winsock (Whitelist)

---------- | Hosts

---------- | Ping

Pinging google.com [172.217.3.238] with 32 bytes of data:
Reply from 172.217.3.238: bytes=32 time=31ms TTL=51
Reply from 172.217.3.238: bytes=32 time=142ms TTL=51
Reply from 172.217.3.238: bytes=32 time=60ms TTL=51
Reply from 172.217.3.238: bytes=32 time=94ms TTL=51

Ping statistics for 172.217.3.238:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 31ms, Maximum = 142ms, Average = 81ms

---------- | @

[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Internet Explorer\Main]
"Disable Script Debugger"=yes
"Anchor Underline"=yes
"Cache_Update_Frequency"=Once_Per_Session
"Display Inline Images"=yes
"Do404Search"=0x01000000
"Local Page"=C:\Windows\system32\blank.htm
"Save_Session_History_On_Exit"=no
"Show_FullURL"=no
"Show_StatusBar"=yes
"Show_ToolBar"=yes
"Show_URLinStatusBar"=yes
"Show_URLToolBar"=yes
"Use_DlgBox_Colors"=yes
"Search Page"=http://go.microsoft.com/fwlink/?LinkId=54896
"XMLHTTP"=1
"NoUpdateCheck"=1
"UseClearType"=no
"Enable Browser Extensions"=yes
"Play_Background_Sounds"=yes
"Play_Animations"=yes
"Start Page"=http://www.dell.com/
"Default_Page_URL"=http://www.dell.com
"DisableFirstRunCustomize"=1
"DisableScriptDebuggerIE"=yes
"OperationalData"=5
"CompatibilityFlags"=0
"SearchBandRestoreBarCount"=0
"SearchBandMigrationVersion"=1
"FullScreen"=no
"Window_Placement"=0x2C0000000200000003000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF2300000023000000780300007B020000
"ImageStoreRandomFolder"=xs9y7oq
"DownloadWindowPlacement"=0x0000000000000000000000000000000000000000000000000000000000000000000000000000000000

000000
"Use FormSuggest"=yes
"Start Page_TIMESTAMP"=0x659D410ED838D501
"SyncHomePage Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy"=
"Check_Associations"=no
"IE11DefaultsFREGPOFileOptions"=0
"IE11DefaultsFREGPOFileCheck"=1
"IE11DefaultsFREGPOCheckTimestamp"=0x533DF504D838D501

[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows\CurrentVersion\Internet

settings]
"IE5_UA_Backup_Flag"=5.0
"User Agent"=Mozilla/4.0 (compatible; MSIE 8.0; Win32)
"EmailName"=User@
"PrivDiscUiShown"=1
"EnableHttp1_1"=1
"WarnOnIntranet"=1
"MimeExclusionListForCache"=multipart/mixed multipart/x-mixed-replace multipart/x-byteranges
"AutoConfigProxy"=wininet.dll
"UseSchannelDirectly"=0x01000000
"WarnOnPost"=0x01000000
"UrlEncoding"=0
"SecureProtocols"=2688
"PrivacyAdvanced"=0
"ZonesSecurityUpgrade"=0xFC39CC526C0DD401
"DisableCachingOfSSLPages"=0
"WarnonZoneCrossing"=0
"CertificateRevocation"=1
"EnableNegotiate"=1
"MigrateProxy"=1
"ProxyEnable"=0

[HKLM\Software\Microsoft\Internet Explorer\Main]
"AutoHide"=yes
"Security Risk Page"=about:SecurityRisk
"Extensions Off Page"=about:NoAdd-ons
"Default_Search_URL"=http://go.microsoft.com/fwlink/?LinkId=54896
"Default_Page_URL"=http://go.microsoft.com/fwlink/p/?LinkId=255141
"Anchor_Visitation_Horizon"=0x01000000
"Cache_Percent_of_Disk"=0x0A000000
"Placeholder_Width"=0x1A000000
"Placeholder_Height"=0x1A000000
"Default_Secondary_Page_URL"=
"Use_Async_DNS"=yes
"Start Page"=http://go.microsoft.com/fwlink/p/?LinkId=255141
"Local Page"=C:\Windows\System32\blank.htm
"Search Page"=http://go.microsoft.com/fwlink/?LinkId=54896
"Delete_Temp_Files_On_Exit"=yes
"Enable_Disk_Cache"=yes
"ApplicationTileImmersiveActivation"=1
"AssociationActivationMode"=0
"x86AppPath"=C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

[HKLM\Software\Microsoft\Internet Explorer\AboutURLs]
"blank"=res://mshtml.dll/blank.htm
"NoAdd-onsInfo"=res://ieframe.dll/noaddoninfo.htm
"InPrivate"=res://ieframe.dll/inprivate_win7.htm
"NavigationFailure"=res://ieframe.dll/navcancl.htm
"NoAdd-ons"=res://ieframe.dll/noaddon.htm
"Home"=270
"PostNotCached"=res://ieframe.dll/repost.htm
"DesktopItemNavigationFailure"=res://ieframe.dll/navcancl.htm
"NavigationCanceled"=res://ieframe.dll/navcancl.htm
"SecurityRisk"=res://ieframe.dll/securityatrisk.htm
"Compat"=res://mshtml.dll/compat.htm

[HKLM\Software\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix]
""=http://

[HKLM\Software\Microsoft\Windows\CurrentVersion\URL\Prefixes]
"mosaic"=http://
"www"=http://
"home"=http://
"ftp"=ftp://

[HKLM\Software\Microsoft\Windows\CurrentVersion\Internet settings]
"EnablePunycode"=1
"CodeBaseSearchPath"=CODEBASE
"WarnOnIntranet"=1
"MinorVersion"=0
"ActiveXCache"=C:\Windows\Downloaded Program Files

[HKLM\Software\WOW6432Node\Microsoft\Internet Explorer\Main]
"AutoHide"=yes
"Security Risk Page"=about:SecurityRisk
"Extensions Off Page"=about:NoAdd-ons
"Default_Search_URL"=http://go.microsoft.com/fwlink/?LinkId=54896
"Default_Page_URL"=http://go.microsoft.com/fwlink/p/?LinkId=255141
"Anchor_Visitation_Horizon"=0x01000000
"Cache_Percent_of_Disk"=0x0A000000
"Placeholder_Width"=0x1A000000
"Placeholder_Height"=0x1A000000
"Default_Secondary_Page_URL"=
"Use_Async_DNS"=yes
"Start Page"=http://go.microsoft.com/fwlink/p/?LinkId=255141
"Local Page"=C:\Windows\SysWOW64\blank.htm
"Search Page"=http://go.microsoft.com/fwlink/?LinkId=54896
"Delete_Temp_Files_On_Exit"=yes
"Enable_Disk_Cache"=yes
"Check_Associations"=yes
"ApplicationTileImmersiveActivation"=1
"AssociationActivationMode"=0
"x86AppPath"=C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

[HKLM\Software\WOW6432Node\Microsoft\Internet Explorer\AboutURLs]
"blank"=res://mshtml.dll/blank.htm
"NoAdd-onsInfo"=res://ieframe.dll/noaddoninfo.htm
"InPrivate"=res://ieframe.dll/inprivate_win7.htm
"NavigationFailure"=res://ieframe.dll/navcancl.htm
"NoAdd-ons"=res://ieframe.dll/noaddon.htm
"Home"=270
"PostNotCached"=res://ieframe.dll/repost.htm
"DesktopItemNavigationFailure"=res://ieframe.dll/navcancl.htm
"NavigationCanceled"=res://ieframe.dll/navcancl.htm
"SecurityRisk"=res://ieframe.dll/securityatrisk.htm
"Compat"=res://mshtml.dll/compat.htm

[HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix]
""=http://

[HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\URL\Prefixes]
"mosaic"=http://
"www"=http://
"home"=http://
"ftp"=ftp://

[HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet settings]
"EnablePunycode"=1
"CodeBaseSearchPath"=CODEBASE
"WarnOnIntranet"=1
"MinorVersion"=0
"ActiveXCache"=C:\Windows\Downloaded Program Files

---------- | Proxy

---------- | reparsepoint

---------- | Detection of offsets

---------- | Notify

---------- | Execution FileExts

---------- | SIOI | SEH | URLSH

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\EnhancedStorageShell] -

{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D} -- %SystemRoot%\system32\EhStorShell.dll
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Offline Files] -

{4E77131D-3629-431c-9818-C5679DC83E81} -- %SystemRoot%\System32\cscui.dll
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\SharingPrivate] -

{08244EE6-92F0-47f2-9FC9-929BAA2E7235} -- %SystemRoot%\system32\ntshrui.dll
[HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers

\EnhancedStorageShell] - {D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D} -- %SystemRoot%\system32\EhStorShell.dll
[HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers

\SharingPrivate] - {08244EE6-92F0-47f2-9FC9-929BAA2E7235} -- %SystemRoot%\system32\ntshrui.dll

[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=

---------- | Toolbar

[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"Locked"=1
"ShowDiscussionButton"=Yes

[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"ITBar7Height"=0

[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"={0633EE93-D776-472f-A0FF-E1416B8B2E3A}
"DefaultPackCorrection"=1
"DefaultPackNTCorrection"=1
"KnownProvidersUpgradeTime"=0x22717741BACCD401
"DownloadRetries"=1
"Version"=4
"UpgradeTime"=0x56CB4B08D838D501

[HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"={0633EE93-D776-472f-A0FF-E1416B8B2E3A}

[HKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"={0633EE93-D776-472f-A0FF-E1416B8B2E3A}

---------- | Extensions

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}] : (Se&nd to

OneNote) - []
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}] : (OneNote

Lin&ked Notes) - []
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}] :

(Se&nd to OneNote) - []
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}] :

(OneNote Lin&ked Notes) - []

---------- | SearchScopes

[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes

\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}] - (Bing) - http://www.bing.com/search?pc=COSP&ptag=D031719-

N0400A915F698E57&form=CONBDF&conlogo=CT3335818&q={searchTerms} :
[HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}] -

(@ieframe.dll,-12512) - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC :
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}] -

(@ieframe.dll,-12512) - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC :

---------- | Browser Helper Objects

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-

42B3008E02FF}] -> (Office Document Cache Handler) : C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL [21/12/2010

01:05:22]
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-

4959-BA22-42B3008E02FF}] -> (Office Document Cache Handler) : C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL

[21/12/2010 01:05:22]

---------- | Chrome

C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\extensions\aapocclcgogkmnckokdopfmhonfmgoek =

: Google & co - Google & co - https://clients2.google.com/service/update2/crx
C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\extensions\aohghmighlieiainnegkcijnfilokake =

: Google & co - Google & co - https://clients2.google.com/service/update2/crx
C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\extensions\apdfllckaahabafndbhieahigkjlhalf =

: Google & co - https://drive.google.com/?usp=chrome_app - Google & co -

[http://docs.google.com/http://drive.google.com/https://docs.google.com/https://drive.google.com/] -

https://clients2.google.com/service/update2/crx

C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo =

: Google & co - http://www.youtube.com - http://www.youtube.com - Google & co -

http://clients2.google.com/service/update2/crx

C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\extensions\felcaaldnbdncclmgdcncolpebgiejap =

: Google & co - Google & co - https://clients2.google.com/service/update2/crx
C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi =

: __MSG_extDesc__ - __MSG_extName__ - https://clients2.google.com/service/update2/crx
C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\extensions\nmmhkkegccagdldgiimedpiccmgmieda =

: Google & co - Google & co - 203784468217.apps.googleusercontent.com -

https://clients2.google.com/service/update2/crx

C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\extensions\pjkljhegncpnkpknbcohdijeoejaedia =

: Google & co - https://mail.google.com/mail - Google & co - [*://mail.google.com/mail] -

https://clients2.google.com/service/update2/crx

C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm =

: Provider for discovery and services for mirroring of Chrome Media Router - Chrome Media Router -

919648714761-55j965o0km033psv3i9qls5mo3qtdrb0.apps.googleusercontent.com -

https://clients2.google.com/service/update2/crx

---------- | Opera

---------- | Firefox

[HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer] - (Adobe® Flash® Player 29.0.0.171 Plugin) : C:\Windows

\system32\Macromed\Flash\NPSWF64_29_0_0_171.dll
[HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE] - () : disabled
[HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0] - (Office Authorization plug-in for

NPAPI browsers) : C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL
[HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=3.0.6] - (VLC Multimedia Plugin) : C:\Program Files

\VideoLAN\VLC\npvlc.dll
[HKLM\Software\WOW6432Node\MozillaPlugins\@adobe.com/FlashPlayer] - (Adobe® Flash® Player 29.0.0.171 Plugin) :

C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_29_0_0_171.dll
[HKLM\Software\WOW6432Node\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf]

- () : C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll
[HKLM\Software\WOW6432Node\MozillaPlugins\@foxitsoftware.com/Foxit Reader

Plugin,version=1.0,application/vnd.fdf] - () : C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins

\npFoxitReaderPlugin.dll
[HKLM\Software\WOW6432Node\MozillaPlugins\@foxitsoftware.com/Foxit Reader

Plugin,version=1.0,application/vnd.xdp] - () : C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins

\npFoxitReaderPlugin.dll
[HKLM\Software\WOW6432Node\MozillaPlugins\@foxitsoftware.com/Foxit Reader

Plugin,version=1.0,application/vnd.xfdf] - () : C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins

\npFoxitReaderPlugin.dll
[HKLM\Software\WOW6432Node\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5] - (Intel IPT

WebApi plugin) : C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll
[HKLM\Software\WOW6432Node\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater] - (This plugin updates

Intel WebAPI component) : C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT

\npIntelWebAPIUpdater.dll
[HKLM\Software\WOW6432Node\MozillaPlugins\@microsoft.com/GENUINE] - () : disabled
[HKLM\Software\WOW6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0] - (Office Authorization

plug-in for NPAPI browsers) : C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
[HKLM\Software\WOW6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0] - (Microsoft SharePoint

Plug-in for Firefox) : C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
[HKLM\Software\WOW6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3] - (Google Update) : C:

\Program Files (x86)\Google\Update\1.3.34.11\npGoogleUpdate3.dll
[HKLM\Software\WOW6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9] - (Google Update) : C:

\Program Files (x86)\Google\Update\1.3.34.11\npGoogleUpdate3.dll

C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\54mhv969.default-1563029380061\Prefs.js

user_pref("browser.startup.homepage_override.buildID", "20190705220548");
user_pref("browser.startup.homepage_override.mstone", "68.0");
user_pref("extensions.activeThemeID", "default-theme@mozilla.org");
user_pref("extensions.blocklist.lastModified", "Wed, 17 Jul 2019 12:38:35 GMT");
user_pref("extensions.blocklist.pingCountTotal", 2);
user_pref("extensions.blocklist.pingCountVersion", 2);
user_pref("extensions.databaseSchema", 31);
user_pref("extensions.getAddons.cache.lastUpdate", 1563150826);
user_pref("extensions.getAddons.databaseSchema", 5);
user_pref("extensions.incognito.migrated", true);
user_pref("extensions.lastAppBuildId", "20190705220548");
user_pref("extensions.lastAppVersion", "68.0");
user_pref("extensions.lastPlatformVersion", "68.0");
user_pref("extensions.pendingOperations", false);
user_pref("extensions.systemAddonSet", "{\"schema\":1,\"addons\":{}}");
user_pref("extensions.ui.dictionary.hidden", true);
user_pref("extensions.ui.lastCategory", "addons://discover/");
user_pref("extensions.ui.locale.hidden", true);
user_pref("extensions.webcompat.perform_injections", true);
user_pref("extensions.webcompat.perform_ua_overrides", true);
user_pref("extensions.webextensions.uuids", "{\"formautofill@mozilla.org\":\"8cf51839-5178-4706-8894-

a7604ccd544e\",\"fxmonitor@mozilla.org\":\"37e8b279-98eb-40af-ae9e-714ca5e53b59\",\"screenshots@mozilla.org

\":\"9e8e57a4-a57a-465a-93c7-40cf00e8aceb\",\"webcompat-reporter@mozilla.org\":\"9feda981-b02b-42b5-bc59-

48e9b1989934\",\"webcompat@mozilla.org\":\"0f4ee8cc-7ede-4f2a-b7f8-d8726fd90941\",\"default-theme@mozilla.org

\":\"f21a9632-2965-4ca3-ad00-41f54b213db7\",\"google@search.mozilla.org\":\"56c1156f-d2c3-49dc-af9b-

16737fbddbb1\",\"amazondotcom@search.mozilla.org\":\"a37be111-df1b-4dc2-b0ab-03c2cc85b89c\",

\"bing@search.mozilla.org\":\"1fda2a1f-e04a-4cac-aa0c-1af55c5ccdb9\",\"ddg@search.mozilla.org\":\"1db4767d-

a28b-43bf-9729-274fa7df05e8\",\"ebay@search.mozilla.org\":\"8c8e9597-c05c-425f-aba4-606c5ed3d48c\",

\"twitter@search.mozilla.org\":\"905358ea-8b10-4d20-98e1-879b9504d9a8\",\"wikipedia@search.mozilla.org\":

\"d39ae4b1-368d-4b56-b802-174647ad82de\"}");

C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\54mhv969.default-1563029380061
C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\w9ra6rx2.default

[Profile0] - Name=default -> Profiles/54mhv969.default-1563029380061

---------- | DNS

[HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters]
"DhcpNameServer"=209.18.47.62 209.18.47.61
[HKLM\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{F1ABA7E1-57DC-49E4-8FA4-8A72EEFAFE0B}]
"DhcpNameServer"=209.18.47.62 209.18.47.61
[HKLM\SYSTEM\ControlSet002\services\Tcpip\Parameters\Interfaces\{F1ABA7E1-57DC-49E4-8FA4-8A72EEFAFE0B}]
"DhcpNameServer"=8.8.8.8 8.8.4.4
[HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{F1ABA7E1-57DC-49E4-8FA4-8A72EEFAFE0B}]
"DhcpNameServer"=209.18.47.62 209.18.47.61

---------- | Applications

[HKLM\SOFTWARE\Classes\Applications\ehshell.exe] : "C:\Windows\eHome\ehshell.exe" "%1"
[HKLM\SOFTWARE\Classes\Applications\iexplore.exe] : "C:\Program Files\Internet Explorer\iexplore.exe" %1
[HKLM\SOFTWARE\Classes\Applications\i_view32.exe] : "C:\Program Files (x86)\IrfanView\i_view32.exe" "%1"
[HKLM\SOFTWARE\Classes\Applications\notepad.exe] : %SystemRoot%\system32\NOTEPAD.EXE %1
[HKLM\SOFTWARE\Classes\Applications\ois.exe] : C:\PROGRA~2\MICROS~1\Office14\OIS.EXE /shellOpen "%1"
[HKLM\SOFTWARE\Classes\Applications\photoviewer.dll] : %SystemRoot%\System32\rundll32.exe "%ProgramFiles%

\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
[HKLM\SOFTWARE\Classes\Applications\vlc.exe] : "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file

"%1"
[HKLM\SOFTWARE\Classes\Applications\wmplayer.exe] : "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe"

/Open "%L"
[HKLM\SOFTWARE\Classes\Applications\wordpad.exe] : "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"
[HKLM\SOFTWARE\WOW6432Node\Classes\Applications\ehshell.exe] : "C:\Windows\eHome\ehshell.exe" "%1"
[HKLM\SOFTWARE\WOW6432Node\Classes\Applications\iexplore.exe] : "C:\Program Files\Internet Explorer

\iexplore.exe" %1
[HKLM\SOFTWARE\WOW6432Node\Classes\Applications\i_view32.exe] : "C:\Program Files (x86)\IrfanView

\i_view32.exe" "%1"
[HKLM\SOFTWARE\WOW6432Node\Classes\Applications\notepad.exe] : %SystemRoot%\system32\NOTEPAD.EXE %1
[HKLM\SOFTWARE\WOW6432Node\Classes\Applications\ois.exe] : C:\PROGRA~2\MICROS~1\Office14\OIS.EXE /shellOpen

"%1"
[HKLM\SOFTWARE\WOW6432Node\Classes\Applications\photoviewer.dll] : %SystemRoot%\System32\rundll32.exe

"%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
[HKLM\SOFTWARE\WOW6432Node\Classes\Applications\vlc.exe] : "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-

from-file "%1"
[HKLM\SOFTWARE\WOW6432Node\Classes\Applications\wmplayer.exe] : "%ProgramFiles(x86)%\Windows Media Player

\wmplayer.exe" /Open "%L"
[HKLM\SOFTWARE\WOW6432Node\Classes\Applications\wordpad.exe] : "%ProgramFiles%\Windows NT\Accessories

\WORDPAD.EXE" "%1"

---------- | SvcHost (Whitelist)

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost]
"regsvc"=RemoteRegistry
"DcomLaunch"=Power
PlugPlay
DcomLaunch
"secsvcs"=WinDefend
"bthsvcs"=bthserv
"PeerDist"=PeerDistSvc
"GPSvcGroup"=GPSvc

[HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SvcHost]
"DcomLaunch"=Power
PlugPlay
DcomLaunch

---------- | SvcHost - Netsvcs (Whitelist)

---------- | Software

[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\7-Zip]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Alps]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\AppDataLow]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\BitTorrentPersist]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Clients]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Dell Computer Corporation]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Foxit Software]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\g3n-h@ckm@n]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Google]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Hewlett-Packard]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Intel]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\iZotope]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Lavasoft]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Macrium]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\MixMeister Technology]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Mozilla]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Netscape]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\ODBC]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Policies]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Propellerhead Software]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\ProtectedStorage]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\RegisteredApplications]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\SimonTatham]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\skype]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\skypeapp-8527ec7da092]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\skypeapp-908498f39d08]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\SmartImage]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\sysinternals]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Trolltech]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Visioneer]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Winamp]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Wow6432Node]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\SOFTWARE\AppDataLow\Software\Microsoft]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows\CurrentVersion]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows\DWM]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows\Shell]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows\ShellNoRoam]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows\TabletPC]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows\Windows Error Reporting]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows NT\CurrentVersion]
[HKLM\Software\7-Zip]
[HKLM\Software\Alps]
[HKLM\Software\ASIO]
[HKLM\Software\ATI Technologies]
[HKLM\Software\CBSTEST]
[HKLM\Software\Clients]
[HKLM\Software\Dell]
[HKLM\Software\Dell Computer Corporation]
[HKLM\Software\Dell Inc.]
[HKLM\Software\Foxit Software]
[HKLM\Software\g3n-h@ckm@n]
[HKLM\Software\IDT]
[HKLM\Software\InstalledOptions]
[HKLM\Software\Intel]
[HKLM\Software\Khronos]
[HKLM\Software\Macromedia]
[HKLM\Software\ManageableUpdatePackage]
[HKLM\Software\Microsoft]
[HKLM\Software\Mozilla]
[HKLM\Software\mozilla.org]
[HKLM\Software\MozillaPlugins]
[HKLM\Software\ODBC]
[HKLM\Software\PC-Doctor]
[HKLM\Software\Policies]
[HKLM\Software\Propellerhead Software]
[HKLM\Software\RegisteredApplications]
[HKLM\Software\SimonTatham]
[HKLM\Software\Sonic]
[HKLM\Software\sysinternals]
[HKLM\Software\VideoLAN]
[HKLM\Software\Visioneer]
[HKLM\Software\Wow6432Node]
[HKLM\Software\Microsoft\Windows\CurrentVersion]
[HKLM\Software\Microsoft\Windows\HTML Help]
[HKLM\Software\Microsoft\Windows\ITStorage]
[HKLM\Software\Microsoft\Windows\ScheduledDiagnostics]
[HKLM\Software\Microsoft\Windows\ScriptedDiagnosticsProvider]
[HKLM\Software\Microsoft\Windows\Tablet PC]
[HKLM\Software\Microsoft\Windows\TabletPC]
[HKLM\Software\Microsoft\Windows\Windows Error Reporting]
[HKLM\Software\Microsoft\Windows\Windows Search]
[HKLM\Software\Microsoft\Windows NT\CurrentVersion]
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\AxInstSVGroup]
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\defragsvc]
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\GPSvcGroup]
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\LocalService]
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\LocalServiceAndNoImpersonation]
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\LocalServiceNetworkRestricted]
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\LocalServiceNoNetwork]
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\LocalSystemNetworkRestricted]
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\netsvcs]
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\NetworkService]
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\NetworkServiceRemoteDesktopHyperVAgent]
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\NetworkServiceRemoteDesktopPublishing]
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\SDRSVC]
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\swprv]
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\termsvcs]
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\utcsvc]
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\wcssvc]
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\wercplsupport]
[HKLM\Software\WOW6432Node\ASIO]
[HKLM\Software\WOW6432Node\Foxit Software]
[HKLM\Software\WOW6432Node\Google]
[HKLM\Software\WOW6432Node\IDT]
[HKLM\Software\WOW6432Node\Intel]
[HKLM\Software\WOW6432Node\IrfanView]
[HKLM\Software\WOW6432Node\iZotope, Inc./Neutron 2 Advanced]
[HKLM\Software\WOW6432Node\iZotope, Inc./Ozone 8 Advanced]
[HKLM\Software\WOW6432Node\Khronos]
[HKLM\Software\WOW6432Node\Lame For Audacity]
[HKLM\Software\WOW6432Node\Lavasoft]
[HKLM\Software\WOW6432Node\Line 6]
[HKLM\Software\WOW6432Node\Macromedia]
[HKLM\Software\WOW6432Node\Microsoft]
[HKLM\Software\WOW6432Node\MixMeister Technology]
[HKLM\Software\WOW6432Node\Mozilla]
[HKLM\Software\WOW6432Node\MozillaPlugins]
[HKLM\Software\WOW6432Node\Notepad++]
[HKLM\Software\WOW6432Node\Nullsoft]
[HKLM\Software\WOW6432Node\ODBC]
[HKLM\Software\WOW6432Node\Panda Security]
[HKLM\Software\WOW6432Node\Panda Software]
[HKLM\Software\WOW6432Node\Prolific Technology INC]
[HKLM\Software\WOW6432Node\Visioneer]
[HKLM\Software\WOW6432Node\Clients]
[HKLM\Software\WOW6432Node\Policies]
[HKLM\Software\WOW6432Node\RegisteredApplications]
[HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion]
[HKLM\Software\WOW6432Node\Microsoft\Windows\Help]
[HKLM\Software\WOW6432Node\Microsoft\Windows\HTML Help]
[HKLM\Software\WOW6432Node\Microsoft\Windows\ITStorage]
[HKLM\Software\WOW6432Node\Microsoft\Windows\ScriptedDiagnosticsProvider]
[HKLM\Software\WOW6432Node\Microsoft\Windows\Windows Error Reporting]
[HKLM\Software\WOW6432Node\Microsoft\Windows\Windows Search]
[HKLM\Software\WOW6432Node\Microsoft\Windows\Tablet PC]
[HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion]
[HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SvcHost\LocalService]
[HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SvcHost\LocalServiceAndNoImpersonation]
[HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SvcHost\LocalServiceNetworkRestricted]
[HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SvcHost\LocalServiceNoNetwork]
[HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SvcHost\LocalSystemNetworkRestricted]
[HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SvcHost\netsvcs]
[HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SvcHost\NetworkService]
[HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SvcHost\NetworkServiceRemoteDesktopHyperVAgent]
[HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SvcHost\NetworkServiceRemoteDesktopPublishing]
[HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SvcHost\termsvcs]
[HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SvcHost\wcssvc]

---------- | Drives

F:

---------- | C:

[13/07/2009 23:18:56] - |SHD| - [8531617394] - C:\$Recycle.Bin
[31/10/2018 18:03:25] - |SHD| - [3523720] - C:\Config.Msi
[14/07/2009 01:08:56] - |SHD| - [0] - C:\Documents and Settings
[26/06/2018 13:17:53] - |D| - [281775] - C:\Drivers
[14/07/2019 21:35:29] - |D| - [105575672] - C:\FRST
[MD5.D41D8CD98F00B204E9800998ECF8427E] - [26/06/2018 12:21:24] - |ASH| - (.-.) - [12783353856] - (0.0.0.0) -

C:\hiberfil.sys
[26/06/2018 13:17:53] - |D| - [33569904] - C:\Hotfix
[26/06/2018 10:01:32] - |D| - [37360] - C:\Intel
[27/06/2018 08:28:07] - |RHD| - [649826903] - C:\MSOCache
[MD5.D41D8CD98F00B204E9800998ECF8427E] - [26/06/2018 12:21:24] - |ASH| - (.-.) - [17044475904] - (0.0.0.0) -

C:\pagefile.sys
[13/07/2009 23:20:08] - |D| - [0] - C:\PerfLogs
[13/07/2009 23:20:08] - |RD| - [57066968275] - C:\Program Files
[13/07/2009 23:20:08] - |RD| - [3594947406] - C:\Program Files (x86)
[13/07/2009 23:20:08] - |HD| - [7724597251] - C:\ProgramData
[30/10/2018 18:29:52] - |D| - [0] - C:\python-scripts
[15/07/2019 10:24:39] - |D| - [309016] - C:\QuickDiag
[MD5.413141830607B3FD3B2C82ACD9A3D022] - [15/07/2019 10:40:00] - |A| - (.-.) - [107256] - (0.0.0.0) - C:

\QuickDiag.txt
[MD5.DF70DB7C478D62CDF2903994E01FDBFE] - [15/07/2019 10:26:54] - |RAST| - (.-.) - [234523] - (0.0.0.0) - C:

\QuickDiag_15_07_2019_10_26_54.txt
[26/06/2018 09:29:06] - |SHD| - [295090159] - C:\Recovery
[30/10/2018 18:32:02] - |D| - [311764819] - C:\Sleep Playlist
[26/06/2018 12:21:24] - |SHD| - [0] - C:\System Volume Information
[29/10/2018 20:46:56] - |D| - [0] - C:\temp
[13/07/2009 23:20:08] - |RD| - [71182103676] - C:\Users
[20/03/2019 21:55:37] - |D| - [1471760606] - C:\VSTs
[13/07/2009 23:20:08] - |D| - [27250990995] - C:\Windows

---------- | C:\Windows

[MD5.E809E1FAA8A40B74787077028B385E6E] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\1f8bf2vui4tpp8w
[MD5.7B14EDAD6B2509C7E473EACE82935E27] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\1f8bf4c2m4tpp8w
[MD5.07520BE893D14D360FD558C54DD695C4] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\1f8bf4f5i4tpp8w
[MD5.D954CF6201902E9B47A948AD571BE32A] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\1f8bf7q2d4tpp8w
[MD5.B617806483C7B20495D1C0F5D55349B2] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\1f8bfmk8m4tpp8w
[MD5.5BD7810EA166D44AB32058C2DE503DE4] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\2e2uf4b4q8p2kci
[MD5.F7AB403899391B1EBDA99FAD162E8709] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\4cwyf4jbcce5n1p
[MD5.E560112DBE06C00119562B55876FE48A] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\4cwyfyv7x1w5n1p
[MD5.160C7598C55154670531399F68CEFC2E] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\5b4wf2e7p2v8qio
[MD5.2FBE828181EE5EE81AAE003BDD62CEB8] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\5b4wf4c8n5s1jta
[MD5.7F2833A4520A051C7C82D04943BAF0A0] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\5b4wf4poy2v8qio
[MD5.0A8074B30B1CFB5931BFB39F99E869E4] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\5b4wf4t4k2v8qio
[MD5.5CFE017757A09E53518572C2A0AF4369] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\5b4wf7y1l7q8qio
[MD5.EF5CD7A92582CCFF75D16EE102A9AEEE] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\5b4wffx8w5s1jta
[MD5.A1385BB4C24E0FB3F4D91EECAD0A2B5C] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\5b4wfyk4b2v8qio
[MD5.3F0EBE13E5D5C713288B7748C2CE6C5E] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\5b4wfyn5a5s1jta
[MD5.B16BEA90634E3861F216519F42730387] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\5b4wfyn5s5s1jta
[14/07/2009 01:32:38] - |D| - [802] - C:\Windows\addins
[13/07/2009 23:20:08] - |D| - [6865258] - C:\Windows\AppCompat
[13/07/2009 23:20:08] - |D| - [10942180] - C:\Windows\AppPatch
[13/07/2009 23:20:08] - |RSD| - [1747935411] - C:\Windows\assembly
[MD5.317CD1CE327B6520BF4EE007BCD39E61] - [20/11/2010 23:24:22] - |A| - (.© Microsoft Corporation. - Boot File

Servicing Utility.) - [71168] - (6.1.7601.17514) - C:\Windows\bfsvc.exe
[13/07/2009 23:20:09] - |D| - [29189342] - C:\Windows\Boot
[MD5.5D41CA5B9A5AA7F7F5A71D991FB08DA4] - [14/07/2009 01:38:36] - |AS| - (.-.) - [67584] - (0.0.0.0) - C:

\Windows\bootstat.dat
[13/07/2009 23:20:09] - |D| - [2418176] - C:\Windows\Branding
[21/11/2010 03:17:10] - |D| - [0] - C:\Windows\CSC
[MD5.A4C15BCAD35B4DB7A9DCF859B4E0BEF7] - [26/06/2018 13:17:53] - |RA| - (.-.) - [13] - (0.0.0.0) - C:\Windows

\csup.txt
[13/07/2009 23:20:09] - |D| - [2113488] - C:\Windows\Cursors
[14/07/2009 00:45:54] - |D| - [29552] - C:\Windows\debug
[26/06/2018 13:45:10] - |D| - [948] - C:\Windows\Dell
[14/07/2009 01:32:38] - |D| - [3003724] - C:\Windows\diagnostics
[14/07/2009 01:37:46] - |D| - [0] - C:\Windows\DigitalLocker
[14/07/2009 01:32:38] - |D| - [65] - C:\Windows\Downloaded Program Files
[MD5.94F1B93B30FECAD7F8DDF99037EF8D23] - [14/11/2018 18:47:04] - |A| - (.-.) - [6058] - (0.0.0.0) - C:

\Windows\DPINST.LOG
[21/11/2010 03:17:11] - |D| - [117959641] - C:\Windows\ehome
[14/07/2009 01:37:46] - |D| - [110080] - C:\Windows\en-US
[MD5.BCCD6F8B278450DE25224C0157789584] - [26/06/2018 13:45:10] - |A| - (.-.) - [17776] - (0.0.0.0) - C:

\Windows\EvtMessage.dll
[MD5.38AE1B3C38FAEF56FE4907922F0385BA] - [26/06/2018 11:02:30] - |A| - (.© Microsoft Corporation. - Windows

Explorer.) - [3229696] - (6.1.7601.23537) - C:\Windows\explorer.exe
[13/07/2009 23:20:09] - |RSD| - [388351939] - C:\Windows\Fonts
[MD5.92BB2E9AA28542C685C59EFCBAC2490B] - [13/07/2009 19:22:13] - |A| - (.© Microsoft Corporation. - BitLocker

Drive Encryption Servicing Utility.) - [15360] - (6.1.7600.16385) - C:\Windows\fveupdate.exe
[13/07/2009 23:20:09] - |D| - [32090797] - C:\Windows\Globalization
[13/07/2009 23:20:09] - |D| - [30366808] - C:\Windows\Help
[MD5.A66E522F3CBFB8709EA37844922A002E] - [26/06/2018 09:55:47] - |A| - (.© Microsoft Corporation. - Microsoft

Help and Support.) - [733696] - (6.1.7601.23834) - C:\Windows\HelpPane.exe
[MD5.12589371C087A76B6E8E152939E59E98] - [26/06/2018 09:55:46] - |A| - (.© Microsoft Corporation. - Microsoft®

HTML Help Executable.) - [16896] - (6.1.7601.24134) - C:\Windows\hh.exe
[13/07/2009 23:20:09] - |D| - [143540740] - C:\Windows\IME
[13/07/2009 23:20:10] - |D| - [148300674] - C:\Windows\inf
[26/06/2018 11:09:19] - |SHD| - [1914297515] - C:\Windows\Installer
[13/07/2009 23:20:10] - |D| - [48371] - C:\Windows\L2Schemas
[13/07/2009 23:20:10] - |D| - [0] - C:\Windows\LiveKernelReports
[13/07/2009 23:20:10] - |D| - [75617344] - C:\Windows\Logs
[13/07/2009 23:20:10] - |RSD| - [13327133] - C:\Windows\Media
[MD5.D0F3DD75203DB96D38BDA64F492F1E87] - [04/07/2018 21:03:29] - |A| - (.-.) - [749232895] - (0.0.0.0) - C:

\Windows\MEMORY.DMP
[MD5.23AF90D2355D8C83AA4567EF1763B467] - [13/07/2009 20:10:29] - |A| - (.-.) - [43131] - (0.0.0.0) - C:

\Windows\mib.bin
[13/07/2009 23:20:10] - |D| - [873800845] - C:\Windows\Microsoft.NET
[26/06/2018 11:09:31] - |D| - [4398] - C:\Windows\Migration
[04/07/2018 21:03:31] - |D| - [2222584] - C:\Windows\Minidump
[13/07/2009 23:20:10] - |D| - [0] - C:\Windows\ModemLogs
[MD5.B9FB94A8DA62711C6955825DEFB25C5A] - [13/07/2009 22:35:42] - |A| - (.-.) - [1405] - (0.0.0.0) - C:

\Windows\msdfmap.ini
[MD5.B32189BDFF6E577A92BAA61AD49264E6] - [26/06/2018 11:06:21] - |A| - (.© Microsoft Corporation. - Notepad.)

- [193536] - (6.1.7601.18917) - C:\Windows\notepad.exe
[14/07/2009 01:32:38] - |D| - [65] - C:\Windows\Offline Web Pages
[26/06/2018 13:18:27] - |D| - [0] - C:\Windows\Panther
[27/06/2018 08:31:04] - |D| - [0] - C:\Windows\PCHEALTH
[14/07/2009 01:32:38] - |D| - [62438456] - C:\Windows\Performance
[MD5.AFB1846B83AAEE4BCADCA21260DB9733] - [18/07/2018 16:20:26] - |A| - (.-.) - [69938] - (0.0.0.0) - C:

\Windows\PFRO.log
[13/07/2009 23:20:10] - |D| - [1109514] - C:\Windows\PLA
[13/07/2009 23:20:10] - |D| - [4903900] - C:\Windows\PolicyDefinitions
[26/06/2018 12:22:12] - |D| - [52004630] - C:\Windows\Prefetch
[MD5.FFB8B91BD19E5BC10A3344AAF34880F3] - [21/11/2010 03:17:51] - |A| - (.-.) - [53551] - (0.0.0.0) - C:

\Windows\Professional.xml
[MD5.2E2C937846A0B8789E5E91739284D17A] - [13/07/2009 19:27:10] - |A| - (.© Microsoft Corporation. - Registry

Editor.) - [427008] - (6.1.7600.16385) - C:\Windows\regedit.exe
[13/07/2009 23:20:10] - |D| - [22588] - C:\Windows\Registration
[13/07/2009 23:20:10] - |D| - [5807844] - C:\Windows\rescache
[13/07/2009 23:20:10] - |D| - [1674534] - C:\Windows\Resources
[13/07/2009 23:20:10] - |D| - [0] - C:\Windows\SchCache
[13/07/2009 23:20:10] - |D| - [58021] - C:\Windows\schemas
[13/07/2009 23:20:10] - |D| - [2215878] - C:\Windows\security
[14/07/2009 00:45:47] - |D| - [53275028] - C:\Windows\ServiceProfiles
[13/07/2009 23:20:10] - |D| - [159759889] - C:\Windows\servicing
[14/07/2009 00:45:50] - |D| - [4038] - C:\Windows\Setup
[MD5.D1E4D206D7DF436266301ACCA3CC853A] - [18/07/2018 16:20:51] - |A| - (.-.) - [24250] - (0.0.0.0) - C:

\Windows\setupact.log
[MD5.D41D8CD98F00B204E9800998ECF8427E] - [18/07/2018 16:20:51] - |A| - (.-.) - [0] - (0.0.0.0) - C:\Windows

\setuperr.log
[27/06/2018 08:28:38] - |D| - [35886] - C:\Windows\SHELLNEW
[26/06/2018 12:24:33] - |D| - [1836341289] - C:\Windows\SoftwareDistribution
[13/07/2009 23:20:10] - |D| - [181014046] - C:\Windows\Speech
[MD5.D01628AF9F7FB3F415B357D446FBE6D9] - [20/11/2010 23:24:16] - |A| - (.© Microsoft Corporation. - Print

driver host for 32bit applications.) - [67072] - (6.1.7601.17514) - C:\Windows\splwow64.exe
[MD5.9060C3C745E7B2D8E1A81DD061021546] - [14/07/2009 01:28:38] - |A| - (.-.) - [48201] - (0.0.0.0) - C:

\Windows\Starter.xml
[13/07/2009 23:20:10] - |D| - [0] - C:\Windows\system
[MD5.286A9EDB379DC3423A528B0864A0F111] - [13/07/2009 22:34:57] - |A| - (.-.) - [219] - (0.0.0.0) - C:\Windows

\system.ini
[13/07/2009 23:20:10] - |D| - [3965717846] - C:\Windows\System32
[13/07/2009 23:20:14] - |D| - [1227294567] - C:\Windows\SysWOW64
[13/07/2009 23:20:14] - |D| - [15] - C:\Windows\TAPI
[13/07/2009 23:20:14] - |D| - [17170] - C:\Windows\Tasks
[13/07/2009 23:20:14] - |D| - [90185128] - C:\Windows\Temp
[13/07/2009 23:20:14] - |D| - [0] - C:\Windows\tracing
[MD5.0BEA3F79A36B1F67B2CE0F595524C77C] - [10/06/2009 17:41:17] - |A| - (.- Twain Source Manager (Image

Acquisition Interface).) - [94784] - (1.7.0.0) - C:\Windows\twain.dll
[14/07/2009 01:32:38] - |D| - [14385108] - C:\Windows\twain_32
[MD5.163A95975E1D8819E653AA3E961371CA] - [20/11/2010 23:25:10] - |A| - (.- Twain_32 Source Manager (Image

Acquisition Interface).) - [51200] - (1.7.1.3) - C:\Windows\twain_32.dll
[29/10/2018 20:45:56] - |D| - [16988116] - C:\Windows\Twain_64
[MD5.F36A271706EDD23C94956AFB56981184] - [13/07/2009 18:47:26] - |A| - (.- Twain_32.dll Client's 16-Bit

Thunking Server.) - [49680] - (1.7.0.0) - C:\Windows\twunk_16.exe
[MD5.0BD6E68F3EA0DD62CD86283D86895381] - [13/07/2009 20:14:40] - |A| - (.- Twain.dll Client's 32-Bit Thunking

Server.) - [31232] - (1.7.1.0) - C:\Windows\twunk_32.exe
[MD5.85726231A5D21A86BEF871F552ECBB0F] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\ugisf2r8ffbdd5t
[06/04/2019 14:02:57] - |D| - [3553943] - C:\Windows\usb-audio.deAkaiEIE
[MD5.F5F5F500A20CB350BA5DE93BE7E8763F] - [26/06/2018 13:17:54] - |RAH| - (.-.) - [29] - (0.0.0.0) - C:

\Windows\version
[13/07/2009 23:20:14] - |D| - [12420] - C:\Windows\Vss
[13/07/2009 23:20:14] - |D| - [44155055] - C:\Windows\Web
[MD5.2465EBC8CD6E412CDC1AB9FEF40BCAE6] - [13/07/2009 22:34:57] - |A| - (.-.) - [478] - (0.0.0.0) - C:\Windows

\win.ini
[MD5.5A5CFF37F1BD0F86B9BDAAD7A9445882] - [14/07/2009 00:54:24] - |RAH| - (.-.) - [749] - (0.0.0.0) - C:

\Windows\WindowsShell.Manifest
[MD5.55F310719071386CAC1A8DE3736F4435] - [26/06/2018 12:24:31] - |A| - (.-.) - [1916132] - (0.0.0.0) - C:

\Windows\WindowsUpdate.log
[MD5.1D420D66250BCAAAED05724FB34008CF] - [13/07/2009 20:12:29] - |A| - (.© Microsoft Corporation. - Windows

Winhlp32 Stub.) - [9728] - (6.1.7600.16385) - C:\Windows\winhlp32.exe
[13/07/2009 23:20:14] - |D| - [13228677245] - C:\Windows\winsxs
[MD5.DC17DD0189B0C36D863B4DD0A036C10F] - [10/06/2009 16:52:44] - |A| - (.-.) - [316640] - (0.0.0.0) - C:

\Windows\WMSysPr9.prx
[MD5.F8ED3B4B209E2CB49028E36CF06CA851] - [13/07/2009 19:56:28] - |A| - (.© Microsoft Corporation. - Windows

Write.) - [10240] - (6.1.7600.16385) - C:\Windows\write.exe
[MD5.77802F8703462B1721F42CB116E606B8] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\yxa4f1odk8u8v5
[MD5.51E998034011BA21C7AB51136DC3B004] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\yxa4f1w5a8u8v5
[MD5.FD9D0357DF3715976C84D19284658D09] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\yxa4fff5a8u8v5
[MD5.B9A2867AC53D9A75E99448D43DE3D615] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\yxa4fmw5a8u8v5

---------- | C:\Windows\System32\GroupPolicy

---------- | Systemroot\System

---------- | Systemroot\Installer (Microsoft Files Whitelisted)

[26/06/2018 22:12:55] - C:\Windows\Installer\10406fa.msi : (7-Zip (x64 edition) Package - Igor Pavlov)

[Offsets ok ! : D0CF11E0A1B11AE10000000000000000]
[12/07/2019 13:36:26] - C:\Windows\Installer\16985d.msi : (Google Update Helper - Google LLC)

[Offsets ok ! : D0CF11E0A1B11AE10000000000000000]
[02/06/2016 15:08:14] - C:\Windows\Installer\3f5a6b7f.msi : (Visioneer RoadWarrior 3 Series Driver - Visioneer

Inc.) [Offsets ok ! : D0CF11E0A1B11AE10000000000000000]
[02/06/2016 14:44:00] - C:\Windows\Installer\3f5a6b86.msi : (Visioneer Acuity Assets V1 - Visioneer Inc.)

[Offsets ok ! : D0CF11E0A1B11AE10000000000000000]
[17/01/2019 20:46:44] - C:\Windows\Installer\7652fd62.msi : ( -) [Offsets ok ! :

D0CF11E0A1B11AE10000000000000000]
[30/05/2019 09:44:38] - C:\Windows\Installer\b8ad7f5.msi : (Dell SupportAssist - Dell Inc.) [Offsets

ok ! : D0CF11E0A1B11AE10000000000000000]
[26/06/2018 21:10:23] - C:\Windows\Installer\ceac6b.msi : (PuTTY release 0.70 installer - Simon Tatham)

[Offsets ok ! : D0CF11E0A1B11AE10000000000000000]
[13/11/2013 15:23:14] - C:\Windows\Installer\e73ad.msi : (Intel(R) Trusted Connect Service Client - Intel

Corporation) [Offsets ok ! : D0CF11E0A1B11AE10000000000000000]
[25/07/2013 03:00:48] - C:\Windows\Installer\e73b2.msi : (Intel® WiFi - Intel Corporation) [Offsets

ok ! : D0CF11E0A1B11AE10000000000000000]
[17/07/2013 14:57:16] - C:\Windows\Installer\e73b7.msi : (Intel® WiFi - Intel Corporation) [Offsets

ok ! : D0CF11E0A1B11AE10000000000000000]
[17/07/2013 14:57:24] - C:\Windows\Installer\e73bc.msi : (Intel® WiFi - Intel Corporation) [Offsets

ok ! : D0CF11E0A1B11AE10000000000000000]
[09/04/2019 19:34:58] - [41828352] - (.().-. - ()) - C:\Windows\Installer\1af6a9a8.msp
[15/05/2019 22:28:12] - [41816064] - (.().-. - ()) - C:\Windows\Installer\1afd1dd3.msp
[07/06/2018 07:41:40] - [10661888] - (.().-. - ()) - C:\Windows\Installer\1f3b43.msp
[14/08/2018 17:08:56] - [41676800] - (.().-. - ()) - C:\Windows\Installer\1fcc0b.msp
[31/08/2018 01:38:14] - [41668608] - (.().-. - ()) - C:\Windows\Installer\23c104.msp
[07/07/2011 18:53:20] - [14467072] - (.().-. - ()) - C:\Windows\Installer\33719d1.msp
[07/07/2011 18:53:20] - [11155456] - (.().-. - ()) - C:\Windows\Installer\3371a0f.msp
[07/07/2011 18:53:20] - [16972800] - (.().-. - ()) - C:\Windows\Installer\3371a24.msp
[07/07/2011 18:53:20] - [11056128] - (.().-. - ()) - C:\Windows\Installer\3371a37.msp
[07/07/2011 18:53:20] - [13031936] - (.().-. - ()) - C:\Windows\Installer\3371a5e.msp
[07/07/2011 18:53:20] - [2426880] - (.().-. - ()) - C:\Windows\Installer\3371a65.msp
[07/07/2011 18:53:20] - [608768] - (.().-. - ()) - C:\Windows\Installer\3371a6c.msp
[07/07/2011 18:53:20] - [3459584] - (.().-. - ()) - C:\Windows\Installer\3371ba6.msp
[07/07/2011 18:53:20] - [3994624] - (.().-. - ()) - C:\Windows\Installer\3371bb5.msp
[28/06/2011 21:27:28] - [4028928] - (.().-. - ()) - C:\Windows\Installer\a6453.msp
[28/06/2011 21:21:32] - [4637184] - (.().-. - ()) - C:\Windows\Installer\e5797.msp
[04/06/2019 03:15:38] - [41811968] - (.().-. - ()) - C:\Windows\Installer\f11588.msp

---------- | %System%\*.in*

[14/07/2009 00:57:09] - [73] - C:\Windows\System32\desktop.ini
[26/06/2018 11:38:47] - [16303] - C:\Windows\System32\ieuinit.inf
[14/07/2009 01:13:15] - [781790] - C:\Windows\System32\PerfStringBackup.INI
[10/06/2009 17:01:25] - [60124] - C:\Windows\System32\tcpmon.ini
[26/06/2018 11:38:47] - [16303] - C:\Windows\Syswow64\ieuinit.inf
[14/07/2009 00:55:01] - [535] - C:\Windows\Syswow64\mapisvc.inf
[26/06/2018 11:10:24] - [774404] - C:\Windows\Syswow64\PerfStringBackup.INI

---------- | Listing no Microsoft signed files (Not necessary Malwares) | system32 | Syswow64 | General scan

[MD5.6712E83EA2BF4FB46A316EEEF51E8101] - |A| - [03/07/2019 22:16:13] - (.-.) - [124.99 Ko] - (0.0.0.0) - C:

\Windows\AppPatch\AppPatch64\sysmain.sdb
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:08] - [0 Ko] - C:\Windows\AppPatch\Custom

\Custom64
[MD5.00000000000000000000000000000000] - |D| - [08/05/2019 08:49:50] - [0 Ko] - C:\Windows\Temp\7zS6D2D.tmp
[MD5.00000000000000000000000000000000] - |D| - [19/03/2019 18:13:17] - [0 Ko] - C:\Windows\Temp\7zSBC48.tmp
[MD5.00000000000000000000000000000000] - |D| - [07/04/2019 14:54:28] - [0 Ko] - C:\Windows\Temp\7zSD1CA.tmp
[MD5.E9E131B47B5F401894A1256C945DA58D] - |A| - [15/08/2018 09:58:26] - (.-.) - [4.47 Ko] - (0.0.0.0) - C:

\Windows\Temp\ASPNETSetup_00000.log
[MD5.ED15F7C2043E446541E5E18DE0273940] - |A| - [15/08/2018 09:58:37] - (.-.) - [2.9 Ko] - (0.0.0.0) - C:

\Windows\Temp\ASPNETSetup_00001.log
[MD5.A6207B26D0687EFDFC7EE1A866022ECB] - |A| - [10/12/2018 23:13:31] - (.-.) - [4.47 Ko] - (0.0.0.0) - C:

\Windows\Temp\ASPNETSetup_00002.log
[MD5.D000CCB7D2D8D1B66A365C1C6630A10E] - |A| - [10/12/2018 23:13:44] - (.-.) - [2.9 Ko] - (0.0.0.0) - C:

\Windows\Temp\ASPNETSetup_00003.log
[MD5.A46CF44A5F4E47BB421AC92579F70B1E] - |A| - [10/12/2018 23:16:39] - (.-.) - [4.47 Ko] - (0.0.0.0) - C:

\Windows\Temp\ASPNETSetup_00004.log
[MD5.DA4FAFF057A0032BDBE8D448027D0076] - |A| - [10/12/2018 23:16:50] - (.-.) - [2.9 Ko] - (0.0.0.0) - C:

\Windows\Temp\ASPNETSetup_00005.log
[MD5.305F9377876CCA3D256621465AADF1DB] - |A| - [10/12/2018 23:20:54] - (.-.) - [4.47 Ko] - (0.0.0.0) - C:

\Windows\Temp\ASPNETSetup_00006.log
[MD5.6595E9949FE6B2A6B8F388519B83C182] - |A| - [10/12/2018 23:21:04] - (.-.) - [2.9 Ko] - (0.0.0.0) - C:

\Windows\Temp\ASPNETSetup_00007.log
[MD5.F3492D2CA7E1136B24D9D4B0E6CB2249] - |A| - [03/07/2019 22:22:19] - (.-.) - [4.47 Ko] - (0.0.0.0) - C:

\Windows\Temp\ASPNETSetup_00008.log
[MD5.BCCB51111B4C3188D527EF7D5FB12B6C] - |A| - [03/07/2019 22:22:46] - (.-.) - [2.9 Ko] - (0.0.0.0) - C:

\Windows\Temp\ASPNETSetup_00009.log
[MD5.B41CC0595BAD22F30B191D997F54E405] - |A| - [03/07/2019 22:28:41] - (.-.) - [4.47 Ko] - (0.0.0.0) - C:

\Windows\Temp\ASPNETSetup_00010.log
[MD5.658F72C1515F61708B9BF9CA273284EE] - |A| - [03/07/2019 22:28:49] - (.-.) - [2.9 Ko] - (0.0.0.0) - C:

\Windows\Temp\ASPNETSetup_00011.log
[MD5.B2EA5738FB72DEA3116B7AFDDD59D9E6] - |A| - [09/10/2018 21:54:09] - (.-.) - [3.89 Ko] - (0.0.0.0) - C:

\Windows\Temp\AutoUpdateScheduler.xml
[MD5.00000000000000000000000000000000] - |D| - [14/07/2019 20:29:33] - [0 Ko] - C:\Windows\Temp\C78D8CC8-

270A-44A8-ACEF-885EF75722CE-Sigs
[MD5.00000000000000000000000000000000] - |D| - [12/07/2019 13:36:51] - [0.04 Ko] - C:\Windows\Temp\Crashpad
[MD5.F9E6B0E3691B63E4A0F7D4E00A83655A] - |A| - [23/10/2018 21:05:06] - (.-.) - [24.57 Ko] - (0.0.0.0) - C:

\Windows\Temp\dat445A.tmp
[MD5.AE05638BF81CBF345EBCD8B470E409AF] - |A| - [23/10/2018 21:05:06] - (.-.) - [18.72 Ko] - (0.0.0.0) - C:

\Windows\Temp\dat446A.tmp
[MD5.46E48CE0628835F68A7369D0254E4283] - |A| - [23/10/2018 21:05:06] - (.-.) - [123.82 Ko] - (0.0.0.0) - C:

\Windows\Temp\dat448B.tmp
[MD5.894A2EDE85A483BF9BEDEFD4DB45CDB9] - |A| - [23/10/2018 21:05:09] - (.-.) - [124.5 Ko] - (0.0.0.0) - C:

\Windows\Temp\dat5167.tmp
[MD5.0825F1DFB7B05FECE8D5CBF12928DD35] - |A| - [23/10/2018 21:05:09] - (.-.) - [26.71 Ko] - (0.0.0.0) - C:

\Windows\Temp\dat5178.tmp
[MD5.D5F6D36274376F4727D6F90C95C4CCDC] - |A| - [23/10/2018 21:05:12] - (.-.) - [3.77 Ko] - (0.0.0.0) - C:

\Windows\Temp\dat5975.tmp
[MD5.F4769F9BDB7466BE65088239C12046D1] - |A| - [23/10/2018 21:05:12] - (.-.) - [19.66 Ko] - (0.0.0.0) - C:

\Windows\Temp\dat59B4.tmp
[MD5.75801960794B7873D87AAA597BCF7447] - |A| - [23/10/2018 21:05:12] - (.-.) - [38.18 Ko] - (0.0.0.0) - C:

\Windows\Temp\dat5BE7.tmp
[MD5.AE05638BF81CBF345EBCD8B470E409AF] - |A| - [22/07/2018 22:22:25] - (.-.) - [18.72 Ko] - (0.0.0.0) - C:

\Windows\Temp\dat9677.tmp
[MD5.46E48CE0628835F68A7369D0254E4283] - |A| - [22/07/2018 22:22:25] - (.-.) - [123.82 Ko] - (0.0.0.0) - C:

\Windows\Temp\dat96B7.tmp
[MD5.F9E6B0E3691B63E4A0F7D4E00A83655A] - |A| - [22/07/2018 22:22:25] - (.-.) - [24.57 Ko] - (0.0.0.0) - C:

\Windows\Temp\dat96D7.tmp
[MD5.0825F1DFB7B05FECE8D5CBF12928DD35] - |A| - [22/07/2018 22:22:35] - (.-.) - [26.71 Ko] - (0.0.0.0) - C:

\Windows\Temp\datC038.tmp
[MD5.D5F6D36274376F4727D6F90C95C4CCDC] - |A| - [22/07/2018 22:22:42] - (.-.) - [3.77 Ko] - (0.0.0.0) - C:

\Windows\Temp\datD935.tmp
[MD5.75801960794B7873D87AAA597BCF7447] - |A| - [22/07/2018 22:22:42] - (.-.) - [38.18 Ko] - (0.0.0.0) - C:

\Windows\Temp\datD9F1.tmp
[MD5.FF2581D26B5DE2E906348EE4C68F16B9] - |A| - [15/08/2018 09:57:42] - (.-.) - [1.2 Ko] - (0.0.0.0) - C:

\Windows\Temp\dd_NDP46-KB4344146-x64_decompression_log.txt
[MD5.F90999AC16A0F79DDE85979BE1AFE769] - |A| - [10/12/2018 23:15:49] - (.-.) - [1.25 Ko] - (0.0.0.0) - C:

\Windows\Temp\dd_NDP46-KB4457035-x64_decompression_log.txt
[MD5.ACEFC0CDA1B4E5DCF9344B014ACEE009] - |A| - [10/12/2018 23:20:12] - (.-.) - [1.2 Ko] - (0.0.0.0) - C:

\Windows\Temp\dd_NDP46-KB4459942-x64_decompression_log.txt
[MD5.ABA771F52BEEFDCB99DDFF1DB0FD6024] - |A| - [03/07/2019 22:20:38] - (.-.) - [1.18 Ko] - (0.0.0.0) - C:

\Windows\Temp\dd_NDP46-KB4495588-x64_decompression_log.txt
[MD5.FD1BBF332340BA16BBCE03D9797B72BF] - |A| - [03/07/2019 22:28:09] - (.-.) - [1.18 Ko] - (0.0.0.0) - C:

\Windows\Temp\dd_NDP47-KB4502558-x64_decompression_log.txt
[MD5.A5DFAFA27D1C0A8B085099D24C88281F] - |A| - [10/12/2018 23:10:38] - (.-.) - [1.29 Ko] - (0.0.0.0) - C:

\Windows\Temp\dd_ndp472-kb4054541-x86-x64-enu_decompression_log.txt
[MD5.365E7F8279C00E3803ED17D9397F8DD3] - |A| - [10/12/2018 23:15:19] - (.-.) - [1.22 Ko] - (0.0.0.0) - C:

\Windows\Temp\dd_ndp472-kb4087364-x64_decompression_log.txt
[MD5.CD4BB68004280C23DAFAD97658E011F6] - |A| - [10/12/2018 23:11:23] - (.-.) - [0.46 Ko] - (0.0.0.0) - C:

\Windows\Temp\dd_SetupUtility.txt
[MD5.4D70B5E2F73283F7C67E6D5A314908EF] - |A| - [15/08/2018 09:58:18] - (.-.) - [4.57 Ko] - (0.0.0.0) - C:

\Windows\Temp\dd_wcf_CA_smci_20180815_135818_368.txt
[MD5.454F4661A98F9A5F4392DD7F1EB1547C] - |A| - [15/08/2018 09:58:20] - (.-.) - [2.63 Ko] - (0.0.0.0) - C:

\Windows\Temp\dd_wcf_CA_smci_20180815_135820_958.txt
[MD5.93E339E94A8BAA4B320BC8E325DA4F45] - |A| - [10/12/2018 23:13:18] - (.-.) - [4.57 Ko] - (0.0.0.0) - C:

\Windows\Temp\dd_wcf_CA_smci_20181211_031318_725.txt
[MD5.98D43FF9F73ADB25A6677CF1B744D7A6] - |A| - [10/12/2018 23:13:28] - (.-.) - [2.63 Ko] - (0.0.0.0) - C:

\Windows\Temp\dd_wcf_CA_smci_20181211_031328_246.txt
[MD5.2991C504D7F2E26F45F3B6040F7923E0] - |A| - [10/12/2018 23:16:18] - (.-.) - [4.57 Ko] - (0.0.0.0) - C:

\Windows\Temp\dd_wcf_CA_smci_20181211_031618_754.txt
[MD5.174DACDB97075A2426DA1C2031708C63] - |A| - [10/12/2018 23:16:33] - (.-.) - [2.63 Ko] - (0.0.0.0) - C:

\Windows\Temp\dd_wcf_CA_smci_20181211_031633_144.txt
[MD5.613A71FB24791A30966A37D30E20D2C5] - |A| - [10/12/2018 23:20:40] - (.-.) - [4.57 Ko] - (0.0.0.0) - C:

\Windows\Temp\dd_wcf_CA_smci_20181211_032040_241.txt
[MD5.3A73EA977881DF379E1367A28ACB5CD3] - |A| - [10/12/2018 23:20:46] - (.-.) - [2.63 Ko] - (0.0.0.0) - C:

\Windows\Temp\dd_wcf_CA_smci_20181211_032046_711.txt
[MD5.BC917652DA88915E6A9EDB070256B97C] - |A| - [03/07/2019 22:22:01] - (.-.) - [4.57 Ko] - (0.0.0.0) - C:

\Windows\Temp\dd_wcf_CA_smci_20190704_022201_410.txt
[MD5.68A8668DEBF07332B5C4FF34C0DA2990] - |A| - [03/07/2019 22:22:09] - (.-.) - [2.63 Ko] - (0.0.0.0) - C:

\Windows\Temp\dd_wcf_CA_smci_20190704_022209_858.txt
[MD5.C53B9B64DB679ACD8883D4B744C295ED] - |A| - [03/07/2019 22:28:35] - (.-.) - [4.57 Ko] - (0.0.0.0) - C:

\Windows\Temp\dd_wcf_CA_smci_20190704_022835_582.txt
[MD5.6A33F4D5BC3DE2556C450C68D3877CA8] - |A| - [03/07/2019 22:28:37] - (.-.) - [2.63 Ko] - (0.0.0.0) - C:

\Windows\Temp\dd_wcf_CA_smci_20190704_022837_009.txt
[MD5.D41D8CD98F00B204E9800998ECF8427E] - |A| - [26/06/2018 13:37:47] - (.-.) - [0 Ko] - (0.0.0.0) - C:

\Windows\Temp\FXSAPIDebugLogFile.txt
[MD5.D41D8CD98F00B204E9800998ECF8427E] - |A| - [26/06/2018 13:37:47] - (.-.) - [0 Ko] - (0.0.0.0) - C:

\Windows\Temp\FXSTIFFDebugLogFile.txt
[MD5.F4AFADC868347D16519E982371C4EF74] - |A| - [10/12/2018 23:15:25] - (.-.) - [3836.99 Ko] - (0.0.0.0) - C:

\Windows\Temp\KB4087364_20181210_221522500-Microsoft .NET Framework 4.7.2-MSP0.txt
[MD5.29B674EB6B07DD5F9DCDDC7B827CA290] - |A| - [10/12/2018 23:15:21] - (.-.) - [76.2 Ko] - (0.0.0.0) - C:

\Windows\Temp\KB4087364_20181210_221522500.html
[MD5.AFECAE9137438CE4419E8149F6890891] - |A| - [15/08/2018 09:57:54] - (.-.) - [9997.8 Ko] - (0.0.0.0) - C:

\Windows\Temp\KB4344146_20180815_095750038-Microsoft .NET Framework 4.7.1-MSP0.txt
[MD5.C7108B51CD6ACD131A425143EBF75548] - |A| - [15/08/2018 09:57:48] - (.-.) - [98.92 Ko] - (0.0.0.0) - C:

\Windows\Temp\KB4344146_20180815_095750038.html
[MD5.233F21D00B3ABA8CE4CA15997460D805] - |A| - [10/12/2018 23:16:02] - (.-.) - [9012.59 Ko] - (0.0.0.0) - C:

\Windows\Temp\KB4457035_20181210_221555184-Microsoft .NET Framework 4.7.2-MSP0.txt
[MD5.3D75FE1311FBF6A1DB65155C51DBE84D] - |A| - [10/12/2018 23:15:53] - (.-.) - [101.6 Ko] - (0.0.0.0) - C:

\Windows\Temp\KB4457035_20181210_221555184.html
[MD5.55F5817CF9046B9447FD3B8B61C054AB] - |A| - [10/12/2018 23:20:21] - (.-.) - [8858.76 Ko] - (0.0.0.0) - C:

\Windows\Temp\KB4459942_20181210_222016771-Microsoft .NET Framework 4.7.2-MSP0.txt
[MD5.4A6EA5A5E4D080A8E29E30E71AC692AB] - |A| - [10/12/2018 23:20:15] - (.-.) - [101.07 Ko] - (0.0.0.0) - C:

\Windows\Temp\KB4459942_20181210_222016771.html
[MD5.875DC6719E07F4914626D7D019C42338] - |A| - [03/07/2019 22:21:09] - (.-.) - [9996.27 Ko] - (0.0.0.0) - C:

\Windows\Temp\KB4495588_20190703_222055263-Microsoft .NET Framework 4.7.2-MSP0.txt
[MD5.DC503177561FC3C3D392BE96CE029B30] - |A| - [03/07/2019 22:20:50] - (.-.) - [100.81 Ko] - (0.0.0.0) - C:

\Windows\Temp\KB4495588_20190703_222055263.html
[MD5.01DE25AB7B3750DBB84BC32661BFBC25] - |A| - [03/07/2019 22:28:17] - (.-.) - [10435.86 Ko] - (0.0.0.0) - C:

\Windows\Temp\KB4502558_20190703_222814635-Microsoft .NET Framework 4.7.2-MSP0.txt
[MD5.CABF8F1F5F9639A31AE1B45701A3599B] - |A| - [03/07/2019 22:28:13] - (.-.) - [99.33 Ko] - (0.0.0.0) - C:

\Windows\Temp\KB4502558_20190703_222814635.html
[MD5.CA7FAEC305931463F4D8E51E5C6E33C7] - |A| - [10/12/2018 23:11:26] - (.-.) - [17473.14 Ko] - (0.0.0.0) - C:

\Windows\Temp\Microsoft .NET Framework 4.7.2 Setup_20181210_221059895-MSI_netfx_Full_x64.msi.txt
[MD5.E2E0696FB31E74FACBC54263CAFC5584] - |A| - [10/12/2018 23:10:49] - (.-.) - [668.69 Ko] - (0.0.0.0) - C:

\Windows\Temp\Microsoft .NET Framework 4.7.2 Setup_20181210_221059895.html
[MD5.6D545BDFB69214468090A5F026A3B615] - |A| - [24/07/2018 03:37:16] - (.-.) - [156.78 Ko] - (0.0.0.0) - C:

\Windows\Temp\MpCmdRun.log
[MD5.00000000000000000000000000000000] - |D| - [22/07/2018 22:20:59] - [0 Ko] - C:\Windows\Temp

\MPInstrumentation
[MD5.280473151997F840803405C9220443D8] - |A| - [18/07/2018 15:54:47] - (.-.) - [89.65 Ko] - (0.0.0.0) - C:

\Windows\Temp\MpSigStub.log
[MD5.00000000000000000000000000000000] - |D| - [18/07/2018 15:54:53] - [0 Ko] - C:\Windows\Temp

\MPTelemetrySubmit
[MD5.00000000000000000000000000000000] - |D| - [14/11/2018 18:47:03] - [3681.12 Ko] - C:\Windows\Temp\PL-

2303_backup
[MD5.004FA62F61DF14EA8623B474E49921AF] - |A| - [14/11/2018 18:47:04] - (.Copyright (C) 2001 - QRemover MFC

Application.) - [144 Ko] - (1.0.0.1) - C:\Windows\Temp\QRemover.exe
[MD5.DBEF78447120E830587017C581F994F1] - |A| - [10/12/2018 23:21:00] - (.-.) - [10.19 Ko] - (0.0.0.0) - C:

\Windows\Temp\RGI564B.tmp
[MD5.4AAE089D3731C3F9DCA27587E61CC4A2] - |A| - [10/12/2018 23:21:00] - (.-.) - [8.79 Ko] - (0.0.0.0) - C:

\Windows\Temp\RGI564B.tmp-tmp
[MD5.DBEF78447120E830587017C581F994F1] - |A| - [10/12/2018 23:16:45] - (.-.) - [10.19 Ko] - (0.0.0.0) - C:

\Windows\Temp\RGI7437.tmp
[MD5.4AAE089D3731C3F9DCA27587E61CC4A2] - |A| - [10/12/2018 23:16:45] - (.-.) - [8.79 Ko] - (0.0.0.0) - C:

\Windows\Temp\RGI7437.tmp-tmp
[MD5.DBEF78447120E830587017C581F994F1] - |A| - [03/07/2019 22:28:46] - (.-.) - [10.19 Ko] - (0.0.0.0) - C:

\Windows\Temp\RGI8D4F.tmp
[MD5.4AAE089D3731C3F9DCA27587E61CC4A2] - |A| - [03/07/2019 22:28:46] - (.-.) - [8.79 Ko] - (0.0.0.0) - C:

\Windows\Temp\RGI8D4F.tmp-tmp
[MD5.DBEF78447120E830587017C581F994F1] - |A| - [10/12/2018 23:13:39] - (.-.) - [10.19 Ko] - (0.0.0.0) - C:

\Windows\Temp\RGI9C8E.tmp
[MD5.4AAE089D3731C3F9DCA27587E61CC4A2] - |A| - [10/12/2018 23:13:39] - (.-.) - [8.79 Ko] - (0.0.0.0) - C:

\Windows\Temp\RGI9C8E.tmp-tmp
[MD5.DBEF78447120E830587017C581F994F1] - |A| - [15/08/2018 09:58:33] - (.-.) - [10.19 Ko] - (0.0.0.0) - C:

\Windows\Temp\RGIC626.tmp
[MD5.4AAE089D3731C3F9DCA27587E61CC4A2] - |A| - [15/08/2018 09:58:33] - (.-.) - [8.79 Ko] - (0.0.0.0) - C:

\Windows\Temp\RGIC626.tmp-tmp
[MD5.DBEF78447120E830587017C581F994F1] - |A| - [03/07/2019 22:22:41] - (.-.) - [10.19 Ko] - (0.0.0.0) - C:

\Windows\Temp\RGIFCD3.tmp
[MD5.4AAE089D3731C3F9DCA27587E61CC4A2] - |A| - [03/07/2019 22:22:41] - (.-.) - [8.79 Ko] - (0.0.0.0) - C:

\Windows\Temp\RGIFCD3.tmp-tmp
[MD5.00000000000000000000000000000000] - |D| - [22/07/2018 22:39:09] - [514.78 Ko] - C:\Windows\Temp

\SupportAssistAgent
[MD5.59071590099D21DD439896592338BF95] - |A| - [22/07/2018 22:19:34] - (.-.) - [512 Ko] - (0.0.0.0) - C:

\Windows\Temp\TMPCA02463A00ECA135
[MD5.59071590099D21DD439896592338BF95] - |A| - [22/07/2018 22:25:39] - (.-.) - [512 Ko] - (0.0.0.0) - C:

\Windows\Temp\TMPDFA6F2776A4DEE34
[MD5.3E628653AFD3EAA739D69BEC0E21E913] - |A| - [04/07/2019 00:50:36] - (.-.) - [128 Ko] - (0.0.0.0) - C:

\Windows\Temp\TS_4D06.tmp
[MD5.55C536FA338683D16C6ADA6AE7501EB2] - |A| - [04/07/2019 00:50:53] - (.-.) - [256 Ko] - (0.0.0.0) - C:

\Windows\Temp\TS_905D.tmp
[MD5.A0F17DD1D8D018D5FA536764A6120350] - |A| - [06/04/2019 14:02:50] - (.-.) - [48.7 Ko] - (0.0.0.0) - C:

\Windows\Temp\USB_AUDIO_SETUP.LOG
[MD5.8BE389E76473CD5F1B5DD15BD4EE411F] - |A| - [19/03/2019 18:13:15] - (.-.) - [12.53 Ko] - (0.0.0.0) - C:

\Windows\Temp\WcInstaller.log
[MD5.00000000000000000000000000000000] - |D| - [07/04/2019 14:54:27] - [346.9 Ko] - C:\Windows\Temp

\wctmp_1920530832
[MD5.00000000000000000000000000000000] - |D| - [19/03/2019 18:13:16] - [346.95 Ko] - C:\Windows\Temp

\wctmp_558918626
[MD5.00000000000000000000000000000000] - |D| - [08/05/2019 08:49:49] - [347.76 Ko] - C:\Windows\Temp

\wctmp_727316983
[MD5.D85AD4E72DBDC9B3338FD0DE945BA3FA] - |A| - [19/03/2019 18:13:19] - (.-.) - [9286.35 Ko] - (0.0.0.0) - C:

\Windows\Temp\WebCompanion.zip
[MD5.00000000000000000000000000000000] - |D| - [24/09/2018 21:27:02] - [0 Ko] - C:\Windows\Temp\__SKIP_598
[MD5.00000000000000000000000000000000] - |D| - [21/11/2010 03:06:51] - [0 Ko] - C:\Windows\System32\0409
[MD5.D41D8CD98F00B204E9800998ECF8427E] - |AH| - [14/07/2009 00:45:49] - (.-.) - [21 Ko] - (0.0.0.0) - C:

\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[MD5.D41D8CD98F00B204E9800998ECF8427E] - |AH| - [14/07/2009 00:45:49] - (.-.) - [21 Ko] - (0.0.0.0) - C:

\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:10] - [4987.5 Ko] - C:\Windows

\System32\AdvancedInstallers
[MD5.00000000000000000000000000000000] - |D| - [26/06/2018 13:22:12] - [2732.89 Ko] - C:\Windows

\System32\appraiser
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:10] - [201.5 Ko] - C:\Windows\System32\ar-SA
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:10] - [173 Ko] - C:\Windows\System32\bg-BG
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:10] - [2584.8 Ko] - C:\Windows\System32\Boot
[MD5.F02F93D5AEC524052E4A37C1BB7CCF31] - |A| - [13/07/2009 21:20:24] - (.Copyright(C)Brother Industries

Ltd.1997-2006 - Brother Multi Function CoInstaller.) - [19 Ko] - (1.0.0.20) - C:\Windows\System32\brcoinst.dll
[MD5.7D00FF6A4315FDF4ACAFBB4EF157EA9F] - |A| - [13/07/2009 20:07:04] - (.Copyright (C) 2008 - Bthpan Context

Handler.) - [91.5 Ko] - (1.0.0.1) - C:\Windows\System32\BthpanContextHandler.dll
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:10] - [99444.95 Ko] - C:\Windows

\System32\catroot
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:10] - [27138.78 Ko] - C:\Windows

\System32\catroot2
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:10] - [10612.11 Ko] - C:\Windows

\System32\CodeIntegrity
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:10] - [357 Ko] - C:\Windows\System32\com
[MD5.00000000000000000000000000000000] - |SD| - [26/06/2018 13:22:12] - [5028.19 Ko] - C:\Windows

\System32\CompatTel
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:10] - [271083.36 Ko] - C:\Windows

\System32\config
[MD5.55A9CC0ABBBDA692CD6F3AFDD3847524] - |N| - [06/04/2019 14:02:59] - (.Copyright (C) Ploytec GmbH 2000-2011

- AKAI USB Audio control panel.) - [257.23 Ko] - (2.9.30.0) - C:\Windows\System32\CPLAKAIEIEPRO.CPL
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:10] - [432 Ko] - C:\Windows\System32\cs-CZ
[MD5.59075B2A63DF6A568123218BF4DC2696] - |A| - [02/06/2016 13:15:54] - (.-.) - [0.87 Ko] - (0.0.0.0) - C:

\Windows\System32\CustomModeApp.exe.config
[MD5.899E708E589C09700BFF1C73CB7D7002] - |A| - [02/06/2016 13:15:54] - (.-.) - [0.87 Ko] - (0.0.0.0) - C:

\Windows\System32\CustomModeAppv2_0.exe.config
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:10] - [427.5 Ko] - C:\Windows\System32\da-DK
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:10] - [457.5 Ko] - C:\Windows\System32\de-DE
[MD5.079B8AEB4A55BF8493BD1EC70285D920] - |ASH| - [14/07/2009 00:57:09] - (.-.) - [0.07 Ko] - (0.0.0.0) - C:

\Windows\System32\desktop.ini
[MD5.0E2B7D35E3DDD21AF04FB4D98C2BCF7F] - |A| - [02/06/2016 13:15:54] - (.-.) - [308.83 Ko] - (0.0.0.0) - C:

\Windows\System32\DisplayAudiox64.cab
[MD5.59075B2A63DF6A568123218BF4DC2696] - |A| - [02/06/2016 13:15:54] - (.-.) - [0.87 Ko] - (0.0.0.0) - C:

\Windows\System32\DPTopologyApp.exe.config
[MD5.899E708E589C09700BFF1C73CB7D7002] - |A| - [02/06/2016 13:15:54] - (.-.) - [0.87 Ko] - (0.0.0.0) - C:

\Windows\System32\DPTopologyAppv2_0.exe.config
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:10] - [63125.15 Ko] - C:\Windows

\System32\drivers
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [1267107.62 Ko] - C:\Windows

\System32\DriverStore
[MD5.884BE1FCF1D321D560063BB78E84FEE0] - |A| - [06/01/2012 22:02:08] - (.-.) - [3.04 Ko] - (0.0.0.0) - C:

\Windows\System32\e1c62x64.din
[MD5.DFFDB573AEB313E6F70CDF4590BCC215] - |A| - [18/07/2018 16:20:47] - (.-.) - [329.95 Ko] - (0.0.0.0) - C:

\Windows\System32\FNTCACHE.DAT
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [454 Ko] - C:\Windows\System32\fr-FR
[MD5.00000000000000000000000000000000] - |D| - [14/07/2009 01:32:38] - [0 Ko] - C:\Windows\System32\FxsTmp
[MD5.2AE808CB0D9A667B0CF41EA74B3B9BAC] - |A| - [10/06/2009 16:36:24] - (.-.) - [39.6 Ko] - (0.0.0.0) - C:

\Windows\System32\gatherNetworkInfo.vbs
[MD5.899E708E589C09700BFF1C73CB7D7002] - |A| - [02/06/2016 13:15:54] - (.-.) - [0.87 Ko] - (0.0.0.0) - C:

\Windows\System32\Gfxv2_0.exe.config
[MD5.59075B2A63DF6A568123218BF4DC2696] - |A| - [02/06/2016 13:15:54] - (.-.) - [0.87 Ko] - (0.0.0.0) - C:

\Windows\System32\Gfxv4_0.exe.config
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [0 Ko] - C:\Windows

\System32\GroupPolicy
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [0 Ko] - C:\Windows

\System32\GroupPolicyUsers
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [191.5 Ko] - C:\Windows\System32\he-IL
[MD5.17646020C8DACD0F51E76846CFDAEB3A] - |A| - [13/07/2009 21:20:27] - (.-.) - [18.46 Ko] - (0.0.0.0) - C:

\Windows\System32\HPEACLHN.HPI
[MD5.93243A03EA8FB94AB6F3D5E4A3CBD69C] - |A| - [02/06/2016 13:34:16] - (.-.) - [100.5 Ko] - (0.0.0.0) - C:

\Windows\System32\IccLibDll_x64.dll
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [36.27 Ko] - C:\Windows\System32\icsxml
[MD5.0B0A9C46F9A8450857383D4CB798ED28] - |A| - [26/06/2018 13:41:42] - (.Copyright © 2004 - 2009 IDT, Inc. -

IDT PC Audio.) - [1853.5 Ko] - (1.0.6491.0) - C:\Windows\System32\IDTNC64.cpl
[MD5.C6BC3358BFC6ECAA2E830F05B64EDC42] - |A| - [02/06/2016 13:38:58] - (.-.) - [167 Ko] - (0.0.0.0) - C:

\Windows\System32\igdail64.dll
[MD5.BFBFC29FF7D0149EB354C46B7ADB06D7] - |A| - [02/06/2016 13:39:04] - (.-.) - [224.5 Ko] - (0.0.0.0) - C:

\Windows\System32\igdde64.dll
[MD5.F5EC784EBD55DFF46764A0134C3CBCB4] - |A| - [02/06/2016 13:40:26] - (.Copyright (C) 2012-2013 - MDF(CM)

Runtime DX11 Dynamic Link Library.) - [188.99 Ko] - (3.0.0.1284) - C:\Windows\System32\igfx11cmrt64.dll
[MD5.DADEA3888F8175EA4B7E8EF24DA73DFF] - |A| - [02/06/2016 13:40:36] - (.Copyright (C) 2010 - 2013 - MDF(CM)

JIT Dynamic Link Library.) - [1987.99 Ko] - (3.0.0.1284) - C:\Windows\System32\igfxcmjit64.dll
[MD5.521E38CB6C096E91E46D9436DD85AA0C] - |A| - [02/06/2016 13:48:06] - (.Copyright (C) 2010 - 2013 - MDF(CM)

Runtime Dynamic Link Library.) - [194.43 Ko] - (3.0.0.1284) - C:\Windows\System32\igfxcmrt64.dll
[MD5.B554A0591241BD7310C692D540FE9720] - |A| - [02/06/2016 13:40:38] - (.-.) - [258 Ko] - (0.0.0.0) - C:

\Windows\System32\igfxCPL.cpl
[MD5.533E9CC9949165FE3E36491665B54864] - |A| - [02/06/2016 13:40:40] - (.-.) - [92.99 Ko] - (0.0.0.0) - C:

\Windows\System32\igfxCUIServicePS.dll
[MD5.857B333695676433E5AB27365BAE2F8F] - |A| - [02/06/2016 13:40:44] - (.-.) - [67 Ko] - (1.0.0.0) - C:

\Windows\System32\igfxDHLib.dll
[MD5.857912645067D137D31A429657A02074] - |A| - [02/06/2016 13:40:46] - (.-.) - [76.5 Ko] - (1.0.0.0) - C:

\Windows\System32\igfxDHLibv2_0.dll
[MD5.0D8E7EDF1BAE5345236BDE69B5938179] - |A| - [02/06/2016 13:40:48] - (.-.) - [18.99 Ko] - (1.0.0.0) - C:

\Windows\System32\igfxDILib.dll
[MD5.FCA27E38DB40D86E0AB16100647292C2] - |A| - [02/06/2016 13:40:50] - (.-.) - [19 Ko] - (1.0.0.0) - C:

\Windows\System32\igfxDILibv2_0.dll
[MD5.9742A8FB45D39C1AE6530AEB2FFF31ED] - |A| - [02/06/2016 13:40:54] - (.-.) - [18.5 Ko] - (1.0.0.0) - C:

\Windows\System32\igfxEMLib.dll
[MD5.075F721C433FCDB7EAC66009A265C7D8] - |A| - [02/06/2016 13:40:54] - (.-.) - [18.49 Ko] - (1.0.0.0) - C:

\Windows\System32\igfxEMLibv2_0.dll
[MD5.865BB0C723B21D62A16BE6EDD831A17C] - |A| - [02/06/2016 13:41:02] - (.-.) - [13.5 Ko] - (1.0.0.0) - C:

\Windows\System32\igfxLHMLib.dll
[MD5.11BC4B4011AA5FE01FA22A360B875184] - |A| - [02/06/2016 13:41:02] - (.-.) - [13.49 Ko] - (1.0.0.0) - C:

\Windows\System32\igfxLHMLibv2_0.dll
[MD5.6C0F36ABFE80433B352FA7748ED887BF] - |A| - [02/06/2016 13:16:10] - (.-.) - [2748 Ko] - (0.0.0.0) - C:

\Windows\System32\iglhxa64.cpa
[MD5.2FCCF7939D4D3F392AB3C0F5F40039DD] - |A| - [02/06/2016 13:16:10] - (.-.) - [1.1 Ko] - (0.0.0.0) - C:

\Windows\System32\iglhxa64.vp
[MD5.B226B85123619EF1394339C1B5EB5A8D] - |A| - [02/06/2016 13:16:10] - (.-.) - [42.47 Ko] - (0.0.0.0) - C:

\Windows\System32\iglhxc64.vp
[MD5.55C71EDC47B57E5115B40095EEC9E205] - |A| - [02/06/2016 13:16:10] - (.-.) - [42.79 Ko] - (0.0.0.0) - C:

\Windows\System32\iglhxc64_dev.vp
[MD5.94ED4F871997E5DFC610DC1649C38911] - |A| - [02/06/2016 13:16:10] - (.-.) - [42.24 Ko] - (0.0.0.0) - C:

\Windows\System32\iglhxg64.vp
[MD5.04590E9E52E13EF34B2AA02C7EA2431B] - |A| - [02/06/2016 13:16:10] - (.-.) - [42.28 Ko] - (0.0.0.0) - C:

\Windows\System32\iglhxg64_dev.vp
[MD5.3B6EF4F03F2DE75A3B7DDF627A3EC146] - |A| - [02/06/2016 13:16:10] - (.-.) - [42.99 Ko] - (0.0.0.0) - C:

\Windows\System32\iglhxo64.vp
[MD5.715DBDBED4599E798F94EDF6003F75B6] - |A| - [02/06/2016 13:16:10] - (.-.) - [41.09 Ko] - (0.0.0.0) - C:

\Windows\System32\iglhxo64_dev.vp
[MD5.1C70F59C563D05DE6CAFFA7C280987F5] - |A| - [02/06/2016 13:16:10] - (.-.) - [2.52 Ko] - (0.0.0.0) - C:

\Windows\System32\iglhxs64.vp
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [36875.94 Ko] - C:\Windows\System32\IME
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [0 Ko] - C:\Windows\System32\inetsrv
[MD5.AAA0C03BF54FC8A4E895B576861A9848] - |A| - [20/11/2010 23:07:41] - (.-.) - [29.12 Ko] - (0.0.0.0) - C:

\Windows\System32\InstallPackage_ETW.Log
[MD5.4D38B30EF71C8F2CDAAD31166BA66756] - |A| - [02/06/2016 13:41:14] - (.Copyright © The Khronos Group Inc

2011 - OpenCL Client DLL.) - [71 Ko] - (1.2.11.0) - C:\Windows\System32\Intel_OpenCL_ICD64.dll
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [452 Ko] - C:\Windows\System32\it-IT
[MD5.C1B7AB03AC2F3C990A40BC2E18E02CF1] - |A| - [13/07/2009 22:35:50] - (.-.) - [11687.04 Ko] - (0.0.0.0) - C:

\Windows\System32\korwbrkr.lex
[MD5.E89C001FB4D9E08CC7072CE774CDB999] - |A| - [20/11/2010 22:52:07] - (.-.) - [0.01 Ko] - (0.0.0.0) - C:

\Windows\System32\LocalGroupAdminAdd.log
[MD5.563C3703A9B57CC9B370A76D6173D09C] - |A| - [20/11/2010 22:52:08] - (.-.) - [0.05 Ko] - (0.0.0.0) - C:

\Windows\System32\Local_LLU.log
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [2536.51 Ko] - C:\Windows

\System32\LogFiles
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [165 Ko] - C:\Windows\System32\lt-LT
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [166 Ko] - C:\Windows\System32\lv-LV
[MD5.00000000000000000000000000000000] - |D| - [26/06/2018 14:06:44] - [57417.1 Ko] - C:\Windows

\System32\Macromed
[MD5.7A495CA1402C2F9F5D035092AD808669] - |A| - [13/07/2009 16:17:48] - (.-.) - [0.85 Ko] - (0.0.0.0) - C:

\Windows\System32\manage-bde.wsf
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [1981.88 Ko] - C:\Windows

\System32\manifeststore
[MD5.39E801545FFF6230C80140E0F8A06629] - |A| - [14/07/2009 00:57:09] - (.-.) - [1.21 Ko] - (0.0.0.0) - C:

\Windows\System32\migwiz.lnk
[MD5.00000000000000000000000000000000] - |D| - [26/06/2018 11:19:54] - [0 Ko] - C:\Windows\System32\MRT
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [4148.28 Ko] - C:\Windows

\System32\Msdtc
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [11.33 Ko] - C:\Windows\System32\MUI
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [422.5 Ko] - C:\Windows\System32\nb-NO
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [384 Ko] - C:\Windows\System32\NDF
[MD5.CD48AD912839B9FB6CCA5D4AA9B37500] - |A| - [13/07/2009 18:01:19] - (.-.) - [21.3 Ko] - (0.0.0.0) - C:

\Windows\System32\NetTrace.PLA.Diagnostics.xml
[MD5.8E24A7BCAEF2045DA1FF29217622843E] - |A| - [20/11/2010 22:52:07] - (.-.) - [0.04 Ko] - (0.0.0.0) - C:

\Windows\System32\Network_LLU.log
[MD5.1C96B3DA6ABE5E18B63C64DF75884F6A] - |A| - [13/07/2009 22:35:51] - (.-.) - [1.45 Ko] - (0.0.0.0) - C:

\Windows\System32\noise.kor
[MD5.4BAEC8EF638F43F289868C8DBB48B893] - |A| - [07/04/2016 15:07:44] - (.Copyright (c) NovaTek 2009 - 2013 -

NovaTek Msdc Ext - Avision.) - [66.5 Ko] - (12.1.13.23) - C:\Windows\System32\NvUSBScan.dll
[MD5.00000000000000000000000000000000] - |D| - [26/06/2018 13:17:53] - [114.78 Ko] - C:\Windows\System32\OEM
[MD5.2901049544FDF863362FABA2363EB647] - |A| - [13/07/2009 16:24:21] - (.-.) - [0.82 Ko] - (0.0.0.0) - C:

\Windows\System32\onlinesetup.cmd
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [14429.42 Ko] - C:\Windows

\System32\oobe
[MD5.C906B7C38274609652827718DA41D2C3] - |A| - [13/07/2009 22:36:59] - (.-.) - [119.28 Ko] - (0.0.0.0) - C:

\Windows\System32\perfc009.dat
[MD5.B7795BC96C1CEB86E04E8DC843E9C784] - |A| - [10/06/2009 16:33:35] - (.-.) - [113.56 Ko] - (0.0.0.0) - C:

\Windows\System32\PerfCenterCpl.ico
[MD5.7AAA3E23CE4C7845B112F7A79B110E60] - |A| - [13/07/2009 22:36:59] - (.-.) - [30.81 Ko] - (0.0.0.0) - C:

\Windows\System32\perfd009.dat
[MD5.83CB269D4BEDBC99E35408C54FEDB50A] - |A| - [13/07/2009 22:36:59] - (.-.) - [646.79 Ko] - (0.0.0.0) - C:

\Windows\System32\perfh009.dat
[MD5.F1AC5B24012847B39B328104FA2886A5] - |A| - [14/07/2009 01:13:15] - (.-.) - [763.47 Ko] - (0.0.0.0) - C:

\Windows\System32\PerfStringBackup.INI
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [439 Ko] - C:\Windows\System32\pl-PL
[MD5.1DD626FE4DE2D4B710DD1360F404A54F] - |A| - [26/06/2018 09:56:00] - (.Copyright (C) 2001 - PrintBrm

Application.) - [70 Ko] - (1.0.0.0) - C:\Windows\System32\PrintBrmUi.exe
[MD5.00000000000000000000000000000000] - |D| - [21/11/2010 03:06:50] - [413.88 Ko] - C:\Windows

\System32\Printing_Admin_Scripts
[MD5.F5A689BA3FDB5F8A6F13622B5AC02FD8] - |A| - [29/10/2018 20:46:24] - (.-.) - [2842 Ko] - (4.7.0.0) - C:

\Windows\System32\QtCoreViz4.dll
[MD5.15A0D55B076B0A0CB201B9B286277CA4] - |A| - [29/10/2018 20:46:24] - (.-.) - [10360 Ko] - (4.7.0.0) - C:

\Windows\System32\QtGuiViz4.dll
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [23.75 Ko] - C:\Windows\System32\ras
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [0.78 Ko] - C:\Windows

\System32\Recovery
[MD5.7C47E200D9D049C49156A7D416586C4F] - |A| - [02/06/2016 13:16:24] - (.-.) - [161.58 Ko] - (0.0.0.0) - C:

\Windows\System32\resARA.cui
[MD5.BB02E0907790B462282C099197F01A07] - |A| - [02/06/2016 13:16:26] - (.-.) - [146.02 Ko] - (0.0.0.0) - C:

\Windows\System32\resCHS.cui
[MD5.2F6B4B08827D5B994B097C0D8A9F15C3] - |A| - [02/06/2016 13:16:26] - (.-.) - [146.88 Ko] - (0.0.0.0) - C:

\Windows\System32\resCHT.cui
[MD5.971B2384427DD0133F9FD7B923F395DF] - |A| - [02/06/2016 13:16:26] - (.-.) - [152.96 Ko] - (0.0.0.0) - C:

\Windows\System32\resCSY.cui
[MD5.D48CD2D59E5C72C187883320AFB5FE93] - |A| - [02/06/2016 13:16:26] - (.-.) - [149.91 Ko] - (0.0.0.0) - C:

\Windows\System32\resDAN.cui
[MD5.82566CB31CEA7567BF8B45D832668439] - |A| - [02/06/2016 13:16:26] - (.-.) - [154.68 Ko] - (0.0.0.0) - C:

\Windows\System32\resDEU.cui
[MD5.211F5776CF333B89D0BD361F92CB38C3] - |A| - [02/06/2016 13:16:26] - (.-.) - [179.72 Ko] - (0.0.0.0) - C:

\Windows\System32\resELL.cui
[MD5.7CDD3D6A64BC621EB92E97ADBD7C0711] - |A| - [02/06/2016 13:16:26] - (.-.) - [148.6 Ko] - (0.0.0.0) - C:

\Windows\System32\resENU.cui
[MD5.3C63073FF29B04706024E5678CF43CF8] - |A| - [02/06/2016 13:16:26] - (.-.) - [154.35 Ko] - (0.0.0.0) - C:

\Windows\System32\resESN.cui
[MD5.E34147497C3346D48000124EC377A868] - |A| - [02/06/2016 13:16:26] - (.-.) - [152.32 Ko] - (0.0.0.0) - C:

\Windows\System32\resFIN.cui
[MD5.6E29BB7D3A84B8ED2C398483CF037308] - |A| - [02/06/2016 13:16:26] - (.-.) - [156.44 Ko] - (0.0.0.0) - C:

\Windows\System32\resFRA.cui
[MD5.342DC30F883BEA56448B60A2E1F0D432] - |A| - [02/06/2016 13:16:26] - (.-.) - [161.02 Ko] - (0.0.0.0) - C:

\Windows\System32\resHEB.cui
[MD5.3E4404DF28CE437D634BF3EDFC9A10BE] - |A| - [02/06/2016 13:16:26] - (.-.) - [151.89 Ko] - (0.0.0.0) - C:

\Windows\System32\resHRV.cui
[MD5.C4E050B32A65B326819AD20331AAB818] - |A| - [02/06/2016 13:16:26] - (.-.) - [156.5 Ko] - (0.0.0.0) - C:

\Windows\System32\resHUN.cui
[MD5.2E9301D9FAFB38E6014BB850E3CC4FD6] - |A| - [02/06/2016 13:16:26] - (.-.) - [154.64 Ko] - (0.0.0.0) - C:

\Windows\System32\resITA.cui
[MD5.75CF363FB4F974F7D037F1D1BD883E75] - |A| - [02/06/2016 13:16:26] - (.-.) - [161.08 Ko] - (0.0.0.0) - C:

\Windows\System32\resJPN.cui
[MD5.5168626800CC0FAA332BF1A9E7942D05] - |A| - [02/06/2016 13:16:26] - (.-.) - [154.82 Ko] - (0.0.0.0) - C:

\Windows\System32\resKOR.cui
[MD5.CA5A38DCA65C8540183DB5989B45971B] - |A| - [02/06/2016 13:16:26] - (.-.) - [153.64 Ko] - (0.0.0.0) - C:

\Windows\System32\resNLD.cui
[MD5.E3ECBE665A85EDA30A7F3FEA0427FA3E] - |A| - [02/06/2016 13:16:26] - (.-.) - [150.39 Ko] - (0.0.0.0) - C:

\Windows\System32\resNOR.cui
[MD5.A179BBDE67244C7413CC9DD94350575B] - |A| - [02/06/2016 13:16:26] - (.-.) - [153.96 Ko] - (0.0.0.0) - C:

\Windows\System32\resPLK.cui
[MD5.5CCF59C6E0B3FB08FE2058533D448FDD] - |A| - [02/06/2016 13:16:26] - (.-.) - [153.04 Ko] - (0.0.0.0) - C:

\Windows\System32\resPTB.cui
[MD5.82C21F51E2E9912158831CDFB0A206B6] - |A| - [02/06/2016 13:16:26] - (.-.) - [152.75 Ko] - (0.0.0.0) - C:

\Windows\System32\resPTG.cui
[MD5.BEC45D17F77784FDE5FEE50B626F1BDC] - |A| - [02/06/2016 13:16:26] - (.-.) - [154.44 Ko] - (0.0.0.0) - C:

\Windows\System32\resROM.cui
[MD5.EB9FF588AAF2E64CB52F6B6C3BD6BF1A] - |A| - [02/06/2016 13:16:26] - (.-.) - [175.61 Ko] - (0.0.0.0) - C:

\Windows\System32\resRUS.cui
[MD5.CD28EBD732ECF7A0FAD7E7F334F04938] - |A| - [02/06/2016 13:16:26] - (.-.) - [153.8 Ko] - (0.0.0.0) - C:

\Windows\System32\resSKY.cui
[MD5.6C1F10F831655D5AFA97FE16FB917067] - |A| - [02/06/2016 13:16:26] - (.-.) - [151.33 Ko] - (0.0.0.0) - C:

\Windows\System32\resSLV.cui
[MD5.5782CEFEAEF7CA26BAE4CAA27E020F3C] - |A| - [02/06/2016 13:16:26] - (.-.) - [151.49 Ko] - (0.0.0.0) - C:

\Windows\System32\resSVE.cui
[MD5.267A52FC1DC0DB12959A1F1E293A8E68] - |A| - [02/06/2016 13:16:26] - (.-.) - [186.99 Ko] - (0.0.0.0) - C:

\Windows\System32\resTHA.cui
[MD5.00000000000000000000000000000000] - |D| - [14/07/2009 01:32:38] - [0.07 Ko] - C:\Windows\System32\restore
[MD5.CD1ACAC2BEEFEB1684C975496AC7EDA8] - |A| - [02/06/2016 13:16:26] - (.-.) - [152.93 Ko] - (0.0.0.0) - C:

\Windows\System32\resTRK.cui
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [169 Ko] - C:\Windows\System32\ro-RO
[MD5.61AE1F36E653B0CC54EFFED0B0977407] - |A| - [07/04/2016 15:07:44] - (.Copyright (c) 2015, Visioneer Inc. -

Visioneer RoadWarrior 3 LLD.) - [393 Ko] - (0.9.115.331) - C:\Windows\System32\RWAR3.dll
[MD5.942E76C23637C9971EFC250017D52EB9] - |A| - [11/04/2016 19:09:42] - (.Copyright © 2016, Visioneer Inc. -

TNG CoInstaller.) - [417 Ko] - (5.1.16.4119) - C:\Windows\System32\RWAR3CI.dll
[MD5.5430507217D8AD114349064CC2ED616D] - |A| - [20/07/2015 15:14:14] - (.Copyright © 2015, Visioneer Inc. -

Visioneer WIA Driver.) - [537.5 Ko] - (5.1.15.7205) - C:\Windows\System32\RWAR3WIAT.DLL
[MD5.A8D2065C893DC8B656D3C3FA8180F2AA] - |A| - [20/07/2015 11:08:48] - (.Copyright © 2015, Visioneer Inc. -

Visioneer WIA UI Extension.) - [528.5 Ko] - (5.1.15.7202) - C:\Windows\System32\RWAR3WUI.DLL
[MD5.5C18CD22BE4628865FCB63337A6E5EF6] - |A| - [20/11/2010 23:24:25] - (.-.) - [10.18 Ko] - (0.0.0.0) - C:

\Windows\System32\ScavengeSpace.xml
[MD5.8C3D0C73A0850A0EE62DF9EC36DBDE80] - |N| - [26/06/2018 13:46:08] - (.-.) - [1.86 Ko] - (0.0.0.0) - C:

\Windows\System32\SetupBD.din
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [169.5 Ko] - C:\Windows\System32\sk-SK
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [166 Ko] - C:\Windows\System32\sl-SI
[MD5.00000000000000000000000000000000] - |D| - [21/11/2010 03:06:51] - [37.8 Ko] - C:\Windows\System32\slmgr
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [19650.02 Ko] - C:\Windows\System32\SMI
[MD5.C74D61FCA22F36791105D7878AF73572] - |A| - [10/06/2009 17:08:17] - (.-.) - [8.09 Ko] - (0.0.0.0) - C:

\Windows\System32\spcinstrumentation.man
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [26875.5 Ko] - C:\Windows

\System32\Speech
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [69368.74 Ko] - C:\Windows

\System32\spool
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [2133.41 Ko] - C:\Windows\System32\spp
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [30.19 Ko] - C:\Windows\System32\sppui
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [170 Ko] - C:\Windows\System32\sr-

Latn-CS
[MD5.631F98A02426216B8E0DAA0CF012BEF4] - |A| - [26/06/2018 13:41:19] - (.Copyright © 2004 - 2009 IDT, Inc. -

IDT PC Audio.) - [250 Ko] - (1.0.6491.0) - C:\Windows\System32\st646491.dll
[MD5.02FF0CDD04B9E54BB989EDE66B5C2D6B] - |N| - [26/06/2018 13:41:19] - (.Copyright © 2004 - 2009 IDT, Inc. -

IDT PC Audio.) - [681.5 Ko] - (1.0.6491.0) - C:\Windows\System32\stapi64.dll
[MD5.CA416663232F14D4EFB6A8E2640DD7D4] - |A| - [26/06/2018 13:41:19] - (.Copyright © 2004 - 2009 IDT, Inc. -

IDT PC Audio.) - [2161.5 Ko] - (1.0.6491.0) - C:\Windows\System32\stapo64.dll
[MD5.5FD8F1D4A6B8A9D39BEA42C3FE298C4D] - |A| - [26/06/2018 13:41:19] - (.Copyright © 2004 - 2009 IDT, Inc. -

IDT PC Audio.) - [487.5 Ko] - (1.0.6491.0) - C:\Windows\System32\stcplx64.dll
[MD5.A1C3D414D61A9269CD37098D6E969236] - |A| - [26/06/2018 13:41:42] - (.Copyright © 2004 - 2009 IDT, Inc. -

IDT PC Audio.) - [5958.5 Ko] - (1.0.6491.0) - C:\Windows\System32\stlang64.dll
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [426.5 Ko] - C:\Windows\System32\sv-SE
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [133 Ko] - C:\Windows\System32\sysprep
[MD5.5EC92F0EAE3CA59F647C3CA5AA7CB053] - |A| - [20/11/2010 23:24:36] - (.-.) - [339.75 Ko] - (0.0.0.0) - C:

\Windows\System32\systemsf.ebd
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [276.48 Ko] - C:\Windows\System32\Tasks
[MD5.47F22CAD4A16BB40153555D631546B94] - |A| - [10/06/2009 17:01:25] - (.-.) - [58.71 Ko] - (0.0.0.0) - C:

\Windows\System32\tcpmon.ini
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [157 Ko] - C:\Windows\System32\th-TH
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [424 Ko] - C:\Windows\System32\tr-TR
[MD5.DCD85D844C1583C61D3AFABD983AA0B5] - |A| - [29/10/2018 20:46:24] - (.(C) 1993-2013 TWAIN Working Group. -

TWAIN 32 Source Manager (Image Acquisition Interface).) - [164.2 Ko] - (2.3.0.0) - C:\Windows

\System32\TWAINDSM.dll
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [166.5 Ko] - C:\Windows\System32\uk-UA
[MD5.05F9840831C29F5BE93AD8BE810D5614] - |A| - [14/07/2009 00:45:37] - (.-.) - [18 Ko] - (0.0.0.0) - C:

\Windows\System32\umstartup.etl
[MD5.F736AA948D0C3CBCE212B7B2CB0EF115] - |A| - [14/07/2009 00:45:37] - (.-.) - [45 Ko] - (0.0.0.0) - C:

\Windows\System32\umstartup000.etl
[MD5.A6E1379EBE20E0BFA119DAA11D764008] - |A| - [26/06/2018 13:44:55] - (.Copyright (C) 1999-2013 Alps Electric

Co., Ltd. - Vxdif.) - [113.34 Ko] - (8.0.0.40) - C:\Windows\System32\Vxdif.dll
[MD5.00000000000000000000000000000000] - |D| - [26/06/2018 11:53:32] - [1754.83 Ko] - C:\Windows\System32\Wat
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [47697.36 Ko] - C:\Windows

\System32\wbem
[MD5.00000000000000000000000000000000] - |D| - [21/11/2010 03:06:50] - [60.46 Ko] - C:\Windows\System32\WCN
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [102675.76 Ko] - C:\Windows

\System32\wdi
[MD5.6EDD021A8B6457DDE09DE7B7FA4E8C8B] - |A| - [13/07/2009 17:54:15] - (.-.) - [0.6 Ko] - (0.0.0.0) - C:

\Windows\System32\WdsUnattendTemplate.xml
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [96 Ko] - C:\Windows\System32\wfp
[MD5.00000000000000000000000000000000] - |D| - [14/07/2009 01:32:38] - [0 Ko] - C:\Windows

\System32\WinBioDatabase
[MD5.00000000000000000000000000000000] - |D| - [14/07/2009 01:32:38] - [73.5 Ko] - C:\Windows

\System32\WinBioPlugIns
[MD5.00000000000000000000000000000000] - |D| - [14/07/2009 01:32:38] - [8665.44 Ko] - C:\Windows

\System32\WindowsPowerShell
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [80992 Ko] - C:\Windows\System32\winevt
[MD5.00000000000000000000000000000000] - |D| - [21/11/2010 03:06:51] - [99.06 Ko] - C:\Windows\System32\winrm
[MD5.00000000000000000000000000000000] - |HD| - [26/06/2018 13:44:40] - [1.63 Ko] - C:\Windows

\System32\WLANProfiles
[MD5.CB136B267569A62EF63D798BC90ABD5A] - |A| - [26/06/2018 12:39:55] - (.-.) - [0.14 Ko] - (0.0.0.0) - C:

\Windows\System32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
[MD5.9F45771914360A925252A1B7226EC7EC] - |A| - [26/06/2018 10:21:33] - (.-.) - [0.44 Ko] - (0.0.0.0) - C:

\Windows\System32\{F33C3B9B-72AF-418A-B3FD-560646F7CDA2}.bat
[MD5.00000000000000000000000000000000] - |D| - [21/11/2010 03:06:51] - [0 Ko] - C:\Windows\SysWOW64\0409
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [2258.5 Ko] - C:\Windows

\SysWOW64\AdvancedInstallers
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [201.5 Ko] - C:\Windows\SysWOW64\ar-SA
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [173 Ko] - C:\Windows\SysWOW64\bg-BG
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [0 Ko] - C:\Windows\SysWOW64\catroot
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [0 Ko] - C:\Windows\SysWOW64\catroot2
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [302.5 Ko] - C:\Windows\SysWOW64\com
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [157.02 Ko] - C:\Windows

\SysWOW64\config
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [427.5 Ko] - C:\Windows\SysWOW64\cs-CZ
[MD5.F2A1B71072E64F3CBF1045CDA048C945] - |A| - [26/06/2018 13:46:23] - (.Copyright 2011 - CSVer.) - [52 Ko] -

(9.3.0.1019) - C:\Windows\SysWOW64\CSVer.dll
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [422.5 Ko] - C:\Windows\SysWOW64\da-DK
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [452 Ko] - C:\Windows\SysWOW64\de-DE
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [4141.5 Ko] - C:\Windows\SysWOW64\Dism
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [3481.93 Ko] - C:\Windows

\SysWOW64\drivers
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [1.05 Ko] - C:\Windows

\SysWOW64\DriverStore
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [451.5 Ko] - C:\Windows\SysWOW64\el-GR
[MD5.00000000000000000000000000000000] - |D| - [21/11/2010 03:06:51] - [1648 Ko] - C:\Windows\SysWOW64\en
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [32600.57 Ko] - C:\Windows

\SysWOW64\en-US
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [443 Ko] - C:\Windows\SysWOW64\es-ES
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [160.5 Ko] - C:\Windows\SysWOW64\et-EE
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [425 Ko] - C:\Windows\SysWOW64\fi-FI
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [449 Ko] - C:\Windows\SysWOW64\fr-FR
[MD5.00000000000000000000000000000000] - |D| - [14/07/2009 01:32:38] - [0 Ko] - C:\Windows\SysWOW64\FxsTmp
[MD5.A8A9E272B84E2E0A90247B65BC877BD4] - |A| - [28/06/2002 09:08:00] - (.Copyright © 2000-2002 GEAR Software

Inc. - GEARAspi.) - [60 Ko] - (1.0.6.0) - C:\Windows\SysWOW64\GEARAspi.dll
[MD5.17B77D83C53AE007C11ED811D992E727] - |A| - [02/09/2002 10:51:00] - (.Copyright © 2001 GEAR Software -

gearsec.) - [48 Ko] - (1.0.0.3) - C:\Windows\SysWOW64\gearsec.exe
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [0 Ko] - C:\Windows

\SysWOW64\GroupPolicy
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [0 Ko] - C:\Windows

\SysWOW64\GroupPolicyUsers
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [191.5 Ko] - C:\Windows\SysWOW64\he-IL
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [168 Ko] - C:\Windows\SysWOW64\hr-HR
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [429 Ko] - C:\Windows\SysWOW64\hu-HU
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [36.27 Ko] - C:\Windows\SysWOW64\icsxml
[MD5.D384FAC33A6A3E4EDACFE7C1C81105BD] - |A| - [02/06/2016 13:34:14] - (.-.) - [149 Ko] - (0.0.0.0) - C:

\Windows\SysWOW64\igdail32.dll
[MD5.6A2EB90AF06BB1DB56F11FCEC8D5A137] - |A| - [02/06/2016 13:41:12] - (.Copyright © The Khronos Group Inc

2011 - OpenCL Client DLL.) - [67.5 Ko] - (1.2.11.0) - C:\Windows\SysWOW64\Intel_OpenCL_ICD32.dll
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [447 Ko] - C:\Windows\SysWOW64\it-IT
[MD5.FA2E1F09ED6C4C221E4513A7E815E13D] - |A| - [27/08/2013 14:00:08] - (.-.) - [1.5 Ko] - (0.0.0.0) - C:

\Windows\SysWOW64\IusEventLog.dll
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [361 Ko] - C:\Windows\SysWOW64\ja-JP
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [356.5 Ko] - C:\Windows\SysWOW64\ko-KR
[MD5.C1B7AB03AC2F3C990A40BC2E18E02CF1] - |A| - [13/07/2009 22:35:50] - (.-.) - [11687.04 Ko] - (0.0.0.0) - C:

\Windows\SysWOW64\korwbrkr.lex
[MD5.00000000000000000000000000000000] - |D| - [14/07/2009 01:32:38] - [0 Ko] - C:\Windows\SysWOW64\LogFiles
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [165 Ko] - C:\Windows\SysWOW64\lt-LT
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [166 Ko] - C:\Windows\SysWOW64\lv-LV
[MD5.00000000000000000000000000000000] - |D| - [26/06/2018 14:06:12] - [47832.1 Ko] - C:\Windows

\SysWOW64\Macromed
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [1968.26 Ko] - C:\Windows

\SysWOW64\manifeststore
[MD5.98071B6EE16AA76DABFF377A5DC69C86] - |A| - [14/07/2009 00:55:01] - (.-.) - [0.52 Ko] - (0.0.0.0) - C:

\Windows\SysWOW64\mapisvc.inf
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [3178.93 Ko] - C:\Windows

\SysWOW64\migration
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [32737.45 Ko] - C:\Windows

\SysWOW64\migwiz
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [52.28 Ko] - C:\Windows\SysWOW64\Msdtc
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [11.33 Ko] - C:\Windows\SysWOW64\MUI
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [418 Ko] - C:\Windows\SysWOW64\nb-NO
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [0 Ko] - C:\Windows\SysWOW64\NDF
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [51 Ko] - C:\Windows

\SysWOW64\NetworkList
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [438.5 Ko] - C:\Windows\SysWOW64\nl-NL
[MD5.1C96B3DA6ABE5E18B63C64DF75884F6A] - |A| - [13/07/2009 22:35:50] - (.-.) - [1.45 Ko] - (0.0.0.0) - C:

\Windows\SysWOW64\noise.kor
[MD5.E5BB16FC0CF8F16C7CB7BDC51A50F5DB] - |A| - [07/04/2016 15:07:44] - (.Copyright (c) NovaTek 2009 - 2013 -

NovaTek Msdc Ext - Avision.) - [64.5 Ko] - (12.1.13.23) - C:\Windows\SysWOW64\NvUSBScan.dll
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [2566.05 Ko] - C:\Windows\SysWOW64\oobe
[MD5.B7795BC96C1CEB86E04E8DC843E9C784] - |A| - [10/06/2009 17:17:19] - (.-.) - [113.56 Ko] - (0.0.0.0) - C:

\Windows\SysWOW64\PerfCenterCpl.ico
[MD5.44A2D826C266384D0138AD8F556F00D3] - |A| - [26/06/2018 11:10:24] - (.-.) - [756.25 Ko] - (0.0.0.0) - C:

\Windows\SysWOW64\PerfStringBackup.INI
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [434 Ko] - C:\Windows\SysWOW64\pl-PL
[MD5.00000000000000000000000000000000] - |D| - [21/11/2010 03:06:51] - [413.88 Ko] - C:\Windows

\SysWOW64\Printing_Admin_Scripts
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [431 Ko] - C:\Windows\SysWOW64\pt-BR
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [433 Ko] - C:\Windows\SysWOW64\pt-PT
[MD5.03CC2DBAA07B1A6FC2CEE0E5FA96AC8B] - |A| - [29/10/2018 20:46:24] - (.-.) - [2224.5 Ko] - (4.7.0.0) - C:

\Windows\SysWOW64\QtCoreViz4.dll
[MD5.3BD34B2BC0242ACB8C1B5F125674093B] - |A| - [29/10/2018 20:46:24] - (.-.) - [7960 Ko] - (4.7.0.0) - C:

\Windows\SysWOW64\QtGuiViz4.dll
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [23.75 Ko] - C:\Windows\SysWOW64\ras
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [0.64 Ko] - C:\Windows

\SysWOW64\Recovery
[MD5.00000000000000000000000000000000] - |D| - [14/07/2009 01:32:38] - [0 Ko] - C:\Windows\SysWOW64\restore
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [169 Ko] - C:\Windows\SysWOW64\ro-RO
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [429.5 Ko] - C:\Windows\SysWOW64\ru-RU
[MD5.DEDB6A2F987B056D5FF22FD571745B8F] - |A| - [07/04/2016 15:07:44] - (.Copyright (c) 2015, Visioneer Inc. -

Visioneer RoadWarrior 3 LLD.) - [368 Ko] - (0.9.115.331) - C:\Windows\SysWOW64\RWAR3.dll
[MD5.3D3CD5895450C50B37DC20F48C5F735C] - |A| - [11/04/2016 19:08:56] - (.Copyright © 2016, Visioneer Inc. -

TNG CoInstaller.) - [308 Ko] - (5.1.16.4119) - C:\Windows\SysWOW64\RWAR3CI.dll
[MD5.D1FB5EAEAD98E28242D90DAA978A9F2B] - |A| - [20/07/2015 15:13:34] - (.Copyright © 2015, Visioneer Inc. -

Visioneer WIA Driver.) - [408.5 Ko] - (5.1.15.7205) - C:\Windows\SysWOW64\RWAR3WIAT.DLL
[MD5.09418478BB1C1491DD93CED3EE528DAC] - |A| - [20/07/2015 11:07:34] - (.Copyright © 2015, Visioneer Inc. -

Visioneer WIA UI Extension.) - [411 Ko] - (5.1.15.7202) - C:\Windows\SysWOW64\RWAR3WUI.DLL
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [169.5 Ko] - C:\Windows\SysWOW64\sk-SK
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [166 Ko] - C:\Windows\SysWOW64\sl-SI
[MD5.00000000000000000000000000000000] - |D| - [21/11/2010 03:06:51] - [37.8 Ko] - C:\Windows\SysWOW64\slmgr
[MD5.A95238DEB5AEF6CCF70B034F915C1229] - |A| - [18/07/2018 16:07:20] - (.-.) - [0.11 Ko] - (0.0.0.0) - C:

\Windows\SysWOW64\SmartFlow.txt
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [2800 Ko] - C:\Windows\SysWOW64\Speech
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [1142.37 Ko] - C:\Windows\SysWOW64\spp
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [30.19 Ko] - C:\Windows\SysWOW64\sppui
[MD5.D41D8CD98F00B204E9800998ECF8427E] - |A| - [26/03/2019 23:17:48] - (.-.) - [0 Ko] - (0.0.0.0) - C:

\Windows\SysWOW64\SpyWareFolderstoFilter.txt
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [170 Ko] - C:\Windows\SysWOW64\sr-

Latn-CS
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [421.5 Ko] - C:\Windows\SysWOW64\sv-SE
[MD5.00000000000000000000000000000000] - |D| - [21/11/2010 03:06:51] - [0 Ko] - C:\Windows\SysWOW64\sysprep
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [0 Ko] - C:\Windows\SysWOW64\Tasks
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [157 Ko] - C:\Windows\SysWOW64\th-TH
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [419 Ko] - C:\Windows\SysWOW64\tr-TR
[MD5.569EB253765F2B0854F26A1D7A0191BC] - |A| - [29/10/2018 20:46:24] - (.(C) 1993-2013 TWAIN Working Group. -

TWAIN 32 Source Manager (Image Acquisition Interface).) - [147.2 Ko] - (2.3.0.0) - C:\Windows

\SysWOW64\TWAINDSM.dll
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [166.5 Ko] - C:\Windows\SysWOW64\uk-UA
[MD5.15BD0F8D507546F512EE5D73C3721FA8] - |A| - [13/07/2009 22:35:41] - (.Copyright © 2000 - vfpodbc.) - [20.05

Ko] - (1.0.2.0) - C:\Windows\SysWOW64\vfpodbc.dll
[MD5.00000000000000000000000000000000] - |D| - [26/06/2018 11:53:32] - [237.33 Ko] - C:\Windows\SysWOW64\Wat
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [9058.19 Ko] - C:\Windows\SysWOW64\wbem
[MD5.00000000000000000000000000000000] - |D| - [21/11/2010 03:06:51] - [60.46 Ko] - C:\Windows\SysWOW64\WCN
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [101.23 Ko] - C:\Windows\SysWOW64\wdi
[MD5.00000000000000000000000000000000] - |D| - [14/07/2009 01:32:38] - [8539.71 Ko] - C:\Windows

\SysWOW64\WindowsPowerShell
[MD5.00000000000000000000000000000000] - |D| - [21/11/2010 03:06:51] - [99.06 Ko] - C:\Windows\SysWOW64\winrm
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [333.5 Ko] - C:\Windows\SysWOW64\zh-CN
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [255.5 Ko] - C:\Windows\SysWOW64\zh-HK
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [334 Ko] - C:\Windows\SysWOW64\zh-TW

---------- | [Public]

[13/07/2009 23:20:08] - |RHD| - [6788] - C:\Users\Public\Desktop
[14/07/2009 00:54:24] - |ASH| - [174] - C:\Users\Public\desktop.ini
[13/07/2009 23:20:08] - |RD| - [323] - C:\Users\Public\Documents
[13/07/2009 23:20:08] - |RD| - [174] - C:\Users\Public\Downloads
[13/07/2009 23:20:08] - |RHD| - [0] - C:\Users\Public\Favorites
[23/02/2019 19:07:47] - |D| - [1834] - C:\Users\Public\Foxit Software
[13/07/2009 23:20:08] - |RHD| - [3966] - C:\Users\Public\Libraries
[13/07/2009 23:20:08] - |RD| - [17440357] - C:\Users\Public\Music
[13/07/2009 23:20:08] - |RD| - [5838651] - C:\Users\Public\Pictures
[21/11/2010 03:16:58] - |RD| - [9699579] - C:\Users\Public\Recorded TV
[26/06/2018 13:44:20] - |D| - [0] - C:\Users\Public\Roaming
[13/07/2009 23:20:08] - |RD| - [26246732] - C:\Users\Public\Videos

---------- | [********]

[26/06/2018 09:29:15] - |HD| - [37593398117] - C:\Users\********\AppData
[26/06/2018 09:29:15] - |SHD| - [0] - C:\Users\********\Application Data
[26/06/2018 09:29:28] - |RD| - [45008] - C:\Users\********\Contacts
[26/06/2018 09:29:15] - |SHD| - [0] - C:\Users\********\Cookies
[26/06/2018 09:29:15] - |RD| - [2906776435] - C:\Users\********\Desktop
[26/06/2018 09:29:15] - |RD| - [1112685926] - C:\Users\********\Documents
[26/06/2018 09:29:15] - |RD| - [21760657332] - C:\Users\********\Downloads
[26/06/2018 09:29:15] - |RD| - [3432] - C:\Users\********\Favorites
[26/06/2018 10:21:40] - |SHD| - [24444] - C:\Users\********\IntelGraphicsProfiles
[26/06/2018 09:29:15] - |RD| - [2304] - C:\Users\********\Links
[26/06/2018 09:29:15] - |SHD| - [0] - C:\Users\********\Local Settings
[26/06/2018 09:29:15] - |RD| - [21497044] - C:\Users\********\Music
[26/06/2018 09:29:15] - |SHD| - [0] - C:\Users\********\My Documents
[26/06/2018 09:29:15] - |SHD| - [0] - C:\Users\********\NetHood
[26/06/2018 09:29:15] - |ASH| - [1835008] - C:\Users\********\NTUSER.DAT
[26/06/2018 09:29:15] - |ASH| - [262144] - C:\Users\********\ntuser.dat.LOG1
[26/06/2018 09:29:15] - |ASH| - [0] - C:\Users\********\ntuser.dat.LOG2
[26/06/2018 09:29:15] - |ASH| - [65536] - C:\Users\********\NTUSER.DAT{016888bd-6c6f-11de-8d1d-

001e0bcde3ec}.TM.blf
[26/06/2018 09:29:15] - |ASH| - [524288] - C:\Users\********\NTUSER.DAT{016888bd-6c6f-11de-8d1d-

001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
[26/06/2018 09:29:15] - |ASH| - [524288] - C:\Users\********\NTUSER.DAT{016888bd-6c6f-11de-8d1d-

001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
[26/06/2018 09:29:15] - |SH| - [20] - C:\Users\********\ntuser.ini
[26/06/2018 09:29:15] - |RD| - [504] - C:\Users\********\Pictures
[26/06/2018 09:29:15] - |SHD| - [0] - C:\Users\********\PrintHood
[26/06/2018 09:29:15] - |SHD| - [0] - C:\Users\********\Recent
[26/06/2018 13:44:20] - |D| - [0] - C:\Users\********\Roaming
[26/06/2018 09:29:15] - |RD| - [282] - C:\Users\********\Saved Games
[26/06/2018 09:29:40] - |RD| - [2156] - C:\Users\********\Searches
[26/06/2018 09:29:15] - |SHD| - [0] - C:\Users\********\SendTo
[30/08/2018 00:14:03] - |D| - [0] - C:\Users\********\source
[26/06/2018 09:29:15] - |SHD| - [0] - C:\Users\********\Start Menu
[26/06/2018 09:29:15] - |SHD| - [0] - C:\Users\********\Templates
[26/06/2018 09:29:15] - |RD| - [504] - C:\Users\********\Videos
[26/06/2018 09:29:15] - |D| - [37353303098] - C:\Users\********\AppData\Local
[26/06/2018 09:29:15] - |D| - [283563] - C:\Users\********\AppData\LocalLow
[26/06/2018 09:29:15] - |D| - [239811456] - C:\Users\********\AppData\Roaming
[30/08/2018 00:13:41] - |D| - [2] - C:\Users\********\AppData\Local\.IdentityService
[24/02/2019 23:25:18] - |D| - [0] - C:\Users\********\AppData\Local\Adobe
[26/06/2018 09:29:15] - |SHD| - [0] - C:\Users\********\AppData\Local\Application Data
[30/08/2018 08:09:46] - |D| - [0] - C:\Users\********\AppData\Local\Apps
[13/08/2018 21:54:20] - |D| - [0] - C:\Users\********\AppData\Local\Audacity
[26/06/2018 13:46:18] - |D| - [0] - C:\Users\********\AppData\Local\dell
[12/01/2019 00:03:36] - |D| - [11231313] - C:\Users\********\AppData\Local\Dell Inc
[30/08/2018 08:09:45] - |D| - [0] - C:\Users\********\AppData\Local\Deployment
[08/04/2019 10:57:30] - |D| - [101749] - C:\Users\********\AppData\Local\Diagnostics
[27/06/2018 22:18:51] - |A| - [90928] - C:\Users\********\AppData\Local\GDIPFONTCACHEV1.DAT
[12/07/2019 13:36:58] - |D| - [424917179] - C:\Users\********\AppData\Local\Google
[26/06/2018 09:29:15] - |SHD| - [0] - C:\Users\********\AppData\Local\History
[26/06/2018 10:11:51] - |AH| - [2633857] - C:\Users\********\AppData\Local\IconCache.db
[26/06/2018 09:29:15] - |D| - [403277230] - C:\Users\********\AppData\Local\Microsoft
[27/06/2018 08:28:25] - |D| - [145260] - C:\Users\********\AppData\Local\Microsoft Help
[26/06/2018 13:51:55] - |D| - [208431218] - C:\Users\********\AppData\Local\Mozilla
[27/06/2018 13:07:36] - |D| - [0] - C:\Users\********\AppData\Local\Notepad++
[27/06/2018 12:00:34] - |D| - [0] - C:\Users\********\AppData\Local\Programs
[10/03/2019 17:53:01] - |D| - [17260365515] - C:\Users\********\AppData\Local\Propellerhead Software
[07/12/2018 01:43:28] - |A| - [600] - C:\Users\********\AppData\Local\PUTTY.RND
[30/08/2018 00:04:17] - |D| - [32] - C:\Users\********\AppData\Local\ServiceHub
[26/06/2018 09:29:15] - |D| - [19041990985] - C:\Users\********\AppData\Local\Temp
[26/06/2018 09:29:15] - |SHD| - [0] - C:\Users\********\AppData\Local\Temporary Internet Files
[26/06/2018 09:29:26] - |D| - [0] - C:\Users\********\AppData\Local\VirtualStore
[29/10/2018 20:51:50] - |D| - [117230] - C:\Users\********\AppData\Local\Visioneer
[26/06/2018 11:08:58] - |SD| - [283563] - C:\Users\********\AppData\LocalLow\Microsoft
[26/06/2018 13:51:59] - |D| - [0] - C:\Users\********\AppData\LocalLow\Mozilla
[30/08/2018 08:01:19] - |D| - [0] - C:\Users\********\AppData\LocalLow\Temp
[26/06/2018 12:39:59] - |D| - [0] - C:\Users\********\AppData\Roaming\Adobe
[13/08/2018 21:54:20] - |D| - [57419] - C:\Users\********\AppData\Roaming\audacity
[23/02/2019 19:07:39] - |D| - [12] - C:\Users\********\AppData\Roaming\Foxit AgentInformation
[23/02/2019 19:07:33] - |D| - [90981165] - C:\Users\********\AppData\Roaming\Foxit Software
[26/06/2018 09:29:30] - |D| - [0] - C:\Users\********\AppData\Roaming\Identities
[26/06/2018 13:44:29] - |D| - [101299] - C:\Users\********\AppData\Roaming\Intel
[26/06/2018 22:04:50] - |D| - [3760] - C:\Users\********\AppData\Roaming\IrfanView
[20/03/2019 22:28:06] - |D| - [445325] - C:\Users\********\AppData\Roaming\iZotope
[23/08/2018 19:50:09] - |D| - [7454] - C:\Users\********\AppData\Roaming\KeePass
[27/06/2018 12:03:16] - |D| - [964852] - C:\Users\********\AppData\Roaming\Line 6
[26/06/2018 14:06:48] - |D| - [510022] - C:\Users\********\AppData\Roaming\Macromedia
[26/06/2018 09:29:15] - |D| - [0] - C:\Users\********\AppData\Roaming\Media Center Programs
[26/06/2018 09:29:15] - |SD| - [25338783] - C:\Users\********\AppData\Roaming\Microsoft
[30/08/2018 00:04:12] - |D| - [0] - C:\Users\********\AppData\Roaming\Microsoft Visual Studio
[17/01/2019 20:51:45] - |D| - [3805258] - C:\Users\********\AppData\Roaming\MixMeister Technology
[26/06/2018 13:51:57] - |D| - [73381144] - C:\Users\********\AppData\Roaming\Mozilla
[26/06/2018 21:16:07] - |D| - [2507165] - C:\Users\********\AppData\Roaming\Notepad++
[30/08/2018 08:00:53] - |D| - [210] - C:\Users\********\AppData\Roaming\NuGet
[27/06/2018 12:01:01] - |D| - [36444928] - C:\Users\********\AppData\Roaming\Propellerhead Software
[30/08/2018 18:35:48] - |D| - [357] - C:\Users\********\AppData\Roaming\Skype
[30/08/2018 00:04:15] - |D| - [4788763] - C:\Users\********\AppData\Roaming\Visual Studio Setup
[27/04/2019 23:59:13] - |D| - [96417] - C:\Users\********\AppData\Roaming\vlc
[30/08/2018 00:04:16] - |D| - [66] - C:\Users\********\AppData\Roaming\vstelemetry
[26/06/2018 20:44:43] - |D| - [377057] - C:\Users\********\AppData\Roaming\Winamp
[26/06/2018 09:29:40] - |SH| - [174] - C:\Users\********\AppData\Roaming\Microsoft\Windows\Start Menu

\desktop.ini
[26/06/2018 09:29:15] - |RD| - [17432] - C:\Users\********\AppData\Roaming\Microsoft\Windows\Start Menu

\Programs
[26/06/2018 09:29:15] - |RD| - [14615] - C:\Users\********\AppData\Roaming\Microsoft\Windows\Start Menu

\Programs\Accessories
[26/06/2018 09:29:40] - |RD| - [174] - C:\Users\********\AppData\Roaming\Microsoft\Windows\Start Menu

\Programs\Administrative Tools
[26/06/2018 09:29:40] - |SH| - [476] - C:\Users\********\AppData\Roaming\Microsoft\Windows\Start Menu

\Programs\desktop.ini
[26/06/2018 09:29:41] - |A| - [1413] - C:\Users\********\AppData\Roaming\Microsoft\Windows\Start Menu

\Programs\Internet Explorer.lnk
[26/06/2018 09:29:15] - |RD| - [580] - C:\Users\********\AppData\Roaming\Microsoft\Windows\Start Menu

\Programs\Maintenance
[26/06/2018 09:29:40] - |RD| - [174] - C:\Users\********\AppData\Roaming\Microsoft\Windows\Start Menu

\Programs\Startup
[26/06/2018 09:29:40] - |SH| - [174] - C:\Users\********\AppData\Roaming\Microsoft\Windows\Start Menu

\Programs\Startup\desktop.ini

---------- | C:\ProgramData

[14/07/2009 01:08:56] - |SHD| - [0] - C:\ProgramData\Application Data
[26/06/2018 13:40:00] - |D| - [1804255] - C:\ProgramData\dell
[26/06/2018 13:36:38] - |D| - [358787008] - C:\ProgramData\Dell Inc
[14/07/2009 01:08:56] - |SHD| - [0] - C:\ProgramData\Desktop
[14/07/2009 01:08:56] - |SHD| - [0] - C:\ProgramData\Documents
[14/07/2009 01:08:56] - |SHD| - [0] - C:\ProgramData\Favorites
[23/02/2019 19:07:39] - |D| - [29] - C:\ProgramData\Foxit ContentPlatform
[23/02/2019 19:07:53] - |D| - [14336] - C:\ProgramData\Foxit Software
[26/06/2018 13:41:00] - |D| - [81505] - C:\ProgramData\Intel
[26/06/2018 13:43:56] - |D| - [1455] - C:\ProgramData\Intel.sav
[27/06/2018 12:03:15] - |D| - [21621574] - C:\ProgramData\Line 6
[22/02/2019 10:31:22] - |D| - [591] - C:\ProgramData\Macrium
[13/07/2009 23:20:08] - |SD| - [952933339] - C:\ProgramData\Microsoft
[27/06/2018 08:28:24] - |D| - [57380] - C:\ProgramData\Microsoft Help
[29/08/2018 23:57:35] - |D| - [1096] - C:\ProgramData\Microsoft Visual Studio
[08/02/2019 01:45:00] - |D| - [24] - C:\ProgramData\Mozilla
[26/06/2018 13:43:04] - |D| - [163404477] - C:\ProgramData\Package Cache
[26/06/2018 13:37:27] - |D| - [182257943] - C:\ProgramData\PCDr
[27/06/2018 12:01:03] - |D| - [5964808815] - C:\ProgramData\Propellerhead Software
[26/06/2018 13:44:20] - |D| - [0] - C:\ProgramData\Roaming
[14/07/2009 01:08:56] - |SHD| - [0] - C:\ProgramData\Start Menu
[26/06/2018 13:36:35] - |D| - [78823424] - C:\ProgramData\SupportAssist
[14/07/2009 01:08:56] - |SHD| - [0] - C:\ProgramData\Templates
[29/10/2018 20:46:56] - |D| - [0] - C:\ProgramData\Visioneer

---------- | C:\ProgramData\Microsoft\Windows\Start Menu

[14/07/2009 01:01:14] - |A| - [1282] - C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk
[14/07/2009 00:49:40] - |ASH| - [442] - C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini
[13/07/2009 23:20:08] - |RD| - [182250] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs
[14/07/2009 00:49:40] - |A| - [1266] - C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk

---------- | C:\ProgramData\Microsoft\Windows\Start Menu\Programs

[26/06/2018 22:13:31] - |D| - [1637] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
[13/07/2009 23:20:08] - |RD| - [43554] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
[14/07/2009 01:32:38] - |RD| - [21157] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative

Tools
[06/04/2019 14:02:59] - |D| - [1600] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AKAI PROFESSIONAL
[13/08/2018 21:54:14] - |A| - [1019] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk
[30/05/2019 09:48:51] - |D| - [2143] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell
[14/07/2009 00:54:23] - |ASH| - [1130] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini
[13/07/2019 10:49:39] - |A| - [942] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
[23/02/2019 19:07:35] - |D| - [2739] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foxit Reader
[14/07/2009 01:32:38] - |RD| - [778] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
[12/07/2019 13:36:58] - |A| - [2298] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
[26/06/2018 13:40:31] - |RD| - [3490] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel
[26/06/2018 13:44:04] - |RD| - [11852] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel PROSet

Wireless
[26/06/2018 22:04:52] - |D| - [9633] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IrfanView
[20/03/2019 21:59:53] - |D| - [4730] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iZotope
[23/08/2018 18:00:52] - |A| - [1131] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KeePass 2.lnk
[27/06/2018 12:03:16] - |D| - [2144] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Line 6
[13/07/2009 23:20:08] - |RD| - [4370] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance
[26/06/2018 12:24:35] - |A| - [1345] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[27/06/2018 08:31:39] - |D| - [31702] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
[17/01/2019 20:47:45] - |D| - [918] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MixMeister
[26/06/2018 21:16:08] - |D| - [1037] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++
[05/05/2019 22:45:13] - |D| - [2623] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
[27/06/2018 12:00:56] - |D| - [4114] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Propellerhead
[26/06/2018 21:15:05] - |D| - [5242] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PuTTY (64-bit)
[14/07/2009 00:57:08] - |A| - [1330] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
[30/08/2018 18:35:39] - |D| - [1332] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[13/07/2009 23:20:08] - |RD| - [174] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
[27/04/2019 23:56:09] - |D| - [5592] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[30/08/2018 00:12:40] - |D| - [0] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Visual Studio 2017
[26/06/2018 20:45:57] - |D| - [3813] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Winamp
[14/07/2009 00:57:09] - |A| - [1352] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime

Upgrade.lnk
[26/06/2018 12:24:35] - |A| - [1326] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD

Maker.lnk
[14/07/2009 00:54:59] - |A| - [1210] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and

Scan.lnk
[14/07/2009 00:57:06] - |A| - [1547] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media

Player.lnk
[14/07/2009 00:57:08] - |A| - [1246] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk

---------- | C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup

[14/07/2009 00:54:23] - |ASH| - [174] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup

\desktop.ini

---------- | C:\Program Files (x86)

[13/08/2018 21:54:09] - |D| - [55066342] - C:\Program Files (x86)\Audacity
[26/06/2018 13:44:00] - |D| - [7114563] - C:\Program Files (x86)\Cisco
[13/07/2009 23:20:08] - |D| - [1393552496] - C:\Program Files (x86)\Common Files
[14/07/2009 00:54:24] - |ASH| - [174] - C:\Program Files (x86)\desktop.ini
[23/02/2019 19:07:26] - |D| - [262446973] - C:\Program Files (x86)\Foxit Software
[12/07/2019 13:36:26] - |D| - [535966281] - C:\Program Files (x86)\Google
[26/06/2018 13:41:18] - |HD| - [7992886] - C:\Program Files (x86)\InstallShield Installation Information
[26/06/2018 10:01:47] - |D| - [50297901] - C:\Program Files (x86)\Intel
[13/07/2009 23:20:08] - |D| - [10317233] - C:\Program Files (x86)\Internet Explorer
[26/06/2018 22:04:50] - |D| - [3978395] - C:\Program Files (x86)\IrfanView
[20/03/2019 21:56:54] - |D| - [87560357] - C:\Program Files (x86)\iZotope
[23/08/2018 18:00:52] - |D| - [7048580] - C:\Program Files (x86)\KeePass Password Safe 2
[22/10/2018 00:33:43] - |D| - [1615211] - C:\Program Files (x86)\Lame For Audacity
[30/08/2018 18:35:32] - |D| - [196515002] - C:\Program Files (x86)\Microsoft
[27/06/2018 08:28:44] - |D| - [39769547] - C:\Program Files (x86)\Microsoft Analysis Services
[27/06/2018 08:28:24] - |D| - [602654491] - C:\Program Files (x86)\Microsoft Office
[30/08/2018 00:04:04] - |D| - [0] - C:\Program Files (x86)\Microsoft Visual Studio
[26/06/2018 11:09:32] - |D| - [8251487] - C:\Program Files (x86)\Microsoft.NET
[17/01/2019 20:47:44] - |D| - [13503903] - C:\Program Files (x86)\MixMeister Pro 5
[13/07/2019 10:49:38] - |D| - [330977] - C:\Program Files (x86)\Mozilla Maintenance Service
[14/07/2009 01:32:38] - |D| - [25757] - C:\Program Files (x86)\MSBuild
[26/06/2018 21:16:07] - |D| - [10359025] - C:\Program Files (x86)\Notepad++
[05/05/2019 22:45:13] - |D| - [138958688] - C:\Program Files (x86)\Panda Security
[14/07/2009 01:32:38] - |D| - [36962049] - C:\Program Files (x86)\Reference Assemblies
[14/07/2009 00:57:06] - |HD| - [0] - C:\Program Files (x86)\Uninstall Information
[29/10/2018 20:45:33] - |D| - [63898285] - C:\Program Files (x86)\Visioneer
[26/06/2018 20:44:43] - |D| - [26487570] - C:\Program Files (x86)\Winamp
[14/07/2009 01:32:38] - |D| - [512000] - C:\Program Files (x86)\Windows Defender
[13/07/2009 23:20:08] - |D| - [6115840] - C:\Program Files (x86)\Windows Mail
[14/07/2009 01:32:38] - |D| - [5008657] - C:\Program Files (x86)\Windows Media Player
[13/07/2009 23:20:08] - |D| - [12062388] - C:\Program Files (x86)\Windows NT
[14/07/2009 01:32:38] - |D| - [4394248] - C:\Program Files (x86)\Windows Photo Viewer
[14/07/2009 01:32:38] - |D| - [189952] - C:\Program Files (x86)\Windows Portable Devices
[14/07/2009 01:32:38] - |D| - [5990148] - C:\Program Files (x86)\Windows Sidebar

---------- | C:\Program Files

[26/06/2018 22:13:30] - |D| - [5158872] - C:\Program Files\7-Zip
[13/07/2009 23:20:08] - |D| - [1356788886] - C:\Program Files\Common Files
[26/06/2018 13:36:35] - |D| - [513645403] - C:\Program Files\Dell
[26/06/2018 13:45:06] - |D| - [24509650] - C:\Program Files\DellTPad
[14/07/2009 00:54:24] - |ASH| - [174] - C:\Program Files\desktop.ini
[14/07/2009 01:32:38] - |D| - [90245652] - C:\Program Files\DVD Maker
[26/06/2018 13:41:18] - |D| - [46886304] - C:\Program Files\IDT
[26/06/2018 10:01:27] - |D| - [258387305] - C:\Program Files\Intel
[13/07/2009 23:20:08] - |D| - [30309460] - C:\Program Files\Internet Explorer
[27/06/2018 08:28:53] - |D| - [6730385] - C:\Program Files\Microsoft Office
[13/07/2019 10:49:38] - |D| - [189693669] - C:\Program Files\Mozilla Firefox
[14/07/2009 01:32:38] - |D| - [25757] - C:\Program Files\MSBuild
[27/06/2018 12:00:54] - |D| - [54260677671] - C:\Program Files\Propellerhead
[26/06/2018 21:15:05] - |D| - [3748404] - C:\Program Files\PuTTY
[14/07/2009 01:32:38] - |D| - [34625193] - C:\Program Files\Reference Assemblies
[14/07/2009 01:09:26] - |HD| - [0] - C:\Program Files\Uninstall Information
[27/04/2019 23:55:43] - |D| - [174855255] - C:\Program Files\VideoLAN
[29/10/2018 20:45:35] - |D| - [3861966] - C:\Program Files\Visioneer
[15/01/2019 20:21:43] - |D| - [23264232] - C:\Program Files\VSTPlugins
[14/07/2009 01:32:38] - |D| - [4016640] - C:\Program Files\Windows Defender
[13/07/2009 23:20:08] - |D| - [6602240] - C:\Program Files\Windows Mail
[14/07/2009 01:32:38] - |D| - [7665069] - C:\Program Files\Windows Media Player
[13/07/2009 23:20:08] - |D| - [12492468] - C:\Program Files\Windows NT
[14/07/2009 01:32:38] - |D| - [5492504] - C:\Program Files\Windows Photo Viewer
[14/07/2009 01:32:38] - |D| - [244736] - C:\Program Files\Windows Portable Devices
[14/07/2009 01:32:38] - |D| - [7040380] - C:\Program Files\Windows Sidebar

---------- | C:\Program Files (x86)\Common Files

[20/03/2019 21:57:06] - |D| - [461383680] - C:\Program Files (x86)\Common Files\Digidesign
[26/06/2018 10:01:23] - |D| - [106832389] - C:\Program Files (x86)\Common Files\Intel
[13/07/2009 23:20:08] - |D| - [201086897] - C:\Program Files (x86)\Common Files\microsoft shared
[26/06/2018 13:40:28] - |D| - [196972] - C:\Program Files (x86)\Common Files\postureAgent
[26/06/2018 20:44:47] - |D| - [4780336] - C:\Program Files (x86)\Common Files\PX Storage Engine
[13/07/2009 23:20:08] - |D| - [2702] - C:\Program Files (x86)\Common Files\Services
[13/07/2009 23:20:08] - |D| - [41103783] - C:\Program Files (x86)\Common Files\SpeechEngines
[13/07/2009 23:20:08] - |D| - [10535331] - C:\Program Files (x86)\Common Files\System
[29/10/2018 20:46:18] - |D| - [27408454] - C:\Program Files (x86)\Common Files\Visioneer
[20/03/2019 21:57:05] - |D| - [491844096] - C:\Program Files (x86)\Common Files\VST3
[17/01/2019 20:46:44] - |D| - [48377856] - C:\Program Files (x86)\Common Files\Wise Installation Wizard

---------- | C:\Program Files\Common files

[20/03/2019 21:57:06] - |D| - [571580920] - C:\Program Files\Common files\Avid
[26/06/2018 13:44:00] - |D| - [49890704] - C:\Program Files\Common files\Intel
[13/07/2009 23:20:08] - |D| - [70059393] - C:\Program Files\Common files\Microsoft Shared
[27/06/2018 12:03:12] - |D| - [2081280] - C:\Program Files\Common files\Propellerhead Software
[13/07/2009 23:20:08] - |D| - [2702] - C:\Program Files\Common files\Services
[13/07/2009 23:20:08] - |D| - [608768] - C:\Program Files\Common files\SpeechEngines
[13/07/2009 23:20:08] - |D| - [12145651] - C:\Program Files\Common files\System
[29/10/2018 20:45:40] - |D| - [28621132] - C:\Program Files\Common files\Visioneer
[20/03/2019 21:57:05] - |D| - [621798336] - C:\Program Files\Common files\VST3

---------- | Tasks

[MD5.F1A6CD5ADAAB953A6764EA364E17BFB8] - [14/07/2009 01:08:49] - |AH| - [6] - C:\Windows\Tasks\SA.DAT
[MD5.308D90E72887F9B5246AAF2FB1854666] - [14/07/2009 01:08:49] - |A| - [17164] - C:\Windows\Tasks\SCHEDLGU.TXT
[MD5.24B1A797A4DC202EF43B0C1FA9FF0181] - [26/06/2018 13:36:59] - |A| - [4208] - C:\Windows\System32\Tasks\Dell

SupportAssistAgent AutoUpdate : C:\Program Files\Dell\SupportAssistAgent\bin

\SupportAssistInstaller.exe
[MD5.5AFF56636FE26F748FF1155056CE6896] - [12/07/2019 13:36:26] - |A| - [3204] - C:\Windows\System32\Tasks

\GoogleUpdateTaskMachineCore : C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
[MD5.A57909F45AE203BCED744BBF7653EB3C] - [12/07/2019 13:36:26] - |A| - [3332] - C:\Windows\System32\Tasks

\GoogleUpdateTaskMachineUA : C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
[MD5.00000000000000000000000000000000] - [13/07/2009 23:20:13] - |D| - [264846] - C:\Windows\System32\Tasks

\Microsoft
[MD5.00000000000000000000000000000000] - [27/06/2018 08:30:03] - |D| - [4392] - C:\Windows\System32\Tasks

\OfficeSoftwareProtectionPlatform
[MD5.00000000000000000000000000000000] - [14/07/2009 01:09:57] - |D| - [0] - C:\Windows\System32\Tasks\WPD
[MD5.5CF981DB98F4965F9D8F6377991E9F54] - [01/10/2018 08:40:59] - |A| - [3136] - C:\Windows\System32\Tasks

\{EE1BEB1A-D10C-43A0-9D62-B7BBC4690C0E} : C:\Windows\system32\pcalua.exe
[MD5.00000000000000000000000000000000] - [13/07/2009 23:20:14] - |D| - [0] - C:\Windows\Syswow64\Tasks

\Microsoft

---------- | Firewall

[HKLM\SYSTEM\CurrentControlSet\Services\sharedaccess\Parameters\FirewallPolicy\FirewallRules]
"Netlogon-NamedPipe-In"=v2.10|Action=Allow|Active=FALSE|Dir=In|Protocol=6|LPort=445|App=System|

Name=@netlogon.dll,-1003|Desc=@netlogon.dll,-1006|EmbedCtxt=@netlogon.dll,-1010|
"{C9D920BF-E6BD-40EC-9693-86D8D875A097}"=v2.10|Action=Allow|Active=FALSE|Dir=In|Protocol=6|LPort=808|App=C:

\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe|Svc=NetTcpActivator|Name=@C:\Windows

\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelEvents.dll,-2000|Desc=@C:\Windows\Microsoft.NET

\Framework64\v4.0.30319\\ServiceModelEvents.dll,-2001|EmbedCtxt=@C:\Windows\Microsoft.NET

\Framework64\v4.0.30319\\ServiceModelEvents.dll,-2002|
"{DA3FC957-B91F-4B12-B5BC-387B37AEA4A6}"=v2.10|Action=Allow|Active=TRUE|Dir=In|App=C:\Program Files\Intel

\WiFi\bin\PanDhcpDns.exe|Name=Wireless PAN DHCP Server|EmbedCtxt=MyWiFiDHCPDNS|
"{1146613B-9846-4149-AAA7-EED5F9DCFA35}"=v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|

Profile=Public|App=C:\Program Files (x86)\Winamp\winamp.exe|Name=Winamp|
"{4EB93D04-534E-4F05-A655-E0F1761C493A}"=v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|

Profile=Public|App=C:\Program Files (x86)\Winamp\winamp.exe|Name=Winamp|
"{DD6A69A7-6F4D-4C94-93A3-EFD897DCD692}"=v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|App=C:\Users

\********\AppData\Roaming\uTorrent\uTorrent.exe|Name=μTorrent (TCP-In)|Desc=Allow μTorrent network traffic

with Edge Traversal|Edge=TRUE|
"{D0C21295-8A4D-4AAF-867C-F5606173A37E}"=v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|App=C:\Users

\********\AppData\Roaming\uTorrent\uTorrent.exe|Name=μTorrent (UDP-In)|Desc=Allow μTorrent network traffic

with Edge Traversal|Edge=TRUE|
"{43FE1F9D-0162-42B6-B9BC-30E45CEDC654}"=v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|LPort=5353|App=C:

\Program Files (x86)\Google\Chrome\Application\chrome.exe|Name=Google Chrome (mDNS-In)|Desc=Inbound rule for

Google Chrome to allow mDNS traffic.|EmbedCtxt=Google Chrome|

---------- | Control\Class

[HKLM\SYSTEM\CurrentControlSet\Control\Class\{0475BB51-5A02-4EE0-B36C-29040FAD2650}] : (igfx) [] ->
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{1264760F-A5C8-4BFE-B314-D56A7B44A362}] : (DXGKrnl) [] ->
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{24A0C840-2C3D-4410-8236-8B40816C7B90}] : (aswVmm) [] ->
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{25DBCE51-6C8F-4A72-8A6D-B54C2B4FC835}] : (WCEUSBS) [] -> @

%SystemRoot%\System32\SysClass.Dll,-3026
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}] : (USB) [] -> @

%SystemRoot%\System32\SysClass.Dll,-3025
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4116F60B-25B3-4662-B732-99A6111EDC0B}] : (IPMIDRV) [] ->
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{43675D81-502A-4A82-9F84-B75F418C5DEA}] : (Media Center Extender)

[] -> @%SystemRoot%\system32\McxDriv.dll,-100
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4658EE7E-F050-11D1-B6BD-00C04FA372A7}] : (PnpPrinters) [] -> @

%systemroot%\system32\ntprint.dll,-1300
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{48721B56-6795-11D2-B1A8-0080C72E74A2}] : (Dot4) [] -> @

%SystemRoot%\system32\sysclass.dll,-3023
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{49CE6AC8-6F86-11D2-B1E5-0080C72E74A2}] : (Dot4Print) [] -> @

%SystemRoot%\system32\sysclass.dll,-3024
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}] : (CDROM) [] -> @

%SystemRoot%\System32\StorProp.dll,-17001
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E966-E325-11CE-BFC1-08002BE10318}] : (Computer) [] -> @

%SystemRoot%\System32\SysClass.dll,-3000
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}] : (DiskDrive) [] -> @

%SystemRoot%\System32\StorProp.dll,-17000
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}] : (Display) [] ->

@DispCI.dll,-3100
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E969-E325-11CE-BFC1-08002BE10318}] : (fdc) [] -> @

%SystemRoot%\System32\SysClass.Dll,-3013
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}] : (hdc) [] -> @

%SystemRoot%\System32\SysClass.Dll,-3001
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E96B-E325-11CE-BFC1-08002BE10318}] : (Keyboard) [] -> @

%SystemRoot%\System32\SysClass.Dll,-3002
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E96C-E325-11CE-BFC1-08002BE10318}] : (MEDIA) [] ->

@mmci.dll,-3000
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}] : (Modem) [] -> @

%SystemRoot%\System32\mdminst.dll,-14100
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E96E-E325-11CE-BFC1-08002BE10318}] : (Monitor) [] ->

@Montr_CI.dll,-3100
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E96F-E325-11CE-BFC1-08002BE10318}] : (Mouse) [] -> @

%SystemRoot%\System32\SysClass.Dll,-3004
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E970-E325-11CE-BFC1-08002BE10318}] : (MTD) [] ->

@SysClass.Dll,-3021
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E971-E325-11CE-BFC1-08002BE10318}] : (MultiFunction) [] ->

@%SystemRoot%\System32\SysClass.Dll,-3014
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}] : (Net) [] ->

@NetCfgx.dll,-1502
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E973-E325-11CE-BFC1-08002BE10318}] : (NetClient) [] ->

@NetCfgx.dll,-1504
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E974-E325-11CE-BFC1-08002BE10318}] : (NetService) [] ->

@NetCfgx.dll,-1505
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E975-E325-11CE-BFC1-08002BE10318}] : (NetTrans) [] ->

@NetCfgx.dll,-1503
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E977-E325-11CE-BFC1-08002BE10318}] : (PCMCIA) [] -> @

%SystemRoot%\System32\SysClass.Dll,-3010
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E978-E325-11CE-BFC1-08002BE10318}] : (Ports) [] -> @

%SystemRoot%\System32\msports.dll,-10000
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E979-E325-11CE-BFC1-08002BE10318}] : (Printer) [] -> @

%systemroot%\system32\ntprint.dll,-1004
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E97B-E325-11CE-BFC1-08002BE10318}] : (SCSIAdapter) [] -> @

%SystemRoot%\System32\SysClass.Dll,-3005
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E97D-E325-11CE-BFC1-08002BE10318}] : (System) [] -> @

%SystemRoot%\System32\SysClass.Dll,-3008
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E97E-E325-11CE-BFC1-08002BE10318}] : (Unknown) [] -> @

%SystemRoot%\System32\SysClass.Dll,-3009
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E980-E325-11CE-BFC1-08002BE10318}] : (FloppyDisk) [] -> @

%SystemRoot%\System32\SysClass.Dll,-3015
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{50127DC3-0F36-415E-A6CC-4CB3BE910B65}] : (Processor) [] -> @

%SystemRoot%\system32\procinst.dll,-100
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{50906CB8-BA12-11D1-BF5D-0000F805F530}] : (MultiPortSerial) [] ->

@%SystemRoot%\system32\sysclass.dll,-3022
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{5099944A-F6B9-4057-A056-8C550228544C}] : (Memory) [] -> @

%SystemRoot%\System32\SysClass.Dll,-3018
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{50DD5230-BA8A-11D1-BF5D-0000F805F530}] : (SmartCardReader) [] ->

@StorProp.dll,-17002
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{5175D334-C371-4806-B3BA-71FD53C9258D}] : (Sensor) [] -> @

%systemroot%\system32\SensorsCpl.dll,-10000
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] : (VolumeSnapshot) [] ->

@%SystemRoot%\System32\SysClass.Dll,-3011
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{53D29EF7-377C-4D14-864B-EB3A85769359}] : (BiometricDevice) [] ->

@%SystemRoot%\System32\SysClass.DLL,-3028
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}] : (1394) [] -> @

%SystemRoot%\System32\SysClass.Dll,-3016
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{6BDD1FC5-810F-11D0-BEC7-08002BE2092F}] : (Infrared) [] ->

@NetCfgx.dll,-1501
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{6BDD1FC6-810F-11D0-BEC7-08002BE2092F}] : (Image) [] -> @

%systemroot%\system32\sti_ci.dll,-52
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{6D807884-7D21-11CF-801C-08002BE10318}] : (TapeDrive) [] -> @

%SystemRoot%\System32\SysClass.Dll,-3006
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{6FAE73B7-B735-4B50-A0DA-0DC2484B1F1A}] : (igfx) [] ->
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}] : (Volume) [] -> @

%SystemRoot%\System32\SysClass.Dll,-3007
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{72631E54-78A4-11D0-BCF7-00AA00B7B32A}] : (Battery) [] -> @

%SystemRoot%\system32\batt.dll,-100
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}] : (HIDClass) [] ->

@hid.dll,-101
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{7EBEFBC0-3200-11D2-B4C2-00A0C9697D07}] : (61883) [] -> @

%SystemRoot%\System32\SysClass.Dll,-3019
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{8ECC055D-047F-11D1-A537-0000F8753ED1}] : (LegacyDriver) [] -> @

%SystemRoot%\System32\SysClass.Dll,-3003
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{990A2BD7-E738-46C7-B26F-1CF8FB9F1391}] : (SmartCard) [] ->

@sccls.dll,-300
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{997B5D8D-C442-4F2E-BAF3-9C8E671E9E21}] : (SideShow) [] -> @

%systemroot%\system32\AuxiliaryDisplayClassInstaller.dll,-10000
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{A0A588A4-C46F-4B37-B7EA-C82FE89870C6}] : (SDHost) [] -> @

%SystemRoot%\System32\SysClass.Dll,-3012
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{A3E32DBA-BA89-4F17-8386-2D0127FBD4CC}] : (rdpbus) [] ->
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{BC103702-DD72-406F-9B28-95C868337B59}] : (Transfer Cable) [] ->

@%SystemRoot%\System32\migwiz\migres.dll,-20
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{C06FF265-AE09-48F0-812C-16753D7CBA83}] : (AVC) [] -> @

%SystemRoot%\System32\SysClass.Dll,-3027
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{CE5939AE-EBDE-11D0-B181-0000F8753EC4}] : (MediumChanger) [] ->

@%SystemRoot%\System32\StorProp.dll,-17003
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}] : (SBP2) [] -> @

%SystemRoot%\System32\SysClass.Dll,-3017
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{D61CA365-5AF4-4486-998B-9DB4734C6CA3}] : (XnaComposite) [] -> @

%SystemRoot%\system32\XInput9_1_0.dll,-1000
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}] : (SecurityDevices) [] ->

@%SystemRoot%\System32\SysClass.Dll,-3020
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{DB4F6DDD-9C0E-45E4-9597-78DBBAD0F412}] : (SmartCardFilter) [] ->

@sccls.dll,-301
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{E0CBF06C-CD8B-4647-BB8A-263B43F0F974}] : (Bluetooth) [] -> @

%SystemRoot%\system32\bthci.dll,-4001
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{EEC5AD98-8080-425F-922A-DABF3DE3F69A}] : (WPD) [] ->

@wpd_ci.dll,-101
[HKLM\SYSTEM\CurrentControlSet\Control\Els\Services\{2D64B439-6CAF-4f6b-B688-E5D0F4FAA7D7}] : (Script

Detection) [@elscore.dll,-2] -> ElsLad.dll (Copyright (c) Microsoft Corporation.)
[HKLM\SYSTEM\CurrentControlSet\Control\Els\Services\{A22D52C1-DBFD-40cb-AE78-E3BA9EE1D88F}] :

(Transliteration) [@elscore.dll,-5] -> elstrans.dll (Copyright (c) Microsoft Corporation.)
[HKLM\SYSTEM\CurrentControlSet\Control\Els\Services\{CF7E00B1-909B-4d95-A8F4-611F7C377702}] : (Language

Detection) [@elscore.dll,-1] -> ElsLad.dll (Copyright (c) Microsoft Corporation.)

---------- | Loaded modules (whitelist)

[26/06/2018 13:44:55] - (8.0.0.395) - (Alps Electric Co., Ltd. - Alps Touch Pad Driver) - C:\Windows

\system32\DRIVERS\Apfiltr.sys
[08/05/2018 11:33:24] - (1.4.2.0) - (Dell Inc. - DDDriver.sys) - C:\Windows\system32\drivers

\DDDriver64Dcsa.sys
[08/05/2018 11:33:24] - (3.0.1.4) - (Dell Computer Corporation - DellProf.sys) - C:\Windows\system32\drivers

\DellProf.sys
[26/06/2018 13:41:19] - (6.10.6491.0) - (IDT, Inc. - IDT PC Audio) - C:\Windows\system32\DRIVERS\stwrt64.sys
[27/05/2016 08:03:50] - (1.0.0.0) - (LXD Development, Inc. - Gaming Mouse 33052 Driver) - C:\Windows

\system32\drivers\GMLXDFltr01.sys
[06/04/2019 14:02:57] - (2.9.30.0) - (Ploytec GmbH - Ploytec USB Audio driver) - C:\Windows\System32\Drivers

\akaieieu.sys
[06/04/2019 14:02:57] - (2.9.30.0) - (Numark - Numark WDM MIDI Driver) - C:\Windows\system32\drivers

\akaieiem.sys
[06/04/2019 14:02:57] - (2.9.30.0) - (Numark - Numark USB Audio WDM Driver) - C:\Windows\system32\drivers

\akaieiea.sys
[// ::] - (0.0.0.0) - ( -) - C:\Users\********\AppData\Local\Temp\aswMBR.sys
[// ::] - (0.0.0.0) - ( -) - C:\Users\********\AppData\Local\Temp\aswVmm.sys

---------- | Services | 0 : Starting up | 1 : System | 2 : Automatic | 3 : Manual | 4 : Disabled | R : Running

service | S : Stopped service

R0 - [Kernel Driver] - ACPI (Microsoft ACPI Driver) -> system32\drivers\ACPI.sys - AcceptPause: False -

AcceptStop: True
R0 - [Kernel Driver] - amdxata () -> system32\drivers\amdxata.sys - AcceptPause: False - AcceptStop: True
R0 - [Kernel Driver] - CLFS (@%SystemRoot%\system32\clfs.sys,-100) -> System32\CLFS.sys - AcceptPause: False -

AcceptStop: True
R0 - [Kernel Driver] - CNG () -> System32\Drivers\cng.sys - AcceptPause: False - AcceptStop: True
R0 - [Kernel Driver] - Compbatt (Microsoft Composite Battery Driver) -> system32\DRIVERS\compbatt.sys -

AcceptPause: False - AcceptStop: True
R0 - [Kernel Driver] - Disk (Disk Driver) -> system32\drivers\disk.sys - AcceptPause: False - AcceptStop: True
R0 - [File System Driver] - FileInfo (@%SystemRoot%\system32\drivers\fileinfo.sys,-100) -> system32\drivers

\fileinfo.sys - AcceptPause: False - AcceptStop: True
R0 - [File System Driver] - FltMgr (@%SystemRoot%\system32\drivers\fltmgr.sys,-10001) -> system32\drivers

\fltmgr.sys - AcceptPause: False - AcceptStop: True
R0 - [Kernel Driver] - fvevol (@%SystemRoot%\system32\drivers\fvevol.sys,-100) -> System32\DRIVERS\fvevol.sys

- AcceptPause: False - AcceptStop: True
R0 - [Kernel Driver] - hwpolicy (@%systemroot%\system32\drivers\hwpolicy.sys,-101) -> System32\drivers

\hwpolicy.sys - AcceptPause: False - AcceptStop: True
R0 - [Kernel Driver] - iaStorV (Intel RAID Controller Windows 7) -> system32\drivers\iaStorV.sys -

AcceptPause: False - AcceptStop: True
R0 - [Kernel Driver] - KSecDD () -> System32\Drivers\ksecdd.sys - AcceptPause: False - AcceptStop: True
R0 - [Kernel Driver] - KSecPkg () -> System32\Drivers\ksecpkg.sys - AcceptPause: False - AcceptStop: True
R0 - [Kernel Driver] - mountmgr (@%SystemRoot%\system32\drivers\mountmgr.sys,-100) -> System32\drivers

\mountmgr.sys - AcceptPause: False - AcceptStop: True
R0 - [Kernel Driver] - msisadrv () -> system32\drivers\msisadrv.sys - AcceptPause: False - AcceptStop: True
R0 - [File System Driver] - Mup (@%systemroot%\system32\drivers\mup.sys,-101) -> System32\Drivers\mup.sys -

AcceptPause: False - AcceptStop: True
R0 - [Kernel Driver] - NDIS (@%SystemRoot%\system32\drivers\ndis.sys,-200) -> system32\drivers\ndis.sys -

AcceptPause: False - AcceptStop: True
R0 - [Kernel Driver] - partmgr (@%SystemRoot%\system32\drivers\partmgr.sys,-100) -> System32\drivers

\partmgr.sys - AcceptPause: False - AcceptStop: True
R0 - [Kernel Driver] - pci (PCI Bus Driver) -> system32\drivers\pci.sys - AcceptPause: False - AcceptStop:

True
R0 - [Kernel Driver] - pcw (Performance Counters for Windows Driver) -> System32\drivers\pcw.sys -

AcceptPause: False - AcceptStop: True
R0 - [Kernel Driver] - rdyboost (ReadyBoost) -> System32\drivers\rdyboost.sys - AcceptPause: False -

AcceptStop: True
R0 - [Kernel Driver] - spldr (Security Processor Loader Driver) -> (?) - AcceptPause: False - AcceptStop: True
R0 - [Kernel Driver] - storflt (@%SystemRoot%\system32\vmstorfltres.dll,-1000) -> system32\drivers

\vmstorfl.sys - AcceptPause: False - AcceptStop: True
R0 - [Kernel Driver] - Tcpip (@%SystemRoot%\system32\tcpipcfg.dll,-50003) -> System32\drivers\tcpip.sys -

AcceptPause: False - AcceptStop: True
R0 - [Kernel Driver] - vdrvroot (Microsoft Virtual Drive Enumerator Driver) -> system32\drivers\vdrvroot.sys -

AcceptPause: False - AcceptStop: True
R0 - [Kernel Driver] - volmgr (Volume Manager Driver) -> system32\drivers\volmgr.sys - AcceptPause: False -

AcceptStop: True
R0 - [Kernel Driver] - volmgrx (@%SystemRoot%\system32\drivers\volmgrx.sys,-100) -> System32\drivers

\volmgrx.sys - AcceptPause: False - AcceptStop: True
R0 - [Kernel Driver] - volsnap (Storage volumes) -> system32\drivers\volsnap.sys - AcceptPause: False -

AcceptStop: True
R0 - [Kernel Driver] - Wdf01000 (@%SystemRoot%\system32\drivers\Wdf01000.sys,-1000) -> system32\drivers

\Wdf01000.sys - AcceptPause: False - AcceptStop: True
R1 - [Kernel Driver] - AFD (@%systemroot%\system32\drivers\afd.sys,-1000) -> \SystemRoot\system32\drivers

\afd.sys - AcceptPause: False - AcceptStop: True
R1 - [Kernel Driver] - Beep (Beep) -> (?) - AcceptPause: False - AcceptStop: True
R1 - [Kernel Driver] - blbdrive () -> system32\DRIVERS\blbdrive.sys - AcceptPause: False - AcceptStop: True
R1 - [Kernel Driver] - cdrom (CD-ROM Driver) -> system32\DRIVERS\cdrom.sys - AcceptPause: False - AcceptStop:

True
R1 - [Kernel Driver] - CSC (@%systemroot%\system32\cscsvc.dll,-202) -> system32\drivers\csc.sys - AcceptPause:

False - AcceptStop: True
R1 - [File System Driver] - DfsC (@%systemroot%\system32\drivers\dfsc.sys,-101) -> System32\Drivers\dfsc.sys -

AcceptPause: False - AcceptStop: True
R1 - [Kernel Driver] - discache (@%systemroot%\system32\drivers\discache.sys,-102) -> System32\drivers

\discache.sys - AcceptPause: False - AcceptStop: True
R1 - [File System Driver] - Msfs () -> (?) - AcceptPause: False - AcceptStop: True
R1 - [Kernel Driver] - mssmbios (Microsoft System Management BIOS Driver) -> \SystemRoot\system32\drivers

\mssmbios.sys - AcceptPause: False - AcceptStop: True
R1 - [File System Driver] - NetBIOS (NetBIOS Interface) -> system32\DRIVERS\netbios.sys - AcceptPause: False -

AcceptStop: True
R1 - [Kernel Driver] - NetBT (@%SystemRoot%\system32\drivers\netbt.sys,-2) -> System32\DRIVERS\netbt.sys -

AcceptPause: False - AcceptStop: True
R1 - [File System Driver] - Npfs () -> (?) - AcceptPause: False - AcceptStop: True
R1 - [Kernel Driver] - nsiproxy (@%SystemRoot%\system32\drivers\nsiproxy.sys,-2) -> system32\drivers

\nsiproxy.sys - AcceptPause: False - AcceptStop: True
R1 - [Kernel Driver] - Null () -> (?) - AcceptPause: False - AcceptStop: True
R1 - [Kernel Driver] - Psched (@%SystemRoot%\System32\drivers\pacer.sys,-101) -> system32\DRIVERS\pacer.sys -

AcceptPause: False - AcceptStop: True
R1 - [File System Driver] - rdbss (@%systemroot%\system32\wkssvc.dll,-1000) -> system32\DRIVERS\rdbss.sys -

AcceptPause: False - AcceptStop: True
R1 - [Kernel Driver] - RDPCDD (@%systemroot%\system32\DRIVERS\RDPCDD.sys,-100) -> System32\DRIVERS\RDPCDD.sys

- AcceptPause: False - AcceptStop: True
R1 - [Kernel Driver] - RDPENCDD (@%systemroot%\system32\drivers\RDPENCDD.sys,-101) -> system32\drivers

\rdpencdd.sys - AcceptPause: False - AcceptStop: True
R1 - [Kernel Driver] - RDPREFMP (@%systemroot%\system32\drivers\RdpRefMp.sys,-101) -> system32\drivers

\rdprefmp.sys - AcceptPause: False - AcceptStop: True
R1 - [Kernel Driver] - Serial (Serial port driver) -> system32\DRIVERS\serial.sys - AcceptPause: False -

AcceptStop: True
R1 - [Kernel Driver] - tdx (@%SystemRoot%\system32\tcpipcfg.dll,-50004) -> system32\DRIVERS\tdx.sys -

AcceptPause: False - AcceptStop: True
R1 - [Kernel Driver] - TermDD (Terminal Device Driver) -> \SystemRoot\system32\drivers\termdd.sys -

AcceptPause: False - AcceptStop: True
R1 - [Kernel Driver] - VgaSave () -> \SystemRoot\System32\drivers\vga.sys - AcceptPause: False - AcceptStop:

True
R1 - [Kernel Driver] - vwififlt (Virtual WiFi Filter Driver) -> system32\DRIVERS\vwififlt.sys - AcceptPause:

False - AcceptStop: True
R1 - [Kernel Driver] - Wanarpv6 (@%systemroot%\system32\rascfg.dll,-32012) -> system32\DRIVERS\wanarp.sys -

AcceptPause: False - AcceptStop: True
R1 - [Kernel Driver] - WfpLwf (WFP Lightweight Filter) -> system32\DRIVERS\wfplwf.sys - AcceptPause: False -

AcceptStop: True
R2 - [Kernel Driver] - lltdio (Link-Layer Topology Discovery Mapper I/O Driver) -> system32\DRIVERS\lltdio.sys

- AcceptPause: False - AcceptStop: True
R2 - [File System Driver] - luafv (@%systemroot%\system32\drivers\luafv.sys,-100) -> \SystemRoot

\system32\drivers\luafv.sys - AcceptPause: False - AcceptStop: True
R2 - [Kernel Driver] - PEAUTH (PEAUTH) -> system32\drivers\peauth.sys - AcceptPause: False - AcceptStop: True
R2 - [Kernel Driver] - rspndr (Link-Layer Topology Discovery Responder) -> system32\DRIVERS\rspndr.sys -

AcceptPause: False - AcceptStop: True
R2 - [Kernel Driver] - tcpipreg (TCP/IP Registry Compatibility) -> System32\drivers\tcpipreg.sys -

AcceptPause: False - AcceptStop: True

---------- | System files (Microsoft|Avast|Atheros|Adaptec|Brother|Intel Files whitelisted)

[MD5.9FC9C4753876A96C7DEE2E7FF8911294] - [20/03/2003 09:48:00] - (.Copyright (c) GEAR Software 2003 - Filter

Driver for 2k and XP.) - [9.22 Ko] - (1.0.2.3) - C:\Windows\Syswow64\Drivers\GEARAspiWDM.sys

---------- | Uninstall (Whitelist)

[HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\AddressBook] : (.-.) ->
----------[{Hidden}][HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\Connection Manager] : (.-.) ->
[HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\DirectDrawEx] : (.-.) ->
[HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\DXM_Runtime] : (.-.) ->
[HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\Fontcore] : (.-.) ->
[HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\IE40] : (.-.) ->
[HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\IE4Data] : (.-.) ->
[HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\IE5BAKEX] : (.-.) ->
[HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\IEData] : (.-.) ->
[HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\MobileOptionPack] : (.-.) ->
[HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\MPlayer2] : (.-.) ->
[HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\PROSet] : (Intel(R) Network Connections

Drivers.-.Intel) -> Prounstl.exe
[HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\Reason10.0Stable_64_is1] : (Reason 10

10.4.0d4.-.Propellerhead Software AB) -> "C:\Program Files\Propellerhead\Reason 10\Uninstall Reason

10\unins000.exe"
[HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\Reason8.0Stable_64_is1] : (Reason 8

8.3.2d7.-.Propellerhead Software AB) -> "C:\Program Files\Propellerhead\Reason 8\Uninstall Reason

8\unins000.exe"
[HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\SchedulingAgent] : (.-.) ->
[HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\USB_AUDIO_DEusb-audio.deAkaiEIE] : (Akai EIE Pro USB

Audio driver.-.) -> C:\Windows\usb-audio.deAkaiEIE\Setup.exe /l1
[HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\WIC] : (.-.) ->
[HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\{23170F69-40C1-2702-1805-000001000000}] : (7-Zip

18.05 (x64 edition).-.Igor Pavlov) -> MsiExec.exe /I{23170F69-40C1-2702-1805-000001000000}
[HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\{45B3032F-22CC-40CD-9E97-4DA7095FA5A2}] : (PuTTY

release 0.70 (64-bit).-.Simon Tatham) -> MsiExec.exe /X{45B3032F-22CC-40CD-9E97-4DA7095FA5A2}
----------[{Hidden}][HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\{73ca1ddf-9d19-45f2-ad4c-

04169ec13342}] : (Intel(R) PRO/Wireless Driver.-.Intel Corporation) ->
[HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\{806422F1-FC4E-4D7C-8855-05748AEFC031}] : (Dell

SupportAssist.-.Dell Inc.) -> MsiExec.exe /X{806422F1-FC4E-4D7C-8855-05748AEFC031}
----------[{Hidden}][HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\{9C481E27-751F-48B9-801D-

C583F032DA50}] : (Intel® PROSet/Wireless WiFi Software.-.Intel Corporation) -> MsiExec.exe /I{9C481E27-751F-

48B9-801D-C583F032DA50}
----------[{Hidden}][HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\{B5E06417-A4AC-4225-B36E-

7E34C91616E7}] : (Intel® Trusted Connect Service Client.-.Intel Corporation) -> MsiExec.exe /I{B5E06417-A4AC-

4225-B36E-7E34C91616E7}
----------[{Hidden}][HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\{BE1CF6CA-3182-45D8-9535-

A18055B73607}] : (Dell Custom Help.-.Intel Corporation) ->
[HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\{F6762963-9AE5-4bc6-A70F-2D749F6AC02F}_is1] :

(Authorizer 2.9.5d1.-.Propellerhead Software AB) -> "C:\Program Files\Propellerhead\Authorizer\Uninstall

Authorizer\unins000.exe"
[HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\CurrentVersion\Uninstall\AddressBook] : (.-.) ->
----------[{Hidden}][HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\CurrentVersion\Uninstall\Connection Manager]

: (.-.) ->
[HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\CurrentVersion\Uninstall\DirectDrawEx] : (.-.) ->
[HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\CurrentVersion\Uninstall\Fontcore] : (.-.) ->
[HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\CurrentVersion\Uninstall\IE40] : (.-.) ->
[HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\CurrentVersion\Uninstall\IE4Data] : (.-.) ->
[HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\CurrentVersion\Uninstall\IE5BAKEX] : (.-.) ->
[HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\CurrentVersion\Uninstall\IEData] : (.-.) ->
[HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\CurrentVersion\Uninstall\Line 6 Uninstaller] : (Line 6

Uninstaller.-.Line 6) -> C:\Users\********\AppData\Roaming\Line 6\L6TWXY\Tools\Line 6 Uninstaller.exe
[HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\CurrentVersion\Uninstall\MobileOptionPack] : (.-.) ->
[HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\CurrentVersion\Uninstall\Neutron 2] : (Neutron 2

Advanced.-.iZotope, Inc.) -> C:\Program Files (x86)\iZotope\Neutron 2\Uninstall Neutron 2.exe
[HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\CurrentVersion\Uninstall\Ozone 8] : (Ozone 8 Advanced.-.iZotope,

Inc.) -> C:\VSTs\iZotope\Ozone 8\Uninstall Ozone 8.exe
[HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\CurrentVersion\Uninstall\SchedulingAgent] : (.-.) ->
[HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\CurrentVersion\Uninstall\WIC] : (.-.) ->
[HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\CurrentVersion\Uninstall\{24D75A2D-A712-42F7-B71B-2FFF95905C97}

_is1] : (Europa by Reason.-.Propellerhead Software) -> "C:\Users\********\AppData\Roaming\Propellerhead

Software\Europa by Reason\unins000.exe"
[HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\CurrentVersion\Uninstall\{4920CF11-4A79-4D8D-B643-58E0611FC106}]

: (MixMeister Pro 5.-.MixMeister Technology LLC) -> MsiExec.exe /I{4920CF11-4A79-4D8D-B643-58E0611FC106}
----------[{Hidden}][HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6

-A427-B07A5498B4CA}] : (Google Update Helper.-.Google LLC) -> MsiExec.exe /I{60EC980A-BDA2-4CB6-A427-

B07A5498B4CA}
[HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\CurrentVersion\Uninstall\{88374377-FCCE-498B-AD19-D72D755F0D46}]

: (Visioneer RoadWarrior 3 Series Driver.-.Visioneer Inc.) -> MsiExec.exe /I{88374377-FCCE-498B-AD19-

D72D755F0D46}
[HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\CurrentVersion\Uninstall\{AAF91E62-A45B-489B-9C98-3E8C06EBB74F}]

: (Visioneer Acuity Assets V1.-.Visioneer Inc.) -> MsiExec.exe /I{AAF91E62-A45B-489B-9C98-3E8C06EBB74F}

---------- | Ports

---------- | Installer

[HKCR\Installer\Products\11FC029497A4D8D46B34850E16F11C60] : MixMeister Pro 5
[HKCR\Installer\Products\1F224608E4CFC7D488555047A8FE0C13] : Dell SupportAssist -> C:\Windows\Installer

\{806422F1-FC4E-4D7C-8855-05748AEFC031}\ARPPRODUCTICON.exe
[HKCR\Installer\Products\26E19FAAB54AB984C989E3C860BE7BF4] : Visioneer Acuity Assets V1 -> C:\Windows

\Installer\{AAF91E62-A45B-489B-9C98-3E8C06EBB74F}\_6FEFF9B68218417F98F549.exe
[HKCR\Installer\Products\71460E5BCA4A52243BE6E7439C61617E] : Intel® Trusted Connect Service Client
[HKCR\Installer\Products\72E184C9F1579B8408D15C380F23AD05] : Intel® PROSet/Wireless WiFi Software -> C:

\Windows\Installer\{9C481E27-751F-48B9-801D-C583F032DA50}\ARPPRODUCTICON.exe
[HKCR\Installer\Products\77347388ECCFB894DA917DD257F5D064] : Visioneer RoadWarrior 3 Series Driver -> C:

\Windows\Installer\{88374377-FCCE-498B-AD19-D72D755F0D46}\_RWAR3ICON
[HKCR\Installer\Products\96F071321C0420728150000010000000] : 7-Zip 18.05 (x64 edition)
[HKCR\Installer\Products\A089CE062ADB6BC44A720BA745894BAC] : Google Update Helper
[HKCR\Installer\Products\AC6FC1EB28138D5459531A08557B6370] : Dell Custom Help -> C:\Windows\Installer

\{BE1CF6CA-3182-45D8-9535-A18055B73607}\ARPPRODUCTICON.exe
[HKCR\Installer\Products\F2303B54CC22DC04E979D47A90F55A2A] : PuTTY release 0.70 (64-bit) -> C:\Windows

\Installer\{45B3032F-22CC-40CD-9E97-4DA7095FA5A2}\installericon.exe
[HKCR\Installer\Products\FDD1AC3791D92F54DAC44061E91C3324] : Intel(R) PRO/Wireless Driver -> C:\Windows

\Installer\{73CA1DDF-9D19-45F2-AD4C-04169EC13342}\ARPPRODUCTICON.exe

---------- | Drives

---------- | MBR

64 bits not supported by MBR.exe, Dump : C:\QuickDiag\MBR.Bin

---------- | 20 La********ntLog

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

"Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

"//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem

is corrected.
------------

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

"Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

"//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem

is corrected.
------------

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

"Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

"//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem

is corrected.
------------

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

"Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

"//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem

is corrected.
------------

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

"Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

"//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem

is corrected.
------------

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

"Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

"//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem

is corrected.
------------

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

"Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

"//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem

is corrected.
------------

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

"Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

"//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem

is corrected.
------------

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

"Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

"//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem

is corrected.
------------

------------

------------

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

"Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

"//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem

is corrected.
------------

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

"Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

"//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem

is corrected.
------------

An exception occurred in session change of service start: System.Reflection.TargetInvocationException:

Exception has been thrown by the target of an invocation. ---> System.TypeLoadException: Could not find

Windows Runtime type 'Windows.UI.Notifications.ToastNotificationManager'. --->

System.PlatformNotSupportedException: Operation is not supported on this platform.
--- End of inner exception stack trace ---
at

Dell.Services.SupportAssist.Notification.Command.NotificationCommand.<DeleteNotificationWhileUninstall>d__23.M

oveNext()
at System.Runtime.CompilerServices.AsyncTaskMethodBuilder.Start[TStateMachine](TStateMachine& stateMachine)
at Dell.Services.SupportAssist.Notification.Command.NotificationCommand.DeleteNotificationWhileUninstall()
at Dell.Services.SupportAssist.Notification.Command.NotificationCommand.ShowNotificationsOnSessionUnlock

(SessionChangeDescription changeDescription)
--- End of inner exception stack trace ---
at System.RuntimeMethodHandle.InvokeMethod(Object target, Object[] arguments, Signature sig, Boolean

constructor)
at System.Reflection.RuntimeMethodInfo.UnsafeInvokeInternal(Object obj, Object[] parameters, Object[]

arguments)
at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[]

parameters, CultureInfo culture)
at Dell.Services.SupportAssist.SupportAssistAgent.BootStrapperMinimized.SessionChangeAction

(SessionChangeDescription changeDescription)
at Dell.Services.SupportAssist.SupportAssistAgent.SupportAssistAgent.OnSessionChange

(SessionChangeDescription changeDescription)
------------

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

"Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

"//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem

is corrected.
------------

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

"Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

"//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem

is corrected.
------------

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

"Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

"//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem

is corrected.
------------

Faulting application name: wmiprvse.exe, version: 6.1.7601.17514, time stamp: 0x4ce79d42
Faulting module name: WINTRUST.dll, version: 6.1.7601.23971, time stamp: 0x5a26d97f
Exception code: 0xc0000005
Fault offset: 0x000000000000a8ea
Faulting process id: 0xaa8
Faulting application start time: 0x01d51ee7b4e3a1e7
Faulting application path: C:\Windows\system32\wbem\wmiprvse.exe
Faulting module path: C:\Windows\system32\WINTRUST.dll
Report Id: c8af1667-8c90-11e9-bb6e-b8ca3ad5e05a
------------

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

"Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

"//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem

is corrected.
------------

----------( EOF)---------- - 3076 | 10:41:58

Malnutrition · Jul 20, 2019

Make sure and add your user name to this fix, where it is needed.

Download attached fixlist.txt file and save it to the Desktop. NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work. NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system. Run FRST/FRST64 and press the Fix button just once and wait. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run. When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

Malnutrition · Jul 20, 2019

The way you broke the log up to edit your name makes it difficult to read....

What is in these folders??

C:\Windows\1f8bf2vui4tpp8w
C:\Windows\2e2uf4b4q8p2kci
C:\Windows\4cwyf4jbcce5n1p
C:\Windows\4cwyfyv7x1w5n1p
C:\Windows\5b4wf2e7p2v8qio
C:\Windows\5b4wf4c8n5s1jta
C:\Windows\5b4wf4poy2v8qio
C:\Windows\5b4wf7y1l7q8qio
C:\Windows\5b4wffx8w5s1jta
C:\Windows\5b4wfyn5s5s1jta

Fla_Panther · Jul 20, 2019

Those are 1kb hidden files, containing non-human-readable characters.
Not sure how Find & Replace is breaking the logs ... it should just be converting only the relevant characters, not adding any line breaks.

Fix result of Farbar Recovery Scan Tool (x64) Version: 15-07-2019 01
Ran by ******** (15-07-2019 12:07:29) Run:1
Running from C:\Users\********\Desktop
Loaded Profiles: ******** (Available Profiles: ********)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start
Closeprocesses:
CreateRestorePoint:
Emptytemp:
RemoveProxy:
FirewallRules: [{DD6A69A7-6F4D-4C94-93A3-EFD897DCD692}] => (Allow) C:\Users\********\AppData\Roaming\uTorrent\uTorrent.exe No File
FirewallRules: [{D0C21295-8A4D-4AAF-867C-F5606173A37E}] => (Allow) C:\Users\********\AppData\Roaming\uTorrent\uTorrent.exe No File
HKU\S-1-5-21-3206243102-205974907-2145499838-1000\...\MountPoints2: {a08823cb-795d-11e8-b725-e41f28566541} - E:\RTK_NIC_DRIVER_INSTALLER.sfx.exe
Task: {D67DBDCB-4494-4132-A263-D7274A930236} - System32\Tasks\{EE1BEB1A-D10C-43A0-9D62-B7BBC4690C0E} => C:\Windows\system32\pcalua.exe -a C:\Users\********\Desktop\out_lame.binf_v164.exe -d C:\Users\********\Desktop
Task: {F3CA5017-53C0-47CD-A21A-E197090FB41D} - System32\Tasks\Dell SupportAssistAgent AutoUpdate => C:\Program Files\Dell\SupportAssistAgent\bin\SupportAssistInstaller.exe [1512920 2019-05-24] (Dell Inc. -> Dell Inc.)
Tcpip\Parameters: [DhcpNameServer] 209.18.47.62 209.18.47.61
Tcpip\..\Interfaces\{F1ABA7E1-57DC-49E4-8FA4-8A72EEFAFE0B}: [DhcpNameServer] 209.18.47.62 209.18.47.61
HKLM\System\...\Parameters\PersistentRoutes: [0.0.0.0,0.0.0.0,192.168.0.201,-1]
HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.dell.com/
HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dell.com
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
C:\Users\********\AppData\Local\*.*
C:\Users\********\AppData\Roaming\*.*
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File
C:\Windows\system32\drivers\etc\hosts
hosts:
StartBatch:
ipconfig /flushdns
netsh advfirewall reset
net stop Hamachi2Svc
net stop HiPatchService
net stop DDVRulesProcessor
net stop Dell Hardware Support
net stop SupportAssistAgent
net stop WinDefend
sc config "Hamachi2Svc" start= demand
sc config "HiPatchService" start= demand
sc config DDVRulesProcessor start= demand
sc config Dell Hardware Support start= demand
sc config SupportAssistAgent= demand
sc config Windefend= demand
dir /a C:\temp
dir /a "C:\Program Files\Common Files\AV"
dir /a C:\Users\???\AppData\Roaming
dir /a C:\Users\???\AppData\Local
EndBatch:
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state ON
CMD: ipconfig /flushdns
CMD: netsh winsock reset catalog
CMD: netsh int ip reset c:\resetlog.txt
CMD: ipconfig /release
CMD: ipconfig /renew
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
CMD: bitsadmin /reset /allusers
EmptyTemp:
reboot:
end
*****************

Processes closed successfully.
Restore point was successfully created.

========= RemoveProxy: =========

"HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => removed successfully
"HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => removed successfully
"HKU\S-1-5-21-3206243102-205974907-2145499838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => removed successfully
"HKU\S-1-5-21-3206243102-205974907-2145499838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => removed successfully

========= End of RemoveProxy: =========

"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{DD6A69A7-6F4D-4C94-93A3-EFD897DCD692}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{D0C21295-8A4D-4AAF-867C-F5606173A37E}" => removed successfully
HKU\S-1-5-21-3206243102-205974907-2145499838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a08823cb-795d-11e8-b725-e41f28566541} => removed successfully
HKLM\Software\Classes\CLSID\{a08823cb-795d-11e8-b725-e41f28566541} => not found
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{D67DBDCB-4494-4132-A263-D7274A930236}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D67DBDCB-4494-4132-A263-D7274A930236}" => removed successfully
C:\Windows\System32\Tasks\{EE1BEB1A-D10C-43A0-9D62-B7BBC4690C0E} => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{EE1BEB1A-D10C-43A0-9D62-B7BBC4690C0E}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F3CA5017-53C0-47CD-A21A-E197090FB41D}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F3CA5017-53C0-47CD-A21A-E197090FB41D}" => removed successfully
C:\Windows\System32\Tasks\Dell SupportAssistAgent AutoUpdate => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Dell SupportAssistAgent AutoUpdate" => removed successfully
"HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\\DhcpNameServer" => removed successfully
"HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{F1ABA7E1-57DC-49E4-8FA4-8A72EEFAFE0B}\\DhcpNameServer" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\\0.0.0.0,0.0.0.0,192.168.0.201,-1" => removed successfully
HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully
HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully
HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE => removed successfully
HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE => removed successfully

=========== "C:\Users\********\AppData\Local\*.*" ==========

C:\Users\********\AppData\Local\GDIPFONTCACHEV1.DAT => moved successfully
C:\Users\********\AppData\Local\IconCache.db => moved successfully
C:\Users\********\AppData\Local\PUTTY.RND => moved successfully

========= End -> "C:\Users\********\AppData\Local\*.*" ========

=========== "C:\Users\********\AppData\Roaming\*.*" ==========

not found

========= End -> "C:\Users\********\AppData\Roaming\*.*" ========

HKLM\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers\igfxcui => removed successfully
HKLM\Software\Classes\CLSID\{3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => not found
C:\Windows\system32\drivers\etc\hosts => moved successfully
Hosts restored successfully.

========= Batch: =========

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.
Ok.

The service name is invalid.

More help is available by typing NET HELPMSG 2185.

The service name is invalid.

More help is available by typing NET HELPMSG 2185.

The Dell Data Vault Processor service is not started.

More help is available by typing NET HELPMSG 3521.

The syntax of this command is:

NET STOP
service

The Dell SupportAssist service is not started.

More help is available by typing NET HELPMSG 3521.

..
The Windows Defender service was stopped successfully.

[SC] OpenService FAILED 1060:

The specified service does not exist as an installed service.

[SC] OpenService FAILED 1060:

The specified service does not exist as an installed service.

[SC] ChangeServiceConfig SUCCESS
DESCRIPTION:
Modifies a service entry in the registry and Service Database.
USAGE:
sc <server> config [service name] <option1> <option2>...

OPTIONS:
NOTE: The option name includes the equal sign.
A space is required between the equal sign and the value.
type= <own|share|interact|kernel|filesys|rec|adapt>
start= <boot|system|auto|demand|disabled|delayed-auto>
error= <normal|severe|critical|ignore>
binPath= <BinaryPathName>
group= <LoadOrderGroup>
tag= <yes|no>
depend= <Dependencies(separated by / (forward slash))>
obj= <AccountName|ObjectName>
DisplayName= <display name>
password= <password>
DESCRIPTION:
Modifies a service entry in the registry and Service Database.
USAGE:
sc <server> config [service name] <option1> <option2>...

OPTIONS:
NOTE: The option name includes the equal sign.
A space is required between the equal sign and the value.
type= <own|share|interact|kernel|filesys|rec|adapt>
start= <boot|system|auto|demand|disabled|delayed-auto>
error= <normal|severe|critical|ignore>
binPath= <BinaryPathName>
group= <LoadOrderGroup>
tag= <yes|no>
depend= <Dependencies(separated by / (forward slash))>
obj= <AccountName|ObjectName>
DisplayName= <display name>
password= <password>
DESCRIPTION:
Modifies a service entry in the registry and Service Database.
USAGE:
sc <server> config [service name] <option1> <option2>...

OPTIONS:
NOTE: The option name includes the equal sign.
A space is required between the equal sign and the value.
type= <own|share|interact|kernel|filesys|rec|adapt>
start= <boot|system|auto|demand|disabled|delayed-auto>
error= <normal|severe|critical|ignore>
binPath= <BinaryPathName>
group= <LoadOrderGroup>
tag= <yes|no>
depend= <Dependencies(separated by / (forward slash))>
obj= <AccountName|ObjectName>
DisplayName= <display name>
password= <password>
Volume in drive C has no label.
Volume Serial Number is B62F-E83E

Directory of C:\temp

10/29/2018 08:46 PM <DIR> .
10/29/2018 08:46 PM <DIR> ..
0 File(s) 0 bytes
2 Dir(s) 25,897,353,216 bytes free
Volume in drive C has no label.
Volume Serial Number is B62F-E83E

Directory of C:\Program Files\Common Files

File Not Found
The filename, directory name, or volume label syntax is incorrect.
The filename, directory name, or volume label syntax is incorrect.

========= End of Batch: =========

========= reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f =========

The operation completed successfully.

========= End of Reg: =========

========= reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f =========

The operation completed successfully.

========= End of Reg: =========

========= netsh advfirewall reset =========

Ok.

========= End of CMD: =========

========= netsh advfirewall set allprofiles state ON =========

Ok.

========= End of CMD: =========

========= ipconfig /flushdns =========

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========

========= netsh winsock reset catalog =========

Sucessfully reset the Winsock Catalog.
You must restart the computer in order to complete the reset.

========= End of CMD: =========

========= netsh int ip reset c:\resetlog.txt =========

Reseting Global, OK!
Reseting Interface, OK!
Reseting Unicast Address, OK!
Reseting Route, OK!
Reseting Subinterface, OK!
Restart the computer to complete this action.

========= End of CMD: =========

========= ipconfig /release =========

Windows IP Configuration

No operation can be performed on Wireless Network Connection 3 while it has its media disconnected.
No operation can be performed on Wireless Network Connection 2 while it has its media disconnected.

Wireless LAN adapter Wireless Network Connection 3:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Wireless LAN adapter Wireless Network Connection 2:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Wireless LAN adapter Wireless Network Connection:

Connection-specific DNS Suffix . :
IPv6 Address. . . . . . . . . . . : ::808b:ac54:2e88:6506
Temporary IPv6 Address. . . . . . : ::d039:672f:5fd9:d29a
Link-local IPv6 Address . . . . . : fe80::808b:ac54:2e88:6506%14
Default Gateway . . . . . . . . . :

Ethernet adapter Local Area Connection 2:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Tunnel adapter isatap.{41B84864-2D3D-4D17-B09E-E347F560F7F7}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Tunnel adapter isatap.{3D0D15B6-5A19-4873-88B7-D9B5B9D67406}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Tunnel adapter isatap.{AFE20685-E901-42C7-A0EA-94EC69D7938C}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Tunnel adapter isatap.mifi.local:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

========= End of CMD: =========

========= ipconfig /renew =========

Windows IP Configuration

No operation can be performed on Wireless Network Connection 3 while it has its media disconnected.
No operation can be performed on Wireless Network Connection 2 while it has its media disconnected.
No operation can be performed on Local Area Connection 2 while it has its media disconnected.

Wireless LAN adapter Wireless Network Connection 3:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Wireless LAN adapter Wireless Network Connection 2:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Wireless LAN adapter Wireless Network Connection:

Connection-specific DNS Suffix . :
IPv6 Address. . . . . . . . . . . : ::808b:ac54:2e88:6506
Temporary IPv6 Address. . . . . . : ::d039:672f:5fd9:d29a
Link-local IPv6 Address . . . . . : fe80::808b:ac54:2e88:6506%14
IPv4 Address. . . . . . . . . . . : 192.168.0.3
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.0.1

Ethernet adapter Local Area Connection 2:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Tunnel adapter isatap.{41B84864-2D3D-4D17-B09E-E347F560F7F7}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Tunnel adapter isatap.{3D0D15B6-5A19-4873-88B7-D9B5B9D67406}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Tunnel adapter isatap.{AFE20685-E901-42C7-A0EA-94EC69D7938C}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Tunnel adapter isatap.mifi.local:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

========= End of CMD: =========

========= netsh int ipv4 reset =========

Reseting Interface, OK!
Restart the computer to complete this action.

========= End of CMD: =========

========= netsh int ipv6 reset =========

There's no user specified settings to be reset.

========= End of CMD: =========

========= bitsadmin /reset /allusers =========

BITSADMIN version 3.0 [ 7.5.7601 ]
BITS administration utility.
(C) Copyright 2000-2006 Microsoft Corp.

BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.

Unable to cancel {97BBEDF9-9744-46DB-8361-9072ACC2FB39}.
Unable to cancel {EB242197-4D7C-460A-95BA-496CC5DE1902}.
0 out of 2 jobs canceled.

========= End of CMD: =========

=========== EmptyTemp: ==========

BITS transfer queue => 8388608 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 114554891 B
Java, Flash, Steam htmlcache => 508998 B
Windows/system/drivers => 90185128 B
Edge => 0 B
Chrome => 266632772 B
Firefox => 210102278 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Users => 0 B
Default => 0 B
Public => 0 B
ProgramData => 0 B
systemprofile => 66356 B
systemprofile32 => 66356 B
LocalService => 0 B
NetworkService => 228608 B
******** => 19243430732 B

RecycleBin => 609313796 B
EmptyTemp: => 19.1 GB temporary data Removed.

================================

The system needed a reboot.

==== End of Fixlog 12:07:57 ====

Malnutrition · Jul 20, 2019

You are safe to delete those folders, there is no malware that I can see.

I'd Run this tool to clean up more crap from your machine tho, just empty of the temp files cleaned up 20 gigs.

Privazer

Adware Cleaner Scan.

Please download AdwCleaner by Xplode onto your desktop.

Close all open programs and internet browsers.
Right Click on adwcleaner.exe and run as admin to run the tool.
Click on Scan button.
When the scan has finished click on Clean button.
Your computer will be rebooted automatically. A text file will open after the restart.
Please Attach the contents of that logfile with your next reply.
You can find the logfile at C:\AdwCleaner[S1].txt as well.

====================================================================================

ZHP Scan.

Please download Zhp Cleaner to your desktop. Right Click the icon and select run as administrator.

2. Once you have started the program, you will need to click the scanner button.

The program will close all open browsers!
3. Once the scan is completed, the you will want to click the Repair button.

At the end of the process you may be asked to reboot your machine. After you reboot a report will open on your desktop.

Copy and paste the report here in your next reply.

====================================================================

Security Check Scan.

Download Security Check to your desktop.
Right click it run as administrator.
When the program completes, the tool will automatically open a log file.
Please post that log here in your next post.

=============================================================================

HijackThis.

1- Please click HERE to download HijackThis.
2- Run the program.
3- Click on the Main Menu button if not already there.
4- Select Do a system scan and save a logfile.
5- Copy paste the log here.

Fla_Panther · Jul 20, 2019

No, the temp folder was empty. I had a 20GB folder of WAV files on my desktop that I moved to F: and I emptied the recycle bin, which was another 20GB. But Privizer did delete almost another 20GB, so I've got almost 60GB free now.

My main concern about whether or not I've been infected is that in the last year I started using a password manager with different complex passwords for every website. Of course if my PC is infected with a keylogger then they could download my password file and open that and have all the keys anyway. It will be super annoying if I have to go change the passwords for all these sites again (I have something like 100+ recorded).

Here are the logs:

~ ZHPCleaner v2019.7.19.103 by Nicolas Coolman (2019/07/19)
~ Run by ******** (Administrator) (15/07/2019 15:07:42)
~ Web: https://www.nicolascoolman.com
~ Blog: https://nicolascoolman.eu/
~ Facebook : https://www.facebook.com/nicolascoolman1
~ State version : Version OK
~ Certificate ZHPCleaner: Legal
~ Type : Scan
~ Report : C:\Users\********\Desktop\ZHPCleaner (S).txt
~ Quarantine : C:\Users\********\AppData\Roaming\ZHP\ZHPCleaner_Reg.txt
~ System Restore Point :
~ UAC : Activate
~ Boot Mode : Normal (Normal boot)
Windows 7 Professional, 64-bit Service Pack 1 (Build 7601)

---\\ Alternate Data Stream (ADS). (0)
~ No malicious or unnecessary items found.

---\\ Services (0)
~ No malicious or unnecessary items found.

---\\ Browser internet (0)
~ No malicious or unnecessary items found.

---\\ Hosts file (1)
~ The hosts file is legitimate (1)

---\\ Scheduled automatic tasks. (0)
~ No malicious or unnecessary items found.

---\\ Explorer ( File, Folder) (12)
FOUND file: C:\Windows\Installer\wix{B5E06417-A4AC-4225-B36E-7E34C91616E7}.SchedServiceConfig.rmi =>.SUP.Empty
FOUND folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\000 =>.SUP.Temporary.Chrome
FOUND folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\001 =>.SUP.Temporary.Chrome
FOUND folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\002 =>.SUP.Temporary.Chrome
FOUND folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\003 =>.SUP.Temporary.Chrome
FOUND folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\004 =>.SUP.Temporary.Chrome
FOUND folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\005 =>.SUP.Temporary.Chrome
FOUND folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\006 =>.SUP.Temporary.Chrome
FOUND folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\007 =>.SUP.Temporary.Chrome
FOUND folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\008 =>.SUP.Temporary.Chrome
FOUND folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\009 =>.SUP.Temporary.Chrome
FOUND folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\010 =>.SUP.Temporary.Chrome

---\\ Registry ( Key, Value, Data) (0)
~ No malicious or unnecessary items found.

---\\ Summary of the elements found (2)
https://nicolascoolman.eu/2017/01/20/logiciels-superflus/ =>.SUP.Empty
https://nicolascoolman.eu/2017/01/20/logiciels-superflus/ =>.SUP.Temporary.Chrome

---\\ Result of repair
~ Any repair made
~ Browser not found (Opera Software)

---\\ Statistics
~ Items scanned : 64416
~ Items found : 12
~ Items cancelled : 0
~ Items options : 13/13
~ Space saving (bytes) : 0

~ End of search in 00h03mn09s

---\\ Reports (0)
ZHPCleaner-~~-15072019-15_10_51.txt~~

~ ZHPCleaner v2019.7.19.103 by Nicolas Coolman (2019/07/19)
~ Run by ******** (Administrator) (15/07/2019 15:12:37)
~ Web: https://www.nicolascoolman.com
~ Blog: https://nicolascoolman.eu/
~ Facebook : https://www.facebook.com/nicolascoolman1
~ State version : Version OK
~ Certificate ZHPCleaner: Legal
~ Type : Repair
~ Report : C:\Users\********\Desktop\ZHPCleaner (R).txt
~ Quarantine : C:\Users\********\AppData\Roaming\ZHP\ZHPCleaner_Reg.txt
~ System Restore Point : OK
~ UAC : Activate
~ Boot Mode : Normal (Normal boot)
Windows 7 Professional, 64-bit Service Pack 1 (Build 7601)

---\\ Alternate Data Stream (ADS). (0)
~ No malicious or unnecessary items found.

---\\ Services (0)
~ No malicious or unnecessary items found.

---\\ Browser internet (0)
~ No malicious or unnecessary items found.

---\\ Hosts file (1)
~ The hosts file is legitimate (1)

---\\ Scheduled automatic tasks. (0)
~ No malicious or unnecessary items found.

---\\ Explorer ( File, Folder) (12)
MOVED file: C:\Windows\Installer\wix{B5E06417-A4AC-4225-B36E-7E34C91616E7}.SchedServiceConfig.rmi =>.SUP.Empty
MOVED folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\000 =>.SUP.Temporary.Chrome
MOVED folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\001 =>.SUP.Temporary.Chrome
MOVED folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\002 =>.SUP.Temporary.Chrome
MOVED folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\003 =>.SUP.Temporary.Chrome
MOVED folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\004 =>.SUP.Temporary.Chrome
MOVED folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\005 =>.SUP.Temporary.Chrome
MOVED folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\006 =>.SUP.Temporary.Chrome
MOVED folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\007 =>.SUP.Temporary.Chrome
MOVED folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\008 =>.SUP.Temporary.Chrome
MOVED folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\009 =>.SUP.Temporary.Chrome
MOVED folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\010 =>.SUP.Temporary.Chrome

---\\ Registry ( Key, Value, Data) (0)
~ No malicious or unnecessary items found.

---\\ Summary of the elements found (2)
https://nicolascoolman.eu/2017/01/20/logiciels-superflus/ =>.SUP.Empty
https://nicolascoolman.eu/2017/01/20/logiciels-superflus/ =>.SUP.Temporary.Chrome

---\\ Other deletions. (4)
~ Registry Keys Tracing deleted (4)
~ Remove the old reports ZHPCleaner. (0)

---\\ Result of repair
~ Repair carried out successfully
~ Browser not found (Opera Software)

---\\ Statistics
~ Items scanned : 684
~ Items found : 0
~ Items cancelled : 0
~ Items options : 13/13
~ Space saving (bytes) : 0

~ End of clean in 00h00mn07s

---\\ Reports (2)
ZHPCleaner--15072019-15_10_51.txt
ZHPCleaner-[R]-15072019-15_12_44.txt

SecurityCheck by glax24 & Severnyj v.1.4.0.53 [27.10.17]
WebSite: www.safezone.cc
DateLog: 15.07.2019 15:15:57
Path starting: C:\Users\********\AppData\Local\Temp\SecurityCheck\SecurityCheck.exe
Log directory: C:\SecurityCheck\
IsAdmin: True
User: ********
VersionXML: 6.63is-06.07.2019
___________________________________________________________________________

Windows 7(6.1.7601) Service Pack 1 (x64) Professional Lang: English(0409)
Installation date OS: 26.06.2018 13:29:10
LicenseStatus: Windows(R) 7, Professional edition The machine is permanently activated.
Boot Mode: Normal
Default Browser: C:\Program Files\Mozilla Firefox\firefox.exe
SystemDrive: C: FS: [NTFS] Capacity: [200 Gb] Used: [140.6 Gb] Free: [59.4 Gb]
------------------------------- [ Windows ] -------------------------------
Internet Explorer 11.0.9600.19403 [+]
User Account Control enabled (Level 3)
Notify before download
Date install updates: 2019-07-15 00:30:27
Windows Update (wuauserv) - The service has stopped
Security Center (wscsvc) - The service has stopped
Remote Registry (RemoteRegistry) - The service has stopped
SSDP Discovery (SSDPSRV) - The service is running
Remote Desktop Services (TermService) - The service has stopped
Windows Remote Management (WS-Management) (WinRM) - The service has stopped
------------------------------ [ MS Office ] ------------------------------
Microsoft Office 2010 x86 v.14.0.6029.1000
--------------------------- [ FirewallWindows ] ---------------------------
Windows Firewall (MpsSvc) - The service is running
--------------------------- [ AntiSpyware_WMI ] ---------------------------
Windows Defender (enabled and up to date)
--------------------------- [ OtherUtilities ] ----------------------------
VLC media player v.3.0.6 Warning! Download Update
Microsoft .NET Framework 4.7.2 v.4.7.03062
PuTTY release 0.70 (64-bit) v.0.70.0.0 Warning! Download Update
Dell SupportAssist v.3.2.2.119 [+]
Foxit Reader v.9.4.1.16828 Warning! Download Update
IrfanView 4.51 (32-bit) v.4.51
KeePass Password Safe 2.39.1 v.2.39.1 Warning! Download Update
Winamp v.5.666 [+]
-------------------------------- [ Arch ] ---------------------------------
7-Zip 18.05 (x64 edition) v.18.05.00.0 Warning! Download Update
Uninstall old version and install new one.
--------------------------------- [ IM ] ----------------------------------
Skype version 8.29 v.8.29 Warning! Download Update
--------------------------- [ AdobeProduction ] ---------------------------
Adobe Flash Player 32 ActiveX v.32.0.0.142 Warning! Download Update
Adobe Flash Player 29 NPAPI v.29.0.0.171 Warning! Download Update
------------------------------- [ Browser ] -------------------------------
Mozilla Firefox 68.0 (x64 en-US) v.68.0 [+]
Google Chrome v.75.0.3770.142 [+]
------------------ [ AntivirusFirewallProcessServices ] -------------------
Windows Defender (WinDefend) - The service has stopped
----------------------------- [ End of Log ] ------------------------------

Logfile of HiJackThis Fork by Alex Dragokas v.2.9.0.19

Platform: x64 Windows 7 (Pro), 6.1.7601.24496, Service Pack: 1
Time: 15.07.2019 - 15:18 (UTC-04:00)
Language: OS: English (0x409). Display: English (0x409). Non-Unicode: English (0x409)
Elevated: Yes
Ran by: ******** (group: Administrator) on ********-PC, FirstRun: yes

Chrome: 75.0.3770.142
Firefox: 68.0.0.7125
Internet Explorer: 11.0.9600.19404
Default: "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "%1" (Firefox)

Boot mode: Normal

Running processes:
Number | Path
1 C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
1 C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe
1 C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
1 C:\Program Files (x86)\Notepad++\notepad++.exe
1 C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
1 C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
1 C:\Program Files\DellTPad\ApMsgFwd.exe
1 C:\Program Files\DellTPad\ApntEx.exe
1 C:\Program Files\DellTPad\Apoint.exe
1 C:\Program Files\DellTPad\hidfind.exe
1 C:\Program Files\Dell\DellDataVault\DDVCollectorSvcApi.exe
1 C:\Program Files\Dell\DellDataVault\DDVDataCollector.exe
1 C:\Program Files\Dell\DellDataVault\DDVRulesProcessor.exe
1 C:\Program Files\Dell\SupportAssistAgent\PCDr\SupportAssist\6.0.7033.2285\DSAPI.exe
1 C:\Program Files\Dell\SupportAssistAgent\PCDr\SupportAssist\6.0.7033.2285\pcdrwi.exe
1 C:\Program Files\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe
1 C:\Program Files\IDT\WDM\stacsv64.exe
1 C:\Program Files\IDT\WDM\sttray64.exe
1 C:\Program Files\Intel\WiFi\bin\EvtEng.exe
1 C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
1 C:\Program Files\Intel\iCLS Client\HeciServer.exe
1 C:\Program Files\Visioneer\RWAR3\RWAR3HV_0001_0.EXE
1 C:\Program Files\Visioneer\RWAR3\RWAR3Monitor.exe
1 C:\Program Files\Windows Media Player\wmpnetwk.exe
1 C:\Users\********\Desktop\HiJackThis.exe
1 C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
1 C:\Windows\SysWOW64\gearsec.exe
1 C:\Windows\System32\SearchFilterHost.exe
1 C:\Windows\System32\SearchIndexer.exe
1 C:\Windows\System32\SearchProtocolHost.exe
1 C:\Windows\System32\VSSVC.exe
1 C:\Windows\System32\WUDFHost.exe
1 C:\Windows\System32\audiodg.exe
3 C:\Windows\System32\conhost.exe
2 C:\Windows\System32\csrss.exe
1 C:\Windows\System32\dwm.exe
1 C:\Windows\System32\igfxCUIService.exe
1 C:\Windows\System32\igfxEM.exe
1 C:\Windows\System32\igfxHK.exe
1 C:\Windows\System32\igfxTray.exe
1 C:\Windows\System32\lsass.exe
1 C:\Windows\System32\lsm.exe
1 C:\Windows\System32\services.exe
1 C:\Windows\System32\smss.exe
1 C:\Windows\System32\spoolsv.exe
1 C:\Windows\System32\sppsvc.exe
16 C:\Windows\System32\svchost.exe
1 C:\Windows\System32\taskeng.exe
1 C:\Windows\System32\taskhost.exe
1 C:\Windows\System32\wbem\WmiApSrv.exe
3 C:\Windows\System32\wbem\WmiPrvSE.exe
2 C:\Windows\System32\wbem\unsecapp.exe
1 C:\Windows\System32\wininit.exe
1 C:\Windows\System32\winlogon.exe
1 C:\Windows\System32\wlanext.exe
1 C:\Windows\explorer.exe

O4 - HKLM\..\Run: [Apoint] = C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [IntelPROSet] = C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SysTrayApp] = C:\Program Files\IDT\WDM\sttray64.exe
O4-32 - HKLM\..\Run: [IMSS] = C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe
O4-32 - HKLM\..\Run: [KeePass 2 PreLoad] = C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe --preload
O15 - Trusted Zone: *.dell.com
O15 - Trusted Zone: *.localhost
O17 - DHCP DNS 1: 209.18.47.62
O17 - DHCP DNS 2: 209.18.47.61
O23 - Service R2: Audio Service - (STacSV) - C:\Program Files\IDT\WDM\STacSV64.exe
O23 - Service R2: Dell Data Vault Collector - (DDVDataCollector) - C:\Program Files\Dell\DellDataVault\DDVDataCollector.exe
O23 - Service R2: Dell Data Vault Service API - (DDVCollectorSvcApi) - C:\Program Files\Dell\DellDataVault\DDVCollectorSvcApi.exe
O23 - Service R2: Dell Hardware Support - C:\Program Files\Dell\SupportAssistAgent\PCDr\SupportAssist\6.0.7033.2285\DSAPI.exe
O23 - Service R2: Dell SupportAssist - (SupportAssistAgent) - C:\Program Files\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe
O23 - Service R2: Diagnostics Tracking Service - (DiagTrack) - C:\Windows\System32\svchost.exe -k utcsvc; "ServiceDll" = C:\Windows\system32\diagtrack.dll
O23 - Service R2: Intel(R) Capability Licensing Service Interface - C:\Program Files\Intel\iCLS Client\HeciServer.exe
O23 - Service R2: Intel(R) Dynamic Application Loader Host Interface Service - (jhi_service) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
O23 - Service R2: Intel(R) HD Graphics Control Panel Service - (igfxCUIService1.0.0.0) - C:\Windows\system32\igfxCUIService.exe
O23 - Service R2: Intel(R) Management and Security Application Local Management Service - (LMS) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service R2: Intel(R) PROSet/Wireless Event Log - (EvtEng) - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service R2: Intel(R) PROSet/Wireless Registry Service - (RegSrvc) - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service R2: Intel(R) PROSet/Wireless Zero Configuration Service - (ZeroConfigService) - C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
O23 - Service R2: RWAR3HV_0001_0 - C:\Program Files\Visioneer\RWAR3\RWAR3HV_0001_0.EXE
O23 - Service R2: RWAR3Monitor - C:\Program Files\Visioneer\RWAR3\RWAR3Monitor.exe
O23 - Service R2: gearsec - C:\Windows\SysWOW64\gearsec.exe
O23 - Service R3: Dell Data Vault Processor - (DDVRulesProcessor) - C:\Program Files\Dell\DellDataVault\DDVRulesProcessor.exe
O23 - Service S2: Google Update Service (gupdate) - (gupdate) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /svc
O23 - Service S3: Google Chrome Elevation Service - (GoogleChromeElevationService) - C:\Program Files (x86)\Google\Chrome\Application\75.0.3770.142\elevation_service.exe
O23 - Service S3: Google Update Service (gupdatem) - (gupdatem) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /medsvc
O23 - Service S3: Intel(R) Capability Licensing Service TCP IP Interface - C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe
O23 - Service S3: Intel(R) Content Protection HECI Service - (cphs) - C:\Windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service S3: Mozilla Maintenance Service - (MozillaMaintenance) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service S3: Wireless PAN DHCP Server - (MyWiFiDHCPDNS) - C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe

--
End of file - Time spent: 12.1 sec. - 14354 bytes, CRC32: FFFFFFFF. Sign: ⬅짾

Fla_Panther · Jul 22, 2019

Well, on the plus side, I just noticed that my laptop's date was somehow switched to Wednesday the 17th. I corrected it to the proper date and FireFox was able to load the webpages properly that had been failing before.

Malnutrition · Jul 22, 2019

Update your programs with Patch My PC, then post a new security check log please.

This freeware tool from DougKnox.com lets you change the Internet Time Update interval from Weekly to Daily or Hourly. You will have to run the tool as an administrator.

Fla_Panther · Jul 23, 2019

When you ask for a security check log ... which of the programs are you asking me to run? None of them were called "security check".

Malnutrition · Jul 23, 2019

Malnutrition said:
Security Check Scan.

Download Security Check to your desktop.

Right click it run as administrator.

When the program completes, the tool will automatically open a log file.

Please post that log here in your next post.

Fla_Panther · Jul 23, 2019

Bah. My bad. I don't know how I missed it before. Here's the log:

SecurityCheck by glax24 & Severnyj v.1.4.0.53 [27.10.17]
WebSite: www.safezone.cc
DateLog: 23.07.2019 18:35:00
Path starting: C:\Users\********\AppData\Local\Temp\SecurityCheck\SecurityCheck.exe
Log directory: C:\SecurityCheck\
IsAdmin: True
User: ********
VersionXML: 6.63is-06.07.2019
___________________________________________________________________________

Windows 7(6.1.7601) Service Pack 1 (x64) Professional Lang: English(0409)
Installation date OS: 26.06.2018 13:29:10
LicenseStatus: Windows(R) 7, Professional edition The machine is permanently activated.
Boot Mode: Normal
Default Browser: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
SystemDrive: C: FS: [NTFS] Capacity: [200 Gb] Used: [142 Gb] Free: [58 Gb]
------------------------------- [ Windows ] -------------------------------
Internet Explorer 11.0.9600.19403 [+]
User Account Control enabled (Level 3)
Notify before download
Date install updates: 2019-07-15 00:30:27
Windows Update (wuauserv) - The service is running
Security Center (wscsvc) - The service is running
Remote Registry (RemoteRegistry) - The service has stopped
SSDP Discovery (SSDPSRV) - The service is running
Remote Desktop Services (TermService) - The service has stopped
Windows Remote Management (WS-Management) (WinRM) - The service has stopped
------------------------------ [ MS Office ] ------------------------------
Microsoft Office 2010 x86 v.14.0.6029.1000
--------------------------- [ FirewallWindows ] ---------------------------
Windows Firewall (MpsSvc) - The service is running
--------------------------- [ AntiSpyware_WMI ] ---------------------------
Windows Defender (enabled and up to date)
--------------------------- [ OtherUtilities ] ----------------------------
VLC media player v.3.0.7.1
Microsoft .NET Framework 4.8 v.4.8.03761 [+]
Dell SupportAssist v.3.2.2.119 [+]
PuTTY release 0.72 (64-bit) v.0.72.0.0 [+]
Foxit Reader v.9.6.0.25114
IrfanView 4.53 (32-bit) v.4.53
KeePass Password Safe 2.42.1 v.2.42.1
Winamp v.5.666 [+]
-------------------------------- [ Arch ] ---------------------------------
7-Zip 19.00 (x64 edition) v.19.00.00.0
--------------------------------- [ IM ] ----------------------------------
Skype version 8.50 v.8.50 [+]
--------------------------- [ AdobeProduction ] ---------------------------
Adobe Flash Player 32 ActiveX v.32.0.0.223 [+]
Adobe Flash Player 32 NPAPI v.32.0.0.223 [+]
------------------------------- [ Browser ] -------------------------------
Mozilla Firefox 68.0.1 (x64 en-US) v.68.0.1 [+]
Google Chrome v.75.0.3770.142 [+]
------------------ [ AntivirusFirewallProcessServices ] -------------------
Windows Defender (WinDefend) - The service is running
Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - The service has stopped
----------------------------- [ End of Log ] ------------------------------

Malnutrition · Jul 24, 2019

I do not see any malware, but to be certain a couple more checks just to be on the safe side.

Note: You can expect this process to take a long time, up to several hours or more.

Download ESET Online Scanner and save it to your Desktop
Right click on esetonlinescanner_enu.exe and select Run as administrator
Click Computer scan
Click Full scan
Click Start scan, leaving the default setting
If threats were found click Save scan log and save it to your Desktop as ESETScan.txt
Click Continue 3 times
Click Close
Copy and paste the ESETScan.txt file contents in your reply
Review the list and let me know if you think any of the items are legitimate and should be restored
If no threats were found, click Continue 3 times
Place a check mark in Delete application data on closing then click Close

==========================================================================================

Rogue Killer Scan.

Download RogueKiller -- (Portable) -- from one of the following links and save it to your Desktop:

Link 1
Link 2

Close all other the running programs
Disable ALL Antivirus -- Antimalware -- Applications.
Right Click Rogue Killer and Run as Administrator.
Click the Start Scan button.
Allow the scan to run -- it can take ten minutes or more.
Once the scan is complete check All items for removal.

After All items are checked then press Remove Selected.
Wait until the Status box shows Deleting Finished.
Click on open report -- then open txt
Copy the content of the report and paste it here in your next reply.

Fla_Panther · Jul 24, 2019

ESET didn't find anything. RogueKiller did, but I'm a bit surprised at what it found. I had an autoclicker I'd downloaded ... I'd probably downloaded 10 autoclickers, and this one was the only one that didn't have a virus or malware in it. So either it was a new one, or maybe a false positive. Not sure.

RogueKiller Anti-Malware V13.3.2.0 (x64) [Jul 15 2019] (Free) by Adlice Software
mail : https://adlice.com/contact/
Website : https://adlice.com/download/roguekiller/
Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits
Started in : Normal mode
User : ******** [Administrator]
Started from : C:\Users\********\Desktop\RogueKiller_portable64.exe
Signatures : 20190723_195507, Driver : Loaded
Mode : Standard Scan, Delete -- Date : 2019/07/23 21:19:42 (Duration : 00:05:33)

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Delete ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
[PUP.AutoIt.Gen (Potentially Malicious)] GS AutoClicker.exe -- %USERPROFILE%\Desktop\GS AutoClicker.exe -> Deleted
[PUP.AutoIt.Gen (Potentially Malicious)] GS AutoClicker.exe -- %USERPROFILE%\Desktop\GS AutoClicker.exe -> Found

Malnutrition · Jul 24, 2019

Any issues to speak of?

Fla_Panther · Jul 24, 2019

Not that I know of at the moment, but I'd still like clarification on whether I had anything. As I mentioned above, I started using a password manager a few months ago. If I was infected and they had a keylogger they could have downloaded my password file and have the master key. I'd have to go change the passwords for ~100 websites.

Malnutrition · Jul 24, 2019

No, there is no malware to speak of on your machine, just cleaned up a bit of rubbish is all.

Fla_Panther · Jul 25, 2019

Okay, thanks. We can mark this as closed then. I'll see if I can do so, if not feel free to do so.

Fla_Panther

Malnutrition

Malnurished Admin

Malnutrition

Malnurished Admin

How Much Free Space Should You Leave on Your Windows PC?

Fla_Panther

Malnutrition

Malnurished Admin

Attachments

Malnutrition

Malnurished Admin

Fla_Panther

Malnutrition

Malnurished Admin

Fla_Panther

Fla_Panther

Malnutrition

Malnurished Admin

Fla_Panther

Malnutrition

Malnurished Admin

Fla_Panther

Malnutrition

Malnurished Admin

Fla_Panther

Malnutrition

Malnurished Admin

Fla_Panther

Malnutrition

Malnurished Admin

Fla_Panther

Search

Search

Solved Not sure if I'm infected, but it can't hurt to check ...

We value your privacy