GMER 2.2.19882 - http://www.gmer.net
Rootkit scan 2017-03-29 18:30:15
Windows 6.2.9200  x64 
Running: z1w226r1.exe


---- Registry - GMER 2.2 ----

Reg  HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Configuration\BOE06100_01_07DE_04^62DF3EB62B57094435B2926B3BC51C22@Timestamp                                                                                                                       0x02 0xE8 0x3C 0x85 ...
Reg  HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel\RNG@RNGAuxiliarySeed                                                                                                                                                                        1890238222
Reg  HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@TotalResumeTime                                                                                                                                                                              32136250
Reg  HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@KernelReturnFromHandlerTimestamp                                                                                                                                                             32135537
Reg  HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@SleeperThreadEndTimestamp                                                                                                                                                                    32135537
Reg  HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@KernelReturnSystemPowerState                                                                                                                                                                 32135969
Reg  HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@DeviceResumeTime                                                                                                                                                                             342
Reg  HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@ResumeCompleteTimestamp                                                                                                                                                                      0xB6 0xE4 0xE8 0x0A ...
Reg  HKLM\SYSTEM\CurrentControlSet\Services\aswRvrt\Parameters\Instup_14899149914682288@SetupOperations                                                                                                                                                       ???7?????7?8?8?8?8?9?9?9?9?:?:?:?:?;?????????+??? ???????6?????;?????;??????????P?<?????????aswSnx???????7??????????????MoveFile("\??\C:\Program Files\AVAST Software\Avast\HTM916E.tmp","\??\C:\Program Files\AVAST Software\Avast\HTMLayout.dll",TRUE)?MoveFile("\??\C:\Program Files\AVAST Software\Avast\avB925B.tmp","\??\C:\Program Files\AVAST Software\Avast\avBugReport.exe",TRUE)?MoveFile("\??\C:\Program Files\AVAST Software\Avast\AvD92AC.tmp","\??\C:\Program Files\AVAST Software\Avast\AvDump32.exe",TRUE)?MoveFile("\??\C:\Program Files\AVAST Software\Avast\x64\AvD92FC.tmp","\??\C:\Program Files\AVAST Software\Avast\x64\AvDump64.exe",TRUE)?MoveFile("\??\C:\Program Files\AVAST Software\Avast\aswF36C.tmp","\??\C:\Program Files\AVAST Software\Avast\aswcmlx.dll",TRUE)?MoveFile("\??\C:\Program Files\AVAST Software\Avast\aswF37D.tmp","\??\C:\Program Files\AVAST Software\Avast\aswsysx.dll",TRUE)?MoveFile("\??\C:\Program Files\AVAST Software\Avast\gamF3E2.tmp","\??\C:\Program Files\AVAST Software\Avast\gaming_hook.exe",
Reg  HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\f4066972039d                                                                                                                                                                              
Reg  HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\f4066972039d@a0143d6b86b2                                                                                                                                                                 0xD9 0xD8 0x5A 0xCA ...
Reg  HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\f4066972039d@fca89abe4de2                                                                                                                                                                 0xC7 0x31 0xCA 0x24 ...
Reg  HKLM\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\Isatap\{1AC0E203-508D-486A-B992-93A9A2C12DC3}@DefunctTimestamp                                                                                                                                0x67 0x93 0xDA 0x58 ...
Reg  HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch@Epoch                                                                                                                                                                                          7839
Reg  HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch2@Epoch                                                                                                                                                                                         1718
Reg  HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules@{E3BFD756-EF5F-4658-BC49-A3808954F28B}                                                                                                                       v2.26|Action=Allow|Active=TRUE|Dir=Out|Profile=Domain|Profile=Private|Profile=Public|Name=@{Microsoft.BingWeather_4.18.37.0_x86__8wekyb3d8bbwe?ms-resource://Microsoft.BingWeather/Resources/ApplicationTitleWithBranding}|Desc=@{Microsoft.BingWeather_4.18.37.0_x86__8wekyb3d8bbwe?ms-resource://Microsoft.BingWeather/Resources/ApplicationTitleWithBranding}|LUOwn=S-1-5-21-361105629-845945016-2579162131-1000|AppPkgId=S-1-15-2-2040986369-264322980-3882385089-1970153872-3662121739-3363227934-2464603330|EmbedCtxt=@{Microsoft.BingWeather_4.18.37.0_x86__8wekyb3d8bbwe?ms-resource://Microsoft.BingWeather/Resources/ApplicationTitleWithBranding}|Platform=2:6:2|Platform2=GTEQ|
Reg  HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules@{614096B2-F061-4EB3-816B-E952966425E2}                                                                                                                       v2.26|Action=Allow|Active=TRUE|Dir=In|Profile=Domain|Profile=Private|Name=@{Microsoft.BingWeather_4.18.37.0_x86__8wekyb3d8bbwe?ms-resource://Microsoft.BingWeather/Resources/ApplicationTitleWithBranding}|Desc=@{Microsoft.BingWeather_4.18.37.0_x86__8wekyb3d8bbwe?ms-resource://Microsoft.BingWeather/Resources/ApplicationTitleWithBranding}|LUOwn=S-1-5-21-361105629-845945016-2579162131-1000|AppPkgId=S-1-15-2-2040986369-264322980-3882385089-1970153872-3662121739-3363227934-2464603330|EmbedCtxt=@{Microsoft.BingWeather_4.18.37.0_x86__8wekyb3d8bbwe?ms-resource://Microsoft.BingWeather/Resources/ApplicationTitleWithBranding}|Platform=2:6:2|Platform2=GTEQ|
Reg  HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules@{134D6172-66BF-40A8-8669-A148D3005D1F}                                                                                                                       v2.26|Action=Allow|Active=TRUE|Dir=Out|Profile=Domain|Profile=Private|Profile=Public|Name=@{Microsoft.WindowsMaps_5.1611.3342.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsMaps/Resources/AppStoreName}|Desc=@{Microsoft.WindowsMaps_5.1611.3342.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsMaps/Resources/AppStoreName}|LUOwn=S-1-5-21-361105629-845945016-2579162131-1000|AppPkgId=S-1-15-2-1239072475-3687740317-1842961305-3395936705-4023953123-1525404051-2779347315|EmbedCtxt=@{Microsoft.WindowsMaps_5.1611.3342.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsMaps/Resources/AppStoreName}|Platform=2:6:2|Platform2=GTEQ|
Reg  HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules@{DF2A0D66-9C56-465B-9B2D-F9E4238E0B87}                                                                                                                       v2.26|Action=Allow|Active=TRUE|Dir=Out|Profile=Domain|Profile=Private|Profile=Public|Name=@{E046963F.LenovoCompanion_3.70.1.0_x86__k1h2ywk1493x8?ms-resource://E046963F.LenovoCompanion/Resources/AppName}|Desc=@{E046963F.LenovoCompanion_3.70.1.0_x86__k1h2ywk1493x8?ms-resource://E046963F.LenovoCompanion/Resources/AppName}|LUOwn=S-1-5-21-361105629-845945016-2579162131-1000|AppPkgId=S-1-15-2-4089219695-2918877493-2298198654-3910773282-1202009102-2725390625-3479975918|EmbedCtxt=@{E046963F.LenovoCompanion_3.70.1.0_x86__k1h2ywk1493x8?ms-resource://E046963F.LenovoCompanion/Resources/AppName}|Platform=2:6:2|Platform2=GTEQ|
Reg  HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System@{3A71C769-06B1-43F2-8A85-DAC79BD5ABA8}                                                                                              v2.26|Action=Block|Active=TRUE|Dir=In|Name=@{Microsoft.BingWeather_4.18.37.0_x86__8wekyb3d8bbwe?ms-resource://Microsoft.BingWeather/Resources/ApplicationTitleWithBranding}|Desc=@{Microsoft.BingWeather_4.18.37.0_x86__8wekyb3d8bbwe?ms-resource://Microsoft.BingWeather/Resources/ApplicationTitleWithBranding}|LUOwn=S-1-5-21-361105629-845945016-2579162131-1000|AppPkgId=S-1-15-2-2040986369-264322980-3882385089-1970153872-3662121739-3363227934-2464603330|EmbedCtxt=@{Microsoft.BingWeather_4.18.37.0_x86__8wekyb3d8bbwe?ms-resource://Microsoft.BingWeather/Resources/ApplicationTitleWithBranding}|
Reg  HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System@{488706D6-58DF-4131-82A8-E4BC8EFF93D8}                                                                                              v2.26|Action=Block|Active=TRUE|Dir=Out|Name=@{Microsoft.BingWeather_4.18.37.0_x86__8wekyb3d8bbwe?ms-resource://Microsoft.BingWeather/Resources/ApplicationTitleWithBranding}|Desc=@{Microsoft.BingWeather_4.18.37.0_x86__8wekyb3d8bbwe?ms-resource://Microsoft.BingWeather/Resources/ApplicationTitleWithBranding}|LUOwn=S-1-5-21-361105629-845945016-2579162131-1000|AppPkgId=S-1-15-2-2040986369-264322980-3882385089-1970153872-3662121739-3363227934-2464603330|EmbedCtxt=@{Microsoft.BingWeather_4.18.37.0_x86__8wekyb3d8bbwe?ms-resource://Microsoft.BingWeather/Resources/ApplicationTitleWithBranding}|
Reg  HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System@{211023AE-1443-48CB-96DC-655E08EE9D36}                                                                                              v2.26|Action=Allow|Active=TRUE|Dir=In|Profile=Domain|Profile=Private|Profile=Public|RA42=IntrAnet|RA62=IntrAnet|Name=@{Microsoft.BingWeather_4.18.37.0_x86__8wekyb3d8bbwe?ms-resource://Microsoft.BingWeather/Resources/ApplicationTitleWithBranding}|Desc=@{Microsoft.BingWeather_4.18.37.0_x86__8wekyb3d8bbwe?ms-resource://Microsoft.BingWeather/Resources/ApplicationTitleWithBranding}|LUAuth=O:LSD:(A;;CC;;;S-1-15-3-3)(A;;CC;;;WD)(A;;CC;;;AN)|LUOwn=S-1-5-21-361105629-845945016-2579162131-1000|AppPkgId=S-1-15-2-2040986369-264322980-3882385089-1970153872-3662121739-3363227934-2464603330|EmbedCtxt=@{Microsoft.BingWeather_4.18.37.0_x86__8wekyb3d8bbwe?ms-resource://Microsoft.BingWeather/Resources/ApplicationTitleWithBranding}|
Reg  HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System@{493E130C-EC54-4127-922F-A8AA078E8E98}                                                                                              v2.26|Action=Allow|Active=TRUE|Dir=Out|Profile=Domain|Profile=Private|Profile=Public|RA42=IntrAnet|RA62=IntrAnet|Name=@{Microsoft.BingWeather_4.18.37.0_x86__8wekyb3d8bbwe?ms-resource://Microsoft.BingWeather/Resources/ApplicationTitleWithBranding}|Desc=@{Microsoft.BingWeather_4.18.37.0_x86__8wekyb3d8bbwe?ms-resource://Microsoft.BingWeather/Resources/ApplicationTitleWithBranding}|LUAuth=O:LSD:(A;;CC;;;S-1-15-3-3)(A;;CC;;;WD)(A;;CC;;;AN)|LUOwn=S-1-5-21-361105629-845945016-2579162131-1000|AppPkgId=S-1-15-2-2040986369-264322980-3882385089-1970153872-3662121739-3363227934-2464603330|EmbedCtxt=@{Microsoft.BingWeather_4.18.37.0_x86__8wekyb3d8bbwe?ms-resource://Microsoft.BingWeather/Resources/ApplicationTitleWithBranding}|
Reg  HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System@{9342F55F-C0FF-4E6A-A60E-B98770CC0A23}                                                                                              v2.26|Action=Allow|Active=TRUE|Dir=In|Profile=Private|Profile=Public|RA42=RmtIntrAnet|RA62=RmtIntrAnet|Name=@{Microsoft.BingWeather_4.18.37.0_x86__8wekyb3d8bbwe?ms-resource://Microsoft.BingWeather/Resources/ApplicationTitleWithBranding}|Desc=@{Microsoft.BingWeather_4.18.37.0_x86__8wekyb3d8bbwe?ms-resource://Microsoft.BingWeather/Resources/ApplicationTitleWithBranding}|LUAuth=O:LSD:(A;;CC;;;S-1-15-3-3)(A;;CC;;;WD)(A;;CC;;;AN)|LUOwn=S-1-5-21-361105629-845945016-2579162131-1000|AppPkgId=S-1-15-2-2040986369-264322980-3882385089-1970153872-3662121739-3363227934-2464603330|EmbedCtxt=@{Microsoft.BingWeather_4.18.37.0_x86__8wekyb3d8bbwe?ms-resource://Microsoft.BingWeather/Resources/ApplicationTitleWithBranding}|Security=Authenticate|
Reg  HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System@{04CBB286-4944-4C2B-9E30-937AFA68EA2A}                                                                                              v2.26|Action=Allow|Active=TRUE|Dir=Out|Profile=Private|Profile=Public|RA42=RmtIntrAnet|RA62=RmtIntrAnet|Name=@{Microsoft.BingWeather_4.18.37.0_x86__8wekyb3d8bbwe?ms-resource://Microsoft.BingWeather/Resources/ApplicationTitleWithBranding}|Desc=@{Microsoft.BingWeather_4.18.37.0_x86__8wekyb3d8bbwe?ms-resource://Microsoft.BingWeather/Resources/ApplicationTitleWithBranding}|LUAuth=O:LSD:(A;;CC;;;S-1-15-3-3)(A;;CC;;;WD)(A;;CC;;;AN)|LUOwn=S-1-5-21-361105629-845945016-2579162131-1000|AppPkgId=S-1-15-2-2040986369-264322980-3882385089-1970153872-3662121739-3363227934-2464603330|EmbedCtxt=@{Microsoft.BingWeather_4.18.37.0_x86__8wekyb3d8bbwe?ms-resource://Microsoft.BingWeather/Resources/ApplicationTitleWithBranding}|Security=Authenticate|
Reg  HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System@{5FB9F42B-57C3-43C4-BAD4-D70D0C72C6D0}                                                                                              v2.26|Action=Allow|Active=TRUE|Dir=Out|Profile=Domain|Profile=Private|Profile=Public|RA42=IntErnet|RA62=IntErnet|Name=@{Microsoft.BingWeather_4.18.37.0_x86__8wekyb3d8bbwe?ms-resource://Microsoft.BingWeather/Resources/ApplicationTitleWithBranding}|Desc=@{Microsoft.BingWeather_4.18.37.0_x86__8wekyb3d8bbwe?ms-resource://Microsoft.BingWeather/Resources/ApplicationTitleWithBranding}|LUAuth=O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN)|LUOwn=S-1-5-21-361105629-845945016-2579162131-1000|AppPkgId=S-1-15-2-2040986369-264322980-3882385089-1970153872-3662121739-3363227934-2464603330|EmbedCtxt=@{Microsoft.BingWeather_4.18.37.0_x86__8wekyb3d8bbwe?ms-resource://Microsoft.BingWeather/Resources/ApplicationTitleWithBranding}|
Reg  HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System@{BAAA8F6F-B370-4743-94D2-B3F6BBB7B5C6}                                                                                              v2.26|Action=Block|Active=TRUE|Dir=In|Name=@{Microsoft.WindowsMaps_5.1611.3342.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsMaps/Resources/AppStoreName}|Desc=@{Microsoft.WindowsMaps_5.1611.3342.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsMaps/Resources/AppStoreName}|LUOwn=S-1-5-21-361105629-845945016-2579162131-1000|AppPkgId=S-1-15-2-1239072475-3687740317-1842961305-3395936705-4023953123-1525404051-2779347315|EmbedCtxt=@{Microsoft.WindowsMaps_5.1611.3342.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsMaps/Resources/AppStoreName}|
Reg  HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System@{8C57843D-74E0-428B-97A6-16F30441389B}                                                                                              v2.26|Action=Block|Active=TRUE|Dir=Out|Name=@{Microsoft.WindowsMaps_5.1611.3342.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsMaps/Resources/AppStoreName}|Desc=@{Microsoft.WindowsMaps_5.1611.3342.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsMaps/Resources/AppStoreName}|LUOwn=S-1-5-21-361105629-845945016-2579162131-1000|AppPkgId=S-1-15-2-1239072475-3687740317-1842961305-3395936705-4023953123-1525404051-2779347315|EmbedCtxt=@{Microsoft.WindowsMaps_5.1611.3342.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsMaps/Resources/AppStoreName}|
Reg  HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System@{58219B3E-69C8-4BE4-965E-AE619A18EEA4}                                                                                              v2.26|Action=Allow|Active=TRUE|Dir=Out|Profile=Domain|Profile=Private|Profile=Public|RA42=IntErnet|RA62=IntErnet|Name=@{Microsoft.WindowsMaps_5.1611.3342.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsMaps/Resources/AppStoreName}|Desc=@{Microsoft.WindowsMaps_5.1611.3342.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsMaps/Resources/AppStoreName}|LUAuth=O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN)|LUOwn=S-1-5-21-361105629-845945016-2579162131-1000|AppPkgId=S-1-15-2-1239072475-3687740317-1842961305-3395936705-4023953123-1525404051-2779347315|EmbedCtxt=@{Microsoft.WindowsMaps_5.1611.3342.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.WindowsMaps/Resources/AppStoreName}|
Reg  HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System@{FA6D234E-CA95-4CA7-8AC2-17AABF1A332B}                                                                                              v2.26|Action=Block|Active=TRUE|Dir=In|Name=@{E046963F.LenovoCompanion_3.70.1.0_x86__k1h2ywk1493x8?ms-resource://E046963F.LenovoCompanion/Resources/AppName}|Desc=@{E046963F.LenovoCompanion_3.70.1.0_x86__k1h2ywk1493x8?ms-resource://E046963F.LenovoCompanion/Resources/AppName}|LUOwn=S-1-5-21-361105629-845945016-2579162131-1000|AppPkgId=S-1-15-2-4089219695-2918877493-2298198654-3910773282-1202009102-2725390625-3479975918|EmbedCtxt=@{E046963F.LenovoCompanion_3.70.1.0_x86__k1h2ywk1493x8?ms-resource://E046963F.LenovoCompanion/Resources/AppName}|
Reg  HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System@{47611E41-C592-4AF6-B0EE-F3DE36BB5B28}                                                                                              v2.26|Action=Block|Active=TRUE|Dir=Out|Name=@{E046963F.LenovoCompanion_3.70.1.0_x86__k1h2ywk1493x8?ms-resource://E046963F.LenovoCompanion/Resources/AppName}|Desc=@{E046963F.LenovoCompanion_3.70.1.0_x86__k1h2ywk1493x8?ms-resource://E046963F.LenovoCompanion/Resources/AppName}|LUOwn=S-1-5-21-361105629-845945016-2579162131-1000|AppPkgId=S-1-15-2-4089219695-2918877493-2298198654-3910773282-1202009102-2725390625-3479975918|EmbedCtxt=@{E046963F.LenovoCompanion_3.70.1.0_x86__k1h2ywk1493x8?ms-resource://E046963F.LenovoCompanion/Resources/AppName}|
Reg  HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System@{0626AD9A-01E6-4BD5-BC01-5C1D5ADBBE32}                                                                                              v2.26|Action=Allow|Active=TRUE|Dir=Out|Profile=Domain|Profile=Private|Profile=Public|RA42=IntErnet|RA62=IntErnet|Name=@{E046963F.LenovoCompanion_3.70.1.0_x86__k1h2ywk1493x8?ms-resource://E046963F.LenovoCompanion/Resources/AppName}|Desc=@{E046963F.LenovoCompanion_3.70.1.0_x86__k1h2ywk1493x8?ms-resource://E046963F.LenovoCompanion/Resources/AppName}|LUAuth=O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN)|LUOwn=S-1-5-21-361105629-845945016-2579162131-1000|AppPkgId=S-1-15-2-4089219695-2918877493-2298198654-3910773282-1202009102-2725390625-3479975918|EmbedCtxt=@{E046963F.LenovoCompanion_3.70.1.0_x86__k1h2ywk1493x8?ms-resource://E046963F.LenovoCompanion/Resources/AppName}|
Reg  HKLM\SYSTEM\CurrentControlSet\Services\SynTP\Parameters@DetectTimeMS                                                                                                                                                                                     617
Reg  HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{215b5f6a-09f0-45cf-be74-f859a0f29cd5}@LeaseObtainedTime                                                                                                                              1490719867
Reg  HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{215b5f6a-09f0-45cf-be74-f859a0f29cd5}@T1                                                                                                                                             1490763067
Reg  HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{215b5f6a-09f0-45cf-be74-f859a0f29cd5}@T2                                                                                                                                             1490795467
Reg  HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{215b5f6a-09f0-45cf-be74-f859a0f29cd5}@LeaseTerminatesTime                                                                                                                            1490806267
Reg  HKLM\SYSTEM\CurrentControlSet\Services\W32Time\SecureTimeLimits@SecureTimeEstimated                                                                                                                                                                      0xAF 0xD4 0xCE 0xC6 ...
Reg  HKLM\SYSTEM\CurrentControlSet\Services\W32Time\SecureTimeLimits@SecureTimeHigh                                                                                                                                                                           0xAF 0x3C 0x93 0x28 ...
Reg  HKLM\SYSTEM\CurrentControlSet\Services\W32Time\SecureTimeLimits@SecureTimeLow                                                                                                                                                                            0xAF 0x6C 0x0A 0x65 ...
Reg  HKLM\SYSTEM\CurrentControlSet\Services\WmiApRpl\Performance@Object List                                                                                                                                                                                  50396 50402 50414 50424 50434 50454 50498 50508 50546 50552 50568
Reg  HKLM\SYSTEM\CurrentControlSet\Services\WmiApRpl\Performance@Last Counter                                                                                                                                                                                 50574
Reg  HKLM\SYSTEM\CurrentControlSet\Services\WmiApRpl\Performance@Last Help                                                                                                                                                                                    50575
Reg  HKLM\SYSTEM\CurrentControlSet\Services\WmiApRpl\Performance@First Counter                                                                                                                                                                                50396
Reg  HKLM\SYSTEM\CurrentControlSet\Services\WmiApRpl\Performance@First Help                                                                                                                                                                                   50397
Reg  HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\0@Rw                                                                                                                                                                                                       0x64 0x62 0x03 0x00 ...
Reg  HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\0@RwMask                                                                                                                                                                                                   0x64 0x62 0x03 0x00 ...
Reg  HKLM\SYSTEM\Setup\Upgrade\Pnp\CurrentControlSet\Control\DeviceMigration\Devices\SWD\DAFUPNPPROVIDER\UUID:0BEBC200-00C8-1000-87C7-50856966417B\Interfaces\{d0875fb4-2196-4c7a-a63d-e416addd60a1}\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000E@  0x64 0x62 0x04 0x00 ...
Reg  HKLM\SYSTEM\Setup\Upgrade\Pnp\CurrentControlSet\Control\DeviceMigration\Devices\SWD\DAFUPNPPROVIDER\UUID:0BEBC200-00C8-1000-87C7-50856966417B\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000E@                                                    0x64 0x62 0x04 0x00 ...
Reg  HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\SuggestedApps@Facebook.InstagramBeta_8xx8rvfyw5nnt                                                                                                                                 1
Reg  HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceSetup@AppInstallNotificationChangeStamp                                                                                                                                                             397
Reg  HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceSetup@AppUninstallNotificationChangeStamp                                                                                                                                                           330
Reg  HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer@GlobalAssocChangedCounter                                                                                                                                                                        284
Reg  HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Lock Screen\Creative@CreativeId                                                                                                                                                                           1490560285`WW_83000000000266150_PL`0`eec709657f904cd39f5afb3ada1e7205`82800`279978`0
Reg  HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Lock Screen\Creative@PortraitAssetPath                                                                                                                                                                    C:\Users\Damian\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\Assets\69d01cc59c664004a64e73460baf29495c838986e60c62c49856b362fb0db149
Reg  HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Lock Screen\Creative@LandscapeAssetPath                                                                                                                                                                   C:\Users\Damian\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\Assets\c2a92038867c66bea6ec99a9dd2e24615617184250d16764e96e9185caf4a3cc
Reg  HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Lock Screen\Creative@CreativeJson                                                                                                                                                                         {"cdm":{"creativeId":"1490560285`WW_83000000000266150_PL`0`eec709657f904cd39f5afb3ada1e7205`82800`279978`0","placementId":"LockScreen","impressionToken":"_imp","assetFolderRootPath":"C:\\Users\\Damian\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets","imagePairIndex":"001","feedbackEvents":{"onHover":"impr|83000000000266150","onPositiveFeedback":"pos|83000000000266150","onNegativeFeedback":"neg|83000000000266150","feedbackProvided":false}},"assets":{"image_fullscreen_001_landscape":{"t":"img","w":"1920","h":"1080","u":"c2a92038867c66bea6ec99a9dd2e24615617184250d16764e96e9185caf4a3cc","sha256":"n/cG3SGgyvJqZrzkNDfaZp84xuvefIMgrF2OvBn35i0=","fileSize":"752860"},"image_fullscreen_001_portrait":{"t":"img","w":"1080","h":"1920","u":"69d01cc59c664004a64e73460baf29495c838986e60c62c49856b362fb0db149","sha256":"Pg1s3NlT5MRLnYQHqPWjnjCsQfUo7xBni4ranwV1Fwc=","fileSize":"500304"},"tr_hint_hs1_1":{"t":"url","u":"https://g.msn.com/_2AD000LD/83000000000266150.1??&&PID=40
Reg  HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications@TimestampWhenSeen                                                                                                                                                                           0x69 0xD0 0x5D 0xE9 ...
Reg  HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search@JumpListChangedAppIds                                                                                                                                                                              windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel?OperaSoftware.OperaWebBrowser.1446631121?BS.Player.bsplayer.com.BST.v2?{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\notepad.exe?
Reg  HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\JumplistData@windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel                                                                                                   0xB9 0x3E 0x8F 0x92 ...
Reg  HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\JumplistData@OperaSoftware.OperaWebBrowser.1446631121                                                                                                                                              0x51 0x89 0xD1 0x62 ...
Reg  HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\JumplistData@BS.Player.bsplayer.com.BST.v2                                                                                                                                                         0xDB 0xAD 0x6F 0xF2 ...
Reg  HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\JumplistData@{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\notepad.exe                                                                                                                                    0x73 0xE6 0x11 0xEE ...
Reg  HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{263CCDF8-62ED-483B-BF8C-C09D79B05322}@LastAccessedTime                                                                                                                                 0x30 0x9E 0x60 0x5D ...
Reg  HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{263CCDF8-62ED-483B-BF8C-C09D79B05322}@LaunchCount                                                                                                                                      3
Reg  HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{C071788E-3E04-4B0F-8B71-F296199EF948}                                                                                                                                                  
Reg  HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{C071788E-3E04-4B0F-8B71-F296199EF948}@LastAccessedTime                                                                                                                                 0xA0 0x0E 0x41 0xDB ...
Reg  HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{C071788E-3E04-4B0F-8B71-F296199EF948}@AppId                                                                                                                                            Microsoft.AutoGenerated.{0E96F05B-4741-C44B-8B86-3D57F348BED0}
Reg  HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{C071788E-3E04-4B0F-8B71-F296199EF948}@LaunchCount                                                                                                                                      2
Reg  HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{F3D75874-AB0F-4DF6-9AD4-B2C03004B691}@LastAccessedTime                                                                                                                                 0xD0 0x69 0x94 0xD6 ...
Reg  HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{F3D75874-AB0F-4DF6-9AD4-B2C03004B691}@LaunchCount                                                                                                                                      3
Reg  HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Security and Maintenance@MessageTime                                                                                                                                                                      0x27 0x8B 0x45 0xF0 ...
Reg  HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\UFH\SHC@0                                                                                                                                                                                                 C:\Users\Damian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PXG Client.lnk?C:\Users\Damian\AppData\Roaming\pxgclient\pxgclient\client\launcher.exe?https://launchpage.org/?uid=qTxKBKjsgx1sXi94NiAPClNMb3q690ebUqnCbJHssxZjKEeyRMhspHf1XVWTpbZCHis%3D?
Reg  HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\UFH\SHC@1                                                                                                                                                                                                 C:\Users\Damian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PXG Client.lnk?C:\Users\Damian\AppData\Roaming\pxgclient\pxgclient\client\launcher.exe?https://launchpage.org/?uid=qTxKBKjsgx1sXi94NiAPClNMb3q690ebUqnCbJHssxZjKEeyRMhspHf1XVWTpbZCHis%3D?
Reg  HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\UFH\SHC@3                                                                                                                                                                                                 C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HTC\HTC Sync Manager\HTC Sync Manager.lnk?C:\Program Files (x86)\HTC\HTC Sync Manager\HTCSyncManager.exe??
Reg  HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\UFH\SHC@5                                                                                                                                                                                                 C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HTC\HTC Sync Manager\HTC Sync Manager.lnk?C:\Program Files (x86)\HTC\HTC Sync Manager\HTCSyncManager.exe??
Reg  HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\UFH\SHC@6                                                                                                                                                                                                 C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HTC\HTC Sync Manager\Uninstall HTC Sync Manager.lnk?C:\Windows\SysWOW64\msiexec.exe?/x {231D0C79-98A6-4693-A366-36DE7D7346EC}?
Reg  HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate@LastAutoAppUpdateSearchSuccessTime                                                                                                                                                          2017-03-28 16:49:57

---- EOF - GMER 2.2 ----