Frequent popup ads in Chrome (lower right corner) that I can't seem to kill. I can close them, but they will keep popping up throughout the day. Other ads, too some benign, some risque, but 123movie.cc is the most common and also the site I *believe* gave me the crud! Thanks in advance for any help...
----------------------------------------
FRST.txt:
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 23.08.2018
Ran by wadef (administrator) on WTF (23-08-2018 14:03:26)
Running from C:\Users\wadef\Downloads
Loaded Profiles: wadef & (Available Profiles: wadef)
Platform: Windows 10 Home Version 1803 17134.228 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_5f27f588e5eaa413\igfxCUIService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_5f27f588e5eaa413\IntelCpHDCPSvc.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe
(Dolby Laboratories, Inc.) C:\Program Files\Dolby\Dolby DAX2\DAX2_API\DolbyDAX2API.exe
(Wondershare) C:\Program Files (x86)\Wondershare\WAF\2.4.3.236\WsAppService.exe
(Realtek Semiconductor Corp.) C:\Windows\RtkBtManServ.exe
(Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_5f27f588e5eaa413\IntelCpHeciSvc.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_5f27f588e5eaa413\igfxEM.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Dolby Laboratories, Inc.) C:\Program Files\Dolby\Dolby DAX2\DAX2_APP\DolbyDAX2TrayIcon.exe
() C:\Program Files\Google\Drive\googledrivesync.exe
(Lenovo(beijing) Limited) C:\Program Files\WindowsApps\E0469640.LenovoUtility_3.0.37.0_x64__5grkq8ppsgwt4\VFS\ProgramFilesX64\Lenovo\LenovoUtility\utility.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.Office.Desktop.Word_16040.10325.20082.0_x86__8wekyb3d8bbwe\Office16\WINWORD.EXE
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.Office.Desktop.Excel_16040.10325.20082.0_x86__8wekyb3d8bbwe\Office16\EXCEL.EXE
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Program Files\Google\Drive\googledrivesync.exe
(Intel Corporation) C:\Program Files (x86)\Intel\TXE Components\DAL\jhi_service.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler64.exe
(Intel® Corporation) C:\Program Files\Intel\TXE Components\iCLS\SocketHeciServer.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
(Microsoft Corporation) C:\Windows\System32\browser_broker.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Plumbytes Software Lp) C:\Program Files\Plumbytes Software\Plumbytes Anti-Malware\AmwService.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1807.2121.0_x64__8wekyb3d8bbwe\Calculator.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.10325.20117.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.10325.20117.0_x64__8wekyb3d8bbwe\HxTsr.exe
(TechGuy, Inc.) C:\Users\wadef\Downloads\SysInfo.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1815.210.0_x64__kzf8qxf38zg5c\SkypeHost.exe
() C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
(Microsoft Corporation) C:\Windows\System32\SnippingTool.exe
(Microsoft Corporation) C:\Windows\System32\mspaint.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\ImController\PluginHost\Lenovo.Modern.ImController.PluginHost.SettingsApp.exe
(Lenovo Group Limited) C:\Program Files (x86)\Lenovo\ImController\PluginHost\Lenovo.Modern.ImController.PluginHost.SettingsApp.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\ImController\PluginHost\Lenovo.Modern.ImController.PluginHost.SettingsApp.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\ImController\PluginHost\Lenovo.Modern.ImController.PluginHost.CompanionApp.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.10314.31700.0_x64__8wekyb3d8bbwe\Office16\OfficeHubTaskHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [638872 2018-04-11] (Microsoft Corporation)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [298296 2018-04-08] (Apple Inc.)
HKLM\...\Run: [DAX2_APP] => C:\Program Files\Dolby\Dolby DAX2\DAX2_APP\DolbyDAX2TrayIcon.exe [849920 2017-03-07] (Dolby Laboratories, Inc.)
HKLM\...\Run: [Plumbytes Anti-Malware] => C:\Program Files\Plumbytes Software\Plumbytes Anti-Malware\Plumbytes.exe [2189304 2018-06-13] (Plumbytes Software Lp)
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-19\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-11] (Microsoft Corporation)
HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08212018071437550\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-11] (Microsoft Corporation)
HKU\S-1-5-20\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-11] (Microsoft Corporation)
HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08212018071438136\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-11] (Microsoft Corporation)
HKU\S-1-5-21-772274138-2366416172-2937497999-1001\...\Run: [GoogleDriveSync] => C:\Program Files\Google\Drive\googledrivesync.exe [46281248 2018-05-30] ()
HKU\S-1-5-21-772274138-2366416172-2937497999-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08212018071438630\...\Run: [GoogleDriveSync] => C:\Program Files\Google\Drive\googledrivesync.exe [46281248 2018-05-30] ()
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
Tcpip\..\Interfaces\{08417397-c654-4767-b46f-d056c5cc524d}: [DhcpNameServer] 192.168.1.254
Tcpip\..\Interfaces\{66a86b48-4095-4060-8dd8-5d7afa6f88f2}: [DhcpNameServer] 150.207.1.3
Internet Explorer:
==================
HKU\S-1-5-21-772274138-2366416172-2937497999-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo17win10.msn.com/?pc=LCTE
HKU\S-1-5-21-772274138-2366416172-2937497999-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo17win10.msn.com/?pc=LCTE
HKU\S-1-5-21-772274138-2366416172-2937497999-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://mystart.lenovo.com/
HKU\S-1-5-21-772274138-2366416172-2937497999-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08212018071438630\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo17win10.msn.com/?pc=LCTE
HKU\S-1-5-21-772274138-2366416172-2937497999-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08212018071438630\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo17win10.msn.com/?pc=LCTE
HKU\S-1-5-21-772274138-2366416172-2937497999-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08212018071438630\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://mystart.lenovo.com/
SearchScopes: HKU\S-1-5-21-772274138-2366416172-2937497999-1001 -> DefaultScope {D9539856-094D-4636-8228-55131AA1FFC0} URL =
SearchScopes: HKU\S-1-5-21-772274138-2366416172-2937497999-1001 -> {D9539856-094D-4636-8228-55131AA1FFC0} URL =
SearchScopes: HKU\S-1-5-21-772274138-2366416172-2937497999-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08212018071438630 -> DefaultScope {D9539856-094D-4636-8228-55131AA1FFC0} URL =
SearchScopes: HKU\S-1-5-21-772274138-2366416172-2937497999-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08212018071438630 -> {D9539856-094D-4636-8228-55131AA1FFC0} URL =
FireFox:
========
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-17] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-17] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2018-06-29] (Adobe Systems Inc.)
Chrome:
=======
CHR Profile: C:\Users\wadef\AppData\Local\Google\Chrome\User Data\Default [2018-08-23]
CHR Extension: (Slides) - C:\Users\wadef\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2018-03-24]
CHR Extension: (Docs) - C:\Users\wadef\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2018-03-24]
CHR Extension: (Google Drive) - C:\Users\wadef\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2018-03-24]
CHR Extension: (YouTube) - C:\Users\wadef\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2018-03-24]
CHR Extension: (Sheets) - C:\Users\wadef\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2018-03-24]
CHR Extension: (Google Docs Offline) - C:\Users\wadef\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2018-08-15]
CHR Extension: (Kindle Cloud Reader) - C:\Users\wadef\AppData\Local\Google\Chrome\User Data\Default\Extensions\icdipabjmbhpdkjaihfjoikhjjeneebd [2018-03-24]
CHR Extension: (Application Launcher for Drive (by Google)) - C:\Users\wadef\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2018-03-24]
CHR Extension: (Boomerang for Gmail) - C:\Users\wadef\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdanidgdpmkimeiiojknlnekblgmpdll [2018-07-08]
CHR Extension: (Chrome Web Store Payments) - C:\Users\wadef\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-04-04]
CHR Extension: (Gmail) - C:\Users\wadef\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2018-03-24]
CHR Extension: (Chrome Media Router) - C:\Users\wadef\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-08-10]
CHR HKU\S-1-5-21-772274138-2366416172-2937497999-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-772274138-2366416172-2937497999-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08212018071438630\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2018-03-29] (Apple Inc.)
R2 Dolby DAX2 API Service; C:\Program Files\Dolby\Dolby DAX2\DAX2_API\DolbyDAX2API.exe [197120 2017-07-13] (Dolby Laboratories, Inc.)
S3 ESLoadService; C:\Program Files (x86)\EaseUS\EaseUS MobiMover\bin\ESLoadService.exe [47840 2017-10-30] (TODO: <Company name>)
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [144600 2017-10-22] (ELAN Microelectronics Corp.)
R2 ImControllerService; C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe [71408 2018-05-16] (Lenovo Group Limited)
R3 Intel® Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\TXE Components\iCLS\SocketHeciServer.exe [974632 2016-05-23] (Intel® Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\TXE Components\DAL\jhi_service.exe [176416 2016-09-27] (Intel Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6541008 2018-05-09] (Malwarebytes)
R2 pbamw_service; C:\Program Files\Plumbytes Software\Plumbytes Anti-Malware\AmwService.exe [134136 2018-06-13] (Plumbytes Software Lp)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [324584 2017-08-30] (Realtek Semiconductor)
R2 RtkBtManServ; C:\WINDOWS\RtkBtManServ.exe [293352 2017-08-08] (Realtek Semiconductor Corp.)
S4 ssh-agent; C:\WINDOWS\System32\OpenSSH\ssh-agent.exe [495616 2018-03-10] ()
S3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\platform\4.14.17639.18041-0\NisSrv.exe [4632736 2018-04-25] (Microsoft Corporation)
S3 WinDefend; C:\ProgramData\Microsoft\Windows Defender\platform\4.14.17639.18041-0\MsMpEng.exe [104680 2018-04-25] (Microsoft Corporation)
R2 WsAppService; C:\Program Files (x86)\Wondershare\WAF\2.4.3.236\WsAppService.exe [495840 2018-01-26] (Wondershare)
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 aftap0901; C:\WINDOWS\System32\drivers\aftap0901.sys [48624 2018-03-06] (The OpenVPN Project)
R3 ETDHCF; C:\WINDOWS\System32\drivers\ETDHCF.sys [29256 2017-10-22] (ELAN Microelectronics Corp.)
R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [259360 2018-08-20] (Malwarebytes)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [1009128 2017-08-20] (Realtek )
R3 RtkBtFilter; C:\WINDOWS\system32\DRIVERS\RtkBtfilter.sys [724456 2017-08-08] (Realtek Semiconductor Corporation)
R3 rtsuvc; C:\WINDOWS\system32\DRIVERS\rtsuvc.sys [3236320 2017-11-06] (Realtek Semiconductor Corp.)
R3 RTWlanE; C:\WINDOWS\System32\drivers\rtwlane.sys [7895912 2017-10-30] (Realtek Semiconductor Corporation )
S3 WdBoot; C:\WINDOWS\system32\drivers\wd\WdBoot.sys [46072 2018-04-25] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\wd\WdFilter.sys [313888 2018-04-25] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [61472 2018-04-25] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2018-08-23 14:03 - 2018-08-23 14:05 - 000017818 _____ C:\Users\wadef\Downloads\FRST.txt
2018-08-23 14:03 - 2018-08-23 14:03 - 000000000 ____D C:\FRST
2018-08-23 14:02 - 2018-08-23 14:02 - 002413056 _____ (Farbar) C:\Users\wadef\Downloads\FRST64.exe
2018-08-23 07:59 - 2018-08-23 07:59 - 000120145 _____ C:\Users\wadef\Downloads\Sellers_Disclosure_Notice__2118_ts77518.pdf
2018-08-21 14:36 - 2018-08-21 14:36 - 000470143 _____ C:\Users\wadef\Downloads\LISD-District-Calendar_18-19_no-ads.pdf
2018-08-21 13:15 - 2018-08-21 13:15 - 000748192 _____ (TechGuy, Inc.) C:\Users\wadef\Downloads\SysInfo.exe
2018-08-21 07:16 - 2018-08-21 07:33 - 000000000 ____D C:\Users\wadef\AppData\Local\{12A8CCFE-3C33-4995-BAD8-074E4C5B22FD}
2018-08-21 07:16 - 2018-08-21 07:16 - 000001168 _____ C:\Users\wadef\Desktop\Plumbytes Anti-Malware.lnk
2018-08-21 07:16 - 2018-08-21 07:16 - 000000000 ____D C:\Users\wadef\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Plumbytes Anti-Malware
2018-08-21 07:16 - 2018-08-21 07:16 - 000000000 ____D C:\Program Files\Plumbytes Software
2018-08-21 07:15 - 2018-08-21 07:15 - 000882680 _____ (Plumbytes Software Lp) C:\Users\wadef\Downloads\antimalwaresetup.exe
2018-08-20 13:44 - 2018-08-20 13:44 - 000468461 _____ C:\Users\wadef\Downloads\Seller Disclosure Statement.pdf
2018-08-20 13:14 - 2018-08-20 13:14 - 000000000 ____D C:\Users\wadef\AppData\Local\mbam
2018-08-20 13:13 - 2018-08-20 13:13 - 000259360 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys
2018-08-20 13:12 - 2018-08-20 13:12 - 000001919 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2018-08-20 13:12 - 2018-08-20 13:12 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2018-08-20 13:12 - 2018-08-20 13:12 - 000000000 ____D C:\ProgramData\Malwarebytes
2018-08-20 13:12 - 2018-08-20 13:12 - 000000000 ____D C:\Program Files\Malwarebytes
2018-08-20 13:12 - 2018-07-12 08:42 - 000152688 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbae64.sys
2018-08-20 13:08 - 2018-08-20 13:09 - 082459856 _____ (Malwarebytes ) C:\Users\wadef\Downloads\mb3-setup-consumer-3.5.1.2522-1.0.421-1.0.6407.exe
2018-08-16 14:24 - 2018-08-16 14:24 - 001732824 _____ C:\Users\wadef\Downloads\14751 Hwy 29 Flyer.pdf
2018-08-16 14:24 - 2018-08-16 14:24 - 000315799 _____ C:\Users\wadef\Downloads\survey.pdf
2018-08-16 14:08 - 2018-08-16 14:08 - 000068552 _____ C:\Users\wadef\Downloads\Seller's Closing Disclosure (1).pdf
2018-08-15 19:26 - 2018-08-15 19:26 - 000102190 _____ C:\Users\wadef\Downloads\831120670002-15511457.zip
2018-08-15 08:17 - 2018-08-15 08:17 - 000079079 _____ C:\Users\wadef\Downloads\501.doc.pdf
2018-08-14 15:05 - 2018-08-03 03:39 - 021389368 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2018-08-14 15:05 - 2018-08-03 03:20 - 003652608 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2018-08-14 15:05 - 2018-08-03 02:43 - 020383720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2018-08-14 15:05 - 2018-08-02 22:39 - 009091480 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2018-08-14 15:05 - 2018-08-02 22:39 - 007519992 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2018-08-14 15:05 - 2018-08-02 22:39 - 007436120 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2018-08-14 15:05 - 2018-08-02 22:26 - 006043600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2018-08-14 15:05 - 2018-08-02 22:25 - 006568784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2018-08-14 15:05 - 2018-08-02 22:23 - 025846784 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2018-08-14 15:05 - 2018-08-02 22:18 - 022714880 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2018-08-14 15:05 - 2018-08-02 22:18 - 022007808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2018-08-14 15:05 - 2018-08-02 22:17 - 004380160 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeContent.dll
2018-08-14 15:05 - 2018-08-02 22:15 - 008188928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2018-08-14 15:05 - 2018-08-02 22:14 - 004867584 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2018-08-14 15:05 - 2018-08-02 22:13 - 019404288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2018-08-14 15:05 - 2018-08-02 22:13 - 003395072 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2018-08-14 15:05 - 2018-08-02 22:12 - 003392000 _____ (Microsoft Corporation) C:\WINDOWS\system32\tquery.dll
2018-08-14 15:05 - 2018-08-02 22:12 - 002738688 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssrch.dll
2018-08-14 15:05 - 2018-08-02 22:11 - 007577088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2018-08-14 15:05 - 2018-08-02 22:09 - 005776896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2018-08-14 15:05 - 2018-08-02 22:09 - 004615680 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2018-08-14 15:05 - 2018-08-02 22:06 - 004191232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2018-08-14 15:05 - 2018-07-14 19:44 - 006587392 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2018-08-14 15:05 - 2018-07-14 19:43 - 012710400 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2018-08-14 15:05 - 2018-07-14 19:42 - 004708864 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.pcshell.dll
2018-08-14 15:05 - 2018-07-14 18:18 - 005657600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2018-08-14 15:05 - 2018-07-14 18:17 - 011901440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2018-08-14 15:05 - 2018-07-14 01:46 - 023862784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Hydrogen.dll
2018-08-14 15:05 - 2018-07-14 01:42 - 019525632 _____ (Microsoft Corporation) C:\WINDOWS\system32\HologramCompositor.dll
2018-08-14 15:05 - 2018-07-13 23:22 - 006813744 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2018-08-14 15:05 - 2018-07-13 23:22 - 001144664 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetcore.dll
2018-08-14 15:05 - 2018-07-13 23:18 - 002371416 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2vdec.dll
2018-08-14 15:05 - 2018-07-13 23:17 - 006527056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2018-08-14 15:05 - 2018-07-13 23:16 - 002331576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2vdec.dll
2018-08-14 15:05 - 2018-07-13 23:16 - 001143096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetcore.dll
2018-08-14 15:05 - 2018-07-13 22:57 - 007057920 _____ (Microsoft Corporation) C:\WINDOWS\system32\mos.dll
2018-08-14 15:05 - 2018-07-13 22:56 - 002697216 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Controls.dll
2018-08-14 15:05 - 2018-07-13 22:53 - 001825792 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.CloudStore.dll
2018-08-14 15:05 - 2018-07-13 22:51 - 003376640 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkMobileSettings.dll
2018-08-14 15:04 - 2018-08-03 03:39 - 000790304 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2018-08-14 15:04 - 2018-08-03 03:25 - 000178176 _____ (Microsoft Corporation) C:\WINDOWS\system32\t2embed.dll
2018-08-14 15:04 - 2018-08-03 03:25 - 000123392 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontsub.dll
2018-08-14 15:04 - 2018-08-03 03:24 - 000099328 _____ (Microsoft Corporation) C:\WINDOWS\system32\hlink.dll
2018-08-14 15:04 - 2018-08-03 03:24 - 000066048 _____ (Microsoft Corporation) C:\WINDOWS\system32\msiexec.exe
2018-08-14 15:04 - 2018-08-03 03:24 - 000046592 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2018-08-14 15:04 - 2018-08-03 03:22 - 001127936 _____ (Microsoft Corporation) C:\WINDOWS\system32\nettrace.dll
2018-08-14 15:04 - 2018-08-03 03:21 - 001364992 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvruserservice.dll
2018-08-14 15:04 - 2018-08-03 03:21 - 001121792 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWorkspace.dll
2018-08-14 15:04 - 2018-08-03 03:21 - 000765440 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdh.dll
2018-08-14 15:04 - 2018-08-03 03:21 - 000391680 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2018-08-14 15:04 - 2018-08-03 03:20 - 004049408 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll
2018-08-14 15:04 - 2018-08-03 03:20 - 000134144 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppc.dll
2018-08-14 15:04 - 2018-08-03 03:19 - 001661440 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll
2018-08-14 15:04 - 2018-08-03 02:45 - 000663128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2018-08-14 15:04 - 2018-08-03 02:33 - 000138752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\t2embed.dll
2018-08-14 15:04 - 2018-08-03 02:33 - 000098304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontsub.dll
2018-08-14 15:04 - 2018-08-03 02:32 - 000060416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msiexec.exe
2018-08-14 15:04 - 2018-08-03 02:30 - 000099840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hlink.dll
2018-08-14 15:04 - 2018-08-03 02:29 - 000621568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdh.dll
2018-08-14 15:04 - 2018-08-03 02:29 - 000343552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2018-08-14 15:04 - 2018-08-03 02:28 - 002895360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2018-08-14 15:04 - 2018-08-03 02:27 - 004050432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll
2018-08-14 15:04 - 2018-08-03 02:27 - 001469952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll
2018-08-14 15:04 - 2018-08-03 00:41 - 001008640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.MixedRealityCapture.dll
2018-08-14 15:04 - 2018-08-02 23:49 - 000868864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.MixedRealityCapture.dll
2018-08-14 15:04 - 2018-08-02 22:47 - 001034624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApplyTrustOffline.exe
2018-08-14 15:04 - 2018-08-02 22:47 - 000128920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\scmbus.sys
2018-08-14 15:04 - 2018-08-02 22:46 - 000272296 _____ (Microsoft Corporation) C:\WINDOWS\system32\SgrmEnclave.dll
2018-08-14 15:04 - 2018-08-02 22:46 - 000269248 _____ (Microsoft Corporation) C:\WINDOWS\system32\SgrmEnclave_secure.dll
2018-08-14 15:04 - 2018-08-02 22:41 - 000568600 _____ (Microsoft Corporation) C:\WINDOWS\system32\tcblaunch.exe
2018-08-14 15:04 - 2018-08-02 22:41 - 000077608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hvservice.sys
2018-08-14 15:04 - 2018-08-02 22:41 - 000061736 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvhostsvc.dll
2018-08-14 15:04 - 2018-08-02 22:40 - 001221048 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2018-08-14 15:04 - 2018-08-02 22:40 - 001064744 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
2018-08-14 15:04 - 2018-08-02 22:40 - 001030952 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2018-08-14 15:04 - 2018-08-02 22:40 - 000566568 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
2018-08-14 15:04 - 2018-08-02 22:40 - 000228136 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Ucx01000.sys
2018-08-14 15:04 - 2018-08-02 22:40 - 000136488 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.dll
2018-08-14 15:04 - 2018-08-02 22:40 - 000072800 _____ (Microsoft Corporation) C:\WINDOWS\system32\wldp.dll
2018-08-14 15:04 - 2018-08-02 22:39 - 002829216 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2018-08-14 15:04 - 2018-08-02 22:39 - 001457136 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2018-08-14 15:04 - 2018-08-02 22:39 - 000709824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2018-08-14 15:04 - 2018-08-02 22:39 - 000692240 _____ (Microsoft Corporation) C:\WINDOWS\system32\StructuredQuery.dll
2018-08-14 15:04 - 2018-08-02 22:39 - 000170936 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2018-08-14 15:04 - 2018-08-02 22:39 - 000114080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vmbus.sys
2018-08-14 15:04 - 2018-08-02 22:39 - 000075160 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vpci.sys
2018-08-14 15:04 - 2018-08-02 22:39 - 000031648 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\winhv.sys
2018-08-14 15:04 - 2018-08-02 22:38 - 002765440 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2018-08-14 15:04 - 2018-08-02 22:38 - 001945792 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2018-08-14 15:04 - 2018-08-02 22:38 - 001285536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys
2018-08-14 15:04 - 2018-08-02 22:38 - 001258288 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2018-08-14 15:04 - 2018-08-02 22:38 - 001140576 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2018-08-14 15:04 - 2018-08-02 22:38 - 001097648 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvproc.dll
2018-08-14 15:04 - 2018-08-02 22:38 - 000983016 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2018-08-14 15:04 - 2018-08-02 22:38 - 000885856 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
2018-08-14 15:04 - 2018-08-02 22:38 - 000713368 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVideoDSP.dll
2018-08-14 15:04 - 2018-08-02 22:38 - 000604576 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe
2018-08-14 15:04 - 2018-08-02 22:38 - 000158720 _____ (Microsoft Corporation) C:\WINDOWS\system32\vertdll.dll
2018-08-14 15:04 - 2018-08-02 22:38 - 000115640 _____ (Microsoft Corporation) C:\WINDOWS\system32\kdnet.dll
2018-08-14 15:04 - 2018-08-02 22:27 - 000061032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wldp.dll
2018-08-14 15:04 - 2018-08-02 22:25 - 002255008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2018-08-14 15:04 - 2018-08-02 22:25 - 001622296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2018-08-14 15:04 - 2018-08-02 22:25 - 001131064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvproc.dll
2018-08-14 15:04 - 2018-08-02 22:25 - 000583120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVideoDSP.dll
2018-08-14 15:04 - 2018-08-02 22:25 - 000568568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll
2018-08-14 15:04 - 2018-08-02 22:25 - 000539168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StructuredQuery.dll
2018-08-14 15:04 - 2018-08-02 22:17 - 000010240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vmgid.sys
2018-08-14 15:04 - 2018-08-02 22:16 - 000144384 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssprxy.dll
2018-08-14 15:04 - 2018-08-02 22:16 - 000018432 _____ (Microsoft Corporation) C:\WINDOWS\system32\winshfhc.dll
2018-08-14 15:04 - 2018-08-02 22:15 - 000068096 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\winhvr.sys
2018-08-14 15:04 - 2018-08-02 22:14 - 000514560 _____ (Microsoft Corporation) C:\WINDOWS\system32\nltest.exe
2018-08-14 15:04 - 2018-08-02 22:14 - 000209408 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXApplicabilityBlob.dll
2018-08-14 15:04 - 2018-08-02 22:14 - 000113664 _____ (Microsoft Corporation) C:\WINDOWS\system32\WaaSAssessment.dll
2018-08-14 15:04 - 2018-08-02 22:13 - 006661632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2018-08-14 15:04 - 2018-08-02 22:13 - 000395776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Search.ProtocolHandler.MAPI2.dll
2018-08-14 15:04 - 2018-08-02 22:13 - 000154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2018-08-14 15:04 - 2018-08-02 22:12 - 000894464 _____ (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll
2018-08-14 15:04 - 2018-08-02 22:12 - 000761344 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll
2018-08-14 15:04 - 2018-08-02 22:12 - 000726528 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2018-08-14 15:04 - 2018-08-02 22:12 - 000311296 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netbt.sys
2018-08-14 15:04 - 2018-08-02 22:11 - 003712000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2018-08-14 15:04 - 2018-08-02 22:11 - 002700288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tquery.dll
2018-08-14 15:04 - 2018-08-02 22:11 - 002172928 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2018-08-14 15:04 - 2018-08-02 22:11 - 001708544 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSPhotography.dll
2018-08-14 15:04 - 2018-08-02 22:11 - 000983040 _____ (Microsoft Corporation) C:\WINDOWS\system32\wbiosrvc.dll
2018-08-14 15:04 - 2018-08-02 22:11 - 000898560 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcWebFilter.dll
2018-08-14 15:04 - 2018-08-02 22:11 - 000808448 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeManager.dll
2018-08-14 15:04 - 2018-08-02 22:10 - 001535488 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2018-08-14 15:04 - 2018-08-02 22:10 - 000015872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winshfhc.dll
2018-08-14 15:04 - 2018-08-02 22:09 - 001932288 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgeangle.dll
2018-08-14 15:04 - 2018-08-02 22:09 - 001854976 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtsvc.dll
2018-08-14 15:04 - 2018-08-02 22:09 - 001550848 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2018-08-14 15:04 - 2018-08-02 22:09 - 001395200 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll
2018-08-14 15:04 - 2018-08-02 22:09 - 001361408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSPhotography.dll
2018-08-14 15:04 - 2018-08-02 22:09 - 001057792 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchIndexer.exe
2018-08-14 15:04 - 2018-08-02 22:09 - 000916480 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll
2018-08-14 15:04 - 2018-08-02 22:08 - 002258944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssrch.dll
2018-08-14 15:04 - 2018-08-02 22:08 - 002236928 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2018-08-14 15:04 - 2018-08-02 22:08 - 000796672 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssvp.dll
2018-08-14 15:04 - 2018-08-02 22:08 - 000776192 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2018-08-14 15:04 - 2018-08-02 22:08 - 000608768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EdgeManager.dll
2018-08-14 15:04 - 2018-08-02 22:08 - 000602112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll
2018-08-14 15:04 - 2018-08-02 22:08 - 000561152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
2018-08-14 15:04 - 2018-08-02 22:08 - 000542208 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2018-08-14 15:04 - 2018-08-02 22:08 - 000406528 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchProtocolHost.exe
2018-08-14 15:04 - 2018-08-02 22:08 - 000331264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgeIso.dll
2018-08-14 15:04 - 2018-08-02 22:08 - 000288768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Search.ProtocolHandler.MAPI2.dll
2018-08-14 15:04 - 2018-08-02 22:07 - 000578560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webplatstorageserver.dll
2018-08-14 15:04 - 2018-08-02 22:07 - 000505344 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgeIso.dll
2018-08-14 15:04 - 2018-08-02 22:07 - 000176640 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssph.dll
2018-08-14 15:04 - 2018-08-02 22:07 - 000115712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll
2018-08-14 15:04 - 2018-08-02 22:06 - 001000448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll
2018-08-14 15:04 - 2018-08-02 22:06 - 000856064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchIndexer.exe
2018-08-14 15:04 - 2018-08-02 22:06 - 000678400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll
2018-08-14 15:04 - 2018-08-02 22:06 - 000619520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WpcWebFilter.dll
2018-08-14 15:04 - 2018-08-02 22:06 - 000251904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msIso.dll
2018-08-14 15:04 - 2018-08-02 22:05 - 000735744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssvp.dll
2018-08-14 15:04 - 2018-08-02 22:05 - 000669696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2018-08-14 15:04 - 2018-08-02 22:05 - 000534016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2018-08-14 15:04 - 2018-08-02 22:04 - 000345088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchProtocolHost.exe
2018-08-14 15:04 - 2018-08-02 20:54 - 000001312 _____ C:\WINDOWS\system32\tcbres.wim
2018-08-14 15:04 - 2018-07-14 19:58 - 000094112 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2018-08-14 15:04 - 2018-07-14 19:56 - 001523240 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2018-08-14 15:04 - 2018-07-14 19:44 - 000064000 _____ (Microsoft Corporation) C:\WINDOWS\system32\iemigplugin.dll
2018-08-14 15:04 - 2018-07-14 19:42 - 008624128 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2018-08-14 15:04 - 2018-07-14 19:41 - 000169984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.XamlHost.dll
2018-08-14 15:04 - 2018-07-14 19:41 - 000075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\ProvSysprep.dll
2018-08-14 15:04 - 2018-07-14 19:39 - 001787392 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_health.dll
2018-08-14 15:04 - 2018-07-14 19:39 - 001605632 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2018-08-14 15:04 - 2018-07-14 19:38 - 002051584 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_fs.dll
2018-08-14 15:04 - 2018-07-14 19:38 - 001180160 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll
2018-08-14 15:04 - 2018-07-14 19:38 - 001004032 _____ (Microsoft Corporation) C:\WINDOWS\system32\clusapi.dll
2018-08-14 15:04 - 2018-07-14 19:38 - 000615936 _____ (Microsoft Corporation) C:\WINDOWS\system32\resutils.dll
2018-08-14 15:04 - 2018-07-14 19:36 - 000091136 _____ (Microsoft Corporation) C:\WINDOWS\system32\mcbuilder.exe
2018-08-14 15:04 - 2018-07-14 18:28 - 001327424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2018-08-14 15:04 - 2018-07-14 18:15 - 007987712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2018-08-14 15:04 - 2018-07-14 18:14 - 000133632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.XamlHost.dll
2018-08-14 15:04 - 2018-07-14 18:13 - 001452544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_fs.dll
2018-08-14 15:04 - 2018-07-14 18:13 - 001308160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_health.dll
2018-08-14 15:04 - 2018-07-14 18:13 - 000775168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\clusapi.dll
2018-08-14 15:04 - 2018-07-14 18:13 - 000485376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\resutils.dll
2018-08-14 15:04 - 2018-07-14 18:11 - 000080384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mcbuilder.exe
2018-08-14 15:04 - 2018-07-13 23:37 - 000375712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pci.sys
2018-08-14 15:04 - 2018-07-13 23:37 - 000230304 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tpm.sys
2018-08-14 15:04 - 2018-07-13 23:23 - 000760888 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecurityHealthService.exe
2018-08-14 15:04 - 2018-07-13 23:22 - 000510392 _____ (Microsoft Corporation) C:\WINDOWS\system32\policymanager.dll
2018-08-14 15:04 - 2018-07-13 23:22 - 000203560 _____ (Microsoft Corporation) C:\WINDOWS\system32\rsaenh.dll
2018-08-14 15:04 - 2018-07-13 23:21 - 000722824 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
2018-08-14 15:04 - 2018-07-13 23:21 - 000192920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\appid.sys
2018-08-14 15:04 - 2018-07-13 23:20 - 000184472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rsaenh.dll
2018-08-14 15:04 - 2018-07-13 23:19 - 002535032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll
2018-08-14 15:04 - 2018-07-13 23:19 - 001946752 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfplat.dll
2018-08-14 15:04 - 2018-07-13 23:19 - 000981920 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll
2018-08-14 15:04 - 2018-07-13 23:19 - 000636944 _____ (Microsoft Corporation) C:\WINDOWS\system32\services.exe
2018-08-14 15:04 - 2018-07-13 23:19 - 000483024 _____ (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase_enclave.dll
2018-08-14 15:04 - 2018-07-13 23:18 - 002563984 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll
2018-08-14 15:04 - 2018-07-13 23:18 - 001017584 _____ (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase.dll
2018-08-14 15:04 - 2018-07-13 23:18 - 000930712 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWAHost.exe
2018-08-14 15:04 - 2018-07-13 23:18 - 000613176 _____ (Microsoft Corporation) C:\WINDOWS\system32\TextInputFramework.dll
2018-08-14 15:04 - 2018-07-13 23:18 - 000443216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\policymanager.dll
2018-08-14 15:04 - 2018-07-13 23:18 - 000376216 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fastfat.sys
2018-08-14 15:04 - 2018-07-13 23:17 - 002420632 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2018-08-14 15:04 - 2018-07-13 23:17 - 000743320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll
2018-08-14 15:04 - 2018-07-13 23:16 - 000506728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TextInputFramework.dll
2018-08-14 15:04 - 2018-07-13 23:15 - 001559368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfplat.dll
2018-08-14 15:04 - 2018-07-13 23:15 - 001174552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ucrtbase.dll
2018-08-14 15:04 - 2018-07-13 23:15 - 000829856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWAHost.exe
2018-08-14 15:04 - 2018-07-13 23:01 - 006647296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingMaps.dll
2018-08-14 15:04 - 2018-07-13 22:59 - 009084928 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingMaps.dll
2018-08-14 15:04 - 2018-07-13 22:59 - 005883392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mos.dll
2018-08-14 15:04 - 2018-07-13 22:59 - 003553280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputService.dll
2018-08-14 15:04 - 2018-07-13 22:58 - 000172544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\enrollmentapi.dll
2018-08-14 15:04 - 2018-07-13 22:58 - 000094720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataTimeUtil.dll
2018-08-14 15:04 - 2018-07-13 22:58 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tzres.dll
2018-08-14 15:04 - 2018-07-13 22:57 - 004331008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
2018-08-14 15:04 - 2018-07-13 22:57 - 001295360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVPXENC.dll
2018-08-14 15:04 - 2018-07-13 22:57 - 000391168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\daxexec.dll
2018-08-14 15:04 - 2018-07-13 22:56 - 004559872 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2018-08-14 15:04 - 2018-07-13 22:56 - 002900992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2018-08-14 15:04 - 2018-07-13 22:56 - 002449408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapRouter.dll
2018-08-14 15:04 - 2018-07-13 22:56 - 001986560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapGeocoder.dll
2018-08-14 15:04 - 2018-07-13 22:56 - 001703936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Controls.dll
2018-08-14 15:04 - 2018-07-13 22:56 - 001558016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpserverbase.dll
2018-08-14 15:04 - 2018-07-13 22:56 - 000392704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapConfiguration.dll
2018-08-14 15:04 - 2018-07-13 22:56 - 000365568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpencom.dll
2018-08-14 15:04 - 2018-07-13 22:56 - 000257536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WiFiDisplay.dll
2018-08-14 15:04 - 2018-07-13 22:56 - 000118784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\raschap.dll
2018-08-14 15:04 - 2018-07-13 22:56 - 000073728 _____ (Microsoft Corporation) C:\WINDOWS\system32\WFDSConMgr.dll
2018-08-14 15:04 - 2018-07-13 22:55 - 001627136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2018-08-14 15:04 - 2018-07-13 22:55 - 001124352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdprt.dll
2018-08-14 15:04 - 2018-07-13 22:55 - 000993792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.Vpn.dll
2018-08-14 15:04 - 2018-07-13 22:55 - 000582144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Core.TextInput.dll
2018-08-14 15:04 - 2018-07-13 22:55 - 000458752 _____ (Microsoft Corporation) C:\WINDOWS\system32\cloudAP.dll
2018-08-14 15:04 - 2018-07-13 22:55 - 000414720 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cldflt.sys
2018-08-14 15:04 - 2018-07-13 22:55 - 000344576 _____ (Microsoft Corporation) C:\WINDOWS\system32\RasMediaManager.dll
2018-08-14 15:04 - 2018-07-13 22:55 - 000317440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dhcpcore.dll
2018-08-14 15:04 - 2018-07-13 22:55 - 000282624 _____ (Microsoft Corporation) C:\WINDOWS\system32\provops.dll
2018-08-14 15:04 - 2018-07-13 22:55 - 000227840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\winnat.sys
2018-08-14 15:04 - 2018-07-13 22:55 - 000208384 _____ (Microsoft Corporation) C:\WINDOWS\system32\provisioningcsp.dll
2018-08-14 15:04 - 2018-07-13 22:55 - 000205312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OneCoreCommonProxyStub.dll
2018-08-14 15:04 - 2018-07-13 22:55 - 000204288 _____ (Microsoft Corporation) C:\WINDOWS\system32\enrollmentapi.dll
2018-08-14 15:04 - 2018-07-13 22:55 - 000185856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mdmregistration.dll
2018-08-14 15:04 - 2018-07-13 22:55 - 000147456 _____ (Microsoft Corporation) C:\WINDOWS\system32\datamarketsvc.dll
2018-08-14 15:04 - 2018-07-13 22:55 - 000119296 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataTimeUtil.dll
2018-08-14 15:04 - 2018-07-13 22:55 - 000062976 _____ (Microsoft Corporation) C:\WINDOWS\system32\EASPolicyManagerBrokerHost.exe
2018-08-14 15:04 - 2018-07-13 22:55 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\system32\tzres.dll
2018-08-14 15:04 - 2018-07-13 22:54 - 003319808 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2018-08-14 15:04 - 2018-07-13 22:54 - 002825728 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapGeocoder.dll
2018-08-14 15:04 - 2018-07-13 22:54 - 001627136 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll
2018-08-14 15:04 - 2018-07-13 22:54 - 001537024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ActiveSyncProvider.dll
2018-08-14 15:04 - 2018-07-13 22:54 - 001307648 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVPXENC.dll
2018-08-14 15:04 - 2018-07-13 22:54 - 000898560 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll
2018-08-14 15:04 - 2018-07-13 22:54 - 000729088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NMAA.dll
2018-08-14 15:04 - 2018-07-13 22:54 - 000603648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PCPKsp.dll
2018-08-14 15:04 - 2018-07-13 22:54 - 000530432 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapConfiguration.dll
2018-08-14 15:04 - 2018-07-13 22:54 - 000444416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dmenrollengine.dll
2018-08-14 15:04 - 2018-07-13 22:54 - 000409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpencom.dll
2018-08-14 15:04 - 2018-07-13 22:54 - 000392192 _____ (Microsoft Corporation) C:\WINDOWS\system32\provengine.dll
2018-08-14 15:04 - 2018-07-13 22:54 - 000358400 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\exfat.sys
2018-08-14 15:04 - 2018-07-13 22:54 - 000352768 _____ (Microsoft Corporation) C:\WINDOWS\system32\dhcpcore.dll
2018-08-14 15:04 - 2018-07-13 22:54 - 000262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\PushToInstall.dll
2018-08-14 15:04 - 2018-07-13 22:54 - 000137728 _____ (Microsoft Corporation) C:\WINDOWS\system32\raschap.dll
2018-08-14 15:04 - 2018-07-13 22:54 - 000014336 _____ (Microsoft Corporation) C:\WINDOWS\system32\EasPolicyManagerBrokerPS.dll
2018-08-14 15:04 - 2018-07-13 22:53 - 004770816 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputService.dll
2018-08-14 15:04 - 2018-07-13 22:53 - 003381248 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapRouter.dll
2018-08-14 15:04 - 2018-07-13 22:53 - 002368512 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebRuntimeManager.dll
2018-08-14 15:04 - 2018-07-13 22:53 - 001668096 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdprt.dll
2018-08-14 15:04 - 2018-07-13 22:53 - 000713216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingOnlineServices.dll
2018-08-14 15:04 - 2018-07-13 22:53 - 000705024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapControlCore.dll
2018-08-14 15:04 - 2018-07-13 22:53 - 000681984 _____ (Microsoft Corporation) C:\WINDOWS\system32\WFDSConMgrSvc.dll
2018-08-14 15:04 - 2018-07-13 22:53 - 000566272 _____ (Microsoft Corporation) C:\WINDOWS\system32\daxexec.dll
2018-08-14 15:04 - 2018-07-13 22:53 - 000450560 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneCoreCommonProxyStub.dll
2018-08-14 15:04 - 2018-07-13 22:53 - 000396800 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll
2018-08-14 15:04 - 2018-07-13 22:53 - 000220160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmregistration.dll
2018-08-14 15:04 - 2018-07-13 22:52 - 000972800 _____ (Microsoft Corporation) C:\WINDOWS\system32\sysmain.dll
2018-08-14 15:04 - 2018-07-13 22:52 - 000790528 _____ (Microsoft Corporation) C:\WINDOWS\system32\PCPKsp.dll
2018-08-14 15:04 - 2018-07-13 22:52 - 000755712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Core.TextInput.dll
2018-08-14 15:04 - 2018-07-13 22:52 - 000506880 _____ (Microsoft Corporation) C:\WINDOWS\system32\netprofmsvc.dll
2018-08-14 15:04 - 2018-07-13 22:52 - 000311296 _____ (Microsoft Corporation) C:\WINDOWS\system32\WiFiDisplay.dll
2018-08-14 15:04 - 2018-07-13 22:51 - 002904576 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2018-08-14 15:04 - 2018-07-13 22:51 - 001804288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2018-08-14 15:04 - 2018-07-13 22:51 - 001747968 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpserverbase.dll
2018-08-14 15:04 - 2018-07-13 22:51 - 001304064 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.Vpn.dll
2018-08-14 15:04 - 2018-07-13 22:51 - 000491520 _____ (Microsoft Corporation) C:\WINDOWS\system32\defragsvc.dll
2018-08-14 15:04 - 2018-07-13 22:51 - 000466432 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll
2018-08-14 15:04 - 2018-07-13 22:50 - 001773056 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActiveSyncProvider.dll
2018-08-14 15:04 - 2018-07-13 22:50 - 001457664 _____ (Microsoft Corporation) C:\WINDOWS\system32\dosvc.dll
2018-08-14 15:04 - 2018-07-13 22:50 - 001359360 _____ (Microsoft Corporation) C:\WINDOWS\system32\lpasvc.dll
2018-08-14 15:04 - 2018-07-13 22:50 - 001225216 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsStore.dll
2018-08-14 15:04 - 2018-07-13 22:50 - 000949760 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmsvc.dll
2018-08-14 15:04 - 2018-07-13 22:50 - 000943616 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingOnlineServices.dll
2018-08-14 15:04 - 2018-07-13 22:50 - 000932352 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasmans.dll
2018-08-14 15:04 - 2018-07-13 22:50 - 000884224 _____ (Microsoft Corporation) C:\WINDOWS\system32\NMAA.dll
2018-08-14 15:04 - 2018-07-13 22:50 - 000522752 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmenrollengine.dll
2018-08-14 15:04 - 2018-07-13 22:50 - 000401920 _____ (Microsoft Corporation) C:\WINDOWS\system32\rascustom.dll
2018-08-14 15:04 - 2018-07-13 22:49 - 001069568 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthport.sys
2018-08-14 15:04 - 2018-07-13 22:49 - 000884736 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapControlCore.dll
2018-08-14 15:04 - 2018-07-12 23:30 - 002718624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2018-08-14 12:30 - 2018-08-14 12:30 - 000180917 _____ C:\Users\wadef\Desktop\Gmail - Purchase Confirmation from Lens.com.pdf
2018-08-14 12:27 - 2018-08-14 12:27 - 000180917 _____ C:\Users\wadef\Desktop\Purchase Confirmation from Lens.pdf.com
2018-08-14 09:06 - 2018-08-14 09:06 - 018764596 _____ C:\Users\wadef\Downloads\PRED Magazine (2).pdf
2018-08-14 08:02 - 2018-08-14 08:02 - 000110872 _____ C:\Users\wadef\Downloads\201808012016001714.pdf
2018-08-14 08:02 - 2018-08-14 08:02 - 000110872 _____ C:\Users\wadef\Downloads\201808012016001714 (1).pdf
2018-08-13 11:43 - 2018-08-13 11:43 - 000001759 _____ C:\Users\wadef\Downloads\Single Line (13).csv
2018-08-13 09:20 - 2018-08-13 09:20 - 000409772 _____ C:\Users\wadef\Desktop\repairs needed.pdf
2018-08-12 17:15 - 2018-08-12 17:15 - 000002044 _____ C:\Users\wadef\Downloads\Single Line (12).csv
2018-08-12 09:24 - 2018-08-13 08:45 - 000010926 _____ C:\Users\wadef\Desktop\odom list.xlsx
2018-08-10 11:37 - 2018-08-10 11:37 - 000003475 _____ C:\Users\wadef\Downloads\Kimberly_Barnes.vcf
2018-08-10 11:37 - 2018-08-10 11:37 - 000003475 _____ C:\Users\wadef\Downloads\Kimberly_Barnes (1).vcf
2018-08-10 11:29 - 2018-08-10 11:29 - 000003161 _____ C:\Users\wadef\Downloads\Ocie_Vest.vcf
2018-08-09 14:29 - 2018-08-09 14:29 - 000428961 _____ C:\Users\wadef\Downloads\2018.07.24_Kopecky ±526 acres_WCAD Parcels.pdf
2018-08-09 14:29 - 2018-08-09 14:29 - 000132446 _____ C:\Users\wadef\Downloads\2018.07.24_Kopecky±526ac_GT Water Liines.pdf
2018-08-08 10:57 - 2018-08-08 10:57 - 001150101 _____ C:\Users\wadef\Downloads\BooneHeep Landuse.PDF
2018-08-08 10:57 - 2018-08-08 10:57 - 000271399 _____ C:\Users\wadef\Downloads\BOON-HEEP 11x17 60ac (2).pdf
2018-08-07 14:32 - 2018-08-07 14:34 - 011589088 _____ C:\Users\wadef\Downloads\jpegmini_optimized.zip
2018-08-07 09:44 - 2018-08-07 09:44 - 001460503 _____ C:\Users\wadef\Downloads\4110.txt
2018-08-04 19:32 - 2018-08-04 19:32 - 002009339 _____ C:\Users\wadef\Downloads\eye prescriptions-receipts.pdf
2018-08-04 19:30 - 2018-08-04 19:30 - 000336898 _____ C:\Users\wadef\Desktop\kennedy exam receipt.pdf
2018-08-04 19:29 - 2018-08-04 19:29 - 000569199 _____ C:\Users\wadef\Desktop\kennedy-prescriptions.pdf
2018-08-04 19:28 - 2018-08-04 19:28 - 000337068 _____ C:\Users\wadef\Desktop\kylie exam receipt.pdf
2018-08-04 19:27 - 2018-08-04 19:27 - 000578467 _____ C:\Users\wadef\Desktop\kylie-prescriptions.pdf
2018-08-04 19:18 - 2018-08-04 19:18 - 000192512 _____ C:\Users\wadef\Desktop\glasses receipt.pdf
2018-08-01 07:36 - 2018-08-01 07:37 - 000069891 _____ C:\Users\wadef\Downloads\Re-sending.zip
2018-07-31 21:13 - 2018-07-31 21:13 - 007026497 _____ C:\Users\wadef\Downloads\BL-A (2).pdf
2018-07-31 21:12 - 2018-07-31 21:13 - 007026497 _____ C:\Users\wadef\Downloads\BL-A (1).pdf
2018-07-31 21:04 - 2018-07-31 21:04 - 007069924 _____ C:\Users\wadef\Downloads\Please_Sign__Qualifying_Experience_Doc.pdf
2018-07-31 10:31 - 2018-07-31 10:31 - 000001977 _____ C:\Users\wadef\Downloads\lakeline ranch.csv
2018-07-30 12:39 - 2018-07-30 12:39 - 000000000 ____D C:\Users\wadef\AppData\Local\D3DSCache
2018-07-28 16:13 - 2018-07-28 16:13 - 000054203 _____ C:\Users\wadef\Downloads\Amendment_1__11215_ts06369.pdf
2018-07-27 13:20 - 2018-07-27 13:20 - 000088625 _____ C:\Users\wadef\Downloads\Amendment #1 rev 2.pdf
2018-07-27 07:36 - 2018-07-27 07:36 - 000088777 _____ C:\Users\wadef\Downloads\Amendment #1.pdf
2018-07-26 19:32 - 2018-07-26 19:32 - 000118958 _____ C:\Users\wadef\Downloads\LDV Letter for Application.pdf
2018-07-26 19:27 - 2018-07-26 19:27 - 001827604 _____ C:\Users\wadef\Downloads\RenderedImage.JPEG
2018-07-26 19:26 - 2018-07-26 19:27 - 014856519 _____ C:\Users\wadef\Downloads\512419-072618.pdf
2018-07-26 09:22 - 2018-07-26 09:22 - 003570840 _____ C:\Users\wadef\Downloads\7897007 (1).pdf
2018-07-26 09:21 - 2018-07-26 09:21 - 003570840 _____ C:\Users\wadef\Downloads\7897007.pdf
2018-07-24 14:50 - 2018-07-24 14:51 - 005199855 _____ C:\Users\wadef\Downloads\1532461858.pdf
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2018-08-23 13:51 - 2018-05-29 08:11 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2018-08-23 10:24 - 2018-04-11 18:38 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2018-08-23 08:26 - 2018-05-29 09:06 - 000004142 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{B752F558-C61C-4A06-9A97-C0C4B6B85EDC}
2018-08-22 13:04 - 2018-04-11 18:38 - 000000000 ____D C:\WINDOWS\AppReadiness
2018-08-21 08:33 - 2018-04-11 18:38 - 000000000 ___HD C:\Program Files\WindowsApps
2018-08-20 18:05 - 2018-05-29 14:14 - 000000000 ____D C:\Users\wadef\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Coolmuster
2018-08-20 18:05 - 2018-05-29 14:14 - 000000000 ____D C:\Program Files (x86)\Coolmuster
2018-08-20 18:05 - 2018-03-24 18:04 - 000000000 ____D C:\Users\wadef\AppData\Local\Packages
2018-08-16 13:48 - 2018-03-26 10:12 - 000002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2018-08-15 20:28 - 2018-05-29 08:42 - 000793700 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2018-08-15 20:28 - 2018-04-11 18:36 - 000000000 ____D C:\WINDOWS\INF
2018-08-15 20:25 - 2018-03-24 18:53 - 000000000 ___RD C:\Users\wadef\Google Drive
2018-08-15 20:21 - 2018-05-29 09:06 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2018-08-15 20:21 - 2018-03-24 18:04 - 000000000 __SHD C:\Users\wadef\IntelGraphicsProfiles
2018-08-15 20:20 - 2018-04-11 16:04 - 000524288 _____ C:\WINDOWS\system32\config\BBI
2018-08-14 23:13 - 2018-03-24 18:04 - 000000000 ___RD C:\Users\wadef\3D Objects
2018-08-14 23:13 - 2017-10-03 11:48 - 000000000 __RHD C:\Users\Public\AccountPictures
2018-08-14 23:12 - 2018-05-29 08:11 - 000242128 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2018-08-14 23:11 - 2018-05-29 08:29 - 000000000 ____D C:\Users\wadef
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\SysWOW64\zu-ZA
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\SysWOW64\yo-NG
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\SysWOW64\xh-ZA
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\SysWOW64\wo-SN
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\SysWOW64\uz-Latn-UZ
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\SysWOW64\tn-ZA
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\SysWOW64\ti-ET
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\SysWOW64\tg-Cyrl-TJ
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\SysWOW64\sr-Cyrl-RS
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\SysWOW64\sr-Cyrl-BA
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\SysWOW64\sd-Arab-PK
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\SysWOW64\rw-RW
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\SysWOW64\quc-Latn-GT
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\SysWOW64\pa-Arab-PK
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\SysWOW64\nso-ZA
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\SysWOW64\ku-Arab-IQ
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\SysWOW64\ig-NG
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\SysWOW64\ha-Latn-NG
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\SysWOW64\chr-CHER-US
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\SysWOW64\ca-ES-valencia
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\SysWOW64\bs-Latn-BA
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\SysWOW64\az-Latn-AZ
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\system32\zu-ZA
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\system32\yo-NG
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\system32\xh-ZA
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\system32\wo-SN
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\system32\uz-Latn-UZ
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\system32\tn-ZA
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\system32\ti-ET
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\system32\tg-Cyrl-TJ
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\system32\sr-Cyrl-RS
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\system32\sr-Cyrl-BA
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\system32\sd-Arab-PK
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\system32\rw-RW
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\system32\quc-Latn-GT
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\system32\pa-Arab-PK
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\system32\nso-ZA
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\system32\ku-Arab-IQ
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\system32\ig-NG
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\system32\ha-Latn-NG
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\system32\chr-CHER-US
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\system32\ca-ES-valencia
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\system32\bs-Latn-BA
2018-08-14 23:10 - 2018-04-12 04:19 - 000000000 ____D C:\WINDOWS\system32\az-Latn-AZ
2018-08-14 23:10 - 2018-04-11 18:38 - 000000000 ___SD C:\WINDOWS\SysWOW64\F12
2018-08-14 23:10 - 2018-04-11 18:38 - 000000000 ___SD C:\WINDOWS\system32\UNP
2018-08-14 23:10 - 2018-04-11 18:38 - 000000000 ___SD C:\WINDOWS\system32\F12
2018-08-14 23:10 - 2018-04-11 18:38 - 000000000 ___SD C:\WINDOWS\system32\DiagSvcs
2018-08-14 23:10 - 2018-04-11 18:38 - 000000000 ___RD C:\WINDOWS\PrintDialog
2018-08-14 23:10 - 2018-04-11 18:38 - 000000000 ___RD C:\Program Files\Windows Defender
2018-08-14 23:10 - 2018-04-11 18:38 - 000000000 ____D C:\WINDOWS\TextInput
2018-08-14 23:10 - 2018-04-11 18:38 - 000000000 ____D C:\WINDOWS\system32\ShellExperiences
2018-08-14 23:10 - 2018-04-11 18:38 - 000000000 ____D C:\WINDOWS\ShellExperiences
2018-08-14 23:10 - 2018-04-11 18:38 - 000000000 ____D C:\WINDOWS\bcastdvr
2018-08-14 23:10 - 2018-04-11 18:38 - 000000000 ____D C:\Program Files (x86)\Windows Defender
2018-08-14 15:18 - 2018-03-24 20:05 - 000000000 ____D C:\WINDOWS\system32\MRT
2018-08-14 15:15 - 2018-04-11 18:30 - 000000000 ____D C:\WINDOWS\CbsTemp
2018-08-14 15:15 - 2018-03-24 20:02 - 137343192 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2018-08-08 16:02 - 2018-03-24 18:09 - 000002308 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2018-08-08 16:02 - 2018-03-24 18:09 - 000002267 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2018-08-06 10:19 - 2018-04-11 18:41 - 000836480 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2018-08-06 10:19 - 2018-04-11 18:41 - 000181120 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2018-05-29 08:11
==================== End of FRST.txt ============================
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 23.08.2018
Ran by wadef (23-08-2018 14:06:36)
Running from C:\Users\wadef\Downloads
Windows 10 Home Version 1803 17134.228 (X64) (2018-05-29 14:08:52)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-772274138-2366416172-2937497999-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-772274138-2366416172-2937497999-503 - Limited - Disabled)
Guest (S-1-5-21-772274138-2366416172-2937497999-501 - Limited - Disabled)
wadef (S-1-5-21-772274138-2366416172-2937497999-1001 - Administrator - Enabled) => C:\Users\wadef
WDAGUtilityAccount (S-1-5-21-772274138-2366416172-2937497999-504 - Limited - Disabled)
WTFScan (S-1-5-21-772274138-2366416172-2937497999-1003 - Administrator - Enabled)
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Malwarebytes (Disabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}
AS: Malwarebytes (Disabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 18.011.20058 - Adobe Systems Incorporated)
Apple Application Support (32-bit) (HKLM-x32\...\{543F829B-4591-4B2F-AF63-6E6E6AE59EB2}) (Version: 6.4 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{0ECA3BB5-4410-414B-B226-241FF1C12CD0}) (Version: 6.4 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{9E005AAA-81A3-478E-8944-532D350952EE}) (Version: 11.3.1.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{A30EA700-5515-48F0-88B0-9E99DC356B88}) (Version: 2.6.0.1 - Apple Inc.)
Backup and Sync from Google (HKLM\...\{AEFBDB5B-899F-4AE6-B789-BA56A652A476}) (Version: 3.42.9858.3671 - Google, Inc.)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
Dolby Audio X2 Windows API SDK (HKLM\...\{F994125B-7BF5-4A38-A569-82833CEB24DC}) (Version: 0.8.4.83 - Dolby Laboratories, Inc.)
Dolby Audio X2 Windows APP (HKLM\...\{9207D68E-666A-49C7-A900-9F5B2FF289E4}) (Version: 0.8.0.71 - Dolby Laboratories, Inc.)
EaseUS MobiMover 3.0 (HKLM-x32\...\EaseUS MobiMover_is1) (Version: - EaseUS)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 68.0.3440.106 - Google Inc.)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.17 - Google Inc.) Hidden
HP ePrint SW (HKLM-x32\...\{cdb5f70f-5107-4613-bf69-15de903b5b5d}) (Version: 5.5.22560 - HP Inc.)
Intel® Chipset Device Software (HKLM-x32\...\{17408817-d415-4768-a160-ae6d46d6bdb0}) (Version: 10.1.1.44 - Intel® Corporation) Hidden
Intel® Trusted Execution Engine (HKLM\...\{176E2755-0A17-42C6-88E2-192AB2131278}) (Version: 3.0.11.1131 - Intel Corporation)
iTunes (HKLM\...\{3D8C6B05-FE24-4B9C-A57C-B8E1FA39E83D}) (Version: 12.7.4.80 - Apple Inc.)
Malwarebytes version 3.5.1.2522 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.5.1.2522 - Malwarebytes)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Plumbytes Anti-Malware 2018 (HKLM\...\Plumbytes Anti-Malware 2018) (Version: - Plumbytes Software)
Vulkan Run Time Libraries 1.0.54.1 (HKLM\...\VulkanRT1.0.54.1) (Version: 1.0.54.1 - Intel Corporation Inc.) Hidden
Vulkan Run Time Libraries 1.0.54.1 (HKLM\...\VulkanRT1.0.54.1-2) (Version: 1.0.54.1 - Intel Corporation Inc.)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-772274138-2366416172-2937497999-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08212018071438630_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32 -> C:\Users\wadef\AppData\Local\Microsoft\OneDrive\18.025.0204.0009\amd64\FileSyncShell64.dll => No File
CustomCLSID: HKU\S-1-5-21-772274138-2366416172-2937497999-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08212018071438630_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 -> C:\Users\wadef\AppData\Local\Microsoft\OneDrive\18.025.0204.0009\amd64\FileSyncShell64.dll => No File
CustomCLSID: HKU\S-1-5-21-772274138-2366416172-2937497999-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08212018071438630_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32 -> C:\Users\wadef\AppData\Local\Microsoft\OneDrive\18.025.0204.0009\amd64\FileSyncShell64.dll => No File
CustomCLSID: HKU\S-1-5-21-772274138-2366416172-2937497999-1001_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32 -> C:\Users\wadef\AppData\Local\Microsoft\OneDrive\18.025.0204.0009\amd64\FileSyncShell64.dll => No File
CustomCLSID: HKU\S-1-5-21-772274138-2366416172-2937497999-1001_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 -> C:\Users\wadef\AppData\Local\Microsoft\OneDrive\18.025.0204.0009\amd64\FileSyncShell64.dll => No File
CustomCLSID: HKU\S-1-5-21-772274138-2366416172-2937497999-1001_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32 -> C:\Users\wadef\AppData\Local\Microsoft\OneDrive\18.025.0204.0009\amd64\FileSyncShell64.dll => No File
ShellIconOverlayIdentifiers: [ GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files\Google\Drive\googledrivesync64.dll [2018-05-30] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files\Google\Drive\googledrivesync64.dll [2018-05-30] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files\Google\Drive\googledrivesync64.dll [2018-05-30] (Google)
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => -> No File
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => -> No File
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => -> No File
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => -> No File
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => -> No File
ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => -> No File
ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => -> No File
ContextMenuHandlers1: [GDContextMenu] -> {BB02B294-8425-42E5-983F-41A1FA970CD6} => C:\Program Files\Google\Drive\contextmenu64.dll [2018-05-30] (Google)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-05-09] (Malwarebytes)
ContextMenuHandlers4: [GDContextMenu] -> {BB02B294-8425-42E5-983F-41A1FA970CD6} => C:\Program Files\Google\Drive\contextmenu64.dll [2018-05-30] (Google)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\System32\DriverStore\FileRepository\igdlh64.inf_amd64_5f27f588e5eaa413\igfxDTCM.dll [2017-11-06] (Intel Corporation)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-05-09] (Malwarebytes)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {0E0D7AA0-B4EF-474E-AEC2-05B57AE9E0A5} - System32\Tasks\RTKCPL => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2017-08-30] (Realtek Semiconductor)
Task: {12FEDDD9-305C-45A3-BB9A-707FD7E9BAE9} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2018-03-24] (Google Inc.)
Task: {23E7A971-068D-403E-B6FE-9DDE17D2FE59} - System32\Tasks\OneDrive Standalone Update Task v2 => C:\Users\wadef\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
Task: {2C4C8E14-B941-4ED6-AED3-E5E41F23771B} - System32\Tasks\Lenovo\ImController\TimeBasedEvents\c433916b-2cef-4449-935b-d29d7b6a695c => C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe [2018-05-16] (Lenovo Group Limited)
Task: {3627C747-4093-416B-B881-53CC7F1ED38A} - System32\Tasks\Lenovo\LenovoWelcomeTask => C:\ProgramData\Lenovo\ImController\Plugins\LenovoFirstRunExperiencePackage\x86\LenovoWelcomeTask.exe
Task: {463450ED-F251-45E4-A061-E7C367912197} - System32\Tasks\LenovoUtility Task => C:\Windows\explorer.exe lenovo-utility://
Task: {560FAD84-D6FD-4546-A7BB-66BE339F5E0D} - System32\Tasks\HPEA3JOBS => C:\Program [Argument = Files\HP\HP ePrint\hpeprint.exe /CheckJobs]
Task: {62E0D6A1-E132-4842-945E-F38723B39D9B} - System32\Tasks\Lenovo\ImController\Lenovo iM Controller Monitor => C:\WINDOWS\system32\ImController.InfInstaller.exe [2018-05-16] (Lenovo Group Limited)
Task: {65B85F6F-35B3-4459-A179-28255D5B7B25} - System32\Tasks\Microsoft\Windows\HelloFace\FODCleanupTask => C:\WINDOWS\System32\WinBioPlugIns\FaceFodUninstaller.exe [2018-04-11] ()
Task: {8053AC8C-6D2C-4872-813C-4AED2FA455EF} - System32\Tasks\Lenovo\ImController\Lenovo iM Controller Scheduled Maintenance => %windir%\system32\sc.exe START ImControllerService
Task: {88AA02AE-2EC4-4C15-B5AE-374ED51198F3} - System32\Tasks\Intel PTT EK Recertification => C:\Program Files\Intel\TXE Components\iCLS\IntelPTTEKRecertification.exe [2016-05-23] (Intel® Corporation)
Task: {8E78D94E-5AF8-4330-B71A-08E44F60997C} - System32\Tasks\Lenovo\ImController\Plugins\LenovoSystemUpdatePlugin_WeeklyTask => %windir%\System32\reg.exe add hklm\SOFTWARE\Lenovo\SystemUpdatePlugin\scheduler /v start /t reg_dword /d 1 /f /reg:32
Task: {A5914932-6F2E-4CFF-BB71-12FCA587D6C5} - System32\Tasks\RtHDVBg_Dolby => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2017-08-30] (Realtek Semiconductor)
Task: {B3FE5F18-6388-444D-96EA-DE7E55CAF249} - System32\Tasks\RtHDVBg_LENOVO_DOLBYDRAGON => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2017-08-30] (Realtek Semiconductor)
Task: {B5D05395-2D9F-4EE7-8BD9-F9F89CF388A6} - System32\Tasks\Lenovo\ImController\TimeBasedEvents\55d45f1d-9693-4b13-a80f-4da7fb7c7849 => C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe [2018-05-16] (Lenovo Group Limited)
Task: {C625F3F0-9CF4-4522-8DC6-552D9AD3BBAE} - System32\Tasks\Microsoft\Windows\Setup\Notifier => C:\WINDOWS\system32\Notifier.exe
Task: {DC559BB9-C14A-4B91-B5F2-DFCE680E263C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2018-03-24] (Google Inc.)
Task: {DD9A248E-E8A4-442B-B0DF-FB0C3353AF20} - System32\Tasks\Lenovo\ImController\TimeBasedEvents\b0472e66-c2ad-46a4-bf62-61872d0016d1 => C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe [2018-05-16] (Lenovo Group Limited)
Task: {F8CA2EA1-D1C1-43AE-ACCB-4425A158CEE0} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2018-03-21] (Adobe Systems Incorporated)
Task: {F8EB8B76-B7C5-4491-9703-1E53240E3A9F} - System32\Tasks\Lenovo\ImController\TimeBasedEvents\633bf97c-9c41-443b-ab4f-7fee5f6d94e0 => C:\Program Files\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe [2018-05-16] (Lenovo Group Limited)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
==================== Shortcuts & WMI ========================
(The entries could be listed to be restored or removed.)
==================== Loaded Modules (Whitelisted) ==============
2018-03-16 15:19 - 2018-03-16 15:19 - 000088888 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2018-03-16 15:19 - 2018-03-16 15:19 - 001356088 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2018-04-11 18:34 - 2018-04-11 18:34 - 000491744 _____ () C:\WINDOWS\SYSTEM32\inputhost.dll
2018-04-11 18:34 - 2018-04-11 18:34 - 000472064 _____ () C:\Windows\ShellExperiences\TileControl.dll
2018-04-11 18:34 - 2018-04-11 18:34 - 002759168 _____ () C:\Windows\ShellComponents\TaskFlowUI.dll
2018-08-14 15:04 - 2018-08-02 22:09 - 002185728 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2018-04-08 08:04 - 2018-04-08 08:04 - 000088888 _____ () C:\Program Files\iTunes\zlib1.dll
2018-04-08 08:04 - 2018-04-08 08:04 - 001356088 _____ () C:\Program Files\iTunes\libxml2.dll
2018-05-30 11:03 - 2018-05-30 11:03 - 046281248 _____ () C:\Program Files\Google\Drive\googledrivesync.exe
2018-08-15 20:22 - 2018-08-15 20:22 - 000113152 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\_ctypes.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 000080896 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\bz2.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 001585152 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\_hashlib.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 000128512 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\win32api.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 000137728 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\pywintypes27.dll
2018-08-15 20:22 - 2018-08-15 20:22 - 000548864 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\pythoncom27.dll
2018-08-15 20:22 - 2018-08-15 20:22 - 000689664 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\unicodedata.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 000438784 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\win32com.shell.shell.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 001489408 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\wx._core_.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 001007104 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\wx._gdi_.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 001039872 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\wx._windows_.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 001325056 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\wx._controls_.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 000916992 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\wx._misc_.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 001084416 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\pysqlite2._sqlite.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 000149504 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\win32file.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 000136192 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\win32security.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 000007680 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\hashobjs_ext.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 000020992 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\thumbnails_ext.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 000118784 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\usb_ext.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 000047616 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\_socket.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 002224640 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\_ssl.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 000014848 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\common.time34.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 000023040 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\win32event.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 000034304 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\windows.conditional.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 000020480 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\windows.winwrap.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 000110080 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\windows.volumes.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 000223232 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\win32gui.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 000173568 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\_elementtree.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 000169472 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\pyexpat.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 000048128 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\win32inet.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 000103424 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\wx._html2.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 000046080 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\_psutil_windows.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 000633272 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\windows._cacheinvalidation.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 000011776 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\win32crypt.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 000301568 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\PIL._imaging.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 000032256 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\_multiprocessing.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 005458944 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\cello.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 000026112 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\_yappi.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 000044032 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\win32process.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 000027648 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\win32pipe.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 000010752 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\select.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 000029696 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\win32pdh.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 000038400 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\windows.connectivity.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 000073216 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\windows.device_monitor.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 000020480 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\win32profile.pyd
2018-08-15 20:22 - 2018-08-15 20:22 - 000026624 ____N () C:\Users\wadef\AppData\Local\Temp\_MEI98522\win32ts.pyd
2018-08-08 16:02 - 2018-08-07 19:41 - 002682200 _____ () C:\Program Files (x86)\Google\Chrome\Application\68.0.3440.106\swiftshader\libglesv2.dll
2018-08-08 16:02 - 2018-08-07 19:41 - 000148824 _____ () C:\Program Files (x86)\Google\Chrome\Application\68.0.3440.106\swiftshader\libegl.dll
2018-08-21 08:32 - 2018-08-21 08:32 - 004255232 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1807.2121.0_x64__8wekyb3d8bbwe\Calculator.exe
2018-08-21 08:32 - 2018-08-21 08:32 - 004445248 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1807.2121.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll
2018-05-03 09:20 - 2018-05-03 09:20 - 000634880 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1807.2121.0_x64__8wekyb3d8bbwe\RuntimeConfiguration.dll
2018-08-21 08:26 - 2018-08-21 08:28 - 001399992 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.10325.20117.0_x64__8wekyb3d8bbwe\Office.UI.Xaml.Word.dll
2018-07-18 13:44 - 2018-07-18 13:45 - 000086528 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1815.210.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2018-07-18 13:44 - 2018-07-18 13:45 - 000195072 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1815.210.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2018-07-18 13:44 - 2018-07-18 13:45 - 022373888 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1815.210.0_x64__kzf8qxf38zg5c\SkyWrap.dll
2018-07-18 13:44 - 2018-07-18 13:45 - 002610176 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1815.210.0_x64__kzf8qxf38zg5c\skypert.dll
2018-07-18 13:44 - 2018-07-18 13:45 - 000653824 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1815.210.0_x64__kzf8qxf38zg5c\RtmMvrUap.dll
2018-08-21 08:32 - 2018-08-21 08:33 - 000479232 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
2018-08-21 08:32 - 2018-08-21 08:33 - 069226496 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\Microsoft.Photos.dll
2018-03-24 20:24 - 2018-03-24 20:32 - 002523136 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\UnityEngineDelegates.dll
2018-08-21 08:32 - 2018-08-21 08:33 - 000049664 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\RenderingPlugin.dll
2018-08-21 08:32 - 2018-08-21 08:33 - 003693568 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\MediaEngineCSWrapper.dll
2018-04-25 09:42 - 2018-04-25 09:43 - 000009216 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\ImagePipelineNative.dll
2018-08-21 08:32 - 2018-08-21 08:33 - 000035328 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\WinMLWrapper.UWP.dll
2018-08-21 08:32 - 2018-08-21 08:33 - 002480640 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\opencv_imgproc320.dll
2018-08-21 08:32 - 2018-08-21 08:33 - 002280960 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\opencv_core320.dll
2018-04-05 07:07 - 2018-04-05 07:09 - 002283008 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\TrackingDLLUWP.dll
2018-08-21 08:32 - 2018-08-21 08:33 - 014258688 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\PhotosApp.Windows.dll
2018-08-21 08:32 - 2018-08-21 08:33 - 003538944 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\MediaEngine.dll
2018-08-21 08:32 - 2018-08-21 08:33 - 002944512 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\AppCore.Windows.dll
2018-05-30 06:37 - 2018-05-30 06:39 - 000872448 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\RuntimeConfiguration.dll
2018-07-28 09:44 - 2018-07-28 09:45 - 004584960 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll
2018-07-03 09:11 - 2018-07-03 09:15 - 001922224 _____ () C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.10314.31700.0_x64__8wekyb3d8bbwe\Microsoft.Applications.Telemetry.Windows.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2017-09-29 08:46 - 2018-03-26 10:48 - 000000826 _____ C:\WINDOWS\system32\Drivers\etc\hosts
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08212018071437550\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Windows\img0.jpg
HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08212018071438136\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Windows\img0.jpg
HKU\S-1-5-21-772274138-2366416172-2937497999-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Lenovo\LenovoWallPaper.jpg
HKU\S-1-5-21-772274138-2366416172-2937497999-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08212018071438630\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Lenovo\LenovoWallPaper.jpg
DNS Servers: 192.168.1.254
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: )
Windows Firewall is disabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [{7FADD033-FDE9-4067-9899-E9EFEF842B3B}] => (Allow) C:\Program Files (x86)\Apowersoft\ApowerManager\ApowerManagerCoreServices.exe
FirewallRules: [{C72D46EB-0961-4B66-879B-91A2DEF38451}] => (Allow) C:\Program Files (x86)\Apowersoft\ApowerManager\ApowerManagerCoreServices.exe
FirewallRules: [{E3D442C0-32E1-4971-B11F-F611C36EE232}] => (Allow) C:\Program Files (x86)\Apowersoft\ApowerManager\ApowerManager.exe
FirewallRules: [{0218E624-7691-42A3-8DFF-9A64F8C828B9}] => (Allow) C:\Program Files (x86)\Apowersoft\ApowerManager\ApowerManager.exe
FirewallRules: [{01D3A21D-43A1-4388-9916-167CA724BB66}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{D745BD95-35DF-49D0-82F6-EF9A8EA9F99F}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{E589BA53-D724-4BCC-BBEE-90C178A4EDFB}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{BE8D0156-C6BE-4ABB-98CD-2BF0CA4418E9}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{A2EFDBC1-D480-4B5F-A25E-43B90212788A}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{D7D610AE-2C5A-414B-8F42-772578063016}] => (Allow) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
FirewallRules: [{2BFD73A1-2AD4-4B58-B282-C75934FC1B18}] => (Allow) C:\Program Files\WindowsApps\Microsoft.Office.Desktop.Outlook_16040.10325.20082.0_x86__8wekyb3d8bbwe\Office16\OUTLOOK.exe
FirewallRules: [{7745A929-F3C6-4FB4-B98E-58E2B7F0E1F0}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{4AAA38CF-20BF-4B6F-A098-09F45981616A}] => (Allow) C:\Program Files\WindowsApps\Microsoft.Office.Desktop.Outlook_16040.10325.20118.0_x86__8wekyb3d8bbwe\Office16\OUTLOOK.exe
==================== Restore Points =========================
05-08-2018 11:06:25 Scheduled Checkpoint
14-08-2018 15:02:35 Windows Update
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (08/22/2018 12:52:09 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Local Hostname WTF.local already in use; will try WTF-2.local instead
Error: (08/22/2018 12:52:09 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: ProbeCount 2; will deregister 4 WTF.local. Addr 192.168.1.95
Error: (08/22/2018 12:52:09 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from 192.168.1.95:5353 16 WTF.local. AAAA 2600:1700:8C60:6EC0:1D39:22FC:A9EB:3E96
Error: (08/22/2018 12:52:09 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Resetting to Probing: 16 WTF.local. AAAA FE80:0000:0000:0000:01EE:10F8:9DA3:0972
Error: (08/22/2018 12:52:09 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from 192.168.1.95:5353 16 WTF.local. AAAA 2600:1700:8C60:6EC0:1D39:22FC:A9EB:3E96
Error: (08/22/2018 12:52:09 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Resetting to Probing: 16 WTF.local. AAAA 2600:1700:8C60:6EC0:6D40:F8EB:6E1C:80D3
Error: (08/22/2018 12:52:09 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from 192.168.1.95:5353 16 WTF.local. AAAA 2600:1700:8C60:6EC0:1D39:22FC:A9EB:3E96
Error: (08/22/2018 12:52:09 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Resetting to Probing: 16 WTF.local. AAAA 2600:1700:8C60:6EC0:01EE:10F8:9DA3:0972
System errors:
=============
Error: (08/23/2018 01:37:44 PM) (Source: DCOM) (EventID: 10016) (User: WTF)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
and APPID
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
to the user WTF\wadef SID (S-1-5-21-772274138-2366416172-2937497999-1001) from address LocalHost (Using LRPC) running in the application container Microsoft.Windows.ContentDeliveryManager_10.0.17134.1_neutral_neutral_cw5n1h2txyewy SID (S-1-15-2-350187224-1905355452-1037786396-3028148496-2624191407-3283318427-1255436723). This security permission can be modified using the Component Services administrative tool.
Error: (08/23/2018 03:40:21 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (08/22/2018 09:03:01 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (08/22/2018 01:04:40 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80073d02: ApplicationSet-CFQ7TTC0K56C-Microsoft.Office.Desktop.
Error: (08/22/2018 09:09:50 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80073d02: ApplicationSet-CFQ7TTC0K56C-Microsoft.Office.Desktop.
Error: (08/22/2018 07:46:38 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (08/22/2018 07:16:36 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (08/22/2018 07:14:07 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
CodeIntegrity:
===================================
Date: 2018-08-20 13:13:42.235
Description:
Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files (x86)\Google\Chrome\Application\chrome.exe) attempted to load \Device\HarddiskVolume3\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Microsoft signing level requirements.
Date: 2018-08-17 11:26:10.245
Description:
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\browser_broker.exe) attempted to load \Device\HarddiskVolume3\Program Files\Google\Drive\googledrivesync64.dll that did not meet the Microsoft signing level requirements.
Date: 2018-08-17 11:26:10.111
Description:
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\browser_broker.exe) attempted to load \Device\HarddiskVolume3\Program Files\Google\Drive\googledrivesync64.dll that did not meet the Microsoft signing level requirements.
Date: 2018-08-17 11:26:10.076
Description:
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\browser_broker.exe) attempted to load \Device\HarddiskVolume3\Program Files\Google\Drive\googledrivesync64.dll that did not meet the Microsoft signing level requirements.
Date: 2018-08-07 14:59:08.580
Description:
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\browser_broker.exe) attempted to load \Device\HarddiskVolume3\Program Files\Google\Drive\googledrivesync64.dll that did not meet the Microsoft signing level requirements.
Date: 2018-08-07 14:59:08.569
Description:
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\browser_broker.exe) attempted to load \Device\HarddiskVolume3\Program Files\Google\Drive\googledrivesync64.dll that did not meet the Microsoft signing level requirements.
Date: 2018-08-07 14:59:08.406
Description:
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\browser_broker.exe) attempted to load \Device\HarddiskVolume3\Program Files\Google\Drive\googledrivesync64.dll that did not meet the Microsoft signing level requirements.
==================== Memory info ===========================
Processor: Intel® Celeron® CPU N3350 @ 1.10GHz
Percentage of memory in use: 85%
Total physical RAM: 3920.28 MB
Available physical RAM: 560.43 MB
Total Virtual: 8399.14 MB
Available Virtual: 2330.78 MB
==================== Drives ================================
Drive c: (Windows) (Fixed) (Total:905.27 GB) (Free:798.82 GB) NTFS
Drive d: (LENOVO) (Fixed) (Total:25 GB) (Free:23.68 GB) NTFS
\\?\Volume{498bc45d-448c-48bd-aa1c-54c87a0dffa6}\ (WINRE_DRV) (Fixed) (Total:0.98 GB) (Free:0.53 GB) NTFS
\\?\Volume{343c5735-90cc-468d-be81-5eba6bd7a357}\ (SYSTEM_DRV) (Fixed) (Total:0.25 GB) (Free:0.22 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: B18CBA5A)
Partition: GPT.
==================== End of Addition.txt ============================
Edited by Funkerama, 23 August 2018 - 02:30 PM.
