GMER 2.2.19882 - http://www.gmer.net Rootkit scan 2017-03-17 14:37:03 Windows 6.2.9200 x64 \Device\Harddisk1\DR1 -> \Device\00000033 INTEL_SSDSC2CW120A3 rev.400i 111,79GB Running: ufltei2n.exe; Driver: C:\Users\Ann\AppData\Local\Temp\pxldipob.sys ---- Threads - GMER 2.2 ---- Thread C:\WINDOWS\system32\csrss.exe [704:824] ffffdd4e8e536c20 ---- Registry - GMER 2.2 ---- Reg HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData@SystemStartTime 0x8F 0x6F 0xD4 0xE0 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData@SystemLastStartTime 0x97 0x45 0x6D 0xB7 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData@CMFStartTime 0x8F 0x6F 0xD4 0xE0 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData@CMFLastStartTime 0x97 0x45 0x6D 0xB7 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData\BootLanguages@pl-PL 450 Reg HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Configuration\GSM59F191_08_07E0_38^96F178EBB34D3FB797C1C29C0A36ABE8@Timestamp 0x44 0xB6 0x7D 0xE1 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel\RNG@RNGAuxiliarySeed -2114589232 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management@DisablePagingExecutive 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server@InstanceID c9ac00d9-79e7-40e1-992b-484c0cc Reg HKLM\SYSTEM\CurrentControlSet\Control\Windows@ShutdownStopTimePerfCounter 0x5F 0x0A 0xF4 0x1B ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession@Start 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession@GUID {1a15901b-0686-4433-955f-2ee7f9c61cfc}??????????????B?????????????????????????????????????????????? Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession@FileName c:\xperf\boot_1_um_premerge.etl Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession@MinimumBuffers 32 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession@MaximumBuffers 32 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession@MaxFileSize 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession@BufferSize 1024 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession@ClockType 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{0063715b-eeda-4007-9429-ad526f62696e} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{0063715b-eeda-4007-9429-ad526f62696e}@ProviderFriendlyName Service Control Manager Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{0063715b-eeda-4007-9429-ad526f62696e}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{0063715b-eeda-4007-9429-ad526f62696e}@MatchAnyKeyword 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{0063715b-eeda-4007-9429-ad526f62696e}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{0063715b-eeda-4007-9429-ad526f62696e}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{0063715b-eeda-4007-9429-ad526f62696e}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{030f2f57-abd0-4427-bcf1-3a3587d7dc7d} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{030f2f57-abd0-4427-bcf1-3a3587d7dc7d}@ProviderFriendlyName PerfTrack Status Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{030f2f57-abd0-4427-bcf1-3a3587d7dc7d}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{030f2f57-abd0-4427-bcf1-3a3587d7dc7d}@MatchAnyKeyword 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{030f2f57-abd0-4427-bcf1-3a3587d7dc7d}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{030f2f57-abd0-4427-bcf1-3a3587d7dc7d}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{030f2f57-abd0-4427-bcf1-3a3587d7dc7d}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{06184c97-5201-480e-92af-3a3626c5b140} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{06184c97-5201-480e-92af-3a3626c5b140}@ProviderFriendlyName Service Host Provider Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{06184c97-5201-480e-92af-3a3626c5b140}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{06184c97-5201-480e-92af-3a3626c5b140}@MatchAnyKeyword 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{06184c97-5201-480e-92af-3a3626c5b140}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{06184c97-5201-480e-92af-3a3626c5b140}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{06184c97-5201-480e-92af-3a3626c5b140}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{0a002690-3839-4e3a-b3b6-96d8df868d99} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{0a002690-3839-4e3a-b3b6-96d8df868d99}@ProviderFriendlyName AMP1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{0a002690-3839-4e3a-b3b6-96d8df868d99}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{0a002690-3839-4e3a-b3b6-96d8df868d99}@MatchAnyKeyword 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{0a002690-3839-4e3a-b3b6-96d8df868d99}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{0a002690-3839-4e3a-b3b6-96d8df868d99}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{0a002690-3839-4e3a-b3b6-96d8df868d99}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{15ca44ff-4d7a-4baa-bba5-0998955e531e} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{15ca44ff-4d7a-4baa-bba5-0998955e531e}@ProviderFriendlyName Loader Info Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{15ca44ff-4d7a-4baa-bba5-0998955e531e}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{15ca44ff-4d7a-4baa-bba5-0998955e531e}@MatchAnyKeyword 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{15ca44ff-4d7a-4baa-bba5-0998955e531e}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{15ca44ff-4d7a-4baa-bba5-0998955e531e}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{15ca44ff-4d7a-4baa-bba5-0998955e531e}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{176cd9c5-c90c-5471-38ba-0eeb4f7e0bd0} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{176cd9c5-c90c-5471-38ba-0eeb4f7e0bd0}@ProviderFriendlyName Microsoft.Windows.UI.Logon Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{176cd9c5-c90c-5471-38ba-0eeb4f7e0bd0}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{176cd9c5-c90c-5471-38ba-0eeb4f7e0bd0}@MatchAnyKeyword 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{176cd9c5-c90c-5471-38ba-0eeb4f7e0bd0}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{176cd9c5-c90c-5471-38ba-0eeb4f7e0bd0}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{176cd9c5-c90c-5471-38ba-0eeb4f7e0bd0}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{1915117c-a61c-54d4-6548-56cac6dbfede} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{1915117c-a61c-54d4-6548-56cac6dbfede}@ProviderFriendlyName Microsoft.Windows.Shell.AboveLockActivationManager Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{1915117c-a61c-54d4-6548-56cac6dbfede}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{1915117c-a61c-54d4-6548-56cac6dbfede}@MatchAnyKeyword 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{1915117c-a61c-54d4-6548-56cac6dbfede}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{1915117c-a61c-54d4-6548-56cac6dbfede}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{1915117c-a61c-54d4-6548-56cac6dbfede}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{1fd7c1d2-d037-4620-8d29-b2c7e5fcc13a} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{1fd7c1d2-d037-4620-8d29-b2c7e5fcc13a}@ProviderFriendlyName Software Licensing (V6) Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{1fd7c1d2-d037-4620-8d29-b2c7e5fcc13a}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{1fd7c1d2-d037-4620-8d29-b2c7e5fcc13a}@MatchAnyKeyword 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{1fd7c1d2-d037-4620-8d29-b2c7e5fcc13a}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{1fd7c1d2-d037-4620-8d29-b2c7e5fcc13a}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{1fd7c1d2-d037-4620-8d29-b2c7e5fcc13a}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{206f6dea-d3c5-4d10-bc72-989f03c8b84b} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{206f6dea-d3c5-4d10-bc72-989f03c8b84b}@ProviderFriendlyName Wininit Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{206f6dea-d3c5-4d10-bc72-989f03c8b84b}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{206f6dea-d3c5-4d10-bc72-989f03c8b84b}@MatchAnyKeyword 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{206f6dea-d3c5-4d10-bc72-989f03c8b84b}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{206f6dea-d3c5-4d10-bc72-989f03c8b84b}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{206f6dea-d3c5-4d10-bc72-989f03c8b84b}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{2a274310-42d5-4019-b816-e4b8c7abe95c} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{2a274310-42d5-4019-b816-e4b8c7abe95c}@ProviderFriendlyName ReadyBoost Driver Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{2a274310-42d5-4019-b816-e4b8c7abe95c}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{2a274310-42d5-4019-b816-e4b8c7abe95c}@MatchAnyKeyword 0x60 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{2a274310-42d5-4019-b816-e4b8c7abe95c}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{2a274310-42d5-4019-b816-e4b8c7abe95c}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{2a274310-42d5-4019-b816-e4b8c7abe95c}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{30336ed4-e327-447c-9de0-51b652c86108} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{30336ed4-e327-447c-9de0-51b652c86108}@ProviderFriendlyName ShellCore Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{30336ed4-e327-447c-9de0-51b652c86108}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{30336ed4-e327-447c-9de0-51b652c86108}@MatchAnyKeyword 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{30336ed4-e327-447c-9de0-51b652c86108}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{30336ed4-e327-447c-9de0-51b652c86108}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{30336ed4-e327-447c-9de0-51b652c86108}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{331c3b3a-2005-44c2-ac5e-77220c37d6b4} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{331c3b3a-2005-44c2-ac5e-77220c37d6b4}@ProviderFriendlyName Kernel-mode Power Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{331c3b3a-2005-44c2-ac5e-77220c37d6b4}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{331c3b3a-2005-44c2-ac5e-77220c37d6b4}@MatchAnyKeyword 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{331c3b3a-2005-44c2-ac5e-77220c37d6b4}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{331c3b3a-2005-44c2-ac5e-77220c37d6b4}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{331c3b3a-2005-44c2-ac5e-77220c37d6b4}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{3ec987dd-90e6-5877-ccb7-f27cdf6a976b} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{3ec987dd-90e6-5877-ccb7-f27cdf6a976b}@ProviderFriendlyName Microsoft.Windows.LogonUI.WinlogonRPC Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{3ec987dd-90e6-5877-ccb7-f27cdf6a976b}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{3ec987dd-90e6-5877-ccb7-f27cdf6a976b}@MatchAnyKeyword 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{3ec987dd-90e6-5877-ccb7-f27cdf6a976b}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{3ec987dd-90e6-5877-ccb7-f27cdf6a976b}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{3ec987dd-90e6-5877-ccb7-f27cdf6a976b}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{43e63da5-41d1-4fbf-aded-1bbed98fdd1d} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{43e63da5-41d1-4fbf-aded-1bbed98fdd1d}@ProviderFriendlyName SMSS Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{43e63da5-41d1-4fbf-aded-1bbed98fdd1d}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{43e63da5-41d1-4fbf-aded-1bbed98fdd1d}@MatchAnyKeyword 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{43e63da5-41d1-4fbf-aded-1bbed98fdd1d}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{43e63da5-41d1-4fbf-aded-1bbed98fdd1d}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{43e63da5-41d1-4fbf-aded-1bbed98fdd1d}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}@ProviderFriendlyName Search Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}@MatchAnyKeyword 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{49c2c27c-fe2d-40bf-8c4e-c3fb518037e7}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{4ee76bd8-3cf4-44a0-a0ac-3937643e37a3} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{4ee76bd8-3cf4-44a0-a0ac-3937643e37a3}@ProviderFriendlyName Code Integrity Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{4ee76bd8-3cf4-44a0-a0ac-3937643e37a3}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{4ee76bd8-3cf4-44a0-a0ac-3937643e37a3}@MatchAnyKeyword 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{4ee76bd8-3cf4-44a0-a0ac-3937643e37a3}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{4ee76bd8-3cf4-44a0-a0ac-3937643e37a3}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{4ee76bd8-3cf4-44a0-a0ac-3937643e37a3}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{4f7c073a-65bf-5045-7651-cc53bb272db5} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{4f7c073a-65bf-5045-7651-cc53bb272db5}@ProviderFriendlyName Microsoft.Windows.LogonController Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{4f7c073a-65bf-5045-7651-cc53bb272db5}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{4f7c073a-65bf-5045-7651-cc53bb272db5}@MatchAnyKeyword 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{4f7c073a-65bf-5045-7651-cc53bb272db5}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{4f7c073a-65bf-5045-7651-cc53bb272db5}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{4f7c073a-65bf-5045-7651-cc53bb272db5}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{5322d61a-9efa-4bc3-a3f9-14be95c144f8} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{5322d61a-9efa-4bc3-a3f9-14be95c144f8}@ProviderFriendlyName Prefetcher Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{5322d61a-9efa-4bc3-a3f9-14be95c144f8}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{5322d61a-9efa-4bc3-a3f9-14be95c144f8}@MatchAnyKeyword 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{5322d61a-9efa-4bc3-a3f9-14be95c144f8}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{5322d61a-9efa-4bc3-a3f9-14be95c144f8}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{5322d61a-9efa-4bc3-a3f9-14be95c144f8}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{56dc463b-97e8-4b59-e836-ab7c9bb96301} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{56dc463b-97e8-4b59-e836-ab7c9bb96301}@ProviderFriendlyName DiagTrack Status Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{56dc463b-97e8-4b59-e836-ab7c9bb96301}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{56dc463b-97e8-4b59-e836-ab7c9bb96301}@MatchAnyKeyword 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{56dc463b-97e8-4b59-e836-ab7c9bb96301}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{56dc463b-97e8-4b59-e836-ab7c9bb96301}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{56dc463b-97e8-4b59-e836-ab7c9bb96301}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{594bf743-ce2e-48ee-83ee-3d50a0add692} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{594bf743-ce2e-48ee-83ee-3d50a0add692}@ProviderFriendlyName Microsoft.Windows.AppModel.TileDataModel Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{594bf743-ce2e-48ee-83ee-3d50a0add692}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{594bf743-ce2e-48ee-83ee-3d50a0add692}@MatchAnyKeyword 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{594bf743-ce2e-48ee-83ee-3d50a0add692}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{594bf743-ce2e-48ee-83ee-3d50a0add692}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{594bf743-ce2e-48ee-83ee-3d50a0add692}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{63d2bb1d-e39a-41b8-9a3d-52dd06677588} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{63d2bb1d-e39a-41b8-9a3d-52dd06677588}@ProviderFriendlyName AuthUI Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{63d2bb1d-e39a-41b8-9a3d-52dd06677588}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{63d2bb1d-e39a-41b8-9a3d-52dd06677588}@MatchAnyKeyword 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{63d2bb1d-e39a-41b8-9a3d-52dd06677588}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{63d2bb1d-e39a-41b8-9a3d-52dd06677588}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{63d2bb1d-e39a-41b8-9a3d-52dd06677588}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{67fe2216-727a-40cb-94b2-c02211edb34a} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{67fe2216-727a-40cb-94b2-c02211edb34a}@ProviderFriendlyName VolSnap Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{67fe2216-727a-40cb-94b2-c02211edb34a}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{67fe2216-727a-40cb-94b2-c02211edb34a}@MatchAnyKeyword 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{67fe2216-727a-40cb-94b2-c02211edb34a}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{67fe2216-727a-40cb-94b2-c02211edb34a}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{67fe2216-727a-40cb-94b2-c02211edb34a}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{74cc4a0b-f577-5929-abcb-aa4bea374cb3} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{74cc4a0b-f577-5929-abcb-aa4bea374cb3}@ProviderFriendlyName Microsoft.Windows.Shell.LockAppHost Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{74cc4a0b-f577-5929-abcb-aa4bea374cb3}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{74cc4a0b-f577-5929-abcb-aa4bea374cb3}@MatchAnyKeyword 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{74cc4a0b-f577-5929-abcb-aa4bea374cb3}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{74cc4a0b-f577-5929-abcb-aa4bea374cb3}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{74cc4a0b-f577-5929-abcb-aa4bea374cb3}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{751ef305-6c6e-4fed-b847-02ef79d26aef} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{751ef305-6c6e-4fed-b847-02ef79d26aef}@ProviderFriendlyName AMP3 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{751ef305-6c6e-4fed-b847-02ef79d26aef}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{751ef305-6c6e-4fed-b847-02ef79d26aef}@MatchAnyKeyword 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{751ef305-6c6e-4fed-b847-02ef79d26aef}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{751ef305-6c6e-4fed-b847-02ef79d26aef}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{751ef305-6c6e-4fed-b847-02ef79d26aef}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{8c416c79-d49b-4f01-a467-e56d3aa8234c} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{8c416c79-d49b-4f01-a467-e56d3aa8234c}@ProviderFriendlyName DwmWin32kWin8 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{8c416c79-d49b-4f01-a467-e56d3aa8234c}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{8c416c79-d49b-4f01-a467-e56d3aa8234c}@MatchAnyKeyword 0x00 0x00 0x40 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{8c416c79-d49b-4f01-a467-e56d3aa8234c}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{8c416c79-d49b-4f01-a467-e56d3aa8234c}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{8c416c79-d49b-4f01-a467-e56d3aa8234c}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{8e92deef-5e17-413b-b927-59b2f06a3cfc} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{8e92deef-5e17-413b-b927-59b2f06a3cfc}@ProviderFriendlyName AMP2 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{8e92deef-5e17-413b-b927-59b2f06a3cfc}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{8e92deef-5e17-413b-b927-59b2f06a3cfc}@MatchAnyKeyword 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{8e92deef-5e17-413b-b927-59b2f06a3cfc}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{8e92deef-5e17-413b-b927-59b2f06a3cfc}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{8e92deef-5e17-413b-b927-59b2f06a3cfc}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{96319132-2f52-5969-f14c-0d0a171b357a} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{96319132-2f52-5969-f14c-0d0a171b357a}@ProviderFriendlyName Microsoft.Windows.Shell.LockFrameworkUAP Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{96319132-2f52-5969-f14c-0d0a171b357a}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{96319132-2f52-5969-f14c-0d0a171b357a}@MatchAnyKeyword 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{96319132-2f52-5969-f14c-0d0a171b357a}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{96319132-2f52-5969-f14c-0d0a171b357a}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{96319132-2f52-5969-f14c-0d0a171b357a}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{9c205a39-1250-487d-abd7-e831c6290539} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{9c205a39-1250-487d-abd7-e831c6290539}@ProviderFriendlyName Kernel-mode PnP Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{9c205a39-1250-487d-abd7-e831c6290539}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{9c205a39-1250-487d-abd7-e831c6290539}@MatchAnyKeyword 0x20 0xF0 0x1F 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{9c205a39-1250-487d-abd7-e831c6290539}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{9c205a39-1250-487d-abd7-e831c6290539}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{9c205a39-1250-487d-abd7-e831c6290539}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{9ca921e3-25a4-5d34-39da-a59bd8bdf7a2} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{9ca921e3-25a4-5d34-39da-a59bd8bdf7a2}@ProviderFriendlyName Microsoft.Windows.Shell.LockAppBroker Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{9ca921e3-25a4-5d34-39da-a59bd8bdf7a2}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{9ca921e3-25a4-5d34-39da-a59bd8bdf7a2}@MatchAnyKeyword 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{9ca921e3-25a4-5d34-39da-a59bd8bdf7a2}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{9ca921e3-25a4-5d34-39da-a59bd8bdf7a2}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{9ca921e3-25a4-5d34-39da-a59bd8bdf7a2}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{9d55b53d-449b-4824-a637-24f9d69aa02f} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{9d55b53d-449b-4824-a637-24f9d69aa02f}@ProviderFriendlyName WinSrv Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{9d55b53d-449b-4824-a637-24f9d69aa02f}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{9d55b53d-449b-4824-a637-24f9d69aa02f}@MatchAnyKeyword 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{9d55b53d-449b-4824-a637-24f9d69aa02f}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{9d55b53d-449b-4824-a637-24f9d69aa02f}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{9d55b53d-449b-4824-a637-24f9d69aa02f}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}@ProviderFriendlyName Kernel General Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}@MatchAnyKeyword 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{a68ca8b7-004f-d7b6-a698-07e2de0f1f5d}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{a6ad76e3-867a-4635-91b3-4904ba6374d7} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{a6ad76e3-867a-4635-91b3-4904ba6374d7}@ProviderFriendlyName ReadyBoost Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{a6ad76e3-867a-4635-91b3-4904ba6374d7}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{a6ad76e3-867a-4635-91b3-4904ba6374d7}@MatchAnyKeyword 0x40 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{a6ad76e3-867a-4635-91b3-4904ba6374d7}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{a6ad76e3-867a-4635-91b3-4904ba6374d7}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{a6ad76e3-867a-4635-91b3-4904ba6374d7}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}@ProviderFriendlyName Group Policy Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}@MatchAnyKeyword 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{b2149bc3-9dfd-5866-92a7-b556b3a6aed0} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{b2149bc3-9dfd-5866-92a7-b556b3a6aed0}@ProviderFriendlyName Microsoft.Windows.Shell.DefaultLockApp Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{b2149bc3-9dfd-5866-92a7-b556b3a6aed0}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{b2149bc3-9dfd-5866-92a7-b556b3a6aed0}@MatchAnyKeyword 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{b2149bc3-9dfd-5866-92a7-b556b3a6aed0}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{b2149bc3-9dfd-5866-92a7-b556b3a6aed0}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{b2149bc3-9dfd-5866-92a7-b556b3a6aed0}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{cfeb0608-330e-4410-b00d-56d8da9986e6} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{cfeb0608-330e-4410-b00d-56d8da9986e6}@ProviderFriendlyName AMP4 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{cfeb0608-330e-4410-b00d-56d8da9986e6}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{cfeb0608-330e-4410-b00d-56d8da9986e6}@MatchAnyKeyword 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{cfeb0608-330e-4410-b00d-56d8da9986e6}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{cfeb0608-330e-4410-b00d-56d8da9986e6}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{cfeb0608-330e-4410-b00d-56d8da9986e6}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{d781ca11-61c0-4387-b83d-af52d3d2dd6a} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{d781ca11-61c0-4387-b83d-af52d3d2dd6a}@ProviderFriendlyName Win32HeapRanges Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{d781ca11-61c0-4387-b83d-af52d3d2dd6a}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{d781ca11-61c0-4387-b83d-af52d3d2dd6a}@MatchAnyKeyword 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{d781ca11-61c0-4387-b83d-af52d3d2dd6a}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{d781ca11-61c0-4387-b83d-af52d3d2dd6a}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{d781ca11-61c0-4387-b83d-af52d3d2dd6a}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{d8975f88-7ddb-4ed0-91bf-3adf48c48e0c} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{d8975f88-7ddb-4ed0-91bf-3adf48c48e0c}@ProviderFriendlyName Microsoft-Windows-RPCSS Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{d8975f88-7ddb-4ed0-91bf-3adf48c48e0c}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{d8975f88-7ddb-4ed0-91bf-3adf48c48e0c}@MatchAnyKeyword 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{d8975f88-7ddb-4ed0-91bf-3adf48c48e0c}@EnableLevel 4 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{d8975f88-7ddb-4ed0-91bf-3adf48c48e0c}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{d8975f88-7ddb-4ed0-91bf-3adf48c48e0c}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{dbe9b383-7cf3-4331-91cc-a3cb16a3b538} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{dbe9b383-7cf3-4331-91cc-a3cb16a3b538}@ProviderFriendlyName Winlogon Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{dbe9b383-7cf3-4331-91cc-a3cb16a3b538}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{dbe9b383-7cf3-4331-91cc-a3cb16a3b538}@MatchAnyKeyword 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{dbe9b383-7cf3-4331-91cc-a3cb16a3b538}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{dbe9b383-7cf3-4331-91cc-a3cb16a3b538}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{dbe9b383-7cf3-4331-91cc-a3cb16a3b538}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{de7b24ea-73c8-4a09-985d-5bdadcfa9017} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{de7b24ea-73c8-4a09-985d-5bdadcfa9017}@ProviderFriendlyName TaskScheduler Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{de7b24ea-73c8-4a09-985d-5bdadcfa9017}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{de7b24ea-73c8-4a09-985d-5bdadcfa9017}@MatchAnyKeyword 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{de7b24ea-73c8-4a09-985d-5bdadcfa9017}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{de7b24ea-73c8-4a09-985d-5bdadcfa9017}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{de7b24ea-73c8-4a09-985d-5bdadcfa9017}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{e23b33b0-c8c9-472c-a5f9-f2bdfea0f156} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{e23b33b0-c8c9-472c-a5f9-f2bdfea0f156}@ProviderFriendlyName Software Licensing (V7) Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{e23b33b0-c8c9-472c-a5f9-f2bdfea0f156}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{e23b33b0-c8c9-472c-a5f9-f2bdfea0f156}@MatchAnyKeyword 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{e23b33b0-c8c9-472c-a5f9-f2bdfea0f156}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{e23b33b0-c8c9-472c-a5f9-f2bdfea0f156}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{e23b33b0-c8c9-472c-a5f9-f2bdfea0f156}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{e58f5f9c-3abb-5fc1-5ae5-dbe956bdbd33} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{e58f5f9c-3abb-5fc1-5ae5-dbe956bdbd33}@ProviderFriendlyName Microsoft.Windows.Shell.AboveLockShellComponent Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{e58f5f9c-3abb-5fc1-5ae5-dbe956bdbd33}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{e58f5f9c-3abb-5fc1-5ae5-dbe956bdbd33}@MatchAnyKeyword 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{e58f5f9c-3abb-5fc1-5ae5-dbe956bdbd33}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{e58f5f9c-3abb-5fc1-5ae5-dbe956bdbd33}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{e58f5f9c-3abb-5fc1-5ae5-dbe956bdbd33}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{e6307a09-292c-497e-aad6-498f68e2b619} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{e6307a09-292c-497e-aad6-498f68e2b619}@ProviderFriendlyName EMDMgmt Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{e6307a09-292c-497e-aad6-498f68e2b619}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{e6307a09-292c-497e-aad6-498f68e2b619}@MatchAnyKeyword 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{e6307a09-292c-497e-aad6-498f68e2b619}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{e6307a09-292c-497e-aad6-498f68e2b619}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{e6307a09-292c-497e-aad6-498f68e2b619}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{e8316a2d-0d94-4f52-85dd-1e15b66c5891} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{e8316a2d-0d94-4f52-85dd-1e15b66c5891}@ProviderFriendlyName CSRSS Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{e8316a2d-0d94-4f52-85dd-1e15b66c5891}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{e8316a2d-0d94-4f52-85dd-1e15b66c5891}@MatchAnyKeyword 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{e8316a2d-0d94-4f52-85dd-1e15b66c5891}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{e8316a2d-0d94-4f52-85dd-1e15b66c5891}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{e8316a2d-0d94-4f52-85dd-1e15b66c5891}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{fb3cd94d-95ef-5a73-b35c-6c78451095ef} Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{fb3cd94d-95ef-5a73-b35c-6c78451095ef}@ProviderFriendlyName Microsoft.Windows.CredProvDataModel Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{fb3cd94d-95ef-5a73-b35c-6c78451095ef}@Enabled 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{fb3cd94d-95ef-5a73-b35c-6c78451095ef}@MatchAnyKeyword 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{fb3cd94d-95ef-5a73-b35c-6c78451095ef}@EnableLevel 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{fb3cd94d-95ef-5a73-b35c-6c78451095ef}@EnableProperty 256 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\XBootMgrSession\{fb3cd94d-95ef-5a73-b35c-6c78451095ef}@Status 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\GlobalLogger@Start 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\XPerfBootmgr Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\XPerfBootmgr@TraceMode 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\XPerfBootmgr@RepeatCount 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\XPerfBootmgr@RepeatIteration 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\XPerfBootmgr@PostBootDelay 180000 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\XPerfBootmgr@TraceFlags latency+dispatcher Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\XPerfBootmgr@StackWalkingFilter 0x2E 0x0F 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\XPerfBootmgr@ResultPath c:\xperf Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\XPerfBootmgr@Callback Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\XPerfBootmgr@RunTag Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\XPerfBootmgr@SleeperCmd C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\xbootmgrSleep.exe Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\XPerfBootmgr@PreTraceCmd Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\XPerfBootmgr@PrepSystem 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\XPerfBootmgr@IssueFlush 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\XPerfBootmgr@UseLog 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\XPerfBootmgr@LeavePremerged 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\XPerfBootmgr@NoMerge 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\XPerfBootmgr@TraceFlagsInFileName 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\XPerfBootmgr@VerboseReadyBoot 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\XPerfBootmgr@IsBuffering 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\XPerfBootmgr@NumPrepSystemIterations 0 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\XPerfBootmgr@DisablePopups 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\aswRvrt\Parameters\Instup_14682586207032272@SetupOperations ???Y?????Y?Y?Y?Y?Z?Z?Z??????????????????????????????????????????? ???????Y???????????Y???????? ??????????????????????????Y??????Commited?????Y?Y?Y?Y?Y?Y?Y?Y???????????????????????????????????????t?????????Y???????????????????????????Y?????????????????Y?????Z?[?[?[?[?\?\?\?\??????????????????????????????????????????????4????????????????Y??????????????MoveFile("\??\C:\Program Files\AVAST Software\Avast\HTMA2D3.tmp","\??\C:\Program Files\AVAST Software\Avast\HTMLayout.dll",TRUE)?MoveFile("\??\C:\Program Files\AVAST Software\Avast\avBA3F0.tmp","\??\C:\Program Files\AVAST Software\Avast\avBugReport.exe",TRUE)?MoveFile("\??\C:\Program Files\AVAST Software\Avast\AvDA45F.tmp","\??\C:\Program Files\AVAST Software\Avast\AvDump32.exe",TRUE)?MoveFile("\??\C:\Program Files\AVAST Software\Avast\x64\AvDA4CE.tmp","\??\C:\Program Files\AVAST Software\Avast\x64\AvDump64.exe",TRUE)?DeleteFile("\??\C:\Program Files\AVAST Software\Avast\setup\CRT\x64")?DeleteFile("\??\C:\Program Files\AVAST Software\Avast\setup\CRT\x86")?MoveFil Reg HKLM\SYSTEM\CurrentControlSet\Services\aswRvrt\Parameters\Instup_14682586434372272@SetupOperations ???Y?????Z?[?[?[?[?\?\?\?\??????????????????????????????????????????????4????????????????Y??????????????MoveFile("\??\C:\Program Files\AVAST Software\Avast\HTMA2D3.tmp","\??\C:\Program Files\AVAST Software\Avast\HTMLayout.dll",TRUE)?MoveFile("\??\C:\Program Files\AVAST Software\Avast\avBA3F0.tmp","\??\C:\Program Files\AVAST Software\Avast\avBugReport.exe",TRUE)?MoveFile("\??\C:\Program Files\AVAST Software\Avast\AvDA45F.tmp","\??\C:\Program Files\AVAST Software\Avast\AvDump32.exe",TRUE)?MoveFile("\??\C:\Program Files\AVAST Software\Avast\x64\AvDA4CE.tmp","\??\C:\Program Files\AVAST Software\Avast\x64\AvDump64.exe",TRUE)?DeleteFile("\??\C:\Program Files\AVAST Software\Avast\setup\CRT\x64")?DeleteFile("\??\C:\Program Files\AVAST Software\Avast\setup\CRT\x86")?MoveFile("\??\C:\Program Files\AVAST Software\Avast\BCU6149.tmp","\??\C:\Program Files\AVAST Software\Avast\BCUCmnRes.dll",TRUE)?MoveFile("\??\C:\Program Files\AVAST Software\Avast\Bro6189.tmp","\??\C:\Program Files\AVAST Software\Avast\BrowserCleanup.exe Reg HKLM\SYSTEM\CurrentControlSet\Services\BITS\Performance@PerfMMFileName Global\MMF_BITS4d1c46c7-715b-4d54-9de5-610b6cec435f Reg HKLM\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\Probe\{c530ca12-7dae-4527-8897-e92f8dfba9ef}@LastProbeTime 1489758983 Reg HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch@Epoch 8497 Reg HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch2@Epoch 762 Reg HKLM\SYSTEM\CurrentControlSet\Services\srvnet\Parameters@MajorSequence 449 Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{f51a4c16-3242-41a3-a0d6-7f3bde9fd9f2}@LeaseObtainedTime 1489755383 Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{f51a4c16-3242-41a3-a0d6-7f3bde9fd9f2}@T1 1489798583 Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{f51a4c16-3242-41a3-a0d6-7f3bde9fd9f2}@T2 1489830983 Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{f51a4c16-3242-41a3-a0d6-7f3bde9fd9f2}@LeaseTerminatesTime 1489841783 Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{f51a4c16-3242-41a3-a0d6-7f3bde9fd9f2}@DhcpConnForceBroadcastFlag 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\SecureTimeLimits@SecureTimeEstimated 0x3A 0xF8 0x1D 0xE2 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\SecureTimeLimits@SecureTimeHigh 0x3A 0x60 0xE2 0x43 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\SecureTimeLimits@SecureTimeLow 0x3A 0x90 0x59 0x80 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt\Parameters@ServiceDllUnloadOnStop 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\WmiApRpl\Performance@Object List 82364 82370 82380 82390 82410 82454 82464 82502 82508 82524 Reg HKLM\SYSTEM\CurrentControlSet\Services\WmiApRpl\Performance@Last Counter 82530 Reg HKLM\SYSTEM\CurrentControlSet\Services\WmiApRpl\Performance@Last Help 82531 Reg HKLM\SYSTEM\CurrentControlSet\Services\WmiApRpl\Performance@First Counter 82364 Reg HKLM\SYSTEM\CurrentControlSet\Services\WmiApRpl\Performance@First Help 82365 Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\0@Rw 0x64 0x62 0x03 0x00 ... Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\0@RwMask 0x64 0x62 0x03 0x00 ... Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList@MRUList ahjcibdef Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Live\Roaming\RegistrarData@LastRenewCollectionsInterest 0x42 0x6E 0xB9 0x31 ... Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search@JumpListChangedAppIds E7CF176E110C211B?{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\ACD Systems\ACDSee Free\ACDSee Free.exe? Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\JumplistData@E7CF176E110C211B 0xCB 0x60 0x6E 0x7B ... Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A} Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}@LastAccessedTime 0x10 0x86 0xCB 0x21 ... Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}@AppId Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}@LaunchCount 2 Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{C66F8692-9A3D-40D1-B901-809368CBA2FD} Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{C66F8692-9A3D-40D1-B901-809368CBA2FD}@Type 0 Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{C66F8692-9A3D-40D1-B901-809368CBA2FD}@Path C:\Users\Ann\Desktop\20170217181549-52.pdf Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{C66F8692-9A3D-40D1-B901-809368CBA2FD}@DisplayName 20170217181549-52 Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{C66F8692-9A3D-40D1-B901-809368CBA2FD}@LastAccessedTime 0x00 0x00 0x00 0x00 ... Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{C66F8692-9A3D-40D1-B901-809368CBA2FD}@Points 0x00 0x00 0x00 0x00 Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{CB5D759A-CA90-4F32-84D8-4557034F667A} Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{CB5D759A-CA90-4F32-84D8-4557034F667A}@Type 0 Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{CB5D759A-CA90-4F32-84D8-4557034F667A}@Path C:\Users\Ann\Desktop\AeroKat-mask-sizer.pdf Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{CB5D759A-CA90-4F32-84D8-4557034F667A}@DisplayName AeroKat-mask-sizer Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{CB5D759A-CA90-4F32-84D8-4557034F667A}@LastAccessedTime 0x00 0x00 0x00 0x00 ... Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{CB5D759A-CA90-4F32-84D8-4557034F667A}@Points 0x00 0x00 0x00 0x00 Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{CC18A09F-6D1C-477D-94A7-29822F54D4A3} Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{CC18A09F-6D1C-477D-94A7-29822F54D4A3}@Type 0 Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{CC18A09F-6D1C-477D-94A7-29822F54D4A3}@Path C:\Users\Ann\Desktop\Pliki\zapiekanka-rodzinna.pdf Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{CC18A09F-6D1C-477D-94A7-29822F54D4A3}@DisplayName zapiekanka-rodzinna Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{CC18A09F-6D1C-477D-94A7-29822F54D4A3}@LastAccessedTime 0x00 0x00 0x00 0x00 ... Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{CC18A09F-6D1C-477D-94A7-29822F54D4A3}@Points 0x00 0x00 0x00 0x00 Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{CCD6B616-1239-42D4-8DD9-F7BB1C871739} Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{CCD6B616-1239-42D4-8DD9-F7BB1C871739}@Type 0 Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{CCD6B616-1239-42D4-8DD9-F7BB1C871739}@Path C:\Users\Ann\Desktop\Mark Foley & Diane Hall - Longman Advanced Learners' Grammar.pdf Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{CCD6B616-1239-42D4-8DD9-F7BB1C871739}@DisplayName Mark Foley & Diane Hall - Longman Advanced Learners' Grammar Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{CCD6B616-1239-42D4-8DD9-F7BB1C871739}@LastAccessedTime 0x00 0x00 0x00 0x00 ... Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{CCD6B616-1239-42D4-8DD9-F7BB1C871739}@Points 0x00 0x00 0x00 0x00 Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{DD057F6A-C587-4C30-9613-BD68BE40BEB9} Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{DD057F6A-C587-4C30-9613-BD68BE40BEB9}@Type 0 Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{DD057F6A-C587-4C30-9613-BD68BE40BEB9}@Path C:\Users\Ann\Desktop\ZKK_110_70102000299000200732194151.pdf Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{DD057F6A-C587-4C30-9613-BD68BE40BEB9}@DisplayName ZKK_110_70102000299000200732194151 Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{DD057F6A-C587-4C30-9613-BD68BE40BEB9}@LastAccessedTime 0x00 0x00 0x00 0x00 ... Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{DD057F6A-C587-4C30-9613-BD68BE40BEB9}@Points 0x00 0x00 0x00 0x00 Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{E000FD4D-ACF4-42BC-8E5D-C02621E5AC2F} Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{E000FD4D-ACF4-42BC-8E5D-C02621E5AC2F}@Type 0 Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{E000FD4D-ACF4-42BC-8E5D-C02621E5AC2F}@Path C:\Users\Ann\Desktop\Pliki\Mad?\Smsy\Madzia 4.12.14-24.02.15.pdf Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{E000FD4D-ACF4-42BC-8E5D-C02621E5AC2F}@DisplayName Madzia 4.12.14-24.02.15 Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{E000FD4D-ACF4-42BC-8E5D-C02621E5AC2F}@LastAccessedTime 0x00 0x00 0x00 0x00 ... Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{E000FD4D-ACF4-42BC-8E5D-C02621E5AC2F}@Points 0x00 0x00 0x00 0x00 Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{E488FD89-5B54-407B-96AF-2D9D27F8702B} Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{E488FD89-5B54-407B-96AF-2D9D27F8702B}@Type 0 Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{E488FD89-5B54-407B-96AF-2D9D27F8702B}@Path C:\Users\Ann\Desktop\Pliki\Koty badania\Diesel wyniki\Viva Zwierzaki z Mi?ska (3915-09W).pdf Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{E488FD89-5B54-407B-96AF-2D9D27F8702B}@DisplayName Viva Zwierzaki z Mi?ska (3915-09W) Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{E488FD89-5B54-407B-96AF-2D9D27F8702B}@LastAccessedTime 0x00 0x00 0x00 0x00 ... Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{E488FD89-5B54-407B-96AF-2D9D27F8702B}@Points 0x00 0x00 0x00 0x00 Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{E95724CB-92D8-4AF7-8562-792EBCB2B7CB} Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{E95724CB-92D8-4AF7-8562-792EBCB2B7CB}@Type 0 Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{E95724CB-92D8-4AF7-8562-792EBCB2B7CB}@Path C:\Users\Ann\Desktop\Pliki\Koty badania\Wyniki Fay\MUSZY?SKA ANNA, 20160618140710.pdf Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{E95724CB-92D8-4AF7-8562-792EBCB2B7CB}@DisplayName MUSZY?SKA ANNA, 20160618140710 Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{E95724CB-92D8-4AF7-8562-792EBCB2B7CB}@LastAccessedTime 0x00 0x00 0x00 0x00 ... Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{E95724CB-92D8-4AF7-8562-792EBCB2B7CB}@Points 0x00 0x00 0x00 0x00 Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{E9AB0173-829A-4AE0-ABEF-01E44899482C} Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{E9AB0173-829A-4AE0-ABEF-01E44899482C}@Type 0 Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{E9AB0173-829A-4AE0-ABEF-01E44899482C}@Path C:\Users\Ann\Desktop\Torment Tides of Numenera - Review Guide.pdf Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{E9AB0173-829A-4AE0-ABEF-01E44899482C}@DisplayName Torment Tides of Numenera - Review Guide Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{E9AB0173-829A-4AE0-ABEF-01E44899482C}@LastAccessedTime 0x00 0x00 0x00 0x00 ... Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{E9AB0173-829A-4AE0-ABEF-01E44899482C}@Points 0x00 0x00 0x00 0x00 Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{FAC27DD0-4FCE-4740-9653-852F211EAB04} Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{FAC27DD0-4FCE-4740-9653-852F211EAB04}@Type 0 Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{FAC27DD0-4FCE-4740-9653-852F211EAB04}@Path C:\Users\Ann\Desktop\3964452_100014004797.pdf Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{FAC27DD0-4FCE-4740-9653-852F211EAB04}@DisplayName 3964452_100014004797 Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{FAC27DD0-4FCE-4740-9653-852F211EAB04}@LastAccessedTime 0x00 0x00 0x00 0x00 ... Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A0C03514-7A96-4234-A7DB-A3F5A28D7F7A}\RecentItems\{FAC27DD0-4FCE-4740-9653-852F211EAB04}@Points 0x00 0x00 0x00 0x00 Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{B371DEB9-0291-43FF-83D7-B98BB845187F}@LastAccessedTime 0x90 0xA6 0xB7 0xB6 ... Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{B371DEB9-0291-43FF-83D7-B98BB845187F}@LaunchCount 1 Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{B371DEB9-0291-43FF-83D7-B98BB845187F}\RecentItems\{3DB025AD-35C4-4D17-AB29-F6EB7A489FCC} Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{B371DEB9-0291-43FF-83D7-B98BB845187F}\RecentItems\{3DB025AD-35C4-4D17-AB29-F6EB7A489FCC}@Type 0 Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{B371DEB9-0291-43FF-83D7-B98BB845187F}\RecentItems\{3DB025AD-35C4-4D17-AB29-F6EB7A489FCC}@Path C:\xperf\xbootmgr.log Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{B371DEB9-0291-43FF-83D7-B98BB845187F}\RecentItems\{3DB025AD-35C4-4D17-AB29-F6EB7A489FCC}@DisplayName xbootmgr Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{B371DEB9-0291-43FF-83D7-B98BB845187F}\RecentItems\{3DB025AD-35C4-4D17-AB29-F6EB7A489FCC}@LastAccessedTime 0x00 0x00 0x00 0x00 ... Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{B371DEB9-0291-43FF-83D7-B98BB845187F}\RecentItems\{3DB025AD-35C4-4D17-AB29-F6EB7A489FCC}@Points 0x00 0x00 0x00 0x00 Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{BB37B2DF-9281-4203-BD49-01770C96C761} Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{BB37B2DF-9281-4203-BD49-01770C96C761}@LastAccessedTime 0x20 0x65 0x9F 0x8D ... Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{BB37B2DF-9281-4203-BD49-01770C96C761}@AppId {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\NapiProjekt\napisy.exe Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{BB37B2DF-9281-4203-BD49-01770C96C761}@LaunchCount 5 ---- Files - GMER 2.2 ---- File C:\Users\Ann\AppData\Local\Mozilla\Firefox\Profiles\5825hcn5.default-1480413091750\cache2\entries\240746A71F25E4B9EE2292698982FAB1A825BF3D 22658 bytes File C:\Users\Ann\AppData\Local\Mozilla\Firefox\Profiles\5825hcn5.default-1480413091750\cache2\entries\0273B9290E45B41513BABFAE4FD5F03D069893C4 17657 bytes File C:\Users\Ann\AppData\Local\Mozilla\Firefox\Profiles\5825hcn5.default-1480413091750\cache2\entries\5A58664411C82DD283512FD33F5C496B4441825F 22962 bytes File C:\Users\Ann\AppData\Local\Mozilla\Firefox\Profiles\5825hcn5.default-1480413091750\cache2\entries\D546C5FC28351224F31922CF59EB848A2714E612 26179 bytes File C:\Users\Ann\AppData\Local\Mozilla\Firefox\Profiles\5825hcn5.default-1480413091750\cache2\entries\6819BA2D5191615581778F6462A77E261E9A7DBE 19000 bytes File C:\Users\Ann\AppData\Local\Mozilla\Firefox\Profiles\5825hcn5.default-1480413091750\cache2\entries\777F9A0F485E4E317A964717F8F268A1835F56C0 0 bytes File C:\Users\Ann\AppData\Local\Mozilla\Firefox\Profiles\5825hcn5.default-1480413091750\cache2\entries\1FA3DB88C2C455AA63620456FC166308DF8F2074 0 bytes File C:\Users\Ann\AppData\Local\Mozilla\Firefox\Profiles\5825hcn5.default-1480413091750\cache2\entries\710FF7A64132F38511B37142D041E753ADF355A1 0 bytes File C:\Users\Ann\AppData\Local\Mozilla\Firefox\Profiles\5825hcn5.default-1480413091750\cache2\entries\1BADA2F17D3665B51A0BD6E01BF121564A7CD11C 0 bytes File C:\Users\Ann\AppData\Local\Mozilla\Firefox\Profiles\5825hcn5.default-1480413091750\cache2\entries\2A571775987D0CC42B6C87AE3706CFA9264F66BE 0 bytes File C:\Users\Ann\AppData\Local\Mozilla\Firefox\Profiles\5825hcn5.default-1480413091750\cache2\entries\826200D3B325CBE995A6B1A620DE2EF8DC32BE3B 0 bytes File C:\Users\Ann\AppData\Local\Mozilla\Firefox\Profiles\5825hcn5.default-1480413091750\cache2\entries\6D5B5D32E87478DAC71E7B21941D57B68C44B052 0 bytes File C:\Users\Ann\AppData\Local\Mozilla\Firefox\Profiles\5825hcn5.default-1480413091750\cache2\entries\10767569EDBB831502C977C8A3211DE56732BE81 0 bytes File C:\Windows\Temp\_avast_\ws000001BC.tmp 0 bytes ---- EOF - GMER 2.2 ----