'Harmless' email received, computer messed up but cleared.

[Electrojim]

Take Two

A new member here, just wondering if anyone is into malware analysis enough to want to receive an email I got a bit earlier today that messed up my Windows 10 system. I don't know enough about malware to do any analysis myself, but was hoping that someone might have a test-bed that could determine if the email was at fault.

The mail came from China, and the Subject was simply "JOB." I opened the message, which asked if I was interested in a position in the steel industry (which I am not), and I just closed the email and that was that. At least until I opened my Firefox browser a minute or two later, and before even navigating anywhere I got one of those red-screen notices that I had to call a US toll-free number right away to get rid of a threat. And if that wasn't enough, my keyboard and mouse started behaving erratically. I did manage to open Task Manager, and didn't see any suspicious process running, but by that time the system was totally locked, so I powered it down.

Next time it booted, everything looked normal, and a Windows Security 'quick' scan showed nothing. The browser seems to be working okay, but who knows what might still be lurking. I'm inclined to just go about my business, but have some reservations about just blowing the whole thing off. I figured that someone who knew what they were doing might have suggestions.

Any advice will be most welcome.

[pgmigg]

Hello Electrojim,

Welcome to the forum!

I am pgmigg and I'll be helping you with any malware problems.

Before we begin, please read and follow these important guidelines, so things will proceed smoothly.

1. The instructions being given are for YOUR computer and system only!
   Using these instructions on a different computer can cause damage to that computer and possibly render it inoperable!
2. You must have Administrator rights, permissions for this computer.
3. DO NOT run any other fix or removal tools unless instructed to do so!
4. DO NOT install any other software (or hardware) during the cleaning process until we are done as well as
   DO NOT Remove, or Scan with anything on your system unless I ask. This adds more items to be researched.
   Extra Additions and Removals of files make the analysis more difficult.
5. Only post your problem at (1) one help site. Applying fixes from multiple help sites can cause problems.
6. Print each set of instructions if possible - your Internet connection will not be available during some fix processes.
7. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
8. Only reply to this thread, do not start another one. Please, continue responding, until I give you the "All Clean!"
   Absence of symptoms does not mean that everything is clear.

I am currently reviewing your logs and will return, as soon as possible, with additional instructions. In the meantime...

Note: If you haven't done so already, please read this topic ALL USERS OF THIS FORUM MUST READ THIS FIRST where the conditions for receiving help here are explained.

Please read all instructions carefully before executing and perform the steps, in the order given.
lf you have any questions or problems executing these instructions, <<STOP>> do not proceed, post back with the question or problem.

Please be aware that removing Malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.

Because of this, I advise you to backup any personal files and folders before you start


Failure to post replies within 72 hours will result in this thread being closed

[pgmigg]

Hello Electrojim,

Step 1.
Run CKScanner

1. Please download CKScanner from here
2. Important: - Save it to your Desktop.
3. Double-click CKScanner.exe and click Search For Files.
4. After a very short time, when the cursor hourglass disappears, click Save List To File.
5. A message box will verify the file saved.
6. Double-click the CKFiles.txt icon on your Desktop and copy/paste the contents in your next reply.

Step 2.
TSG - SysInfo utility

1. Please download SysInfo utility and save it to your Desktop.
2. Right click on SysInfo.exe, select "Run As Administrator..." to run it... if UAC prompts, please allow it.
3. Right click, select copy and then paste in your next post.

Step 3.
Run CodeCheck Scan

1. Please download codecheck from here to your Desktop.
2. Make sure that codecheck.exe is on the your Desktop before running the application!
3. Right-click on codecheck.exe and select "Run as administrator..." to run it.
4. After a very short time a codecheck.txt icon will appear on your Desktop
5. Double-click on the codecheck.txt icon on your Desktop and copy/paste the contents in your next reply.

Then:
Please tell me is this computer used for business or educational purposes and/or connected to a business or educational network?
I need to know it - so I can provide the proper instructions.

Please post each log separately to prevent it being cut off by the forum post size limiter.
Check each after you've posted it to make sure it's all present, if any log is cut off you'll have to post it in sections...

Don't post anything as attachments unless I will ask you about it specifically!

Please include in your next reply:

1. Do you have any problems executing the instructions?
2. Contents of CKFiles.txt log file
3. Contents of SysInfo scan
4. Contents of a log created by codecheck.txt
5. Answer to my question related to type of using of your computer

Thanks,
pgmigg

Failure to post replies within 72 hours will result in this thread being closed

[Electrojim]

Thanks, pgmigg. I have undertaken the tasks assigned.

A. No problem executing your well-written instructions. The only liberty I took was to make a "Malware Check" folder on my Desktop for this job, which now contains the .exe files and the .txt reports. I have a cluttered Desktop and didn't want to have to chase-down the icons.
B. CKScanner results:
CKScanner 2.5 - Additional Security Risks - These are not necessarily bad
c:\windows\servicing\lcu\package_for_rollupfix~31bf3856ad364e35~amd64~~18362.657.1.7\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.18362.657_none_1275b434415f6995\f\ssh-keygen.exe
c:\windows\servicing\lcu\package_for_rollupfix~31bf3856ad364e35~amd64~~18362.657.1.7\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.18362.657_none_1275b434415f6995\r\ssh-keygen.exe
c:\windows\winsxs\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.18362.1_none_8f03ecc82cf7c75c\ssh-keygen.exe
c:\windows\winsxs\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.18362.657_none_1275b434415f6995\ssh-keygen.exe
scanner sequence 3.BB.11.OJAPGZ
----- EOF -----

C. TSG Sys-Info:
Tech Support Guy System Info Utility version 1.0.0.9
OS Version: Microsoft Windows 10 Pro, 64 bit, Build 18363, Installed 20190822203611.000000-480
Processor: Intel(R) Core(TM) i7-6700 CPU @ 3.40GHz, Intel64 Family 6 Model 94 Stepping 3, CPU Count: 8
Total Physical RAM: 16 GB
Graphics Card: AMD Radeon (TM) R9 360
Hard Drives: C: 1849 GB (1684 GB Free);
Motherboard: Dell Inc. 0C2XKD, ver A01, s/n 81QMMD2.CN7016369C01V7.
System: Dell Inc., ver DELL - 1072009, s/n 81QMMD2
Antivirus: Windows Defender, Enabled and Updated

D. CodeCheck:
Codecheck Version 1.0

02021

E. The computer is not used for business/educational purposes per-se, nor is it connected to a business network. The only WAN connection is the home router to the cable-company ISP. However, this is my secondary link for 'working from home.' To that end, I do have the Slack comms utility installed, which I assume is a peer-to-peer one. However, I can uninstall it as it's also on another computer in the house that is used almost exclusively for work-related chores. Hopefully I haven't disqualified myself from assistance on the Forum, and do appreciate anything you can discern from the information provided.

[pgmigg]

Hello Electrojim,

Thank you for your answers. Let's start our treatment...

Step 1.
Create a Backup With Tweaking.com Registry Backup (TCRB)
There is also a tutorial with pictures available HERE.

1. Please download TCRB from HERE and save it to your Desktop, then double-click on tweaking.com_registry_backup_setup.exe and follow the prompts to install TCRB.
2. Launch TCRB.
3. Click the Backup Registry tab and make sure all the boxes are checked.
4. Click on Backup Now.
5. Once the backup is finished you can now exit the program.

< STOP > Do not proceed any further if you were not able to create a registry backup. Post back with what happened so we can determine why it was unsuccessful.

Step 2.
FRST Fix

1. Close all your programs.
2. You should still have FRST64.exe on your Desktop. If not please download it HERE and save it on your Desktop.
3. Please press the Windows Key + R.
4. Type notepad.exe into the text box and click OK.
5. A blank Notepad page should open.
   
   • Copy and Paste the following script into Notepad, but do not include the words Code: Select all.
   • (Click the Select all button next to Code: to select the entire script).

   Code: Select all

   CreateRestorePoint:
   
   HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
   GroupPolicy: Restriction ? <==== ATTENTION
   GroupPolicy\User: Restriction ? <==== ATTENTION
   CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
   Task: {F7A8E1D4-8C92-4AA6-8F72-B85EBD283F14} - \IntegrationManager -> No File <==== ATTENTION
   HKU\S-1-5-21-572709066-2931371650-4259622231-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
   SearchScopes: HKU\S-1-5-21-572709066-2931371650-4259622231-1001 -> DefaultScope {D39EC267-76F4-42FC-8908-73B47C1360BD} URL = hxxps://duckduckgo.com/?q={searchTerms}&atb=v97-4_f
   SearchScopes: HKU\S-1-5-21-572709066-2931371650-4259622231-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
   SearchScopes: HKU\S-1-5-21-572709066-2931371650-4259622231-1001 -> {D39EC267-76F4-42FC-8908-73B47C1360BD} URL = hxxps://duckduckgo.com/?q={searchTerms}&atb=v97-4_f
   FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\defaults\pref\autoconfig.js [2017-07-13] <==== ATTENTION (Points to *.cfg file)
   FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\mozilla.cfg [2017-07-13] <==== ATTENTION
   
   Hosts:
   EmptyTemp:
   CMD: ipconfig /flushdns

6. Save it next to FRST64.exe as fixlist.txt.
   Important! fixlist.txt must be saved in the same directory as FRST64.exe to work.
7. Right click on FRST64.exe and select Run as administrator.
8. Press the Fix button one time only and wait.
9. When FRST finishes you will be prompted to reboot your computer. Click OK.
10. Your computer should now restart. On reboot navigate to your Desktop where you should find Fixlog.txt. Copy and paste the contents in your reply.

Step 3.
Scan with AdwCleaner.

1. Please download AdwCleaner and save it to your Desktop.
2. Double click AdwCleaner.exe to run it. If it will ask for update please decline it.
3. Click Yes on UAC question and I Agreeon Welcome window.
4. Click Scan now button and wait for a while until the scan finish... then click on Cancel button.
5. On the vertical left side menu select Log Files, click on it, and you will see the list of log files.
6. Find most recent one AdwCleaner[Sxx].txt with a type of Scan and double click on it - the Notepad with a log file will be opened.
7. Close the AdwCleaner.
8. Please post the contents of AdwCleaner[Sxx].txt log file from Notepad with your next reply.

AT THIS POINT, DO NOT ATTEMPT TO CLEAN ANYTHING THAT MAY BE FOUND

Please post each log separately to prevent it being cut off by the forum post size limiter.
Check each after you've posted it to make sure it's all present, if any log is cut off you'll have to post it in sections...

Don't post anything as attachments unless I will ask you about it specifically!

Please include in your next reply:

1. Do you have any problems executing the instructions?
2. Contents of the Fixlog.txt log file
3. Content of the C:\AdwCleaner[Sxx].txt
4. Do you see any changes in computer behavior?

Thanks,
pgmigg

Failure to post replies within 72 hours will result in this thread being closed

[Electrojim]

Hi, pgmigg. Before I perform this part of the operation, can you give me a hint at what that script does? It seems to reference my antivirus, my registry and my Firefox browser. Would I notice any operational differences once the script is run? I'd want to be able to keep using the computer in between fixes. Thanks.

[pgmigg]

Hi Electrojim,

Before I perform this part of the operation, can you give me a hint at what that script does? It seems to reference my antivirus, my registry and my Firefox browser. Would I notice any operational differences once the script is run? I'd want to be able to keep using the computer in between fixes.

The infection is trying to quietly change the computer settings of all kinds, (including registry, browser's controls, file system, etc.) in its favor, mimicking the reasonable and competent actions of a person. Scanning a computer can detect suspicious changes. They are restored to default values, so that later, when and if there is a need, a person can return them to the state that he considers necessary - thus, the infection, if this was the reason for the changes, was excluded from consideration. Thousands and thousands of infections can be the cause of something abnormal and, as a rule, common cleaning actions, with some adjustment for a specific computer, is enough for success. Otherwise, the scanning continues, becoming more and more specific, narrowing the circles and picking up what was well hidden ...

All my steps are independent of each other and it is not necessary to perform them in a row (although it is desirable ), but you can use the computer during breaks. The only requirement is to close all processes before completing each step.

So I am waiting for logs...

Thank you,
pgmigg

[Electrojim]

Thanks for the explanation. Coming up!

[Electrojim]

In answer to questions:
A. No problem executing instructions. However, under FRST Fix, when I clicked "Code: Select All" within this thread, it did not highlight the text of the script, but just took me to the top of the thread. I highlighted the text manually and that worked fine.

B. CONTENTS OF Fixlog.text log file:
Fix result of Farbar Recovery Scan Tool (x64) Version: 23-02-2020
Ran by Desk (23-02-2020 12:53:42) Run:1
Running from C:\Users\Lab\Desktop\Malware Check
Loaded Profiles: Desk (Available Profiles: Desk & .NET v4.5 & DefaultAppPool & .NET v4.5 Classic)
Boot Mode: Normal
==============================================

fixlist content:
*****************
CreateRestorePoint:

HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
GroupPolicy: Restriction ? <==== ATTENTION
GroupPolicy\User: Restriction ? <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
Task: {F7A8E1D4-8C92-4AA6-8F72-B85EBD283F14} - \IntegrationManager -> No File <==== ATTENTION
HKU\S-1-5-21-572709066-2931371650-4259622231-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
SearchScopes: HKU\S-1-5-21-572709066-2931371650-4259622231-1001 -> DefaultScope {D39EC267-76F4-42FC-8908-73B47C1360BD} URL = hxxps://duckduckgo.com/?q={searchTerms}&atb=v97-4_f
SearchScopes: HKU\S-1-5-21-572709066-2931371650-4259622231-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-572709066-2931371650-4259622231-1001 -> {D39EC267-76F4-42FC-8908-73B47C1360BD} URL = hxxps://duckduckgo.com/?q={searchTerms}&atb=v97-4_f
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\defaults\pref\autoconfig.js [2017-07-13] <==== ATTENTION (Points to *.cfg file)
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\mozilla.cfg [2017-07-13] <==== ATTENTION

Hosts:
EmptyTemp:
CMD: ipconfig /flushdns
*****************

Restore point was successfully created.
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender => could not remove, key could be protected
C:\WINDOWS\system32\GroupPolicy\Machine => moved successfully
C:\WINDOWS\system32\GroupPolicy\GPT.ini => moved successfully
C:\WINDOWS\SysWOW64\GroupPolicy\GPT.ini => moved successfully
C:\WINDOWS\system32\GroupPolicy\User => moved successfully
HKLM\SOFTWARE\Policies\Google => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{F7A8E1D4-8C92-4AA6-8F72-B85EBD283F14}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F7A8E1D4-8C92-4AA6-8F72-B85EBD283F14}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\IntegrationManager" => not found
HKU\S-1-5-21-572709066-2931371650-4259622231-1001\SOFTWARE\Policies\Microsoft\Internet Explorer => removed successfully
"HKU\S-1-5-21-572709066-2931371650-4259622231-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope" => removed successfully
HKU\S-1-5-21-572709066-2931371650-4259622231-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => removed successfully
HKU\S-1-5-21-572709066-2931371650-4259622231-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D39EC267-76F4-42FC-8908-73B47C1360BD} => removed successfully
C:\Program Files (x86)\mozilla firefox\defaults\pref\autoconfig.js => moved successfully
C:\Program Files (x86)\mozilla firefox\mozilla.cfg => moved successfully
Hosts restored successfully.

========= ipconfig /flushdns =========


Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========


=========== EmptyTemp: ==========

BITS transfer queue => 7888896 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 24325512 B
Java, Flash, Steam htmlcache => 1154 B
Windows/system/drivers => 21870 B
Edge => 4096 B
Chrome => 0 B
Firefox => 33752673 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 6656 B
Users => 6656 B
ProgramData => 6656 B
Public => 6656 B
systemprofile => 6656 B
systemprofile32 => 6656 B
LocalService => 13312 B
NetworkService => 23388 B
Lab => 74427929 B
.NET v4.5 => 74434585 B
DefaultAppPool => 74441241 B
.NET v4.5 Classic => 74447897 B

RecycleBin => 437677737 B
EmptyTemp: => 764.4 MB temporary data Removed.

================================

Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 23-02-2020 12:56:49)


Result of scheduled keys to remove after reboot:

HKLM\SOFTWARE\Policies\Microsoft\Windows Defender => could not remove, key could be protected

==== End of Fixlog 12:56:49 ====

C. Content of the C:\AdwCleaner[S01].txt:
# -------------------------------
# Malwarebytes AdwCleaner 8.0.2.0
# -------------------------------
# Build: 01-27-2020
# Database: 2020-02-17.1 (Cloud)
# Support: https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Scan
# -------------------------------
# Start: 02-23-2020
# Duration: 00:00:32
# OS: Windows 10 Pro
# Scanned: 34851
# Detected: 2


***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

Rogue.Multiple C:\Program Files (x86)\filter

***** [ Files ] *****

No malicious files found.

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

No malicious tasks found.

***** [ Registry ] *****

PUP.Optional.PCVARK HKLM\Software\itldu-pr

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries found.

***** [ Chromium URLs ] *****

No malicious Chromium URLs found.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries found.

***** [ Firefox URLs ] *****

No malicious Firefox URLs found.

***** [ Hosts File Entries ] *****

No malicious hosts file entries found.

***** [ Preinstalled Software ] *****

No Preinstalled Software found.


AdwCleaner_Debug.log - [19177 octets] - [16/09/2019 09:05:22]
AdwCleaner[S00].txt - [2148 octets] - [16/09/2019 09:06:24]
AdwCleaner[C00].txt - [2226 octets] - [16/09/2019 09:09:50]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[S01].txt ##########

D. Changes in computer behavior: The only thing noted so far is that, when the computer rebooted and Windows loaded, I got the Windows 10 'opening screen' (whatever they call it) rather than the sign-in screen. I had done some tweak months ago to take me directly to the sign-in screen on boot. No big deal.

[pgmigg]

Hi Electrojim,

Step 1.
Scan with AdwCleaner.

1. Please close all open programs and windows.
2. You should still have the AdwCleaner.exe on your Desktop. If it not, please download AdwCleaner and save it to your Desktop.
3. Double click AdwCleaner.exe to run it. If it will ask for update please decline it.
4. Click Yes on UAC question and I Agreeon Welcome window.
5. Click Scan now button and wait for a while until the scan finish... if something will be found you will see Scan results, then click on Quarantine button.
6. At the finish of Quarantine process, AdwCleaner will ask you to restart - please allow it.
7. On reboot a log will open AdwCleaner[Cxx].txt. Copy and paste the contents of that log file in your reply.
8. You can also find the most recent log file at C:\AdwCleaner[Sxx].txt.

Step 2.
Fresh FRST64 Scan
You should still have FRST64.exe on your Desktop.

1. Please close all open programs and windows.
2. Right-click FRST64.exe and select "Run as administrator..." to run it.
3. When the tool opens click Yes to the disclaimer if it is occurred.
4. Please be sure that 90 Days Files check box under Optional Scan section is checked.
5. Please be sure that Addition.txt check box under Optional Scan section is checked.
6. Press Scan button. When finished a two logs FRST.txt. and Addition.txt will be created and opened in Notepad.
7. Please post the content of the both FRST.txt and Addition.txt in your next reply and post them separately.

Please post each log separately to prevent it being cut off by the forum post size limiter.
Check each after you've posted it to make sure it's all present, if any log is cut off you'll have to post it in sections....

Please include in your next reply:

1. Do you have any problems executing the instructions?
2. Contents of the AdwCleaner[Cxx].txt log file
3. Contents of the FRST.txt log file after fresh FRST scan
4. Contents of the Addition.txt log file after fresh FRST scan
5. Do you see any changes in computer behavior?

Thanks,
pgmigg

Failure to post replies within 72 hours will result in this thread being closed

[Electrojim]

Have completed tasks, will copy to separate replies as instructed. No problems running either scan, the only effect seems to be the loss of one CAD-type design utility I depend on a lot, but I have it on the other computer as well, the one that seldom connects to the Web, so no problem.

HERE'S THE AdwCleaner[C02].txt LOG FILE:

# -------------------------------
# Malwarebytes AdwCleaner 8.0.2.0
# -------------------------------
# Build: 01-27-2020
# Database: 2020-02-17.1 (Cloud)
# Support: https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Clean
# -------------------------------
# Start: 02-25-2020
# Duration: 00:00:01
# OS: Windows 10 Pro
# Cleaned: 2
# Failed: 0


***** [ Services ] *****

No malicious services cleaned.

***** [ Folders ] *****

Deleted C:\Program Files (x86)\filter

***** [ Files ] *****

No malicious files cleaned.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks cleaned.

***** [ Registry ] *****

Deleted HKLM\Software\itldu-pr

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries cleaned.

***** [ Chromium URLs ] *****

No malicious Chromium URLs cleaned.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries cleaned.

***** [ Firefox URLs ] *****

No malicious Firefox URLs cleaned.

***** [ Hosts File Entries ] *****

No malicious hosts file entries cleaned.

***** [ Preinstalled Software ] *****

No Preinstalled Software cleaned.


*************************

[+] Delete Tracing Keys
[+] Reset Winsock

*************************

AdwCleaner_Debug.log - [19177 octets] - [16/09/2019 09:05:22]
AdwCleaner[S00].txt - [2148 octets] - [16/09/2019 09:06:24]
AdwCleaner[C00].txt - [2226 octets] - [16/09/2019 09:09:50]
AdwCleaner[S01].txt - [1642 octets] - [23/02/2020 13:00:18]
AdwCleaner[S02].txt - [1703 octets] - [25/02/2020 10:04:52]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C02].txt ##########

[Electrojim]

NEXT, THE FRST.txt LOG FILE:
PLEASE NOTE: THIS FILE IS LARGER THAN WHAT'S PERMITTED IN A REPLY. I WILL BREAK IT ABOUT HALFWAY AND SUBMIT THE TWO HALVES IN SEPARATE REPLIES. THE BREAK WILL BE RIGHT AFTER THIS LINE:
2020-02-13 13:41 - 2020-02-13 13:41 - 000486400 _____ (Microsoft Corporation) C:\WINDOWS\system32\srcore.dll

PART ONE:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 23-02-2020
Ran by Desk (administrator) on WINDOWS-9C6P0DA (Dell Inc. Inspiron 3650) (25-02-2020 10:14:28)
Running from C:\Users\Lab\Desktop\Malware Check
Loaded Profiles: Desk (Available Profiles: Desk & .NET v4.5 & DefaultAppPool & .NET v4.5 Classic)
Platform: Windows 10 Pro Version 1909 18363.657 (X64) Language: English (United States)
Default browser: FF
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe
(Advanced Micro Devices, Inc. -> AMD) C:\Windows\System32\atieclxx.exe
(Advanced Micro Devices, Inc. -> AMD) C:\Windows\System32\atiesrxx.exe
(Dropbox, Inc -> Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
(Dropbox, Inc -> Dropbox, Inc.) C:\Windows\System32\DbxSvc.exe
(FSPro Labs -> FSPro Labs) C:\Program Files\My Lockbox\mylbx.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\mqsvc.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\snmp.exe
(Microsoft Windows Hardware Compatibility Publisher -> Advanced Micro Devices, Inc.) C:\Windows\SysWOW64\tbaseprovisioning.exe
(Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2001.7-0\MsMpEng.exe
(Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2001.7-0\NisSrv.exe
(Qualcomm Atheros -> Windows (R) Win 7 DDK provider) C:\Windows\System32\drivers\AdminService.exe
(Realtek Semiconductor Corp -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor Corp -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor Corp -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor Corp -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor Corp -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor Corp -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Renesas Electronics Corporation -> Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe

==================== Registry (Whitelisted) ===================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8512760 2015-08-03] (Realtek Semiconductor Corp -> Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_MAXX6] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1411320 2015-08-03] (Realtek Semiconductor Corp -> Realtek Semiconductor)
HKLM\...\Run: [mylbx] => C:\Program Files\My Lockbox\mylbx.exe [2921184 2017-06-30] (FSPro Labs -> FSPro Labs)
HKLM\...\Run: [WavesSvc] => C:\Program Files\Waves\MaxxAudio\WavesSvc64.exe [610048 2015-01-20] (Waves Inc -> Waves Audio Ltd.)
HKLM-x32\...\Run: [RUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe [115048 2011-09-20] (Renesas Electronics Corporation -> Renesas Electronics Corporation)
HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [6260736 2020-02-19] (Dropbox, Inc -> Dropbox, Inc.)
HKU\S-1-5-19\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518656 2019-03-18] (Microsoft Windows -> Microsoft Corporation)
HKU\S-1-5-20\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518656 2019-03-18] (Microsoft Windows -> Microsoft Corporation)
HKU\S-1-5-21-572709066-2931371650-4259622231-1001\...\Run: [Stride] => C:\Users\Lab\AppData\Local\Stride\update.exe [1864504 2019-01-03] (Atlassian, Inc. -> ) [File not signed]
HKU\S-1-5-21-572709066-2931371650-4259622231-1001\...\Run: [CCleaner Smart Cleaning] => C:\Program Files\CCleaner\CCleaner64.exe [24552064 2019-10-15] (Piriform Software Ltd -> Piriform Ltd)
HKU\S-1-5-21-572709066-2931371650-4259622231-1001\...\Run: [com.squirrel.slack.slack] => C:\Users\Lab\AppData\Local\slack\slack.exe [306704 2020-02-13] (Slack Technologies, Inc. -> Slack Technologies Inc.)
HKU\S-1-5-21-572709066-2931371650-4259622231-1001\...\Policies\system: [DisableLockWorkstation] 0
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bitmeter2.lnk [2017-10-11]
ShortcutTarget: Bitmeter2.lnk -> C:\Program Files (x86)\Codebox\BitMeter\BitMeter2.exe () [File not signed]
Startup: C:\Users\Lab\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Live Mail.lnk [2017-10-11]
ShortcutTarget: Windows Live Mail.lnk -> C:\Program Files (x86)\Windows Live\Mail\wlmail.exe (Microsoft Corporation -> Microsoft Corporation)

==================== Scheduled Tasks (Whitelisted) ============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {1C39CB76-9E87-4680-8FC5-D848D7D02FF3} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2001.7-0\MpCmdRun.exe [473544 2020-02-03] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {3462C010-86B6-4096-91E1-924571F0FC07} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2017-03-17] (Dropbox, Inc -> Dropbox, Inc.)
Task: {48673C96-9B69-418D-9E3E-B5CD35DAF138} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe [608384 2019-10-15] (Piriform Software Ltd -> Piriform Software Ltd)
Task: {5C2C0D96-C24B-4EA4-B589-714EFD6223A9} - System32\Tasks\Disable Lock Screen => reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\SessionData /t REG_DWORD /v AllowLockScreen /d 0 /f
Task: {75C7D7C1-3B2C-4798-BE7C-5F9D72078FFE} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2017-03-17] (Dropbox, Inc -> Dropbox, Inc.)
Task: {80B2EB78-5907-4390-A400-D45B454E400F} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task => {3519154C-227E-47F3-9CC9-12C3F05817F1}
Task: {8113E4C5-60F9-41A4-8F9C-BC63681DF404} - System32\Tasks\{8C6872F8-6A49-47C4-ACD5-942A295AC3B0} => C:\windows\system32\pcalua.exe -a D:\AutoPlay.exe -d D:\ -c -c
Task: {8E1A3A90-1B06-4239-8091-5BC002CA63A1} - System32\Tasks\StartCN => C:\Program Files\AMD\CNext\CNext\cncmd.exe [52104 2017-06-27] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.)
Task: {90F0E3E1-A466-4143-BA64-27ADF4F627C6} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2001.7-0\MpCmdRun.exe [473544 2020-02-03] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {A50B4B8D-2ACE-4359-A3EF-C7D37A8BAB70} - System32\Tasks\Adobe Flash Player NPAPI Notifier => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_32_0_0_330_Plugin.exe [1458232 2020-02-13] (Adobe Inc. -> Adobe)
Task: {D78CE9D6-E38A-4516-9893-1F2BEDD60BB9} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [18458752 2019-10-15] (Piriform Software Ltd -> Piriform Ltd)
Task: {DE0837A3-AFFC-4060-9AC8-C3045F1C67F0} - System32\Tasks\{E68E1D02-CE3F-46B4-88C8-956747E342A1} => C:\windows\system32\pcalua.exe -a D:\AutoPlay.exe -d D:\ -c -c
Task: {E99E0067-344E-4534-821D-4A09DCEF5F3F} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2001.7-0\MpCmdRun.exe [473544 2020-02-03] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {EF0E9E5E-5E53-4A0E-8182-FD33688E5715} - System32\Tasks\RtHDVBg_PushButton => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1411320 2015-08-03] (Realtek Semiconductor Corp -> Realtek Semiconductor)
Task: {F57CCB5E-7D12-4BFB-BD20-404D705DB083} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2001.7-0\MpCmdRun.exe [473544 2020-02-03] (Microsoft Windows Publisher -> Microsoft Corporation)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 10.0.0.1
Tcpip\..\Interfaces\{cacfe802-233a-436d-b259-32715c634d3c}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{df648765-6e27-42eb-83d1-1c0125fbfe78}: [DhcpNameServer] 10.0.0.1

Internet Explorer:
==================
HKU\S-1-5-21-572709066-2931371650-4259622231-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation -> Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation -> Microsoft Corporation)

Edge:
======
DownloadDir: C:\Users\Lab\Downloads
Edge HomeButtonPage: HKU\S-1-5-21-572709066-2931371650-4259622231-1001 -> hxxp://www.bouncerevel.com/in/

FireFox:
========
FF DefaultProfile: 4wyhpro4.default
FF ProfilePath: C:\Users\Lab\AppData\Roaming\Mozilla\Firefox\Profiles\4wyhpro4.default [2020-02-25]
FF Extension: (Ghostery – Privacy Ad Blocker) - C:\Users\Lab\AppData\Roaming\Mozilla\Firefox\Profiles\4wyhpro4.default\Extensions\firefox@ghostery.com.xpi [2020-01-13]
FF Extension: (HyperSnap Helper) - C:\Users\Lab\AppData\Roaming\Mozilla\Firefox\Profiles\4wyhpro4.default\Extensions\jid0-GWN5cQ7aNwf7gXzAEIjPjwc37Gg@jetpack.xpi [2017-08-11] [Legacy]
FF Extension: (Windows 7 Aero Blue) - C:\Users\Lab\AppData\Roaming\Mozilla\Firefox\Profiles\4wyhpro4.default\Extensions\{8df5432f-2fe1-451c-aac9-115bf404baf1}.xpi [2019-05-13]
FF HKLM-x32\...\Firefox\Extensions: [{jid1-vS7biDmom8YxhA@jetpack}] - C:\Users\Lab\AppData\Roaming\Mozilla\Firefox\Profiles\4wyhpro4.default\extensions\{jid1-vS7biDmom8YxhA@jetpack} => not found
FF HKLM-x32\...\Firefox\Extensions: [search@safesear.ch] - C:\Users\Lab\AppData\Roaming\Mozilla\Firefox\Profiles\4wyhpro4.default\extensions\search@safesear.ch => not found
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_32_0_0_330.dll [2020-02-13] (Adobe Inc. -> )
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2018-01-24] (Tracker Software Products (Canada) Ltd. -> Tracker Software Products (Canada) Ltd.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50918.0\npctrl.dll [2018-10-23] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2018-01-24] (Tracker Software Products (Canada) Ltd. -> Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_32_0_0_330.dll [2020-02-13] (Adobe Inc. -> )
FF Plugin-x32: @BCDVR/dvrclient -> C:\Program Files\npdvrclient\npDvrOcx02.dll [2016-12-10] (BC) [File not signed]
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2018-01-24] (Tracker Software Products (Canada) Ltd. -> Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\npctrl.dll [2018-10-23] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2018-01-24] (Tracker Software Products (Canada) Ltd. -> Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2019-08-14] (VideoLAN -> VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2019-08-14] (VideoLAN -> VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=3.0.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2019-08-14] (VideoLAN -> VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=3.0.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2019-08-14] (VideoLAN -> VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=3.0.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2019-08-14] (VideoLAN -> VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=3.0.7 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2019-08-14] (VideoLAN -> VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=3.0.7.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2019-08-14] (VideoLAN -> VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=3.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2019-08-14] (VideoLAN -> VideoLAN)
FF Plugin HKU\S-1-5-21-572709066-2931371650-4259622231-1001: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2018-01-24] (Tracker Software Products (Canada) Ltd. -> Tracker Software Products (Canada) Ltd.)
FF Plugin HKU\S-1-5-21-572709066-2931371650-4259622231-1001: @ipcocx.com/npipcam;version=1.0 -> C:\Program Files (x86)\Common Files\IPCOCX2.0\IPCCameraOCX\npipcam.dll [2017-05-27] () [File not signed]
FF Plugin HKU\S-1-5-21-572709066-2931371650-4259622231-1001: @ipcpbocx.com/npipcpb;version=1.0 -> C:\Program Files (x86)\Common Files\IPCOCX2.0\IPCCameraOCX\npipcpb.dll [2017-05-27] () [File not signed]
FF Plugin HKU\S-1-5-21-572709066-2931371650-4259622231-1001: hangzhoutaoshitechnologycoltd.com/DevWebClient -> C:\Program Files\WebClientNoIE\npDevWebClient.dll [2017-06-08] (Hangzhou Taoshi Technology Co., Ltd.) [File not signed]

==================== Services (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD External Events Utility; C:\WINDOWS\system32\atiesrxx.exe [551832 2017-06-30] (Advanced Micro Devices, Inc. -> AMD)
R2 AtherosSvc; C:\WINDOWS\System32\drivers\AdminService.exe [382928 2019-09-23] (Qualcomm Atheros -> Windows (R) Win 7 DDK provider)
S3 Backupper Service; C:\Program Files (x86)\AOMEI Backupper\ABService.exe [180072 2018-07-11] (CHENGDU AOMEI Tech Co., Ltd. -> AOMEI Tech Co., Ltd.)
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2017-03-17] (Dropbox, Inc -> Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2017-03-17] (Dropbox, Inc -> Dropbox, Inc.)
R2 DbxSvc; C:\WINDOWS\system32\DbxSvc.exe [44552 2020-02-19] (Dropbox, Inc -> Dropbox, Inc.)
S2 Freemake Improver; C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [81280 2019-12-11] (Mixbyte Inc -> Freemake)
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [118520 2013-02-28] (Riverbed Technology, Inc. -> Riverbed Technology, Inc.)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [312056 2015-08-03] (Realtek Semiconductor Corp -> Realtek Semiconductor)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [5796168 2019-09-13] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 SNMP; C:\WINDOWS\System32\snmp.exe [53248 2019-08-22] (Microsoft Windows -> Microsoft Corporation)
R2 SNMP; C:\WINDOWS\SysWOW64\snmp.exe [46592 2019-08-22] (Microsoft Windows -> Microsoft Corporation)
R2 tbaseprovisioning; C:\windows\SysWOW64\tbaseprovisioning.exe [60432 2015-06-23] (Microsoft Windows Hardware Compatibility Publisher -> Advanced Micro Devices, Inc.)
R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2001.7-0\NisSrv.exe [3284840 2020-02-03] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2001.7-0\MsMpEng.exe [103168 2020-02-03] (Microsoft Windows Publisher -> Microsoft Corporation)

===================== Drivers (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R0 ambakdrv; C:\WINDOWS\System32\ambakdrv.sys [51120 2016-12-21] (CHENGDU AOMEI Tech Co., Ltd. -> )
S3 amdide64; C:\WINDOWS\System32\drivers\amdide64.sys [13848 2015-05-11] (Microsoft Windows Hardware Compatibility Publisher -> Advanced Micro Devices Inc.)
S3 amdkmcsp; C:\WINDOWS\System32\drivers\amdkmcsp.sys [101104 2015-06-23] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc. )
R3 amdkmdag; C:\WINDOWS\System32\DriverStore\FileRepository\c0315687.inf_amd64_374fae4a4c5ce87a\atikmdag.sys [36572568 2017-06-30] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.)
R3 amdkmdap; C:\WINDOWS\System32\DriverStore\FileRepository\c0315687.inf_amd64_374fae4a4c5ce87a\atikmpag.sys [529304 2017-06-30] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.)
R0 amdkmpfd; C:\WINDOWS\System32\drivers\amdkmpfd.sys [73976 2015-06-04] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.)
S3 amdpsp; C:\WINDOWS\System32\drivers\amdpsp.sys [277240 2015-06-23] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc. )
R2 ammntdrv; C:\WINDOWS\system32\ammntdrv.sys [171952 2016-12-21] (CHENGDU AOMEI Tech Co., Ltd. -> )
R2 amwrtdrv; C:\WINDOWS\system32\amwrtdrv.sys [38320 2017-09-01] (CHENGDU AOMEI Tech Co., Ltd. -> )
R3 athr; C:\WINDOWS\System32\drivers\athw10x.sys [4322672 2018-06-28] (Qualcomm Atheros -> Qualcomm Atheros Communications, Inc.)
R3 AtiHDAudioService; C:\WINDOWS\system32\drivers\AtihdWT6.sys [102912 2015-05-28] (Microsoft Windows Hardware Compatibility Publisher -> Advanced Micro Devices)
S3 CYUSB; C:\WINDOWS\System32\Drivers\CyUSB.sys [47104 2016-09-07] (Analog Devices Incorporated -> Cypress Semiconductor)
S3 DDDriver; C:\WINDOWS\system32\drivers\DDDriver64Dcsa.sys [32464 2016-06-23] (Techporch Incorporated -> Dell Computer Corporation)
S3 DellProf; C:\WINDOWS\system32\drivers\DellProf.sys [24240 2016-06-23] (Techporch Incorporated -> Dell Computer Corporation)
S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus.sys [131984 2017-05-18] (Samsung Electronics Co., Ltd. -> Samsung Electronics Co., Ltd.)
S3 DigiartyVirtualCDBus; C:\WINDOWS\System32\drivers\DigiartyVirtualCDBus.sys [276256 2019-06-09] (Digiarty, Inc. -> Digiarty Software, Inc.)
R0 FSProFilter2; C:\WINDOWS\System32\Drivers\FSPFltd2.sys [57648 2011-06-03] (Alfa System Programming -> FSPro Labs)
R3 LifeCamTrueColor; C:\WINDOWS\system32\DRIVERS\LifeCamTrueColor.sys [37928 2016-07-27] (Microsoft Corporation -> Microsoft Corporation)
R2 NPF; C:\WINDOWS\System32\drivers\npf.sys [36600 2013-02-28] (Riverbed Technology, Inc. -> Riverbed Technology, Inc.)
S3 rccfg; C:\WINDOWS\System32\drivers\rccfg.sys [30432 2015-06-24] (Dot Hill Systems Corp -> AMD, Inc.)
S3 rcraid; C:\WINDOWS\System32\drivers\rcraid.sys [551136 2015-06-24] (Dot Hill Systems Corp -> AMD, Inc.)
S3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [886528 2015-05-29] (Realtek Semiconductor Corp -> Realtek )
S3 RtkAvrcp; C:\WINDOWS\System32\drivers\RtkAvrcp.sys [64216 2014-12-23] (Realtek Semiconductor Corp -> Realtek Semiconductor Corporation)
S3 RtkAvrcpCtrlr; C:\WINDOWS\System32\drivers\RtkAvrcpCtrlr.sys [74496 2015-05-28] (Realtek Semiconductor Corp -> Realtek Semiconductor Corporation)
R3 RTSUER; C:\WINDOWS\system32\Drivers\RtsUer.sys [402136 2015-05-27] (Realtek Semiconductor Corp -> Realsil Semiconductor Corporation)
S3 rusb3hub; C:\WINDOWS\System32\drivers\rusb3hub.sys [114568 2012-08-27] (Renesas Electronics Corporation -> Renesas Electronics Corporation)
S3 rusb3xhc; C:\WINDOWS\system32\DRIVERS\rusb3xhc.sys [230280 2012-08-27] (Renesas Electronics Corporation -> Renesas Electronics Corporation)
S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [166288 2017-05-18] (Samsung Electronics Co., Ltd. -> Samsung Electronics Co., Ltd.)
R3 TotRec8; C:\WINDOWS\system32\drivers\TotRec8.sys [124616 2014-04-30] (High Criteria Inc -> High Criteria inc.)
S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [45960 2020-02-03] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [376032 2020-02-03] (Microsoft Windows -> Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [53984 2020-02-03] (Microsoft Windows -> Microsoft Corporation)
S3 WsAudio_Device(1); C:\WINDOWS\system32\drivers\VirtualAudio1.sys [31080 2015-08-03] (Wondershare Software Co., Ltd. -> Wondershare)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Three months (created) ===================

(If an entry is included in the fixlist, the file/folder will be moved.)

2020-02-24 17:41 - 2020-02-24 17:41 - 031233184 _____ (2BrightSparks Pte Ltd ) C:\Users\Lab\Downloads\SyncBack_Setup(1).exe
2020-02-24 09:46 - 2020-02-24 09:46 - 019255000 _____ (Microsoft Corporation) C:\Users\Lab\Desktop\MediaCreationTool1909.exe
2020-02-23 12:47 - 2020-02-23 12:47 - 000000207 _____ C:\WINDOWS\tweaking.com-regbackup-WINDOWS-9C6P0DA-Windows-10-Pro-(64-bit).dat
2020-02-23 12:47 - 2020-02-23 12:47 - 000000000 ____D C:\RegBackup
2020-02-23 12:46 - 2020-02-23 12:47 - 000017987 _____ C:\WINDOWS\Tweaking.com - Registry Backup Setup Log.txt
2020-02-23 12:46 - 2020-02-23 12:46 - 000002310 _____ C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
2020-02-23 12:46 - 2020-02-23 12:46 - 000002310 _____ C:\ProgramData\Desktop\Tweaking.com - Registry Backup.lnk
2020-02-23 12:46 - 2020-02-23 12:46 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
2020-02-23 12:46 - 2020-02-23 12:46 - 000000000 ____D C:\Program Files (x86)\Tweaking.com
2020-02-23 10:20 - 2020-02-23 10:20 - 001684356 _____ C:\Users\Lab\Desktop\565 Sofia Web Jim1.pdf
2020-02-23 10:10 - 2020-02-23 10:12 - 001808034 _____ C:\Users\Lab\Desktop\568 Sofia Web Jim1.pdf
2020-02-23 09:33 - 2020-02-23 09:33 - 000024669 _____ C:\Users\Lab\Desktop\Langlley letter.pdf
2020-02-22 19:12 - 2020-02-22 19:12 - 000050126 _____ C:\Users\Lab\Downloads\LabelDownloadServlet(2)
2020-02-22 19:04 - 2020-02-22 19:04 - 000029903 _____ C:\Users\Lab\Downloads\Label-1.pdf
2020-02-21 15:07 - 2020-02-21 15:07 - 000000000 ____D C:\Users\Lab\Desktop\UFS Collection
2020-02-21 08:13 - 2020-02-25 10:14 - 000000000 ____D C:\Users\Lab\Desktop\Malware Check
2020-02-20 15:49 - 2020-02-20 15:49 - 000363028 _____ C:\Users\Lab\Downloads\Statement_022020_7861.pdf
2020-02-20 15:18 - 2020-02-25 10:15 - 000000000 ____D C:\FRST
2020-02-19 13:37 - 2020-02-19 13:37 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
2020-02-19 11:36 - 2020-02-19 11:36 - 000968629 _____ C:\Users\Lab\Downloads\magnetic_sound_recording.pdf
2020-02-19 05:21 - 2020-02-19 05:21 - 000047600 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-stable.sys
2020-02-19 05:21 - 2020-02-19 05:21 - 000047600 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-dev.sys
2020-02-19 05:21 - 2020-02-19 05:21 - 000047600 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-canary.sys
2020-02-19 05:21 - 2020-02-19 05:21 - 000044552 _____ (Dropbox, Inc.) C:\WINDOWS\system32\DbxSvc.exe
2020-02-17 10:50 - 2020-02-17 10:50 - 001122474 _____ C:\Users\Lab\Downloads\19700016297(1).pdf
2020-02-16 18:44 - 2020-02-16 18:44 - 001122474 _____ C:\Users\Lab\Downloads\19700016297.pdf
2020-02-16 09:13 - 2020-02-21 08:47 - 000000000 ____D C:\Users\Lab\Desktop\NASA Temp
2020-02-15 15:22 - 2020-02-15 15:22 - 000864139 _____ C:\Users\Lab\Downloads\FBI_Risks_To_Academia.pdf
2020-02-15 15:22 - 2020-02-15 15:22 - 000864139 _____ C:\Users\Lab\Downloads\FBI_Risks_To_Academia(1).pdf
2020-02-14 09:54 - 2020-02-14 09:54 - 000329064 _____ C:\Users\Lab\Downloads\Statement(3).pdf
2020-02-14 09:54 - 2020-02-14 09:54 - 000329064 _____ C:\Users\Lab\Downloads\Statement(2).pdf
2020-02-14 09:43 - 2020-02-14 09:43 - 000000000 ____D C:\Users\Lab\AppData\Local\cache
2020-02-13 16:09 - 2020-02-13 16:09 - 000273546 _____ C:\Users\Lab\Downloads\BrokerageStatement1231199652
2020-02-13 16:08 - 2020-02-13 16:08 - 000091486 _____ C:\Users\Lab\Downloads\1099CompositeandYearEndSummary20190207201879
2020-02-13 15:59 - 2020-02-13 15:59 - 000231077 _____ C:\Users\Lab\Downloads\1099CompositeandYearEndSummary20190207200660
2020-02-13 15:48 - 2020-02-13 15:48 - 000000000 ___RD C:\Users\Lab\3D Objects
2020-02-13 14:14 - 2020-02-13 14:14 - 000000000 ____D C:\ProgramData\ssh
2020-02-13 13:42 - 2020-02-13 13:42 - 025444352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Hydrogen.dll
2020-02-13 13:42 - 2020-02-13 13:42 - 019813376 _____ (Microsoft Corporation) C:\WINDOWS\system32\HologramWorld.dll
2020-02-13 13:42 - 2020-02-13 13:42 - 005502464 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdp.dll
2020-02-13 13:42 - 2020-02-13 13:42 - 004470272 _____ (Microsoft Corporation) C:\WINDOWS\system32\xpsrchvw.exe
2020-02-13 13:42 - 2020-02-13 13:42 - 004308480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdp.dll
2020-02-13 13:42 - 2020-02-13 13:42 - 004129416 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2020-02-13 13:42 - 2020-02-13 13:42 - 003525592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2020-02-13 13:42 - 2020-02-13 13:42 - 003365376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xpsrchvw.exe
2020-02-13 13:42 - 2020-02-13 13:42 - 002493720 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2vdec.dll
2020-02-13 13:42 - 2020-02-13 13:42 - 002314952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2vdec.dll
2020-02-13 13:42 - 2020-02-13 13:42 - 002230232 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfasfsrcsnk.dll
2020-02-13 13:42 - 2020-02-13 13:42 - 002188816 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystems64.dll
2020-02-13 13:42 - 2020-02-13 13:42 - 001835128 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsrcsnk.dll
2020-02-13 13:42 - 2020-02-13 13:42 - 001610240 _____ (Microsoft Corporation) C:\WINDOWS\system32\HologramCompositor.dll
2020-02-13 13:42 - 2020-02-13 13:42 - 001541632 _____ (Microsoft Corporation) C:\WINDOWS\system32\wbengine.exe
2020-02-13 13:42 - 2020-02-13 13:42 - 001496080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppVEntSubsystems32.dll
2020-02-13 13:42 - 2020-02-13 13:42 - 001489064 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll
2020-02-13 13:42 - 2020-02-13 13:42 - 001417760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsrcsnk.dll
2020-02-13 13:42 - 2020-02-13 13:42 - 001272360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll
2020-02-13 13:42 - 2020-02-13 13:42 - 001151816 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll
2020-02-13 13:42 - 2020-02-13 13:42 - 001106944 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Streaming.dll
2020-02-13 13:42 - 2020-02-13 13:42 - 001105776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll
2020-02-13 13:42 - 2020-02-13 13:42 - 001098720 _____ (Microsoft Corporation) C:\WINDOWS\system32\DolbyDecMFT.dll
2020-02-13 13:42 - 2020-02-13 13:42 - 000952416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DolbyDecMFT.dll
2020-02-13 13:42 - 2020-02-13 13:42 - 000890368 _____ (Microsoft Corporation) C:\WINDOWS\system32\HolographicExtensions.dll
2020-02-13 13:42 - 2020-02-13 13:42 - 000852480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Streaming.dll
2020-02-13 13:42 - 2020-02-13 13:42 - 000805888 _____ (Microsoft Corporation) C:\WINDOWS\system32\cscui.dll
2020-02-13 13:42 - 2020-02-13 13:42 - 000537608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mf.dll
2020-02-13 13:42 - 2020-02-13 13:42 - 000516544 _____ (Microsoft Corporation) C:\WINDOWS\system32\mf.dll
2020-02-13 13:42 - 2020-02-13 13:42 - 000444928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv.sys
2020-02-13 13:42 - 2020-02-13 13:42 - 000174392 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\AppvVemgr.sys
2020-02-13 13:42 - 2020-02-13 13:42 - 000153912 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\AppvVfs.sys
2020-02-13 13:42 - 2020-02-13 13:42 - 000138040 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\AppVStrm.sys
2020-02-13 13:41 - 2020-02-13 13:41 - 025900032 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 022635008 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 019850240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 018026496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 009929016 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 008013824 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 007905208 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 007754752 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 007600448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 007263992 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 007259648 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 007017472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 006519752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 006435840 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 006284800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 006167552 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.pcshell.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 006083832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 005943296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 005912064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 005764664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 005112320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 005041664 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 004856832 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 004575232 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 004562896 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 004538880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 004470784 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputService.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 004348616 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Mirage.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 004005888 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeContent.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 003967888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 003820032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 003792384 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 003728896 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2020-02-13 13:41 - 2020-02-13 13:41 - 003550208 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 003484672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 003372440 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 003263488 _____ (Microsoft Corporation) C:\WINDOWS\system32\tquery.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 003243080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Mirage.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 002988552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2020-02-13 13:41 - 2020-02-13 13:41 - 002870272 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssrch.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 002861568 _____ (Microsoft Corporation) C:\WINDOWS\system32\xpsservices.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 002800128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2020-02-13 13:41 - 2020-02-13 13:41 - 002773776 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 002766088 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 002755584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb
2020-02-13 13:41 - 2020-02-13 13:41 - 002755584 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb
2020-02-13 13:41 - 2020-02-13 13:41 - 002703872 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebRuntimeManager.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 002698768 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2020-02-13 13:41 - 2020-02-13 13:41 - 002584008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 002561536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tquery.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 002305536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssrch.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 002260176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 002225160 _____ (Microsoft Corporation) C:\WINDOWS\system32\ResetEngine.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 002147328 _____ (Microsoft Corporation) C:\WINDOWS\system32\pnidui.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 002084576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 002071552 _____ (Microsoft Corporation) C:\WINDOWS\system32\ISM.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 002032128 _____ C:\WINDOWS\system32\rdpnano.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001999960 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001985928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.appcore.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001916744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001858560 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001841152 _____ C:\WINDOWS\system32\TextInputMethodFormatter.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001835008 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001830200 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpserverbase.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001757096 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2020-02-13 13:41 - 2020-02-13 13:41 - 001743680 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001726480 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001697280 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001693184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001687040 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsPrint.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001664696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001664680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001657856 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001655880 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001647072 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001602560 _____ (Microsoft Corporation) C:\WINDOWS\system32\dosvc.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001562424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpserverbase.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001540096 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001512320 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 001505592 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpbase.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001482040 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys
2020-02-13 13:41 - 2020-02-13 13:41 - 001481216 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpsharercom.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001480192 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocoreworker.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 001458688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001413840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001412096 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettings.Handlers.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001398584 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 001394168 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinTypes.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001372160 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationController.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001366128 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2020-02-13 13:41 - 2020-02-13 13:41 - 001330952 _____ (Microsoft Corporation) C:\WINDOWS\system32\crypt32.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001319936 _____ (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001300280 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\http.sys
2020-02-13 13:41 - 2020-02-13 13:41 - 001284096 _____ (Microsoft Corporation) C:\WINDOWS\system32\werconcpl.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001283592 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
2020-02-13 13:41 - 2020-02-13 13:41 - 001273856 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcore.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001261464 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001260544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpsharercom.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001218120 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipUp.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 001216000 _____ (Microsoft Corporation) C:\WINDOWS\system32\sdclt.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 001214976 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001213752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpbase.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001195008 _____ (Microsoft Corporation) C:\WINDOWS\system32\sdengin2.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001182232 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 001170960 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001154448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001097216 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Immersive.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001083904 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001083392 _____ (Microsoft Corporation) C:\WINDOWS\system32\clusapi.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001080832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpcore.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001077264 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 001060352 _____ (Microsoft Corporation) C:\WINDOWS\system32\termsrv.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001054864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001051448 _____ (Microsoft Corporation) C:\WINDOWS\system32\pidgenx.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001020032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\crypt32.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001009664 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 001000960 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Mirage.Internal.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000996352 _____ (Microsoft Corporation) C:\WINDOWS\system32\sysmain.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000986936 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\refsv1.sys
2020-02-13 13:41 - 2020-02-13 13:41 - 000974336 _____ (Microsoft Corporation) C:\WINDOWS\system32\uDWM.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000949248 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecurityHealthSSO.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000928120 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecurityHealthService.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000923136 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeManager.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000921600 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Management.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000916480 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Core.TextInput.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000913408 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasmans.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000904504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgent.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000896512 _____ (Microsoft Corporation) C:\WINDOWS\system32\MdmDiagnostics.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000895488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Immersive.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000892488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinTypes.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000891736 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000882688 _____ (Microsoft Corporation) C:\WINDOWS\system32\CPFilters.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000875448 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000864256 _____ (Microsoft Corporation) C:\WINDOWS\system32\netlogon.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000857088 _____ C:\WINDOWS\system32\MBR2GPT.EXE
2020-02-13 13:41 - 2020-02-13 13:41 - 000852480 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieproxy.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000851968 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchIndexer.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000843776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webplatstorageserver.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000842552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CloudExperienceHostCommon.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000839680 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000828216 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVClient.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000824848 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupEngine.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000822416 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000805376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\clusapi.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000797112 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000788992 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000784384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000783480 _____ (Microsoft Corporation) C:\WINDOWS\system32\tcblaunch.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000774664 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000768488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000758800 _____ (Microsoft Corporation) C:\WINDOWS\system32\wimgapi.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000749568 _____ (Microsoft Corporation) C:\WINDOWS\system32\FrameServer.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000747320 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000705536 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000704512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.FileExplorer.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000701440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Mirage.Internal.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CPFilters.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000685056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000679368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000678928 _____ (Microsoft Corporation) C:\WINDOWS\system32\StructuredQuery.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000674280 _____ (Microsoft Corporation) C:\WINDOWS\system32\services.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000673792 _____ (Microsoft Corporation) C:\WINDOWS\system32\wiaaut.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000673456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000673080 _____ (Microsoft Corporation) C:\WINDOWS\system32\comctl32.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000671232 _____ (Microsoft Corporation) C:\WINDOWS\system32\wiaservc.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000670720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchIndexer.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000667136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000667136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EdgeManager.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000663552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netlogon.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000661816 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\afd.sys
2020-02-13 13:41 - 2020-02-13 13:41 - 000646144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.Management.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000642008 _____ (Microsoft Corporation) C:\WINDOWS\system32\TextInputFramework.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000637440 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000629760 _____ (Microsoft Corporation) C:\WINDOWS\system32\ipnathlp.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000623104 _____ (Microsoft Corporation) C:\WINDOWS\system32\resutils.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000617784 _____ (Microsoft Corporation) C:\WINDOWS\system32\hal.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000610816 _____ (Microsoft Corporation) C:\WINDOWS\system32\netprofmsvc.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000605184 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000599552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ActivationManager.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000598528 _____ (Microsoft Corporation) C:\WINDOWS\system32\webio.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000597816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wimgapi.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000595968 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000593128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000587064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupEngine.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000578560 _____ (Microsoft Corporation) C:\WINDOWS\system32\SppExtComObj.Exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000571392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wiaaut.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000568120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comctl32.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000562176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000558592 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_Notifications.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000550400 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2020-02-13 13:41 - 2020-02-13 13:41 - 000545432 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.MediaControl.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000542288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StructuredQuery.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000535552 _____ (Microsoft Corporation) C:\WINDOWS\system32\usosvc.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000532480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000530432 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppcext.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000521728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.System.Launcher.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000518456 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000516648 _____ (Microsoft Corporation) C:\WINDOWS\system32\wimserv.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000516096 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotificationUx.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000512000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000511000 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64win.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000510768 _____ (Microsoft Corporation) C:\WINDOWS\system32\systemreset.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000500736 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2020-02-13 13:41 - 2020-02-13 13:41 - 000497152 _____ (Microsoft Corporation) C:\WINDOWS\system32\werui.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000494080 _____ (Microsoft Corporation) C:\WINDOWS\system32\defragsvc.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000490496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.FileExplorer.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000490496 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000486912 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiobj.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000486400 _____ (Microsoft Corporation) C:\WINDOWS\system32\srcore.dll

[END OF PART ONE]

[Electrojim]

PART TWO:

2020-02-13 13:41 - 2020-02-13 13:41 - 000477496 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\FWPKCLNT.SYS
2020-02-13 13:41 - 2020-02-13 13:41 - 000476672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\resutils.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000475648 _____ (Microsoft Corporation) C:\WINDOWS\system32\DscCore.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000469504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webio.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000467952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000465208 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000459896 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotifyIcon.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000457216 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cldflt.sys
2020-02-13 13:41 - 2020-02-13 13:41 - 000453432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000450560 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpclip.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000443904 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgeIso.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000441072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.MediaControl.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000435200 _____ (Microsoft Corporation) C:\WINDOWS\system32\wincorlib.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000432256 _____ (Microsoft Corporation) C:\WINDOWS\system32\tsmf.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000430080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werui.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000430080 _____ (Microsoft Corporation) C:\WINDOWS\system32\fhcfg.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000422912 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpencom.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000422008 _____ (Microsoft Corporation) C:\WINDOWS\system32\SgrmEnclave_secure.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000421376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2020-02-13 13:41 - 2020-02-13 13:41 - 000416056 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Classpnp.sys
2020-02-13 13:41 - 2020-02-13 13:41 - 000407040 _____ (Microsoft Corporation) C:\WINDOWS\system32\DispBroker.Desktop.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000406480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Enumeration.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000405632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000401408 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchProtocolHost.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000400696 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys
2020-02-13 13:41 - 2020-02-13 13:41 - 000399360 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000392192 _____ (Microsoft Corporation) C:\WINDOWS\system32\Search.ProtocolHandler.MAPI2.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000384000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiobj.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000375504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000370688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieproxy.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000369504 _____ (Microsoft Corporation) C:\WINDOWS\system32\BCP47Langs.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000368128 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssvp.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000366416 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsensorgroup.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000363840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tsmf.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000355840 _____ (Microsoft Corporation) C:\WINDOWS\system32\WaaSMedicSvc.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000353280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpencom.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000350720 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_SpeechPrivacy.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000345088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000342528 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\udfs.sys
2020-02-13 13:41 - 2020-02-13 13:41 - 000336384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchProtocolHost.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000335448 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000329216 _____ (Microsoft Corporation) C:\WINDOWS\system32\DiagnosticLogCSP.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000327680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgeIso.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000324616 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000324608 _____ (Microsoft Corporation) C:\WINDOWS\system32\FSClient.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32k.sys
2020-02-13 13:41 - 2020-02-13 13:41 - 000324096 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpviewerax.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000321536 _____ (Microsoft Corporation) C:\WINDOWS\system32\sti.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000317440 _____ (Microsoft Corporation) C:\WINDOWS\system32\ConhostV1.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000311096 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecurityHealthAgent.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000309248 _____ (Microsoft Corporation) C:\WINDOWS\system32\tapisrv.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000308736 _____ (Microsoft Corporation) C:\WINDOWS\system32\msIso.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000307712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wincorlib.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000300392 _____ (Microsoft Corporation) C:\WINDOWS\system32\skci.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000299520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssvp.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000285184 _____ (Microsoft Corporation) C:\WINDOWS\system32\WaaSMedicCapsule.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000283136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Search.ProtocolHandler.MAPI2.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000281088 _____ (Microsoft Corporation) C:\WINDOWS\system32\msutb.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000274464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BCP47Langs.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000270848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpviewerax.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000268800 _____ (Microsoft Corporation) C:\WINDOWS\system32\rstrui.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000266752 _____ (Microsoft Corporation) C:\WINDOWS\system32\DAFMCP.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000259984 _____ (Microsoft Corporation) C:\WINDOWS\system32\logoncli.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000252928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tapisrv.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000251904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msIso.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000249344 _____ (Microsoft Corporation) C:\WINDOWS\system32\srrstr.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000247856 _____ (Microsoft Corporation) C:\WINDOWS\system32\weretw.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000240640 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchFilterHost.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000228864 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000227840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sti.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000227840 _____ (Microsoft Corporation) C:\WINDOWS\system32\IndexedDbLegacy.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000226816 _____ (Microsoft Corporation) C:\WINDOWS\system32\netprofm.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000225792 _____ (Microsoft Corporation) C:\WINDOWS\system32\wersvc.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000224768 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWWIN.EXE
2020-02-13 13:41 - 2020-02-13 13:41 - 000222208 _____ (Microsoft Corporation) C:\WINDOWS\system32\Winlangdb.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000220984 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000217600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msutb.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000214528 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdsdwmdr.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000211968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchFilterHost.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000210744 _____ (Microsoft Corporation) C:\WINDOWS\system32\tcbloader.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000206336 _____ (Microsoft Corporation) C:\WINDOWS\system32\sti_ci.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000204800 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssph.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000203776 _____ (Microsoft Corporation) C:\WINDOWS\system32\regapi.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000201728 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiapi.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000199480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000197632 _____ (Microsoft Corporation) C:\WINDOWS\system32\Win32CompatibilityAppraiserCSP.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000194560 _____ (Microsoft Corporation) C:\WINDOWS\system32\recdisc.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000193800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\weretw.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000190464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\regapi.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000190256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\logoncli.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000186880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWWIN.EXE
2020-02-13 13:41 - 2020-02-13 13:41 - 000186880 _____ (Microsoft Corp.) C:\WINDOWS\system32\Defrag.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000186672 _____ (Microsoft Corporation) C:\WINDOWS\system32\BCP47mrm.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000183808 _____ (Microsoft Corporation) C:\WINDOWS\system32\ResetEngOnline.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000179720 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2020-02-13 13:41 - 2020-02-13 13:41 - 000179712 _____ (Microsoft Corporation) C:\WINDOWS\system32\t2embed.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000175616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\IndexedDbLegacy.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000172032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiapi.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000165832 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000162696 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmcmnutils.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000160768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssph.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000158208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Winlangdb.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000155136 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000152064 _____ (Microsoft Corporation) C:\WINDOWS\system32\fdWSD.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000150536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFaultSecure.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000149504 _____ (Microsoft Corporation) C:\WINDOWS\system32\sdrsvc.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000148992 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDMAppInstaller.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000147456 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssprxy.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000145920 _____ (Microsoft Corporation) C:\WINDOWS\system32\wiadss.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000143872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SpatialAudioLicenseSrv.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000143160 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupApi.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000139776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakrathunk.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000138752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\t2embed.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000138752 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputLocaleManager.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000135168 _____ (Microsoft Corporation) C:\WINDOWS\system32\musdialoghandlers.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000133464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BCP47mrm.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000132624 _____ (Microsoft Corporation) C:\WINDOWS\system32\offlinelsa.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000130560 _____ (Microsoft Corporation) C:\WINDOWS\system32\globinputhost.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000128512 _____ (Microsoft Corporation) C:\WINDOWS\system32\usoapi.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000128512 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssitlb.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000127520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dmcmnutils.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000127280 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32u.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000126976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fdWSD.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000125952 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontsub.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000125440 _____ (Microsoft Corporation) C:\WINDOWS\system32\sdshext.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000123904 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptcatsvc.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000123392 _____ (Microsoft Corporation) C:\WINDOWS\system32\wercplsupport.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000119808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wiadss.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000119808 _____ (Microsoft Corporation) C:\WINDOWS\system32\DafPrintProvider.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000119296 _____ (Microsoft Corporation) C:\WINDOWS\system32\compstui.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000117264 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bindflt.sys
2020-02-13 13:41 - 2020-02-13 13:41 - 000117248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000113152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssitlb.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000112128 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetDriverInstall.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000108544 _____ (Microsoft Corporation) C:\WINDOWS\system32\fdSSDP.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000107832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupApi.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000107008 _____ (Microsoft Corporation) C:\WINDOWS\system32\DevicePairingExperienceMEM.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000106808 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecurityHealthProxyStub.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000105984 _____ (Microsoft Corporation) C:\WINDOWS\system32\utcutil.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000105472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakrathunk.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000105472 _____ (Microsoft Corporation) C:\WINDOWS\system32\dfrgui.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000100352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cdfs.sys
2020-02-13 13:41 - 2020-02-13 13:41 - 000099712 _____ (Microsoft Corporation) C:\WINDOWS\system32\FsIso.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000099328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontsub.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000097280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\compstui.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000097080 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000096768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\globinputhost.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000095232 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeedsbs.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000093496 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsqmcons.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000090624 _____ (Microsoft Corporation) C:\WINDOWS\system32\tsgqec.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000090624 _____ (Microsoft Corporation) C:\WINDOWS\system32\keyiso.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000089600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dfrgui.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000089328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32u.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000089088 _____ (Microsoft Corporation) C:\WINDOWS\system32\WaaSMedicAgent.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000088576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fdSSDP.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000088576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DafPrintProvider.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditBufferTestHook.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000084992 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecurityHealthSystray.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000084496 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hvservice.sys
2020-02-13 13:41 - 2020-02-13 13:41 - 000084480 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterpriseresourcemanager.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000083968 _____ (Microsoft Corporation) C:\WINDOWS\system32\wiarpc.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000083456 _____ (Microsoft Corporation) C:\WINDOWS\system32\clfsw32.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000080896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetDriverInstall.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000079872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeedsbs.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000077824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\usoapi.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000072816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\remoteaudioendpoint.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000071480 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32appinventorycsp.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000070144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tsgqec.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000069120 _____ (Microsoft Corporation) C:\WINDOWS\system32\UsoClient.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000068096 _____ (Microsoft Corporation) C:\WINDOWS\system32\fdProxy.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000066560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\keyiso.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000066560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\clfsw32.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000066560 _____ (Microsoft Corporation) C:\WINDOWS\system32\findnetprinters.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000066048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\enterpriseresourcemanager.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000065536 _____ (Microsoft Corporation) C:\WINDOWS\system32\iemigplugin.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000064000 _____ (Microsoft Corporation) C:\WINDOWS\system32\printui.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000063488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iemigplugin.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000063488 _____ (Microsoft Corporation) C:\WINDOWS\system32\rtutils.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000063288 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecurityHealthHost.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000062464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\printui.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000060416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssprxy.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000060416 _____ (Microsoft Corporation) C:\WINDOWS\system32\msscntrs.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000059392 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserLanguageProfileCallback.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000059221 _____ C:\WINDOWS\system32\srms.dat
2020-02-13 13:41 - 2020-02-13 13:41 - 000058880 _____ C:\WINDOWS\system32\runexehelper.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000057856 _____ (Microsoft Corporation) C:\WINDOWS\system32\SrTasks.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000053248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\findnetprinters.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000052736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rtutils.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000046592 _____ (Microsoft Corporation) C:\WINDOWS\system32\Websocket.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000046080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msscntrs.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000045056 _____ (Microsoft Corporation) C:\WINDOWS\system32\npmproxy.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000044544 _____ (Microsoft Corporation) C:\WINDOWS\system32\werdiagcontroller.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000044032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserLanguageProfileCallback.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000042512 _____ (Microsoft Corporation) C:\WINDOWS\system32\SysResetErr.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000041472 _____ (Microsoft Corporation) C:\WINDOWS\system32\WordBreakers.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000038912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werdiagcontroller.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000038400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mcicda.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000037392 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wimmount.sys
2020-02-13 13:41 - 2020-02-13 13:41 - 000036864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Websocket.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000032056 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdpvideominiport.sys
2020-02-13 13:41 - 2020-02-13 13:41 - 000029696 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlmproxy.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000028672 _____ (Microsoft Corporation) C:\WINDOWS\system32\WaaSMedicPS.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000027648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mciwave.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000026112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msimsg.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000026112 _____ (Microsoft Corporation) C:\WINDOWS\system32\msimsg.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000024064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mciseq.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000021520 _____ (Microsoft Corporation) C:\WINDOWS\system32\kdhvcom.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000020944 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64cpu.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000019768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ResetEngine.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000018432 _____ (Microsoft Corporation) C:\WINDOWS\system32\wiatrace.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000017920 _____ (Microsoft Corporation) C:\WINDOWS\system32\icsunattend.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000017920 _____ (Microsoft Corporation) C:\WINDOWS\system32\bindflt.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000017408 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlmsprep.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000015360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wiatrace.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000015360 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeedssync.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000014336 _____ (Microsoft Corporation) C:\WINDOWS\system32\dciman32.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000013824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeedssync.exe
2020-02-13 13:41 - 2020-02-13 13:41 - 000011776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dciman32.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000010752 _____ (Microsoft Corporation) C:\WINDOWS\system32\DMAlertListener.ProxyStub.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000007680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DMAlertListener.ProxyStub.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000003072 _____ (Microsoft Corporation) C:\WINDOWS\system32\lpk.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\lpk.dll
2020-02-13 13:41 - 2020-02-13 13:41 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth9.bin
2020-02-13 13:41 - 2020-02-13 13:41 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth8.bin
2020-02-13 13:41 - 2020-02-13 13:41 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth7.bin
2020-02-13 13:41 - 2020-02-13 13:41 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth6.bin
2020-02-13 13:41 - 2020-02-13 13:41 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth5.bin
2020-02-13 13:41 - 2020-02-13 13:41 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth4.bin
2020-02-13 13:41 - 2020-02-13 13:41 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth3.bin
2020-02-13 13:41 - 2020-02-13 13:41 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth2.bin
2020-02-13 13:41 - 2020-02-13 13:41 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth12.bin
2020-02-13 13:41 - 2020-02-13 13:41 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth11.bin
2020-02-13 13:41 - 2020-02-13 13:41 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth10.bin
2020-02-13 13:41 - 2020-02-13 13:41 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth1.bin
2020-02-13 13:40 - 2020-02-13 13:40 - 017787904 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 007278592 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 006231200 _____ (Microsoft Corporation) C:\WINDOWS\system32\StartTileData.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 004615376 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2020-02-13 13:40 - 2020-02-13 13:40 - 003969536 _____ (Microsoft Corporation) C:\WINDOWS\system32\tellib.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 003703296 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 003590968 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2020-02-13 13:40 - 2020-02-13 13:40 - 003110400 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 002714624 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2020-02-13 13:40 - 2020-02-13 13:40 - 002473976 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.appcore.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 002284544 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 002125904 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 001942016 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 001748480 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 001413912 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 001149928 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApplyTrustOffline.exe
2020-02-13 13:40 - 2020-02-13 13:40 - 001084216 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgent.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 001026792 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipSVC.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 001006904 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHostCommon.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000878080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Management.Service.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000874296 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys
2020-02-13 13:40 - 2020-02-13 13:40 - 000826368 _____ (Microsoft Corporation) C:\WINDOWS\system32\printfilterpipelinesvc.exe
2020-02-13 13:40 - 2020-02-13 13:40 - 000804872 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys
2020-02-13 13:40 - 2020-02-13 13:40 - 000803840 _____ (Microsoft Corporation) C:\WINDOWS\system32\bisrv.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000782848 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifinetworkmanager.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000750080 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActivationManager.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000737280 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.System.Launcher.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000735744 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000732200 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_StorageSense.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000727040 _____ (Microsoft Corporation) C:\WINDOWS\system32\agentactivationruntime.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000716288 _____ (Microsoft Corporation) C:\WINDOWS\system32\agentactivationruntimewindows.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000646656 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdpsvc.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000637968 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys
2020-02-13 13:40 - 2020-02-13 13:40 - 000589592 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2020-02-13 13:40 - 2020-02-13 13:40 - 000524264 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Enumeration.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000464384 _____ (Microsoft Corporation) C:\WINDOWS\system32\cloudAP.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000456192 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.ConversationalAgent.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000441144 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2020-02-13 13:40 - 2020-02-13 13:40 - 000437776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pci.sys
2020-02-13 13:40 - 2020-02-13 13:40 - 000422712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fastfat.sys
2020-02-13 13:40 - 2020-02-13 13:40 - 000415808 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000404480 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\exfat.sys
2020-02-13 13:40 - 2020-02-13 13:40 - 000379392 _____ (Microsoft Corporation) C:\WINDOWS\system32\provengine.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000296760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys
2020-02-13 13:40 - 2020-02-13 13:40 - 000294400 _____ (Microsoft Corporation) C:\WINDOWS\system32\provops.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000291328 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceDirectoryClient.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000282112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.AppDefaults.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000277504 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_CapabilityAccess.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000271872 _____ (Microsoft Corporation) C:\WINDOWS\system32\provhandlers.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000265216 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdd.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000256000 _____ (Microsoft Corporation) C:\WINDOWS\system32\UpdateDeploymentProvider.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000250880 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\winnat.sys
2020-02-13 13:40 - 2020-02-13 13:40 - 000233472 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCore.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000232448 _____ (Microsoft Corporation) C:\WINDOWS\system32\provisioningcsp.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000209920 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhosdeployment.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000201728 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXApplicabilityBlob.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000194064 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys
2020-02-13 13:40 - 2020-02-13 13:40 - 000187392 _____ (Microsoft Corporation) C:\WINDOWS\system32\tssrvlic.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000184832 _____ (Microsoft Corporation) C:\WINDOWS\system32\AarSvc.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000169472 _____ (Microsoft Corporation) C:\WINDOWS\system32\SpatialAudioLicenseSrv.exe
2020-02-13 13:40 - 2020-02-13 13:40 - 000157696 _____ (Microsoft Corporation) C:\WINDOWS\system32\dssvc.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000155648 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_AppExecutionAlias.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000151552 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_BackgroundApps.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000132096 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tsusbhub.sys
2020-02-13 13:40 - 2020-02-13 13:40 - 000128528 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifitask.exe
2020-02-13 13:40 - 2020-02-13 13:40 - 000123904 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApplicationControlCSP.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000120320 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCsp.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000102400 _____ (Microsoft Corporation) C:\WINDOWS\system32\NFCProvisioningPlugin.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000097280 _____ (Microsoft Corporation) C:\WINDOWS\system32\provdatastore.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000091136 _____ (Microsoft Corporation) C:\WINDOWS\system32\ProvPluginEng.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000089912 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volmgr.sys
2020-02-13 13:40 - 2020-02-13 13:40 - 000088576 _____ (Microsoft Corporation) C:\WINDOWS\system32\BarcodeProvisioningPlugin.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000088352 _____ (Microsoft Corporation) C:\WINDOWS\system32\remoteaudioendpoint.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000083456 _____ (Microsoft Corporation) C:\WINDOWS\system32\provtool.exe
2020-02-13 13:40 - 2020-02-13 13:40 - 000077824 _____ (Microsoft Corporation) C:\WINDOWS\system32\CustomInstallExec.exe
2020-02-13 13:40 - 2020-02-13 13:40 - 000076288 _____ (Microsoft Corporation) C:\WINDOWS\system32\autopilot.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000070656 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Management.EnrollmentStatusTracking.ConfigProvider.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000067112 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsManagementServiceWinRt.ProxyStub.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000066048 _____ (Microsoft Corporation) C:\WINDOWS\system32\RemovableMediaProvisioningPlugin.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000062976 _____ (Microsoft Corporation) C:\WINDOWS\system32\LSCSHostPolicy.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000057856 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000057344 _____ (Microsoft Corporation) C:\WINDOWS\system32\audioresourceregistrar.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000048640 _____ (Microsoft Corporation) C:\WINDOWS\system32\mcicda.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000047208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2020-02-13 13:40 - 2020-02-13 13:40 - 000046592 _____ (Microsoft Corporation) C:\WINDOWS\system32\printfilterpipelineprxy.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000034816 _____ (Microsoft Corporation) C:\WINDOWS\system32\DevQueryBroker.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000034304 _____ (Microsoft Corporation) C:\WINDOWS\system32\mciwave.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000033792 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Management.Provisioning.ProxyStub.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\mciseq.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000027648 _____ (Microsoft Corporation) C:\WINDOWS\system32\lstelemetry.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000026112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WSDScan.sys
2020-02-13 13:40 - 2020-02-13 13:40 - 000025600 _____ (Microsoft Corporation) C:\WINDOWS\system32\autopilotdiag.dll
2020-02-13 13:40 - 2020-02-13 13:40 - 000013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\dstokenclean.exe
2020-02-13 13:40 - 2020-02-13 13:40 - 000013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\serscan.sys
2020-02-13 13:28 - 2020-02-13 13:29 - 000492544 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe
2020-02-13 13:28 - 2020-02-13 13:29 - 000390656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe
2020-02-13 09:11 - 2020-02-13 09:11 - 000997931 _____ C:\Users\Lab\Downloads\LabelDownloadServlet(1)
2020-02-12 15:18 - 2020-02-12 15:18 - 000998563 _____ C:\Users\Lab\Downloads\LabelDownloadServlet
2020-02-12 13:30 - 2020-02-12 13:30 - 001850084 _____ C:\Users\Lab\Downloads\rate-calculator-api(1).pdf
2020-02-12 13:30 - 2020-02-12 13:30 - 001728028 _____ C:\Users\Lab\Downloads\evs-label-api(1).pdf
2020-02-12 13:24 - 2020-02-12 13:24 - 001850084 _____ C:\Users\Lab\Downloads\rate-calculator-api.pdf
2020-02-12 13:24 - 2020-02-12 13:24 - 001728028 _____ C:\Users\Lab\Downloads\evs-label-api.pdf
2020-02-12 11:02 - 2020-02-12 11:02 - 001385834 _____ C:\Users\Lab\Downloads\sn74hc04.pdf
2020-02-12 11:01 - 2020-02-12 11:01 - 001096727 _____ C:\Users\Lab\Downloads\74HC_HCT04.pdf
2020-02-12 10:02 - 2020-02-12 10:02 - 000307665 _____ C:\Users\Lab\Downloads\v-1382719.pdf
2020-02-12 09:54 - 2020-02-12 09:54 - 000211080 _____ C:\Users\Lab\Downloads\Series_SE1022-949(1).pdf
2020-02-12 09:50 - 2020-02-12 09:50 - 000280382 _____ C:\Users\Lab\Downloads\datasheet.pdf
2020-02-12 09:36 - 2020-02-12 09:36 - 000211080 _____ C:\Users\Lab\Downloads\Series_SE1022-949.pdf
2020-02-12 09:19 - 2020-02-12 09:19 - 000339851 _____ C:\Users\Lab\Downloads\hc49ux.pdf
2020-02-11 09:14 - 2020-02-11 09:14 - 000405698 _____ C:\Users\Lab\Downloads\BOUSD_-_IA(1).pdf
2020-02-11 09:13 - 2020-02-11 09:13 - 000406015 _____ C:\Users\Lab\Downloads\BOUSD_-_TRS.pdf
2020-02-11 09:12 - 2020-02-11 09:12 - 000428808 _____ C:\Users\Lab\Downloads\BOUSD_-_FT.pdf
2020-02-11 09:11 - 2020-02-11 09:11 - 000405698 _____ C:\Users\Lab\Downloads\BOUSD_-_IA.pdf
2020-02-11 09:11 - 2020-02-11 09:11 - 000148413 _____ C:\Users\Lab\Downloads\FrequentlyAskedQuestionsAboutMeasureG.pdf
2020-02-10 08:47 - 2020-02-10 08:47 - 000087711 _____ C:\Users\Lab\Downloads\California_Proposition_13_(2020).pdf
2020-02-08 22:34 - 2020-02-08 22:34 - 000114305 _____ C:\Users\Lab\Downloads\Statement(1).pdf
2020-02-06 18:26 - 2020-02-06 18:26 - 000267029 _____ C:\Users\Lab\Downloads\dd184ff5-081e-444b-9d06-3d37cde9892f
2020-02-06 14:22 - 2020-02-06 14:22 - 000069930 _____ C:\Users\Lab\Desktop\PizzaCrust.pdf
2020-02-05 20:14 - 2020-02-05 20:14 - 000266743 _____ C:\Users\Lab\Downloads\4f47ba1a-1268-4d7f-829f-690dbdb909aa
2020-02-05 20:07 - 2020-02-05 20:07 - 000267949 _____ C:\Users\Lab\Downloads\fb5b70a4-e679-4a8b-ad62-ba318759bd52
2020-02-05 20:04 - 2020-02-05 20:04 - 000158170 _____ C:\Users\Lab\Downloads\8cc598cc-d079-4baa-b8e8-eb3b727d24ea
2020-02-05 19:34 - 2020-02-05 19:34 - 000766230 _____ C:\Users\Lab\Downloads\Tech Short 5 - Receiver Selectivity and Crystal Filters.pdf
2020-02-03 17:33 - 2020-02-03 17:33 - 000464732 _____ C:\Users\Lab\Downloads\SiLabs_producting_3580kHz_signal.MOV
2020-02-03 17:32 - 2020-02-03 17:32 - 000422375 _____ C:\Users\Lab\Downloads\NCO_producting_3000kHz_signal.MOV
2020-02-03 13:03 - 2020-02-03 13:03 - 001779204 _____ C:\Users\Lab\Downloads\aee96f_7c6e0d9d422d46d29fa5705e6de57884(1).pdf
2020-02-03 10:23 - 2020-02-03 10:23 - 001779204 _____ C:\Users\Lab\Downloads\aee96f_7c6e0d9d422d46d29fa5705e6de57884.pdf
2020-02-02 16:40 - 2020-02-02 16:40 - 000085514 _____ C:\Users\Lab\Downloads\label_48878986013.pdf
2020-02-02 16:40 - 2020-02-02 16:40 - 000085514 _____ C:\Users\Lab\Downloads\label_48878986013(2).pdf
2020-02-02 16:40 - 2020-02-02 16:40 - 000085514 _____ C:\Users\Lab\Downloads\label_48878986013(1).pdf
2020-01-28 09:36 - 2020-01-28 09:36 - 000114929 _____ C:\Users\Lab\Downloads\Statement.pdf
2020-01-28 08:51 - 2020-01-28 08:51 - 000012370 _____ C:\Users\Lab\Desktop\download.pdf
2020-01-24 17:47 - 2020-01-24 17:47 - 000038047 _____ C:\Users\Lab\Downloads\HoursForJim_01_20_2020.pdf
2020-01-21 13:14 - 2020-01-21 14:43 - 004482748 _____ C:\Users\Lab\Downloads\SOFIA 567 Firmware Rev 1.0.0.0.bin
2020-01-19 20:42 - 2020-01-19 20:42 - 000000000 ____D C:\Users\Lab\.MakeMKV
2020-01-19 20:22 - 2020-01-19 20:22 - 000000020 ___SH C:\Users\DefaultAppPool\ntuser.ini
2020-01-17 08:04 - 2020-01-17 08:04 - 000000000 ____D C:\WINDOWS\Panther
2020-01-08 22:14 - 2020-01-08 22:14 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2019-12-22 20:03 - 2019-12-22 20:03 - 000000000 ____D C:\Users\Lab\AppData\Roaming\ICQ
2019-12-21 19:59 - 2019-12-21 19:59 - 030695248 _____ (Digital Wave Ltd ) C:\Users\Lab\Desktop\FreeVideoToDVDConverter_5.0.99.823_r.exe
2019-12-21 19:43 - 2019-12-21 19:51 - 000000000 ____D C:\Program Files (x86)\Freemake
2019-12-20 22:48 - 2019-12-20 22:48 - 036049294 _____ C:\Users\Lab\Downloads\IMG_1051.MOV
2019-12-18 16:57 - 2019-12-18 16:57 - 023451960 _____ C:\Users\Lab\Downloads\com.skype.m2_1.79.0.1_win10storeapp.com.apk
2019-12-18 16:53 - 2019-12-18 16:53 - 000949192 _____ (Olcinium ) C:\Users\Lab\Downloads\setupSkypeLiteClient.exe
2019-12-18 12:52 - 2019-12-18 12:53 - 000000000 ____D C:\Users\Lab\Desktop\Marianne's Phone
2019-12-10 22:19 - 2019-12-10 22:19 - 000010688 _____ C:\Users\Lab\Downloads\JimProject.zip
2019-12-10 14:36 - 2019-12-10 14:37 - 001003928 _____ (Ellora Assets Corporation ) C:\Users\Lab\Downloads\FreemakeAudioConverterSetup.exe
2019-12-10 14:18 - 2019-12-10 14:18 - 000614016 _____ C:\Users\Lab\Downloads\TRAO_Vorbis_16.exe
2019-12-10 09:27 - 2019-12-10 09:29 - 347838234 _____ C:\Users\Lab\Downloads\MovieTime.zip
2019-12-10 07:38 - 2019-12-12 14:39 - 000000000 ____D C:\Users\Lab\Desktop\AirPods
2019-12-05 09:50 - 2019-12-05 09:53 - 000000000 ____D C:\Users\Lab\Desktop\IEEE Edison
2019-11-27 16:47 - 2019-11-27 16:47 - 000263178 _____ C:\Users\Lab\Downloads\Model_525N_scaled_and_raw_output_of_rssi_and_noise.zip

==================== Three months (modified) ==================

(If an entry is included in the fixlist, the file/folder will be moved.)

2020-02-25 10:13 - 2019-01-07 10:55 - 000000000 ____D C:\Users\Lab\AppData\Roaming\Slack
2020-02-25 10:13 - 2016-12-14 14:02 - 000000000 ____D C:\ProgramData\Bitmeter2
2020-02-25 10:11 - 2019-08-22 20:33 - 000976040 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2020-02-25 10:11 - 2019-03-18 20:50 - 000000000 ____D C:\WINDOWS\INF
2020-02-25 10:07 - 2016-11-29 18:15 - 008248517 _____ C:\WINDOWS\SysWOW64\rootpa.e2e
2020-02-25 10:06 - 2019-08-22 20:35 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2020-02-25 10:06 - 2019-03-18 20:37 - 000262144 _____ C:\WINDOWS\system32\config\BBI
2020-02-25 10:06 - 2017-08-26 19:17 - 000065536 _____ C:\WINDOWS\system32\spu_storage.bin
2020-02-25 10:03 - 2017-03-23 11:51 - 000000000 ____D C:\Users\Lab\Documents\Email Folders
2020-02-25 10:02 - 2016-12-14 11:09 - 000000000 ____D C:\Users\Lab\AppData\LocalLow\Mozilla
2020-02-25 09:10 - 2019-08-22 20:15 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2020-02-25 08:28 - 2019-03-18 20:52 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2020-02-24 15:33 - 2016-12-21 17:38 - 000000000 ____D C:\Users\Lab\AppData\Roaming\vlc
2020-02-23 12:56 - 2019-08-22 20:36 - 000000008 __RSH C:\Users\Lab\ntuser.pol
2020-02-23 12:56 - 2019-08-22 19:47 - 000000000 ____D C:\Users\Lab
2020-02-23 12:55 - 2016-12-14 15:27 - 000000008 __RSH C:\ProgramData\ntuser.pol
2020-02-23 12:54 - 2019-11-01 11:07 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2020-02-23 12:54 - 2019-03-18 20:52 - 000000000 ____D C:\WINDOWS\SysWOW64\GroupPolicy
2020-02-23 12:54 - 2017-08-03 20:02 - 000000000 ____D C:\Users\Lab\AppData\LocalLow\Temp
2020-02-23 12:54 - 2016-07-16 03:47 - 000000000 ___HD C:\WINDOWS\system32\GroupPolicy
2020-02-21 15:17 - 2018-12-11 11:14 - 000001142 _____ C:\Users\Lab\Desktop\rempl - Shortcut.lnk
2020-02-21 15:17 - 2018-10-27 08:24 - 000001782 _____ C:\Users\Lab\Desktop\WebCache - Shortcut.lnk
2020-02-21 15:04 - 2018-09-13 10:14 - 000000000 ____D C:\Users\Lab\Desktop\Old Lab Asus Files
2020-02-19 13:37 - 2017-03-17 08:12 - 000000000 ____D C:\Program Files (x86)\Dropbox
2020-02-18 22:32 - 2017-12-30 14:31 - 000001230 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2020-02-18 10:53 - 2017-06-27 09:27 - 000000000 ____D C:\Users\Lab\Documents\IMAGES
2020-02-18 10:28 - 2017-03-17 08:16 - 000000000 ___RD C:\Users\Lab\Dropbox
2020-02-18 10:28 - 2017-03-17 08:12 - 000000000 ____D C:\Users\Lab\AppData\Local\Dropbox
2020-02-15 10:10 - 2019-03-18 20:52 - 000000000 ___HD C:\Program Files\WindowsApps
2020-02-15 10:10 - 2019-03-18 20:52 - 000000000 ____D C:\WINDOWS\AppReadiness
2020-02-13 15:52 - 2019-08-22 20:35 - 000004544 _____ C:\WINDOWS\system32\Tasks\Adobe Flash Player NPAPI Notifier
2020-02-13 15:52 - 2019-06-27 09:41 - 000000000 ____D C:\Users\Lab\AppData\Local\Adobe
2020-02-13 15:51 - 2019-03-18 20:52 - 000000000 ____D C:\WINDOWS\SysWOW64\Macromed
2020-02-13 15:51 - 2019-03-18 20:52 - 000000000 ____D C:\WINDOWS\system32\Macromed
2020-02-13 15:50 - 2019-11-05 16:56 - 000000000 ____D C:\Users\Lab\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Slack Technologies Inc
2020-02-13 15:50 - 2019-01-07 10:55 - 000000000 ____D C:\Users\Lab\AppData\Local\slack
2020-02-13 15:50 - 2017-09-24 12:04 - 000000000 ____D C:\Users\Lab\AppData\Local\SquirrelTemp
2020-02-13 15:48 - 2016-11-29 16:21 - 000000000 __RHD C:\Users\Public\AccountPictures
2020-02-13 14:16 - 2019-08-22 20:14 - 000545232 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2020-02-13 14:16 - 2017-03-17 08:12 - 000000934 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job
2020-02-13 14:16 - 2017-03-17 08:12 - 000000930 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job
2020-02-13 14:14 - 2019-03-18 20:52 - 000000000 ___SD C:\WINDOWS\system32\UNP
2020-02-13 14:14 - 2019-03-18 20:52 - 000000000 ___RD C:\WINDOWS\PrintDialog
2020-02-13 14:14 - 2019-03-18 20:52 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2020-02-13 14:14 - 2019-03-18 20:52 - 000000000 ____D C:\WINDOWS\SysWOW64\oobe
2020-02-13 14:14 - 2019-03-18 20:52 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2020-02-13 14:14 - 2019-03-18 20:52 - 000000000 ____D C:\WINDOWS\SystemResources
2020-02-13 14:14 - 2019-03-18 20:52 - 000000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2020-02-13 14:14 - 2019-03-18 20:52 - 000000000 ____D C:\WINDOWS\system32\SystemResetPlatform
2020-02-13 14:14 - 2019-03-18 20:52 - 000000000 ____D C:\WINDOWS\system32\PerceptionSimulation
2020-02-13 14:14 - 2019-03-18 20:52 - 000000000 ____D C:\WINDOWS\system32\oobe
2020-02-13 14:14 - 2019-03-18 20:52 - 000000000 ____D C:\WINDOWS\system32\Dism
2020-02-13 14:14 - 2019-03-18 20:52 - 000000000 ____D C:\WINDOWS\ShellExperiences
2020-02-13 14:14 - 2019-03-18 20:52 - 000000000 ____D C:\WINDOWS\bcastdvr
2020-02-13 14:14 - 2019-03-18 20:37 - 000000000 ____D C:\WINDOWS\servicing
2020-02-13 13:50 - 2019-03-18 20:37 - 000000000 ____D C:\WINDOWS\CbsTemp
2020-02-13 13:48 - 2016-12-14 16:14 - 000000000 ____D C:\WINDOWS\system32\MRT
2020-02-13 13:45 - 2016-12-14 16:14 - 120407888 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2020-02-03 19:57 - 2017-06-27 09:20 - 000000000 ____D C:\Users\Lab\Documents\DVD Fab Files
2020-02-03 13:33 - 2018-02-27 19:30 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd
2020-02-03 12:56 - 2019-09-13 08:48 - 000835688 _____ (Adobe) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2020-02-03 12:56 - 2019-09-13 08:48 - 000179608 _____ (Adobe) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2020-02-02 10:05 - 2017-06-27 09:10 - 000000000 ____D C:\Users\Lab\Desktop\Bob's Book
2020-02-01 19:16 - 2017-03-15 18:37 - 000000000 ____D C:\Users\Lab\AppData\Roaming\dvdcss
2020-02-01 17:32 - 2017-06-27 10:32 - 000000000 ____D C:\ProgramData\DVD Shrink
2020-01-28 13:29 - 2019-08-22 20:35 - 000003994 _____ C:\WINDOWS\system32\Tasks\DropboxUpdateTaskMachineUA
2020-01-28 13:29 - 2019-08-22 20:35 - 000003762 _____ C:\WINDOWS\system32\Tasks\DropboxUpdateTaskMachineCore

==================== Files in the root of some directories ========

2016-01-17 09:49 - 2016-07-18 22:02 - 000483328 _____ () C:\Program Files (x86)\BogusSMACC.exe
2016-12-15 16:34 - 2017-06-29 19:18 - 000681536 _____ (O&O Software GmbH) C:\Program Files (x86)\OOSU10.exe
2016-12-16 14:33 - 2016-12-16 15:24 - 000531368 _____ (Simon Tatham) C:\Program Files (x86)\Putty.exe
2016-10-26 23:18 - 2016-10-26 23:18 - 000244224 _____ (http://winaero) C:\Program Files (x86)\ThemeSwitcher.exe
2018-07-18 19:09 - 2018-07-18 19:09 - 000399480 _____ () C:\Users\Lab\AppData\Local\ars.cache
2018-07-18 19:09 - 2018-07-18 19:09 - 000819599 _____ () C:\Users\Lab\AppData\Local\census.cache
2018-07-18 18:49 - 2018-07-18 18:49 - 000000036 _____ () C:\Users\Lab\AppData\Local\housecall.guid.cache
2018-03-13 14:48 - 2019-10-08 07:44 - 000000600 _____ () C:\Users\Lab\AppData\Local\PUTTY.RND
2017-08-03 13:31 - 2017-08-03 13:31 - 000007993 _____ () C:\Users\Lab\AppData\Local\recently-used.xbel
2018-07-18 18:57 - 2018-07-18 18:57 - 000000010 _____ () C:\Users\Lab\AppData\Local\sponge.last.runtime.cache

==================== SigCheck ============================

(There is no automatic fix for files that do not pass verification.)

==================== End of FRST.txt ========================

[Electrojim]

AND FINALLY, THE addition.txt LOG:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 23-02-2020
Ran by Desk (25-02-2020 10:17:09)
Running from C:\Users\Lab\Desktop\Malware Check
Windows 10 Pro Version 1909 18363.657 (X64) (2019-08-23 04:36:11)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-572709066-2931371650-4259622231-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-572709066-2931371650-4259622231-503 - Limited - Disabled)
Desk (S-1-5-21-572709066-2931371650-4259622231-1001 - Administrator - Enabled) => C:\Users\Lab
Guest (S-1-5-21-572709066-2931371650-4259622231-501 - Limited - Disabled)
WDAGUtilityAccount (S-1-5-21-572709066-2931371650-4259622231-504 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 19.00 (x64) (HKLM\...\7-Zip) (Version: 19.00 - Igor Pavlov)
Adobe Flash Player 32 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 32.0.0.330 - Adobe)
AMD Settings (HKLM\...\WUCCCApp) (Version: 2017.0627.1013.18374 - Advanced Micro Devices, Inc.)
Analog Devices SigmaStudio v3.14 (HKLM\...\{42AF9B53-0C33-403C-BB76-1C6D4DFB0B83}) (Version: 3.14 - Analog Devices Inc.)
Analog Devices SigmaStudio v4.2 (HKLM\...\{6B1DA57D-5974-4A08-8EDC-72764F5BE940}) (Version: 4.2 - Analog Devices Inc.)
AOMEI Backupper Standard (HKLM-x32\...\{A83692F5-3E9B-4E95-9E7E-B5DF5536CE9D}_is1) (Version: - AOMEI Technology Co., Ltd.)
Audacity 2.1.3 (HKLM-x32\...\Audacity®_is1) (Version: 2.1.3 - Audacity Team)
BitMeter (HKLM-x32\...\BitMeter) (Version: - )
Catalyst Control Center Next Localization BR (HKLM\...\{3E245378-BF77-6946-C6F6-096DBE5EAB82}) (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization BR (HKLM\...\{51F85784-6799-5CA3-97B2-2E5904FC3E58}) (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization BR (HKLM\...\{54E3E97D-573B-9568-2A06-FDC4BDAD4F13}) (Version: 2017.0627.1013.18374 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization BR (HKLM\...\{658D9D92-2733-E8FA-B31E-C264902DDFBD}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHS (HKLM\...\{153FBCEB-4888-529B-C6E4-EEF414230B5F}) (Version: 2017.0627.1013.18374 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHS (HKLM\...\{45907537-804A-514F-5280-5F4F12A6DCBC}) (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHS (HKLM\...\{743885D6-1B53-7B56-437D-56B32DAAF522}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHS (HKLM\...\{8E6F5592-ED7E-9C50-74AC-BF417B1FE291}) (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHT (HKLM\...\{19F1603B-1CC7-9057-27D6-7376D2EC0165}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHT (HKLM\...\{962364E4-08BB-347D-32E7-2B789F37BF8A}) (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHT (HKLM\...\{AD28960A-6190-C991-C964-308B86EAA2E2}) (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CHT (HKLM\...\{D9B815AA-CF4D-08E0-338E-6D9E4074CFC8}) (Version: 2017.0627.1013.18374 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CS (HKLM\...\{51D588C1-A0C9-1C56-DF03-7BECEB829770}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CS (HKLM\...\{84C3F2C5-F7B2-2F08-CDF4-79EF7CC55D74}) (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CS (HKLM\...\{A0407E39-2AA4-60B3-885F-3C5347B6909E}) (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization CS (HKLM\...\{B4239749-1CCA-A61E-D5C1-F72EA5E12064}) (Version: 2017.0627.1013.18374 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DA (HKLM\...\{0989D0EA-AFF3-5F9A-3D25-20EE133E409B}) (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DA (HKLM\...\{0E8A3B17-D603-B1B6-C205-1685EBDD23E9}) (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DA (HKLM\...\{6F07BC43-5B87-6A89-875E-9569E92EA80E}) (Version: 2017.0627.1013.18374 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DA (HKLM\...\{D1000796-511E-0A49-39B4-D125C8258CA6}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DE (HKLM\...\{0E6CC911-B0B7-11A2-411A-8B2A02080618}) (Version: 2017.0627.1013.18374 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DE (HKLM\...\{1E7D3072-1D28-E33A-99DF-85D9F7ECD06E}) (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DE (HKLM\...\{A8689A0F-5928-7300-B82B-C5E85131B7BA}) (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization DE (HKLM\...\{DBB0B902-73E6-3521-15C2-6998C63A6129}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization EL (HKLM\...\{29E87A92-2A5D-C559-EFAB-C418748551DD}) (Version: 2017.0627.1013.18374 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization EL (HKLM\...\{76AAF56B-93D8-161D-809A-EC05F3B913DA}) (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization EL (HKLM\...\{99B2E1B4-5D98-8B59-DD39-4E4992821703}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization EL (HKLM\...\{BA26B70C-3D8C-2D14-4122-211FB3E6F691}) (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization ES (HKLM\...\{063CED74-F5F0-870E-DC9C-2D78FDEDA3EE}) (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization ES (HKLM\...\{5FEACE78-C338-9AED-FF05-7DE7E273C774}) (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization ES (HKLM\...\{9A2554B9-485D-4BA2-40EB-F82756A4AB06}) (Version: 2017.0627.1013.18374 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization ES (HKLM\...\{A67403D6-8FA6-BEB2-E55B-91635BFF70B3}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FI (HKLM\...\{13BB60AA-88F7-4B1F-2DEC-D81EEDE8B3AA}) (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FI (HKLM\...\{7ADBE369-E788-6AA4-475A-9583670E6F2A}) (Version: 2017.0627.1013.18374 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FI (HKLM\...\{A3795528-F572-6314-C4E3-EE9DAF0FBF02}) (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FI (HKLM\...\{DD0C2473-8594-5D35-8048-5FAF76196D9E}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FR (HKLM\...\{37AA6227-FF2C-95AC-87C0-45DCC0BB87DA}) (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FR (HKLM\...\{4853A56D-7931-A08B-5BA7-8E2D61043DF9}) (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FR (HKLM\...\{73A94ECB-4EC8-6C73-12F9-F28EAFD5B237}) (Version: 2017.0627.1013.18374 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization FR (HKLM\...\{FFED5E09-AA96-7352-22FB-944FC47BBCB5}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization HU (HKLM\...\{09E0143F-79BC-1FF9-B433-B12C1AF3D942}) (Version: 2017.0627.1013.18374 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization HU (HKLM\...\{416D7723-3B10-D406-0A84-8DF69ED131ED}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization HU (HKLM\...\{B28CF677-E2C8-12CA-52BB-19B6F066D36A}) (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization HU (HKLM\...\{EB328356-1DF0-1CCE-3607-6361DD329219}) (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization IT (HKLM\...\{43F6D22B-E0E9-EE90-9B62-1C5FC5D15A55}) (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization IT (HKLM\...\{75959794-FADB-743F-70C9-1BFAB0B37E24}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization IT (HKLM\...\{7AEBE733-FCAE-C7CD-092B-8BD38B0B33A3}) (Version: 2017.0627.1013.18374 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization IT (HKLM\...\{87E6EC29-AEC5-28CB-F773-93EB6C1B8A2B}) (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization JA (HKLM\...\{13DA946D-1BC4-1ED0-F6BD-722AEFACBCB5}) (Version: 2017.0627.1013.18374 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization JA (HKLM\...\{B7CC66D4-D5B7-C345-BF1D-1695ABF7C23A}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization JA (HKLM\...\{CA55697D-BD74-3ED8-6B21-D7EDAD3B7D02}) (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization JA (HKLM\...\{D4490E0F-8E7B-1097-B56A-7643C75F1C28}) (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization KO (HKLM\...\{3261D423-2791-D2C6-68FF-B248B1412F12}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization KO (HKLM\...\{A4C56925-B29F-0F69-54EA-6EC25FE22074}) (Version: 2017.0627.1013.18374 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization KO (HKLM\...\{CFC860C8-4F51-E08C-A74C-2E444ED06160}) (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization KO (HKLM\...\{DAB44116-0266-C65B-B643-AC11217C3041}) (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NL (HKLM\...\{3AF70346-52C7-0334-606F-118D1C1CB7A2}) (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NL (HKLM\...\{884B39AE-C737-8EE2-AB54-64E593B42C4C}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NL (HKLM\...\{9338D693-38B7-1ED4-9B42-BFA1D5600CCB}) (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NL (HKLM\...\{B145D7B0-BB39-535E-67AE-29F104A56C21}) (Version: 2017.0627.1013.18374 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NO (HKLM\...\{53AE8AC7-5213-67AF-0DC0-CED696B77643}) (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NO (HKLM\...\{7186C78E-A1AD-4AB6-6AE9-D75C372F5014}) (Version: 2017.0627.1013.18374 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NO (HKLM\...\{C7A04DCF-0305-1955-6663-8905CF530A11}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization NO (HKLM\...\{C971C145-258D-6650-7088-13DDB161327A}) (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization PL (HKLM\...\{119BCF10-3F00-6E9A-BF42-AF216BF2D6DE}) (Version: 2017.0627.1013.18374 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization PL (HKLM\...\{D7438F64-B441-1F37-FB0A-C9EAF4ECFDAB}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization PL (HKLM\...\{DC9DFCBF-87DA-892C-6151-99CC9EF46E3E}) (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization PL (HKLM\...\{EBA09DAF-14B4-7BE7-676E-6E2FB21EDBDD}) (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization RU (HKLM\...\{4D447284-F649-D2BC-5FD7-E8853CA26E24}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization RU (HKLM\...\{9AA4DD93-94BF-22EA-C9D2-7084F304A31B}) (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization RU (HKLM\...\{C1EFF2A2-DF4A-F6D1-B99C-1ED194AE9E78}) (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization RU (HKLM\...\{F54DBF01-18BC-EB5A-458A-363A197E772E}) (Version: 2017.0627.1013.18374 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization SV (HKLM\...\{2DFA8397-A1A6-BA94-D582-63387958A605}) (Version: 2017.0627.1013.18374 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization SV (HKLM\...\{379D900B-A785-6DB0-012E-434356A365B3}) (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization SV (HKLM\...\{46EB68BE-8AAC-8C2B-7284-8DEDE6B5CD2A}) (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization SV (HKLM\...\{C1776FAC-8CC8-3EE2-47A5-38671A83661B}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TH (HKLM\...\{366C4FB5-CF6E-258B-418D-E6D29549A278}) (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TH (HKLM\...\{7A6E431B-CF43-EC3E-FD7E-0A0AAB1B25FC}) (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TH (HKLM\...\{967CEFF4-8D1A-C70C-FACE-C81F07DF0553}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TH (HKLM\...\{F1F1CE29-2910-7005-DBF6-E51D788B27EF}) (Version: 2017.0627.1013.18374 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TR (HKLM\...\{46827A2F-7A32-3BCC-46C5-FB491A009D66}) (Version: 2017.0627.1013.18374 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TR (HKLM\...\{7D7982D5-9BA1-47EF-DE19-896D78027265}) (Version: 2016.1206.1960.35982 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TR (HKLM\...\{89A1F076-19B8-A2B1-D5A3-E8247EFAF157}) (Version: 2016.0916.1515.27418 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Next Localization TR (HKLM\...\{B10089DE-934F-6E0F-683A-B788F89348DF}) (Version: 2016.1121.1657.30480 - Advanced Micro Devices, Inc.) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 5.62 - Piriform)
CircuitMaker 2000 (Professional Edition) (HKLM-x32\...\{B7AC1B73-F3DF-11D3-B991-00A0C9848FC5}) (Version: - )
CircuitMaker 2000 Service Pack 1 (HKLM-x32\...\CircuitMaker 2000 Service Pack 1) (Version: - )
D3DX10 (HKLM-x32\...\{E09C4DB7-630C-4F06-A631-8EA7239923AF}) (Version: 15.4.2368.0902 - Microsoft) Hidden
Dropbox (HKLM-x32\...\Dropbox) (Version: 91.4.548 - Dropbox, Inc.)
Dropbox Update Helper (HKLM-x32\...\{099218A5-A723-43DC-8DB5-6173656A1E94}) (Version: 1.3.295.1 - Dropbox, Inc.) Hidden
EMCO MoveOnBoot 3.0 (HKLM\...\{AB85FE65-1E44-43FF-BE2A-CA2811EAB7CF}) (Version: 3.0.1.3569 - EMCO Software)
EMCO UnLock IT 5.0 (HKLM\...\{98663DC2-9ED2-4382-89B7-356A8F555521}) (Version: 5.0.0.1001 - EMCO Software)
Filter Design 4.0 (HKLM-x32\...\Filter Design_is1) (Version: - Almost All Digital Electronics)
Filter Design 4.4 (HKLM-x32\...\Filter Design 4.4_is1) (Version: 4.4 - Almost All Digital Electronics)
Filter Wiz Lite 1 (HKLM-x32\...\{1FCDC78C-F97A-47E3-9601-D5F46DAC41D8}_is1) (Version: - Schematica software)
FilterLab 2.0 (HKLM-x32\...\{68D0DC60-36E4-4114-853E-73D326BB7222}) (Version: 2.00.0000 - Microchip Technology)
HP OfficeJet 4650 series Basic Device Software (HKLM\...\{F68DF314-BD12-4549-941C-521CB8D16DDE}) (Version: 40.11.1122.1796 - HP Inc.)
HyperSnap 8 (HKLM\...\HyperSnap (Version: 8.13.04 - Hyperionics Technology LLC)
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
Inovonics 633 RDS Receiver (HKLM-x32\...\{86442510-2B27-4C46-ACCF-25AD4DBB8C57}) (Version: 2.0.0 - Inovonics)
Inovonics 703-720-730 RDS (HKLM-x32\...\{DD7CF94F-85E5-490C-ABDE-FA597A9B4A82}) (Version: 3.4 - Inovonics)
inSSIDer (HKU\S-1-5-21-572709066-2931371650-4259622231-1001\...\inSSIDer) (Version: 1.12.0 - MetaGeek, LLC)
inSSIDer 2.0 (HKLM\...\{57019733-78E6-43DE-8E6D-55349F0FDE6F}) (Version: 2.0.7 - MetaGeek)
Intel(R) Chipset Device Software (HKLM-x32\...\{60c073df-e736-4210-9c3a-5fc2b651cef3}) (Version: 10.1.1.7 - Intel(R) Corporation) Hidden
Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 11.0.0.1168 - Intel Corporation)
IPCCameraOCX (HKLM-x32\...\IPCCameraOCX) (Version: - )
Junk Mail filter update (HKLM-x32\...\{0BE9E708-5DC0-4963-9CFD-0AA519090E79}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
MakeMKV v1.12.0 (HKLM-x32\...\MakeMKV) (Version: v1.12.0 - GuinpinSoft inc)
Maxx Audio Installer (x64) (HKLM\...\{307032B2-6AF2-46D7-B933-62438DEB2B9A}) (Version: 1.6.5073.107 - Waves Audio Ltd.) Hidden
Microsoft Office Professional 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50918.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\...\{2DFD8316-9EF1-3210-908C-4CB61961C1AC}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{527BBE2F-1FED-3D8B-91CB-4DB0F838E69E}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\...\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Mozilla Firefox 73.0.1 (x64 en-US) (HKLM\...\Mozilla Firefox 73.0.1 (x64 en-US)) (Version: 73.0.1 - Mozilla)
MPLAB X IDE v3.45 (HKLM-x32\...\MPLAB X IDE v3.45 v3.45) (Version: v3.45 - Microchip)
My Lockbox 4.0 (HKLM\...\My Lockbox_is1) (Version: 4.0 - )
MyHarmony (HKLM-x32\...\{2AD8F8A1-ECE5-4890-BCC2-B4396370A0D4}) (Version: 1.0.308 - Logitech)
Net Uptime Monitor (HKLM-x32\...\{2D6E39DD-9705-48AD-B972-868A4A86D828}) (Version: 1.9.32 - NetUptimeMonitor.com)
NpDvrClient (HKLM-x32\...\dvrclient) (Version: - )
OmniFormat (HKLM-x32\...\OmniFormat) (Version: - )
paint.net (HKLM\...\{F10AAD91-58DF-44EC-A647-810197141667}) (Version: 4.0.19 - dotPDN LLC)
Pdf995 (HKLM-x32\...\Pdf995) (Version: - )
PDF-Viewer (HKLM\...\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.322.8 - Tracker Software Products Ltd)
PDF-XChange Lite 4 (HKLM\...\{B860298B-CE03-4DE2-B92E-422F2C20A2D8}_is1) (Version: 4.0.190.0 - Tracker Software Products Ltd)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7544 - Realtek Semiconductor Corp.)
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\{17528CE4-C333-48FB-A9E4-D841E795CDCE}) (Version: 3.0.23.0 - Renesas Electronics Corporation) Hidden
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{17528CE4-C333-48FB-A9E4-D841E795CDCE}) (Version: 3.0.23.0 - Renesas Electronics Corporation)
Reolink Client version 7.2.2.20 (HKLM-x32\...\{992EF7D5-3D70-6E7F-AFDC-8C946676BD6E}_is1) (Version: 7.2.2.20 - )
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Slack (HKU\S-1-5-21-572709066-2931371650-4259622231-1001\...\slack) (Version: 4.3.4 - Slack Technologies Inc.)
SyncBackFree (HKLM-x32\...\SyncBackFree_is1) (Version: 9.3.3.0 - 2BrightSparks)
Total Recorder 8.5 VideoPro Edition (HKLM-x32\...\TotalRecorder) (Version: - )
TP-Link PLC Utility (HKLM-x32\...\{A79B7C66-DC26-417A-8BB5-B48721B45623}) (Version: 2.2.3149.12 - TP-Link) Hidden
TP-Link PLC Utility (HKLM-x32\...\InstallShield_{A79B7C66-DC26-417A-8BB5-B48721B45623}) (Version: 2.2.3149.12 - TP-Link)
Tweaking.com - Registry Backup (HKLM-x32\...\Tweaking.com - Registry Backup) (Version: 3.5.3 - Tweaking.com)
Update for Windows 10 for x64-based Systems (KB4023057) (HKLM\...\{C3ACFCEA-240F-4DCC-A0C3-DD55FEE6C3C2}) (Version: 2.58.0.0 - Microsoft Corporation)
VLC media player (HKLM-x32\...\VLC media player) (Version: 3.0.8 - VideoLAN)
What's Running 3.0 (HKLM-x32\...\What's Running_is1) (Version: 3.0 - WhatsRunning.net)
Winaero Tweaker (HKLM\...\Winaero Tweaker_is1) (Version: 0.12.0.0 - Winaero)
Windows 10 Update Assistant (HKLM-x32\...\{D5C69738-B486-402E-85AC-2456D98A64E4}) (Version: 1.4.9200.22243 - Microsoft Corporation)
Windows Driver Package - Analog Devices (CYUSB) USB (02/02/2010 3.4.2.147) (HKLM\...\61CE4EFAFFB07B95C04CF41DE45F7A236605A287) (Version: 02/02/2010 3.4.2.147 - Analog Devices)
Windows Driver Package - Segger (jlink) USB (07/28/2014 2.6.8.1) (HKLM\...\468237BA12C6D9DD0125166A16609C632EE9CF1C) (Version: 07/28/2014 2.6.8.1 - Segger)
Windows Driver Package - SEGGER (JLinkCDC_x64) Ports (08/28/2014 6.0.2601.5) (HKLM\...\ED80E3D3A350D18BFD3D3D8DAED8E2B19105763A) (Version: 08/28/2014 6.0.2601.5 - SEGGER)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
Windows Setup Remediations (x64) (KB4023057) (HKLM\...\{5534e02f-0f5d-40dd-ba92-bea38d22384d}.sdb) (Version: - )
WinPcap 4.1.3 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.2980 - Riverbed Technology, Inc.)
WinX DVD Copy Pro 3.9.1 (HKLM\...\WinX DVD Copy Pro_is1) (Version: - Digiarty Software,Inc.)
Wu10Man (HKLM-x32\...\{BF8674A6-4567-45E9-BC7A-6E9D53BCFC86}) (Version: 2.1.0.0 - Weredev)

Packages:
=========
HP Smart -> C:\Program Files\WindowsApps\AD2F1837.HPPrinterControl_110.1.671.0_x64__v10z8vjag6ke6 [2020-02-06] (HP Inc.)

==================== Custom CLSID (Whitelisted): ==============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-572709066-2931371650-4259622231-1001_Classes\CLSID\{E31EA727-12ED-4702-820C-4B6445F28E1A} -> [Dropbox] => C:\Users\Lab\Dropbox [2017-03-17 08:16]
ShellIconOverlayIdentifiers: [ DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.32.0.dll [2020-02-19] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.32.0.dll [2020-02-19] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.32.0.dll [2020-02-19] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.32.0.dll [2020-02-19] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.32.0.dll [2020-02-19] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.32.0.dll [2020-02-19] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.32.0.dll [2020-02-19] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.32.0.dll [2020-02-19] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.32.0.dll [2020-02-19] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.32.0.dll [2020-02-19] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => -> No File
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => -> No File
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => -> No File
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => -> No File
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => -> No File
ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => -> No File
ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => -> No File
ShellIconOverlayIdentifiers-x32: [ DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.32.0.dll [2020-02-19] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.32.0.dll [2020-02-19] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.32.0.dll [2020-02-19] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.32.0.dll [2020-02-19] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.32.0.dll [2020-02-19] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.32.0.dll [2020-02-19] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.32.0.dll [2020-02-19] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.32.0.dll [2020-02-19] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.32.0.dll [2020-02-19] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.32.0.dll [2020-02-19] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => -> No File
ContextMenuHandlers1: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2019-02-21] (Igor Pavlov) [File not signed]
ContextMenuHandlers1: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.32.0.dll [2020-02-19] (Dropbox, Inc -> Dropbox, Inc.)
ContextMenuHandlers1: [ISOWINDOWMENU] -> {3A05F453-60CA-4311-9DA3-FE348CB76056} => C:\Program Files\Digiarty\WinX_DVD_Copy_Pro\IsoWindowMenu64.dll [2013-11-19] (Digiarty, Inc. -> TODO: <Company name>)
ContextMenuHandlers1: [PrivaZer] -> {7691BE2F-3D79-AADE-9C87-4D6EBCC76682} => -> No File
ContextMenuHandlers2: [PrivaZer] -> {7691BE2F-3D79-AADE-9C87-4D6EBCC76682} => -> No File
ContextMenuHandlers3: [PrivaZer] -> {7691BE2F-3D79-AADE-9C87-4D6EBCC76682} => -> No File
ContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2019-02-21] (Igor Pavlov) [File not signed]
ContextMenuHandlers4: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.32.0.dll [2020-02-19] (Dropbox, Inc -> Dropbox, Inc.)
ContextMenuHandlers4: [PrivaZer] -> {7691BE2F-3D79-AADE-9C87-4D6EBCC76682} => -> No File
ContextMenuHandlers5: [ACE] -> {5E2121EE-0300-11D4-8D3B-444553540000} => C:\Program Files\AMD\CNext\CNext\atiacm64.dll [2017-06-27] (Advanced Micro Devices, Inc.) [File not signed]
ContextMenuHandlers5: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.32.0.dll [2020-02-19] (Dropbox, Inc -> Dropbox, Inc.)
ContextMenuHandlers6: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2019-02-21] (Igor Pavlov) [File not signed]
ContextMenuHandlers6: [PrivaZer] -> {7691BE2F-3D79-AADE-9C87-4D6EBCC76682} => -> No File

==================== Codecs (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Drivers32: [vidc.pDAD] => C:\Windows\SysWOW64\prodad-codec.dll [506392 2016-04-27] (proDAD GmbH -> proDAD GmbH)

==================== Shortcuts & WMI ========================

==================== Loaded Modules (Whitelisted) =============

2016-09-14 22:30 - 2016-09-14 22:30 - 000011776 _____ () [File not signed] C:\Program Files\AMD\CNext\CNext\libEGL.dll
2016-09-14 22:30 - 2016-09-14 22:30 - 002013696 _____ () [File not signed] C:\Program Files\AMD\CNext\CNext\libGLESv2.dll
2016-09-14 22:30 - 2016-09-14 22:30 - 000014336 _____ () [File not signed] C:\Program Files\AMD\CNext\CNext\QtQuick.2\qtquick2plugin.dll
2016-09-14 22:30 - 2016-09-14 22:30 - 000739840 _____ () [File not signed] C:\Program Files\AMD\CNext\CNext\QtQuick\Controls\qtquickcontrolsplugin.dll
2016-09-14 22:30 - 2016-09-14 22:30 - 000191488 _____ () [File not signed] C:\Program Files\AMD\CNext\CNext\QtQuick\Dialogs\dialogplugin.dll
2016-09-14 22:30 - 2016-09-14 22:30 - 000071168 _____ () [File not signed] C:\Program Files\AMD\CNext\CNext\QtQuick\Layouts\qquicklayoutsplugin.dll
2016-09-14 22:30 - 2016-09-14 22:30 - 000014336 _____ () [File not signed] C:\Program Files\AMD\CNext\CNext\QtQuick\Window.2\windowplugin.dll
2018-02-13 13:13 - 2006-10-19 21:44 - 000047616 _____ () [File not signed] C:\WINDOWS\System32\pdf995mon64.dll
2017-06-28 19:16 - 2012-03-14 04:00 - 000385024 _____ (CANON INC.) [File not signed] C:\WINDOWS\System32\CNMLMA7.DLL
2017-06-28 15:25 - 2012-06-14 16:18 - 000359936 _____ (CANON INC.) [File not signed] C:\WINDOWS\System32\CNMN6PPM.DLL
2019-10-15 14:24 - 2019-02-21 08:00 - 000078336 _____ (Igor Pavlov) [File not signed] C:\Program Files\7-Zip\7-zip.dll
2016-09-14 22:30 - 2016-09-14 22:30 - 000049664 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\AMD\CNext\CNext\imageformats\qdds.dll
2016-09-14 22:30 - 2016-09-14 22:30 - 000029696 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\AMD\CNext\CNext\imageformats\qgif.dll
2016-09-14 22:30 - 2016-09-14 22:30 - 000037376 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\AMD\CNext\CNext\imageformats\qicns.dll
2016-09-14 22:30 - 2016-09-14 22:30 - 000030208 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\AMD\CNext\CNext\imageformats\qico.dll
2016-09-14 22:30 - 2016-09-14 22:30 - 000459776 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\AMD\CNext\CNext\imageformats\qjp2.dll
2016-09-14 22:30 - 2016-09-14 22:30 - 000236544 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\AMD\CNext\CNext\imageformats\qjpeg.dll
2016-09-14 22:30 - 2016-09-14 22:30 - 000275456 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\AMD\CNext\CNext\imageformats\qmng.dll
2016-09-14 22:30 - 2016-09-14 22:30 - 000023552 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\AMD\CNext\CNext\imageformats\qsvg.dll
2016-09-14 22:30 - 2016-09-14 22:30 - 000022528 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\AMD\CNext\CNext\imageformats\qtga.dll
2016-09-14 22:30 - 2016-09-14 22:30 - 000351744 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\AMD\CNext\CNext\imageformats\qtiff.dll
2016-09-14 22:30 - 2016-09-14 22:30 - 000021504 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\AMD\CNext\CNext\imageformats\qwbmp.dll
2016-09-14 22:30 - 2016-09-14 22:30 - 000374784 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\AMD\CNext\CNext\imageformats\qwebp.dll
2016-09-14 22:30 - 2016-09-14 22:30 - 001212416 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\AMD\CNext\CNext\platforms\qwindows.dll
2016-09-14 22:29 - 2016-09-14 22:29 - 000912384 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5Charts.dll
2016-09-14 22:29 - 2016-09-14 22:29 - 005496320 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5Core.dll
2016-09-14 22:29 - 2016-09-14 22:29 - 005804544 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5Gui.dll
2016-09-14 22:29 - 2016-09-14 22:29 - 001061376 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5Network.dll
2016-09-14 22:29 - 2016-09-14 22:29 - 003187712 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5Qml.dll
2016-09-14 22:30 - 2016-09-14 22:30 - 002924544 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5Quick.dll
2016-09-14 22:30 - 2016-09-14 22:30 - 000310784 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5Svg.dll
2016-09-14 22:30 - 2016-09-14 22:30 - 005444608 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5Widgets.dll
2016-09-14 22:30 - 2016-09-14 22:30 - 000277504 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5WinExtras.dll
2016-09-14 22:30 - 2016-09-14 22:30 - 000193024 _____ (The Qt Company Ltd) [File not signed] C:\Program Files\AMD\CNext\CNext\Qt5Xml.dll

==================== Alternate Data Streams (Whitelisted) ========

==================== Safe Mode (Whitelisted) ==================

==================== Association (Whitelisted) =================

==================== Internet Explorer trusted/restricted ==========

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\S-1-5-21-572709066-2931371650-4259622231-1001\...\localhost -> localhost

==================== Hosts content: =========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2020-02-23 12:54 - 2020-02-23 12:54 - 000000027 _____ C:\WINDOWS\system32\drivers\etc\hosts
127.0.0.1 localhost

2018-10-05 09:54 - 2019-05-20 18:22 - 000000447 _____ C:\WINDOWS\system32\drivers\etc\hosts.ics
69.254.165.166 WINDOWS-9C6P0DA.mshome.net # 2023 10 3 4 17 54 44 472

==================== Other Areas ===========================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-572709066-2931371650-4259622231-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Lab\Documents\IMAGES\Clouds_RJ1_2613.jpg
DNS Servers: 10.0.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: Prompt)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(If an entry is included in the fixlist, it will be removed.)

MSCONFIG\Services: CLKMSVC10_3CD7F304 => 2
MSCONFIG\Services: DellDataVault => 2
MSCONFIG\Services: DellDataVaultWiz => 2
MSCONFIG\Services: RichVideo => 2
MSCONFIG\Services: SupportAssistAgent => 2
HKLM\...\StartupApproved\Run: => "Logitech Download Assistant"
HKLM\...\StartupApproved\Run: => "WavesSvc"
HKLM\...\StartupApproved\Run32: => "Dropbox"
HKLM\...\StartupApproved\Run32: => "Malwarebytes Anti-Malware (cleanup)"
HKU\S-1-5-21-572709066-2931371650-4259622231-1001\...\StartupApproved\Run: => "OneDrive"
HKU\S-1-5-21-572709066-2931371650-4259622231-1001\...\StartupApproved\Run: => "HP OfficeJet 4650 series (NET)"
HKU\S-1-5-21-572709066-2931371650-4259622231-1001\...\StartupApproved\Run: => "OneDriveSetup"
HKU\S-1-5-21-572709066-2931371650-4259622231-1001\...\StartupApproved\Run: => "Stride"
HKU\S-1-5-21-572709066-2931371650-4259622231-1001\...\StartupApproved\Run: => "CCleaner Smart Cleaning"
HKU\S-1-5-21-572709066-2931371650-4259622231-1001\...\StartupApproved\Run: => "FreeYouTubeDownloader"
HKU\S-1-5-21-572709066-2931371650-4259622231-1001\...\StartupApproved\Run: => "Skype for Desktop"

==================== FirewallRules (Whitelisted) ================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [SNMP-In-UDP] => (Allow) %SystemRoot%\system32\snmp.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [SNMP-Out-UDP] => (Allow) %SystemRoot%\system32\snmp.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [SNMP-In-UDP-NoScope] => (Allow) %SystemRoot%\system32\snmp.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [SNMP-Out-UDP-NoScope] => (Allow) %SystemRoot%\system32\snmp.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [UDP Query User{83A3B1B9-401D-487E-8F04-5A8E82CADAD3}C:\program files (x86)\tp-link\tp-link plc utility\tpplc.exe] => (Allow) C:\program files (x86)\tp-link\tp-link plc utility\tpplc.exe (TP-Link TECHNOLOGIES CO., LTD.) [File not signed]
FirewallRules: [TCP Query User{C718BC30-022C-4F24-BD58-146074FE8A5A}C:\program files (x86)\tp-link\tp-link plc utility\tpplc.exe] => (Allow) C:\program files (x86)\tp-link\tp-link plc utility\tpplc.exe (TP-Link TECHNOLOGIES CO., LTD.) [File not signed]
FirewallRules: [UDP Query User{3DB81581-222D-41A5-84B7-009C348708A3}C:\program files (x86)\tp-link\tp-link plc utility\tpplc.exe] => (Allow) C:\program files (x86)\tp-link\tp-link plc utility\tpplc.exe (TP-Link TECHNOLOGIES CO., LTD.) [File not signed]
FirewallRules: [TCP Query User{BA8F9AA0-1995-4206-A785-603A9AE8ADC1}C:\program files (x86)\tp-link\tp-link plc utility\tpplc.exe] => (Allow) C:\program files (x86)\tp-link\tp-link plc utility\tpplc.exe (TP-Link TECHNOLOGIES CO., LTD.) [File not signed]
FirewallRules: [{7BFE13FD-399A-4193-A312-BF3E0E9E0867}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{074F37AA-A342-4C65-94D1-CB25AC52B67E}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{E3ED5FD2-27CC-4479-A1A7-873997971780}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{71C28DEC-5724-4B05-ADB0-57215AEE24EF}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{7911F581-9E16-4424-971C-6D34E56F0B52}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{633C4B8B-6B20-4545-8515-950DCB9BC860}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{839C1466-43C1-431C-B46B-883D6D5CFD5A}] => (Allow) LPort=1900
FirewallRules: [{A505D781-0BD1-4CED-9044-09E36E0E120E}] => (Allow) LPort=2869
FirewallRules: [{E47A38C1-81AE-4567-B3F7-FD8377127901}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{F61DF977-B93B-4291-BDA6-67B6135A6BE4}] => (Allow) C:\Program Files\HP\HP OfficeJet 4650 series\bin\FaxPrinterUtility.exe (Hewlett Packard -> HP Inc.)
FirewallRules: [{E4F4806C-DA49-42B2-A68B-5877C6499B36}] => (Allow) C:\Program Files\HP\HP OfficeJet 4650 series\bin\FaxApplications.exe (Hewlett Packard -> HP Inc.)
FirewallRules: [{197A6A19-76FE-4512-B5FF-B3A32BBFA350}] => (Allow) C:\Program Files\HP\HP OfficeJet 4650 series\bin\DigitalWizards.exe (Hewlett Packard -> HP Inc.)
FirewallRules: [{0F7A0DD9-4DCC-44EC-9929-E12833C5F22A}] => (Allow) C:\Program Files\HP\HP OfficeJet 4650 series\bin\SendAFax.exe (Hewlett Packard -> HP Inc.)
FirewallRules: [{72C60B88-6786-412B-B65B-13BBA4222BD4}] => (Allow) C:\Program Files\HP\HP OfficeJet 4650 series\Bin\DeviceSetup.exe (Hewlett Packard -> HP Inc.)
FirewallRules: [{55E16E3F-0EED-4C3F-BA16-BD97B1B804F0}] => (Allow) LPort=5357
FirewallRules: [{A59095AD-2815-4D3F-94BE-731E03DD37CF}] => (Allow) C:\Program Files\HP\HP OfficeJet 4650 series\Bin\HPNetworkCommunicatorCom.exe (Hewlett Packard -> HP Inc.)
FirewallRules: [TCP Query User{BE0CBBC1-244D-4396-8926-F3BA36F579FC}C:\windows\syswow64\regsvr32.exe] => (Allow) C:\windows\syswow64\regsvr32.exe
FirewallRules: [UDP Query User{DBACCFA6-72B7-4DD3-BF11-42FF681CF227}C:\windows\syswow64\regsvr32.exe] => (Allow) C:\windows\syswow64\regsvr32.exe
FirewallRules: [TCP Query User{B2C1CDAF-955E-4C7F-ACF6-6ABD3F93BC50}C:\program files (x86)\reolink client\reolink client.exe] => (Allow) C:\program files (x86)\reolink client\reolink client.exe (Reolink Digital Technology Co., Ltd. -> )
FirewallRules: [UDP Query User{1CEDC540-8CB2-4E59-B414-D32B98A410B4}C:\program files (x86)\reolink client\reolink client.exe] => (Allow) C:\program files (x86)\reolink client\reolink client.exe (Reolink Digital Technology Co., Ltd. -> )
FirewallRules: [{C7182486-E311-42CE-AE0E-264030AAEA12}] => (Allow) C:\Program Files\CCleaner\CCUpdate.exe (Piriform Software Ltd -> Piriform Software Ltd)
FirewallRules: [{72CE3229-696C-4FA8-9608-0AFFAFDD7954}] => (Allow) C:\Program Files\CCleaner\CCUpdate.exe (Piriform Software Ltd -> Piriform Software Ltd)
FirewallRules: [TCP Query User{BFED1C26-0304-45F1-9584-5307DE71E9D8}C:\program files (x86)\videolan\vlc\vlc.exe] => (Block) C:\program files (x86)\videolan\vlc\vlc.exe (VideoLAN -> VideoLAN)
FirewallRules: [UDP Query User{1F553009-6594-4A55-9A28-FDFABEF962EC}C:\program files (x86)\videolan\vlc\vlc.exe] => (Block) C:\program files (x86)\videolan\vlc\vlc.exe (VideoLAN -> VideoLAN)
FirewallRules: [{0179E966-AEEF-47C7-9658-C05079D8AF04}] => (Allow) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe (Dropbox, Inc -> Dropbox, Inc.)

==================== Restore Points =========================

14-11-2019 17:20:14 Windows Update
18-11-2019 10:03:49 Removed Macrium Reflect Free Edition
01-12-2019 12:48:25 Scheduled Checkpoint
13-02-2020 13:28:30 Windows Modules Installer

==================== Faulty Device Manager Devices ============

Name: PLDS DVD+-RW DU-8A5LH
Description: CD-ROM Drive
Class Guid: {4d36e965-e325-11ce-bfc1-08002be10318}
Manufacturer: (Standard CD-ROM drives)
Service: cdrom
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Realtek PCIe GBE Family Controller
Description: Realtek PCIe GBE Family Controller
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Realtek
Service: rt640x64
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: ========================

Application errors:
==================
Error: (02/25/2020 10:12:31 AM) (Source: ESENT) (EventID: 455) (User: )
Description: svchost (2580,R,98) TILEREPOSITORYS-1-5-18: Error -1023 (0xfffffc01) occurred while opening logfile C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database\EDB.log.

Error: (02/25/2020 10:07:00 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: FreemakeUtilsService.exe, version: 1.0.0.0, time stamp: 0x5df073cc
Faulting module name: KERNELBASE.dll, version: 10.0.18362.628, time stamp: 0x54734dee
Exception code: 0xe0434352
Fault offset: 0x00113db2
Faulting process id: 0xfd8
Faulting application start time: 0x01d5ec065ab972d4
Faulting application path: C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe
Faulting module path: C:\WINDOWS\System32\KERNELBASE.dll
Report Id: 4aff3f83-260f-41e9-8031-6c9cfb4aba1f
Faulting package full name:
Faulting package-relative application ID:

Error: (02/25/2020 10:06:53 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: FreemakeUtilsService.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.IO.FileNotFoundException
at FreemakeUtilsService.Program.Main(System.String[])

Error: (02/25/2020 10:05:56 AM) (Source: VSS) (EventID: 8193) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance. hr = 0x8007045b, A system shutdown is in progress.
.

Error: (02/25/2020 10:05:56 AM) (Source: VSS) (EventID: 13) (User: )
Description: Volume Shadow Copy Service information: The COM Server with CLSID {4e14fba2-2e22-11d1-9964-00c04fbbb345} and name CEventSystem cannot be started. [0x8007045b, A system shutdown is in progress.
]

Error: (02/25/2020 09:48:18 AM) (Source: ESENT) (EventID: 455) (User: )
Description: svchost (10912,R,98) TILEREPOSITORYS-1-5-18: Error -1023 (0xfffffc01) occurred while opening logfile C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database\EDB.log.

Error: (02/25/2020 09:32:48 AM) (Source: ESENT) (EventID: 455) (User: )
Description: svchost (11324,R,98) TILEREPOSITORYS-1-5-18: Error -1023 (0xfffffc01) occurred while opening logfile C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database\EDB.log.

Error: (02/25/2020 09:19:58 AM) (Source: ESENT) (EventID: 455) (User: )
Description: svchost (7012,R,98) TILEREPOSITORYS-1-5-18: Error -1023 (0xfffffc01) occurred while opening logfile C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database\EDB.log.


System errors:
=============
Error: (02/25/2020 10:07:01 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Freemake Improver service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.

Error: (02/25/2020 10:07:01 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (45000 milliseconds) while waiting for the Freemake Improver service to connect.

Error: (02/25/2020 10:06:51 AM) (Source: SNMP) (EventID: 1500) (User: )
Description: The SNMP Service encountered an error while accessing the registry key SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration.

Error: (02/25/2020 10:06:24 AM) (Source: Application Popup) (EventID: 56) (User: )
Description: ACPI5

Error: (02/25/2020 10:05:38 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The DbxSvc service terminated unexpectedly. It has done this 1 time(s).

Error: (02/25/2020 10:05:38 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The AMD External Events Utility service terminated unexpectedly. It has done this 1 time(s).

Error: (02/25/2020 10:05:38 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Office Software Protection Platform service terminated unexpectedly. It has done this 1 time(s).

Error: (02/25/2020 10:05:38 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Message Queuing service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.


Windows Defender:
===================================
Date: 2020-02-24 09:47:47.449
Description:
Windows Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?linkid ... terprise=0
Name: Trojan:O97M/Madeba.A!det
ID: 2147708876
Severity: Severe
Category: Trojan
Path: file:_E:\798614.doc
Detection Origin: Local machine
Detection Type: Concrete
Detection Source: Real-Time Protection
Process Name: C:\Windows\explorer.exe
Security intelligence Version: AV: 1.309.1568.0, AS: 1.309.1568.0, NIS: 1.309.1568.0
Engine Version: AM: 1.1.16700.3, NIS: 1.1.16700.3

Date: 2020-01-20 08:54:10.939
Description:
C:\Windows\SysWOW64\dllhost.exe has been blocked from modifying %userprofile%\Documents\Email Folders\WLMDSS.tmp\WLMA70A.tmp\ by Controlled Folder Access.
Detection time: 2020-01-20T16:54:10.939Z
Path: %userprofile%\Documents\Email Folders\WLMDSS.tmp\WLMA70A.tmp\
Process Name: C:\Windows\SysWOW64\dllhost.exe
Security intelligence Version: 1.307.2606.0
Engine Version: 1.1.16600.7
Product Version: 4.18.1911.3

==================== Memory info ===========================

BIOS: Dell Inc. 3.2.4 06/17/2016
Motherboard: Dell Inc. 0C2XKD
Processor: Intel(R) Core(TM) i7-6700 CPU @ 3.40GHz
Percentage of memory in use: 16%
Total physical RAM: 16327.11 MB
Available physical RAM: 13594.78 MB
Total Virtual: 18759.11 MB
Available Virtual: 16049.35 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:1849.73 GB) (Free:1681.9 GB) NTFS

\\?\Volume{09957070-59a4-44d0-baaf-f0e5a4c0f3b6}\ () (Fixed) (Total:0.84 GB) (Free:0.41 GB) NTFS
\\?\Volume{258364c1-3968-4bb3-80c8-ccfcbfef7589}\ (Image) (Fixed) (Total:11.83 GB) (Free:0.64 GB) NTFS
\\?\Volume{ff9158dc-c224-44c8-b9df-4f1554c94904}\ (ESP) (Fixed) (Total:0.48 GB) (Free:0.46 GB) FAT32

==================== MBR & Partition Table ====================

==========================================================
Disk: 0 (Size: 1863 GB) (Disk ID: B4E795BD)

Partition: GPT.

==================== End of Addition.txt =======================

[pgmigg]

Hi Electrojim,

Very well! One more scan please...

ESET Online Scanner

1. Please close all open programs and windows.
2. Please go HERE, then click on ONE-TIME SCAN and save esetonlinescanner_enu.exe on your Desktop.
3. Double-click on esetsmartinstaller_enu.exe to run it - it will start downloading some modules to be get ready for scan...
4. Then it will start scanning... You need to be patient and wait for a while - it can take even a few hours to finish.
5. When completed, in case anything will be found, you will need to click on Save scan log button and save the log on your Desktop as ESET.txt.
6. Click on Continue, do it one more time on the next screen, then exit out of ESET Online Scanner by clicking on Close button.

Please post each log separately to prevent it being cut off by the forum post size limiter.
Check each after you've posted it to make sure it's all present, if any log is cut off you'll have to post it in sections....

Please include in your next reply:

1. Do you have any problems executing the instructions?
2. Contents of the ESET.txt log file if it was saved
3. Do you see any changes in computer behavior?

Thanks,
pgmigg

Failure to post replies within 72 hours will result in this thread being closed