Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 08-09-2021
Ran by HOME-PC (administrator) on HOME-PC (Gigabyte Technology Co., Ltd. H81M-D3H) (08-09-2021 19:02:03)
Running from C:\Users\vesod\OneDrive\Desktop
Loaded Profiles: HOME-PC
Platform: Windows 10 Pro Version 21H1 19043.1165 (X64) Language: English (United States)
Default browser: Chrome
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Adobe Inc. -> Adobe Systems) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
(Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\amdow.exe
(Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\AMDRSServ.exe
(Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\AMDRSSrcExt.exe
(Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\cncmd.exe
(Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\RadeonSoftware.exe
(Advanced Micro Devices, Inc. -> AMD) C:\Windows\System32\DriverStore\FileRepository\u0368456.inf_amd64_fc65705fd5034968\B367348\atiesrxx.exe
(Arvato Digital Services Canada Inc -> arvato digital services llc) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Cent Studio) [File not signed] C:\Users\vesod\AppData\Local\CentBrowser\Application\chrome.exe <14>
(Code Sector -> ) C:\Program Files\TeraCopy\TeraCopyService.exe
(cv cryptovision GmbH) [File not signed] C:\Program Files (x86)\cv cryptovision\cv act sc interface\RegisterTool.exe
(gemalto -> Gemalto) C:\Program Files\SafeNet\Authentication\SAC\x64\SACMonitor.exe
(gemalto -> Gemalto) C:\Program Files\SafeNet\Authentication\SAC\x64\SACSRV.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\igfxEM.exe
(Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Users\vesod\AppData\Local\Microsoft\OneDrive\OneDrive.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Windows -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe <2>
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MoUsoCoreWorker.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\oobe\UserOOBEBroker.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Microsoft Windows Hardware Compatibility Publisher -> Advanced Micro Devices, Inc.) C:\Windows\System32\amdfendrsr.exe
(OpenBoxLab -> OpenBoxLab) C:\Program Files\OpenBoxLab\RaiDrive\RaiDrive.Service.x64.exe
(Petr Stepanets -> ) [File not signed] C:\Program Files (x86)\Postimage\postimage.exe
(philandro Software GmbH -> philandro Software GmbH) C:\Program Files (x86)\AnyDesk\AnyDesk.exe <2>
(Valve -> Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Valve -> Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe <7>
(Valve -> Valve Corporation) C:\Program Files (x86)\Steam\steam.exe

==================== Registry (Whitelisted) ===================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SACMonitor] => C:\Program Files\SafeNet\Authentication\SAC\x64\SACMonitor.exe [659888 2018-07-31] (gemalto -> Gemalto)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508128 2016-01-07] (Adobe Systems Incorporated -> Adobe Systems Incorporated)
HKU\S-1-5-21-3234571952-35909069-787371351-1001\...\Run: [Postimage] => C:\Program Files (x86)\Postimage\postimage.exe [16306936 2013-07-21] (Petr Stepanets -> ) [File not signed]
HKU\S-1-5-21-3234571952-35909069-787371351-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [4110568 2021-07-21] (Valve -> Valve Corporation)
HKU\S-1-5-21-3234571952-35909069-787371351-1001\...\Run: [5467EC2976B886185904149C18E7FE2C4ECD77E5._service_run] => "C:\Users\vesod\AppData\Local\CentBrowser\Application\chrome.exe" --type=service /prefetch:8
HKU\S-1-5-21-3234571952-35909069-787371351-1001\...\MountPoints2: {8af63dfb-c543-11ea-be89-74d4359d2527} - "F:\HiSuiteDownLoader.exe" 
HKLM\...\Windows x64\Print Processors\ssi2mPC: C:\Windows\System32\spool\prtprocs\x64\ssi2mpc.dll [41984 2013-05-07] (Microsoft Windows Hardware Compatibility Publisher -> Windows (R) Codename Longhorn DDK provider)
HKLM\...\Print\Monitors\Adobe PDF Port Monitor: C:\WINDOWS\system32\AdobePDF.dll [55432 2012-09-23] (Adobe Systems, Incorporated -> Adobe Systems Inc)
HKLM\...\Print\Monitors\ssi2m Langmon: C:\WINDOWS\system32\ssi2mlm.dll [34304 2011-06-12] (Microsoft Windows Hardware Compatibility Publisher -> )
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\93.0.4577.63\Installer\chrmstp.exe [2021-09-08] (Google LLC -> Google LLC)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AnyDesk.lnk [2020-01-18]
ShortcutTarget: AnyDesk.lnk -> C:\Program Files (x86)\AnyDesk\AnyDesk.exe (philandro Software GmbH -> philandro Software GmbH)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\cv act sc interface RegisterTool.lnk [2020-12-29]
ShortcutTarget: cv act sc interface RegisterTool.lnk -> C:\Program Files (x86)\cv cryptovision\cv act sc interface\RegisterTool.exe (cv cryptovision GmbH) [File not signed]
GroupPolicy: Restriction ? <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION

==================== Scheduled Tasks (Whitelisted) ============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {02852C31-150C-47DE-AD48-FAAF059F45C7} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1160408 2017-11-01] (Adobe Systems, Incorporated -> Adobe Systems Incorporated)
Task: {0F755328-278C-4283-AB53-993C0F60DA87} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [21858176 2021-08-23] (Microsoft Corporation -> Microsoft Corporation)
Task: {22145AA0-CCB7-41E5-9E3F-248294CBC0E6} - System32\Tasks\CorelUpdateHelperTaskCore => c:\Program Files (x86)\Corel\CUH\v2\CUH.exe [1662200 2019-02-27] (Corel Corporation -> Corel Corporation)
Task: {2EB95D6F-B89E-4FB0-B431-B97E3C79D137} - System32\Tasks\Microsoft\Office\Office Feature Updates => C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe [139128 2021-08-29] (Microsoft Corporation -> Microsoft Corporation)
Task: {4D485A58-CA92-4E91-AFB5-6988177C8087} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [156104 2020-01-18] (Google LLC -> Google LLC)
Task: {5F011B21-64CD-4ABB-9558-1F8DE6DF0BC8} - System32\Tasks\Mozilla\Firefox Default Browser Agent 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\default-browser-agent.exe [673720 2021-08-29] (Mozilla Corporation -> Mozilla Foundation)
Task: {70867FC9-13B0-40FB-A807-5DCB44BA13DA} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [156104 2020-01-18] (Google LLC -> Google LLC)
Task: {742F7367-ED1B-4304-81CD-CCC5297FB6E7} - System32\Tasks\Microsoft\Office\Office Feature Updates Logon => C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe [139128 2021-08-29] (Microsoft Corporation -> Microsoft Corporation)
Task: {7D66F0FD-3D1E-4A1B-972D-C6886FC69929} - System32\Tasks\AMDInstallLauncher => C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe [1713952 2021-05-11] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.)
Task: {866BF35F-FE33-4E21-8A58-FCB0A949128A} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files\Microsoft Office\root\Office16\msoia.exe [7053744 2021-08-29] (Microsoft Corporation -> Microsoft Corporation)
Task: {CA11B307-5E00-429D-B8D6-70B47EF1406D} - System32\Tasks\Microsoft\Office\Office Automatic Updates 2.0 => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [21858176 2021-08-23] (Microsoft Corporation -> Microsoft Corporation)
Task: {DECAA9FA-74E1-4CA7-B3E8-4957C474A9CE} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files\Microsoft Office\root\Office16\msoia.exe [7053744 2021-08-29] (Microsoft Corporation -> Microsoft Corporation)
Task: {E8AE6B45-D871-4109-B295-3ACA306C191B} - System32\Tasks\ModifyLinkUpdate => C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe [1713952 2021-05-11] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.)
Task: {F5062FC0-6381-4121-AC7C-C6AFDC77FB08} - System32\Tasks\StartDVR => C:\Program Files\AMD\CNext\CNext\RSServCmd.exe [268576 2021-05-11] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.)
Task: {FC64A7FD-9BB2-43F4-8474-B831A25D3AD3} - System32\Tasks\StartCN => C:\Program Files\AMD\CNext\CNext\cncmd.exe [62752 2021-05-11] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{433befec-0f56-4de4-a26b-6b31fafe9517}: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{433befec-0f56-4de4-a26b-6b31fafe9517}: [DhcpNameServer] 192.168.1.1

Edge: 
=======
DownloadDir: C:\Users\vesod\Downloads
Edge Extension: (No Name) -> AutoFormFill_5ED10D46BD7E47DEB1F3685D2C0FCE08 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\AutoFormFill [not found]
Edge Extension: (No Name) -> BookReader_B171F20233094AC88D05A8EF7B9763E8 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\BookViewer [not found]
Edge Extension: (No Name) -> LearningTools_7706F933-971C-41D1-9899-8A026EB5D824 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\LearningTools [not found]
Edge Extension: (No Name) -> PinJSAPI_EC01B57063BE468FAB6DB7EBFC3BF368 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\PinJSAPI [not found]
Edge DefaultProfile: Default
Edge Profile: C:\Users\vesod\AppData\Local\Microsoft\Edge\User Data\Default [2021-09-05]
Edge DownloadDir: Default -> C:\Users\vesod\Downloads
Edge Extension: (Outlook) - C:\Users\vesod\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\bjhmmnoficofgoiacjaajpkfndojknpb [2020-10-19]
Edge Extension: (Word) - C:\Users\vesod\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\hikhggiobiflkdfdgdajcfklmcibbopi [2020-10-19]
Edge Extension: (Excel) - C:\Users\vesod\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\leffmjdabcgaflkikcefahmlgpodjkdm [2020-10-19]
Edge Extension: (PowerPoint) - C:\Users\vesod\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\opfacbhaojodjaojgocnibmklknchehf [2020-10-19]
Edge HKLM-x32\...\Edge\Extension: [ihcjicgdanjaechkgeegckofjjedodee]

FireFox:
========
FF DefaultProfile: 9eldcl16.default
FF ProfilePath: C:\Users\vesod\AppData\Roaming\Mozilla\Firefox\Profiles\9eldcl16.default [2020-11-28]
FF ProfilePath: C:\Users\vesod\AppData\Roaming\Mozilla\Firefox\Profiles\lzt7vsnl.default-release [2021-09-06]
FF Notifications: Mozilla\Firefox\Profiles\lzt7vsnl.default-release -> hxxps://www.instagram.com
FF Extension: (AdGuard рекламен блокер) - C:\Users\vesod\AppData\Roaming\Mozilla\Firefox\Profiles\lzt7vsnl.default-release\Extensions\adguardadblocker@adguard.com.xpi [2021-08-30]
FF Extension: (Malwarebytes Browser Guard) - C:\Users\vesod\AppData\Roaming\Mozilla\Firefox\Profiles\lzt7vsnl.default-release\Extensions\{242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi [2021-08-30]
FF HKLM\...\Firefox\Extensions: [web2pdfextension.17@acrobat.adobe.com] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn\WebExtn\signed_extn\adobe_acrobat-1.0-windows.xpi
FF Extension: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn\WebExtn\signed_extn\adobe_acrobat-1.0-windows.xpi [2017-11-01]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension.17@acrobat.adobe.com] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn\WebExtn\signed_extn\adobe_acrobat-1.0-windows.xpi
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL [2021-06-26] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2015-07-29] (Adobe Systems Incorporated -> Adobe Systems)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\NPSPWRAP.DLL [2021-06-26] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Air\nppdf32.dll [2017-11-01] (Adobe Systems, Incorporated -> Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2015-07-29] (Adobe Systems Incorporated -> Adobe Systems)

Chrome: 
=======
CHR DefaultProfile: Default
CHR Profile: C:\Users\vesod\AppData\Local\Google\Chrome\User Data\Default [2021-09-07]
CHR DownloadDir: D:\Downloads
CHR HomePage: Default -> hxxp://www.google.com/
CHR StartupUrls: Default -> "hxxp://www.nap.bg/"
CHR Extension: (Google Translate) - C:\Users\vesod\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb [2021-08-29]
CHR Extension: (Slides) - C:\Users\vesod\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2020-01-18]
CHR Extension: (Prime VPN - Unlimited VPN service) - C:\Users\vesod\AppData\Local\Google\Chrome\User Data\Default\Extensions\akkbkhnikoeojlhiiomohpdnkhbkhieh [2020-11-07]
CHR Extension: (Docs) - C:\Users\vesod\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2020-01-18]
CHR Extension: (Google Drive) - C:\Users\vesod\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2020-10-29]
CHR Extension: (AdGuard AdBlocker) - C:\Users\vesod\AppData\Local\Google\Chrome\User Data\Default\Extensions\bgnkhhnnamicmpeenaelnjfhikgbkllg [2021-09-07]
CHR Extension: (DuckDuckGo) - C:\Users\vesod\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkdgflcldnnnapblkhphbgpggdiikppg [2021-09-07]
CHR Extension: (X-notifier (for Gmail™,Hotmail,Yahoo,AOL...)) - C:\Users\vesod\AppData\Local\Google\Chrome\User Data\Default\Extensions\cdfjbkbddpfnoplfhceolpopfoepleco [2021-01-19]
CHR Extension: (Sheets) - C:\Users\vesod\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2020-01-18]
CHR Extension: (Watcher for Yahoo! Mail™) - C:\Users\vesod\AppData\Local\Google\Chrome\User Data\Default\Extensions\gdipdemlhefmipmnlbejoccjegankhle [2021-03-01]
CHR Extension: (Google Docs Offline) - C:\Users\vesod\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2021-07-04]
CHR Extension: (IE Tab) - C:\Users\vesod\AppData\Local\Google\Chrome\User Data\Default\Extensions\hehijbfgiekmjfkfjpbkbammjbdenadd [2021-07-04]
CHR Extension: (Malwarebytes Browser Guard) - C:\Users\vesod\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihcjicgdanjaechkgeegckofjjedodee [2021-08-29]
CHR Extension: (Voice to Text) - C:\Users\vesod\AppData\Local\Google\Chrome\User Data\Default\Extensions\jdcdafhjjjfnkoeilnjmnadadaoehgdc [2021-07-18]
CHR Extension: (Google Forms) - C:\Users\vesod\AppData\Local\Google\Chrome\User Data\Default\Extensions\jhknlonaankphkkbnmjdlpehkinifeeg [2020-01-18]
CHR Extension: (BIODIGITAL HUMAN) - C:\Users\vesod\AppData\Local\Google\Chrome\User Data\Default\Extensions\meefjekipolcgabfgaclcpdkbghhmoah [2020-01-18]
CHR Extension: (Chrome Web Store Payments) - C:\Users\vesod\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2021-02-04]
CHR Extension: (Office) - C:\Users\vesod\AppData\Local\Google\Chrome\User Data\Default\Extensions\ocdlmjhbenodhlknglojajgokahchlkk [2020-10-09]
CHR Extension: (Cache Cleaner) - C:\Users\vesod\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfhofmknacogpholikhalfaicliiinii [2021-03-21]
CHR Extension: (Chrome Media Router) - C:\Users\vesod\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2021-08-13]
CHR Profile: C:\Users\vesod\AppData\Local\Google\Chrome\User Data\Guest Profile [2020-04-26]
CHR Profile: C:\Users\vesod\AppData\Local\Google\Chrome\User Data\System Profile [2020-04-26]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCChromeExtn\WCChromeExtn.crx [2017-11-01]
CHR HKLM-x32\...\Chrome\Extension: [ihcjicgdanjaechkgeegckofjjedodee]

==================== Services (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AdobeARMservice; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [88136 2019-09-11] (Adobe Inc. -> Adobe Systems)
R2 AnyDesk; C:\Program Files (x86)\AnyDesk\AnyDesk.exe [3743464 2021-03-09] (philandro Software GmbH -> philandro Software GmbH)
S2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [96056 2020-01-10] (Apple Inc. -> Apple Inc.)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [9166736 2021-08-23] (Microsoft Corporation -> Microsoft Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [7497336 2021-08-31] (Malwarebytes Inc -> Malwarebytes)
R2 PSI_SVC_2; c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe [277360 2014-04-30] (Arvato Digital Services Canada Inc -> arvato digital services llc)
R2 RaiDrive.Service; C:\Program Files\OpenBoxLab\RaiDrive\RaiDrive.Service.x64.exe [8256152 2020-10-13] (OpenBoxLab -> OpenBoxLab)
R2 SACSrv; C:\Program Files\SafeNet\Authentication\SAC\x64\SACSRV.exe [60848 2018-07-31] (gemalto -> Gemalto)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [5394872 2021-08-11] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 TeraCopyService.exe; C:\Program Files\TeraCopy\TeraCopyService.exe [114384 2021-04-21] (Code Sector -> )
S3 VBoxSDS; C:\Program Files\Oracle\VirtualBox\VBoxSDS.exe [746728 2021-07-28] (Oracle Corporation -> Oracle Corporation)
S3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2107.4-0\NisSrv.exe [2727416 2021-07-24] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 WinDefend; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2107.4-0\MsMpEng.exe [136656 2021-07-24] (Microsoft Windows Publisher -> Microsoft Corporation)
S2 Freemake Improver; C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [X]

===================== Drivers (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 A38CCID; C:\WINDOWS\system32\DRIVERS\a38ccid.sys [82480 2015-08-20] (Microsoft Windows Hardware Compatibility Publisher -> Advanced Card Systems Ltd.)
R3 AMDSAFD; C:\WINDOWS\System32\DriverStore\FileRepository\amdsafd.inf_amd64_8e2568524f674315\amdsafd.sys [100768 2021-03-29] (Microsoft Windows Hardware Compatibility Publisher -> Advanced Micro Devices)
R3 AMDXE; C:\WINDOWS\System32\drivers\amdxe.sys [62056 2020-07-27] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.)
R3 ampa; C:\WINDOWS\system32\ampa.sys [38320 2017-02-28] (CHENGDU AOMEI Tech Co., Ltd. -> )
S3 BthA2dp; C:\WINDOWS\System32\drivers\BthA2dp.sys [279040 2020-09-14] (Microsoft Corporation) [File not signed]
R1 cbfs6; C:\Windows\system32\drivers\cbfs6.sys [460992 2016-09-21] (EldoS Corporation -> /n software, Inc.)
S3 ddmdrv; C:\WINDOWS\system32\ddmdrv.sys [35760 2016-12-27] (CHENGDU AOMEI Tech Co., Ltd. -> )
R1 dokan1; C:\WINDOWS\System32\DRIVERS\dokan1.sys [131080 2019-07-24] (D3L -> Dokan Project)
R1 ESProtectionDriver; C:\WINDOWS\system32\drivers\mbae64.sys [160176 2021-08-31] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
S3 GemCCID; C:\WINDOWS\System32\drivers\GemCCID.sys [137712 2016-10-17] (Microsoft Windows Hardware Compatibility Publisher -> Gemalto)
R1 hideaway; C:\WINDOWS\System32\drivers\hideaway.sys [97816 2021-04-11] (Microsoft Windows Hardware Compatibility Publisher -> Firetrust Limited)
R2 MBAMChameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [210344 2021-08-31] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
S0 MbamElam; C:\WINDOWS\System32\DRIVERS\MbamElam.sys [19912 2020-12-21] (Microsoft Windows Early Launch Anti-malware Publisher -> Malwarebytes)
R3 MBAMFarflt; C:\WINDOWS\System32\DRIVERS\farflt.sys [198888 2021-08-31] (Malwarebytes Inc -> Malwarebytes)
R3 MBAMProtection; C:\WINDOWS\system32\DRIVERS\mbam.sys [68528 2021-08-31] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [248992 2021-06-24] (Malwarebytes Inc -> Malwarebytes)
R3 MBAMWebProtection; C:\WINDOWS\system32\DRIVERS\mwac.sys [149424 2021-08-31] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R1 networx; C:\WINDOWS\System32\drivers\networx.sys [72632 2016-09-20] (SOFTPERFECT PTY. LTD. -> NetFilterSDK.com)
S3 tapwindscribe0901; C:\WINDOWS\System32\drivers\tapwindscribe0901.sys [54896 2018-07-06] (Windscribe Limited -> The OpenVPN Project)
R3 VBoxNetAdp; C:\WINDOWS\System32\drivers\VBoxNetAdp6.sys [239664 2021-07-28] (Oracle Corporation -> Oracle Corporation)
R1 VBoxNetLwf; C:\WINDOWS\system32\DRIVERS\VBoxNetLwf.sys [249568 2021-07-28] (Oracle Corporation -> Oracle Corporation)
S3 WdBoot; C:\WINDOWS\system32\drivers\wd\WdBoot.sys [49568 2021-07-24] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\wd\WdFilter.sys [434424 2021-07-24] (Microsoft Windows -> Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [78072 2021-07-24] (Microsoft Windows -> Microsoft Corporation)
S3 ISODrive; \??\D:\software\UltraISO_Portable_9.7.3.3618_Multilingual\UltraISOPortable\App\UltraISO\drivers\ISODrv64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One month (created) (Whitelisted) =========

(If an entry is included in the fixlist, the file/folder will be moved.)

2021-09-08 19:01 - 2021-09-08 19:02 - 000000000 ____D C:\FRST
2021-09-01 21:19 - 2021-09-01 21:19 - 000000000 ____D C:\Users\vesod\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FormatFactory
2021-09-01 21:16 - 2021-09-01 21:19 - 000000000 ____D C:\Users\vesod\Downloads\FormatFactory2021_09_01
2021-08-31 07:43 - 2021-08-31 07:43 - 000210344 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MbamChameleon.sys
2021-08-31 07:43 - 2021-08-31 07:43 - 000198888 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys
2021-08-31 07:43 - 2021-08-31 07:43 - 000149424 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
2021-08-31 07:43 - 2021-08-31 07:43 - 000068528 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2021-08-30 22:18 - 2021-08-30 22:18 - 000000000 ____D C:\WINDOWS\system32\Tasks\HardDiskSentinel
2021-08-29 21:39 - 2021-08-29 21:39 - 000000000 ____D C:\Program Files (x86)\Lame For Audacity
2021-08-29 20:38 - 2021-08-29 20:38 - 000000000 ____D C:\WINDOWS\system32\Tasks\Mozilla
2021-08-21 14:18 - 2021-09-01 20:00 - 000000000 ____D C:\Users\vesod\OneDrive\Documents\FormatFactory
2021-08-21 14:18 - 2021-08-21 14:18 - 000000000 ____D C:\Users\vesod\AppData\Local\FTMod
2021-08-21 14:14 - 2021-09-01 21:19 - 000000000 ____D C:\Users\vesod\AppData\Local\FF001
2021-08-21 14:14 - 2021-09-01 21:19 - 000000000 ____D C:\Program Files (x86)\FormatFactory
2021-08-21 10:12 - 2021-08-21 10:12 - 000000000 ____D C:\Users\vesod\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\URUSoft
2021-08-21 10:12 - 2021-08-21 10:12 - 000000000 ____D C:\Program Files (x86)\URUSoft
2021-08-21 08:05 - 2021-08-21 08:05 - 000001933 _____ C:\Users\Public\Desktop\FileZilla Client.lnk
2021-08-21 08:05 - 2021-08-21 08:05 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
2021-08-21 08:05 - 2021-08-21 08:05 - 000000000 ____D C:\Program Files\FileZilla FTP Client
2021-08-21 08:04 - 2021-08-21 08:04 - 011421048 _____ (Tim Kosse) C:\Users\vesod\Downloads\FileZilla_3.55.1_win64-setup.exe
2021-08-17 19:44 - 2021-08-17 22:27 - 000000000 ____D C:\Users\vesod\Downloads\Gustave-Flaubert_-_Madam_Bovari_-_14997.txt
2021-08-17 19:44 - 2021-08-17 22:26 - 000000000 ____D C:\Users\vesod\Downloads\Honore-de-Balzac_-_Ck_-_Djado_Gorio_-_3157.txt
2021-08-17 19:44 - 2021-08-17 19:44 - 000320444 _____ C:\Users\vesod\Downloads\Gustave-Flaubert_-_Madam_Bovari_-_14997.txt.zip
2021-08-17 19:44 - 2021-08-17 19:44 - 000240385 _____ C:\Users\vesod\Downloads\Honore-de-Balzac_-_Ck_-_Djado_Gorio_-_3157.txt.zip
2021-08-17 19:42 - 2021-08-17 22:28 - 000000000 ____D C:\Users\vesod\Downloads\Paisij_Hilendarski_-_Istorija_slavjanobylgarska_-_3746.txt
2021-08-17 19:42 - 2021-08-17 22:27 - 000000000 ____D C:\Users\vesod\Downloads\Paul-Verlaine_-_Esenna_pesen_-_22021.txt
2021-08-17 19:42 - 2021-08-17 19:42 - 000061246 _____ C:\Users\vesod\Downloads\Paisij_Hilendarski_-_Istorija_slavjanobylgarska_-_3746.txt.zip
2021-08-17 19:42 - 2021-08-17 19:42 - 000001153 _____ C:\Users\vesod\Downloads\Paul-Verlaine_-_Esenna_pesen_-_22021.txt.zip
2021-08-17 19:41 - 2021-08-17 22:28 - 000000000 ____D C:\Users\vesod\Downloads\Petko_R._Slavejkov_-_Izvoryt_na_Belonogata_-_4227.txt
2021-08-17 19:41 - 2021-08-17 19:41 - 000004696 _____ C:\Users\vesod\Downloads\Petko_R._Slavejkov_-_Izvoryt_na_Belonogata_-_4227.txt.zip
2021-08-17 19:39 - 2021-08-31 19:39 - 000000000 ____D C:\Users\vesod\AppData\Local\AMD_Common
2021-08-13 23:35 - 2021-08-13 23:35 - 000000895 _____ C:\Users\Public\Desktop\qBittorrent.lnk
2021-08-13 23:35 - 2021-08-13 23:35 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\qBittorrent
2021-08-13 23:34 - 2021-08-13 23:35 - 000000000 ____D C:\Program Files\qBittorrent
2021-08-13 12:31 - 2021-08-13 12:31 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox
2021-08-13 12:30 - 2021-08-13 12:30 - 000000000 ____D C:\Program Files\Oracle
2021-08-11 15:07 - 2021-08-11 15:07 - 002755584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb
2021-08-11 15:07 - 2021-08-11 15:07 - 002755584 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb
2021-08-11 15:07 - 2021-08-11 15:07 - 001823280 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2021-08-11 15:07 - 2021-08-11 15:07 - 001393480 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2021-08-11 15:07 - 2021-08-11 15:07 - 001333760 _____ C:\WINDOWS\SysWOW64\TextInputMethodFormatter.dll
2021-08-11 15:07 - 2021-08-11 15:07 - 000011347 _____ C:\WINDOWS\system32\DrtmAuthTxt.wim
2021-08-11 15:06 - 2021-08-11 15:06 - 000288768 _____ C:\WINDOWS\system32\Windows.Management.InprocObjects.dll
2021-08-11 15:02 - 2021-08-11 15:02 - 000000000 ___HD C:\$WinREAgent

==================== One month (modified) ==================

(If an entry is included in the fixlist, the file/folder will be moved.)

2021-09-08 18:59 - 2021-06-04 22:49 - 000000000 ____D C:\Users\vesod\AppData\Roaming\TeraCopy
2021-09-08 18:58 - 2020-01-18 17:12 - 000000000 ____D C:\Program Files (x86)\Steam
2021-09-08 18:25 - 2020-01-18 15:39 - 000000000 ____D C:\Program Files (x86)\Google
2021-09-08 18:21 - 2020-07-16 02:46 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2021-09-08 18:13 - 2019-12-07 12:14 - 000000000 ___HD C:\Program Files\WindowsApps
2021-09-08 18:13 - 2019-12-07 12:14 - 000000000 ____D C:\WINDOWS\AppReadiness
2021-09-08 18:12 - 2019-12-07 12:14 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2021-09-08 17:28 - 2021-08-03 20:05 - 000000000 ____D C:\Users\vesod\AppData\LocalLow\IGDump
2021-09-08 17:22 - 2020-01-18 15:40 - 000002307 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2021-09-08 12:23 - 2021-07-07 20:53 - 000000000 ____D C:\Program Files\Genshin Impact
2021-09-08 12:22 - 2021-08-03 19:37 - 000003114 _____ C:\WINDOWS\system32\Tasks\AMDInstallLauncher
2021-09-08 12:22 - 2020-07-16 22:29 - 000000180 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2021-09-08 12:22 - 2020-01-19 10:06 - 000000000 ____D C:\Users\vesod\AppData\Local\CrashDumps
2021-09-06 12:32 - 2020-11-28 16:31 - 000000000 ____D C:\Users\vesod\AppData\LocalLow\Mozilla
2021-09-06 10:35 - 2020-11-28 16:30 - 000000000 ____D C:\ProgramData\Mozilla
2021-09-05 16:59 - 2020-05-04 18:14 - 000002444 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
2021-09-05 16:59 - 2020-05-04 18:14 - 000002282 _____ C:\Users\Public\Desktop\Microsoft Edge.lnk
2021-09-03 10:24 - 2021-02-21 17:44 - 000000000 ____D C:\Program Files\Microsoft Update Health Tools
2021-09-02 22:33 - 2021-04-11 19:50 - 000000000 ____D C:\Users\vesod\AppData\Roaming\HideAway
2021-09-02 20:20 - 2021-04-11 19:50 - 000000000 ____D C:\Users\vesod\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Firetrust Limited
2021-09-02 20:20 - 2021-04-11 19:50 - 000000000 ____D C:\Users\vesod\AppData\Local\HideAway
2021-09-01 23:20 - 2021-04-03 23:34 - 000000000 ____D C:\Users\vesod\AppData\Roaming\Nicepage
2021-09-01 23:19 - 2021-04-03 23:34 - 000000000 ____D C:\Users\vesod\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Nicepage
2021-09-01 23:18 - 2021-04-03 23:34 - 000000000 ____D C:\Users\vesod\AppData\Local\nicepage-updater
2021-09-01 21:14 - 2021-03-30 19:16 - 000000000 ____D C:\Users\vesod\AppData\Roaming\vlc
2021-09-01 19:52 - 2020-10-04 20:38 - 000003362 _____ C:\WINDOWS\system32\Tasks\OneDrive Standalone Update Task-S-1-5-21-3234571952-35909069-787371351-1001
2021-09-01 19:52 - 2020-07-15 23:05 - 000002420 _____ C:\Users\vesod\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2021-08-31 07:43 - 2020-08-18 20:48 - 000002039 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes.lnk
2021-08-31 07:43 - 2020-03-07 23:07 - 000160176 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbae64.sys
2021-08-31 07:43 - 2020-03-07 23:07 - 000002027 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2021-08-31 07:43 - 2020-01-29 17:54 - 000803176 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2021-08-30 23:48 - 2021-01-16 22:03 - 000000000 ____D C:\Users\vesod\AppData\Roaming\Mp3tag
2021-08-30 23:46 - 2020-11-23 00:15 - 000000000 ____D C:\Users\vesod\AppData\Local\Wide Angle Software
2021-08-30 23:13 - 2020-01-18 15:10 - 000000000 ____D C:\Users\vesod\AppData\Local\Packages
2021-08-30 22:21 - 2021-06-01 19:21 - 000001024 ____H C:\AMTAG.BIN
2021-08-30 22:18 - 2021-06-16 21:41 - 000000150 _____ C:\WINDOWS\SysWOW64\Upgrade.dat
2021-08-30 22:18 - 2021-06-16 21:41 - 000000104 _____ C:\WINDOWS\SysWOW64\PaBakConfig.dat
2021-08-30 22:18 - 2021-06-16 21:40 - 000000000 ____D C:\Program Files (x86)\AOMEI Partition Assistant
2021-08-30 22:18 - 2020-12-25 21:43 - 000000000 ____D C:\Program Files (x86)\Hard Disk Sentinel
2021-08-30 21:49 - 2020-05-09 12:59 - 000000000 ____D C:\Program Files\VirtualDJ
2021-08-30 12:07 - 2021-07-07 20:54 - 000000000 ____D C:\Users\vesod\AppData\Local\miHoYo
2021-08-30 12:07 - 2021-07-07 20:53 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Genshin Impact
2021-08-29 21:41 - 2020-08-15 21:59 - 000000000 ____D C:\Users\vesod\AppData\Roaming\audacity
2021-08-29 20:38 - 2021-07-24 17:29 - 000000000 ____D C:\Program Files\Mozilla Firefox
2021-08-29 20:38 - 2020-11-28 16:30 - 000001011 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2021-08-29 19:54 - 2021-06-26 16:16 - 000000000 ____D C:\Program Files\Microsoft Office
2021-08-21 22:16 - 2021-07-22 20:13 - 000000000 ____D C:\Users\vesod\AppData\Roaming\SFVIP-Player
2021-08-20 22:29 - 2020-02-23 19:29 - 000000000 ____D C:\Users\vesod\AppData\Roaming\Rightload
2021-08-20 22:05 - 2020-01-18 16:34 - 000000000 ____D C:\Users\vesod\OneDrive\Documents\Euro Truck Simulator 2
2021-08-18 11:15 - 2020-07-16 02:51 - 000003480 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA
2021-08-18 11:15 - 2020-07-16 02:51 - 000003356 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore
2021-08-17 07:46 - 2020-04-29 18:11 - 000000400 __RSH C:\ProgramData\ntuser.pol
2021-08-17 01:22 - 2021-02-21 17:44 - 000740168 _____ (Microsoft Corporation) C:\WINDOWS\system32\sedplugins.dll
2021-08-17 01:22 - 2021-02-21 17:44 - 000486728 _____ (Microsoft Corporation) C:\WINDOWS\system32\QualityUpdateAssistant.dll
2021-08-16 22:33 - 2020-12-30 23:32 - 000000000 ____D C:\Users\vesod\AppData\Roaming\HD Tune Pro
2021-08-14 00:21 - 2020-02-17 22:14 - 000000000 ____D C:\Users\vesod\AppData\Roaming\qBittorrent
2021-08-13 15:56 - 2020-04-28 13:39 - 000000000 ____D C:\Users\vesod\.VirtualBox
2021-08-13 12:57 - 2020-04-28 13:40 - 000000000 ____D C:\Users\vesod\VirtualBox VMs
2021-08-13 12:57 - 2020-04-28 13:39 - 000000000 ____D C:\ProgramData\VirtualBox
2021-08-13 12:31 - 2020-12-10 11:25 - 000001155 _____ C:\Users\Public\Desktop\Oracle VM VirtualBox.lnk
2021-08-13 12:31 - 2019-12-07 12:13 - 000000000 ____D C:\WINDOWS\INF
2021-08-12 23:24 - 2020-11-28 16:30 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2021-08-11 19:04 - 2020-07-16 02:51 - 000840602 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2021-08-11 16:45 - 2020-07-16 02:51 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2021-08-11 16:45 - 2020-07-16 02:46 - 000570272 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2021-08-11 16:45 - 2020-07-16 02:46 - 000008192 ___SH C:\DumpStack.log.tmp
2021-08-11 16:44 - 2020-01-18 15:10 - 000065536 _____ C:\WINDOWS\system32\spu_storage.bin
2021-08-11 16:44 - 2019-12-07 12:54 - 000000000 ____D C:\Program Files\Windows Defender Advanced Threat Protection
2021-08-11 16:44 - 2019-12-07 12:14 - 000000000 ___SD C:\WINDOWS\system32\UNP
2021-08-11 16:44 - 2019-12-07 12:14 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2021-08-11 16:44 - 2019-12-07 12:14 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2021-08-11 16:44 - 2019-12-07 12:14 - 000000000 ____D C:\WINDOWS\SystemResources
2021-08-11 16:44 - 2019-12-07 12:14 - 000000000 ____D C:\WINDOWS\system32\oobe
2021-08-11 16:44 - 2019-12-07 12:14 - 000000000 ____D C:\WINDOWS\system32\Dism
2021-08-11 16:44 - 2019-12-07 12:14 - 000000000 ____D C:\WINDOWS\ShellComponents
2021-08-11 16:44 - 2019-12-07 12:14 - 000000000 ____D C:\WINDOWS\PolicyDefinitions
2021-08-11 16:44 - 2019-12-07 12:14 - 000000000 ____D C:\WINDOWS\bcastdvr
2021-08-11 16:44 - 2019-12-07 12:03 - 000524288 _____ C:\WINDOWS\system32\config\BBI
2021-08-11 16:44 - 2019-12-07 12:03 - 000000000 ____D C:\WINDOWS\servicing
2021-08-11 15:09 - 2019-12-07 12:03 - 000000000 ____D C:\WINDOWS\CbsTemp
2021-08-11 15:01 - 2020-01-18 15:38 - 000000000 ____D C:\WINDOWS\system32\MRT
2021-08-11 14:58 - 2020-01-18 15:38 - 133215968 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe

==================== Files in the root of some directories ========

2021-07-22 20:13 - 2021-07-22 20:13 - 000000070 _____ () C:\Users\vesod\AppData\Roaming\settings.conf
2020-02-06 07:54 - 2020-05-09 12:05 - 000001230 _____ () C:\Users\vesod\AppData\Local\oobelibMkey.log

==================== SigCheck ============================

(There is no automatic fix for files that do not pass verification.)

==================== End of FRST.txt ========================