La PC queda lenta casi 1 hora completa, proceso sin nombre

Buenas gente! Estoy sospechando de algún virus o malware que usa los recursos de mi PC.

Cuando enciendo la PC, tengo que esperar casi una hora para que la PC regrese a su velocidad normal, ya que cuando arranca es inutilizable.

He podido observar que tanto el disco como el CPU saltan al 100% mientras se inicia, y me he fijado de un proceso que no tiene nombre que consume ambos. Quise tomarle captura pero mi PC como dije está practicamente colgada (solo se puede mover el mouse) en ese estado, y ahora que recien se recuperó y puedo escribir este mensaje, ya no encuentor dicho proceso que les comento.

Mi sistema operativo es Windows 10, estoy en una laptop Lenovo Thinkpad T540 con CPU Intel Core i5 4300M de 2.6Ghz y 4Gb de memoria ram.

Muchas gracias por la ayuda de antemano.

De nada @Brayand_Chacaltana

Ok. Primero descartaremos que no tengas algo “muy escurridizo”. Después descartaremos malware en general.

:one: EN BUSCA / ELIMINACIÓN DE MALWARE

Por favor, descarga todo el software de los enlaces que pongo/de sus respectivos manuales.

Ahora ejecutarás una serie de herramientas respetando el orden los pasos con todos los programas cerrados incluidos los navegadores.

Inicia de nuevo el equipo desde el :arrow_forward: Modo Seguro – con funciones de Red, de Windows. Si no funcionasen los métodos que se explican en el anterior post, prueba estos otros. Más concretamente, primero el 3 (Seleccionando Red en lugar de Mínimo) y si no el 2 (también Red).

Una vez iniciado en este modo, empiezas haciendo todos los pasos que te pondré a continuación.

P.D.: Si el quipo no te arrancase en Modo seguro (cosa que puede pasar), me lo dices e intentaremos arreglar el sistema para que arranque en Modo Seguro. Pues hay malwares que ya se encargaran de que no puedas iniciar en Modo Seguro.

  1. Descarga y ejecuta RKill, más concretamente debes de descargar la que está renombrada bajo el nombre de iExplore.exe. Para evitar el bloqueo de posibles malwares que pueda haber en tu equipo. Una vez que esta haya sido ejecutada, es muy importante no reiniciar el sistema hasta que te lo solicite yo o alguno de los programas de desinfección de los que estemos utilizando.

Me explico, por ejemplo: has iniciado la máquina en Modo Seguro con funciones de Red, has ejecutado Rkill y seguidamente realizas un Análisis con Malwarebytes. Este te detecta infecciones y te pide reiniciar la máquina para poder finalizar exitosamente su desinfección. Seguidamente, yo te he indicado que ejecutes por ejemplo el ESET Online Scanner, pues bien como no hemos acabado de desinfectar la máquina y estamos realizando el proceso de desinfección, y has tenido que reiniciar, ya que te lo ha pedido Malwarebytes pues debes de ejecutar nuevamente Rkill y después acto seguido el ESET ONline.

¿Me entiendes?

Si por ejemplo, incluso con Rkill, Malwarebytes AntiMalware o la herramienta que sea que te he pedido que utilices, ves que se bloquea y que al cabo de un buen rato no responde. Pues pasas a la siguiente y me informas de ello. Y así con todas. ¿OK? ¿Se entiende?

  1. Manual Malwarebytes Anti-Rootkit Beta sigues las instrucciones de su manual y me traes sus correspondientes Informes de análisis: Mbar-log.txt y System-log.txt tal como se indica en su manual (Actualizando la Database).

  2. Descarga, instala y ejecuta TDSKiller de acuerdo a su Manual TDSKiller. Marca todas las casillas (Loaded Modules, Verify file digital signatures y Detect TDLFS file system). Sí te pide reiniciar lo haces, ejecutas de nuevo la herramienta y al marcar nuevamente las casillas que te he dicho, ya te dejara analizar.

NOTA IMPORTANTE

Por Favor, mientras estemos desinfectando tu maquina o terminando de hacerlo:

  • No realices pasos/acciones que NOSOTROS no te hayamos indicado.
  • No descargues NADA de Internet y/o conectes dispositivos externos a tu equipo.
  • No instales NADA (programas/software/complementos/extensiones del navegador…).
  • No ejecutes otros programas de seguridad (Antivirus, Antimalware, ANTINADA…).
  • No realices por tu cuenta otros procedimientos.
  • Usa tu equipo EXCLUSIVAMENTE para desinfectarlo siguiendo nuestras indicaciones.

EN TU PRÓXIMA RESPUESTA

  • Respondes a las preguntas que te haya realizado.
  • Traes los reportes de Malwarebytes Anti-Rootkit y TDSKiller.
  • Comentas el estado en general del ordenador respecto al problema inicial planteado.

Salu2.

Hola que tal! gracias por la ayuda! Tengo un problema con Rkill. Me bajé el iExplore.exe que me señalaste, y cuando ejecuto el programa, se queda trabado en “Performing Miscelaneous Checks”. Es por esta razón que no puedo continuar con los demás análisis, porquie el programa no termina. ¿Qué debería hacer?

Primero de todo disculpa que haya tardado en responder @Brayand_Chacaltana. Pues últimamente voy con muy poco tiempo para el foro y es normal. Pero seguiremos el caso hasta el final.

De nada.

Tengo un problema con Rkill. Me bajé el iExplore.exe que me señalaste, y cuando ejecuto el programa, se queda trabado en “Performing Miscelaneous Checks”. Es por esta razón que no puedo continuar con los demás análisis, porquie el programa no termina.

OK.

Cuando suceda esto y se quede trabado. Prueba a presionar la tecla de ENTER y si no la BARRA ESPACIADORA varias veces seguidas. Primero ENTER varias veces y después BARRA ESPACIADORA varias veces. ¿Se desbloquea? ¿Funciona?

Si es sí, pues sigues con el resto.

Si es no, pues intentas seguir con el resto de programas a ver si te deja.

Salu2.

Hola @Marr0n como estas? Ahora tu discúlpame a mi, esta PC es del trabajo y se la tuvieron que llevar unos días, por ello ya no respondí tus mensajes.

He hecho todos los análisis solicitados y te dejo los reportes que me pediste:

MALWAREBYTES ANTIROOTKIT

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.10.3.1001

(c) Malwarebytes Corporation 2011-2012

OS version: 10.0.9200 Windows 10 x64

System is currently in a safe mode

Account is Administrative

Internet Explorer version: 11.789.19041.0

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
CPU speed: 2.594000 GHz
Memory total: 4166721536, free: 1507393536

Downloaded database version: v2021.11.25.07
Downloaded database version: v2021.11.25.07
Downloaded database version: v2018.01.20.01
=======================================
Initializing...
Driver version: 4.3.0.15
------------ Kernel report ------------
     11/25/2021 14:55:19
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kd.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\System32\drivers\CLFS.SYS
\SystemRoot\System32\drivers\tm.sys
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\BOOTVID.dll
\SystemRoot\System32\drivers\FLTMGR.SYS
\SystemRoot\System32\drivers\msrpc.sys
\SystemRoot\System32\drivers\ksecdd.sys
\SystemRoot\System32\drivers\clipsp.sys
\SystemRoot\System32\drivers\cmimcext.sys
\SystemRoot\System32\drivers\werkernel.sys
\SystemRoot\System32\drivers\ntosext.sys
\SystemRoot\system32\CI.dll
\SystemRoot\System32\drivers\cng.sys
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\WppRecorder.sys
\SystemRoot\system32\drivers\SleepStudyHelper.sys
\SystemRoot\System32\Drivers\acpiex.sys
\SystemRoot\system32\drivers\SgrmAgent.sys
\SystemRoot\System32\drivers\ACPI.sys
\SystemRoot\System32\drivers\WMILIB.SYS
\SystemRoot\System32\drivers\msisadrv.sys
\SystemRoot\System32\drivers\pci.sys
\SystemRoot\System32\drivers\tpm.sys
\SystemRoot\System32\drivers\intelpep.sys
\SystemRoot\system32\drivers\WindowsTrustedRT.sys
\SystemRoot\System32\drivers\IntelTA.sys
\SystemRoot\System32\drivers\WindowsTrustedRTProxy.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\drivers\isapnp.sys
\SystemRoot\System32\drivers\vdrvroot.sys
\SystemRoot\system32\drivers\ucx01000.sys
\SystemRoot\system32\drivers\pdc.sys
\SystemRoot\system32\drivers\CEA.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\System32\drivers\evbda.sys
\SystemRoot\System32\drivers\pcmcia.sys
\SystemRoot\System32\drivers\pciide.sys
\SystemRoot\System32\drivers\PCIIDEX.SYS
\SystemRoot\System32\drivers\spaceport.sys
\SystemRoot\System32\drivers\intelide.sys
\SystemRoot\System32\drivers\volmgr.sys
\SystemRoot\System32\drivers\sdbus.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\System32\drivers\vmbus.sys
\SystemRoot\System32\drivers\NDIS.SYS
\SystemRoot\System32\drivers\NETIO.SYS
\SystemRoot\System32\drivers\hvsocket.sys
\SystemRoot\System32\drivers\vmbkmcl.sys
\SystemRoot\System32\drivers\winhv.sys
\SystemRoot\System32\drivers\vpci.sys
\SystemRoot\System32\drivers\bxvbda.sys
\SystemRoot\System32\drivers\nvraid.sys
\SystemRoot\System32\drivers\CLASSPNP.SYS
\SystemRoot\system32\drivers\urscx01000.sys
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\System32\drivers\iaStorV.sys
\SystemRoot\System32\drivers\vsmraid.sys
\SystemRoot\System32\drivers\storport.sys
\SystemRoot\System32\drivers\3ware.sys
\SystemRoot\System32\drivers\amdsata.sys
\SystemRoot\System32\drivers\amdxata.sys
\SystemRoot\System32\drivers\amdsbs.sys
\SystemRoot\System32\drivers\arcsas.sys
\SystemRoot\System32\drivers\ItSas35i.sys
\SystemRoot\System32\drivers\lsi_sas.sys
\SystemRoot\System32\drivers\lsi_sas2i.sys
\SystemRoot\System32\drivers\lsi_sas3i.sys
\SystemRoot\System32\drivers\lsi_sss.sys
\SystemRoot\System32\drivers\megasas.sys
\SystemRoot\System32\drivers\MegaSas2i.sys
\SystemRoot\System32\drivers\megasas35i.sys
\SystemRoot\System32\drivers\megasr.sys
\SystemRoot\System32\drivers\mvumis.sys
\SystemRoot\System32\drivers\nvstor.sys
\SystemRoot\System32\drivers\percsas2i.sys
\SystemRoot\System32\drivers\percsas3i.sys
\SystemRoot\System32\drivers\SiSRaid2.sys
\SystemRoot\System32\drivers\sisraid4.sys
\SystemRoot\System32\drivers\vstxraid.sys
\SystemRoot\System32\drivers\stexstor.sys
\SystemRoot\System32\drivers\cht4sx64.sys
\SystemRoot\System32\drivers\iaStorAVC.sys
\SystemRoot\System32\drivers\atapi.sys
\SystemRoot\System32\drivers\ataport.SYS
\SystemRoot\System32\drivers\storahci.sys
\SystemRoot\System32\drivers\stornvme.sys
\SystemRoot\System32\drivers\ADP80XX.SYS
\SystemRoot\System32\drivers\HpSAMD.sys
\SystemRoot\System32\drivers\iaStorA.sys
\SystemRoot\System32\drivers\SmartSAMD.sys
\SystemRoot\System32\drivers\nvdimm.sys
\SystemRoot\System32\drivers\EhStorTcgDrv.sys
\SystemRoot\System32\drivers\EhStorClass.sys
\SystemRoot\System32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\Wof.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\drivers\usbccgp.sys
\SystemRoot\System32\drivers\USBD.SYS
\SystemRoot\System32\DriverStore\FileRepository\urschipidea.inf_amd64_78ad1c14e33df968\urschipidea.sys
\SystemRoot\System32\drivers\storvsc.sys
\SystemRoot\System32\drivers\usbehci.sys
\SystemRoot\System32\drivers\USBPORT.SYS
\SystemRoot\System32\drivers\usbhub.sys
\SystemRoot\System32\drivers\UsbHub3.sys
\SystemRoot\System32\drivers\pmdrvs.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\System32\drivers\wfplwfs.sys
\SystemRoot\System32\drivers\vmstorfl.sys
\SystemRoot\System32\drivers\bttflt.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\System32\drivers\volume.sys
\SystemRoot\System32\drivers\volsnap.sys
\SystemRoot\System32\drivers\USBXHCI.SYS
\SystemRoot\System32\drivers\USBSTOR.SYS
\SystemRoot\System32\drivers\uaspstor.sys
\SystemRoot\System32\DRIVERS\ApsHM64.sys
\SystemRoot\System32\drivers\storufs.sys
\SystemRoot\System32\DRIVERS\Apsx64.sys
\SystemRoot\System32\drivers\sdstor.sys
\SystemRoot\System32\drivers\scmbus.sys
\SystemRoot\System32\drivers\sbp2port.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\system32\DRIVERS\ramdisk.sys
\SystemRoot\System32\drivers\pmem.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\system32\drivers\iorate.sys
\SystemRoot\System32\drivers\IntelPcc.sys
\SystemRoot\System32\drivers\disk.sys
\SystemRoot\system32\drivers\avgArDisk.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DriverStore\FileRepository\basicdisplay.inf_amd64_65ab9a260dbf7467\BasicDisplay.sys
\SystemRoot\System32\DriverStore\FileRepository\basicrender.inf_amd64_df49c4daa6251397\BasicRender.sys
\SystemRoot\system32\DRIVERS\googledrivefs3525.sys
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\CimFS.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\drivers\avgRdr2.sys
\SystemRoot\system32\drivers\afunix.sys
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\System32\drivers\vwififlt.sys
\SystemRoot\System32\drivers\pacer.sys
\SystemRoot\System32\drivers\ndiscap.sys
\SystemRoot\system32\drivers\avgNetHub.sys
\SystemRoot\system32\drivers\netbios.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\ahcache.sys
\SystemRoot\System32\DriverStore\FileRepository\compositebus.inf_amd64_7500cffa210c6946\CompositeBus.sys
\SystemRoot\System32\drivers\kdnic.sys
\SystemRoot\System32\DriverStore\FileRepository\umbus.inf_amd64_b78a9c5b6fd62c27\umbus.sys
\SystemRoot\System32\drivers\CAD.sys
\SystemRoot\System32\drivers\HDAudBus.sys
\SystemRoot\System32\drivers\portcls.sys
\SystemRoot\System32\drivers\drmk.sys
\SystemRoot\System32\drivers\ks.sys
\SystemRoot\System32\drivers\hidusb.sys
\SystemRoot\System32\drivers\HIDCLASS.SYS
\SystemRoot\System32\drivers\HIDPARSE.SYS
\SystemRoot\System32\drivers\TeeDriverW8x64.sys
\SystemRoot\System32\DriverStore\FileRepository\e1d68x64.inf_amd64_9b04ae4c30c0d829\e1d68x64.sys
\SystemRoot\System32\drivers\Netwbw02.sys
\SystemRoot\System32\drivers\vwifibus.sys
\SystemRoot\System32\drivers\i8042prt.sys
\SystemRoot\system32\DRIVERS\SynTP.sys
\SystemRoot\system32\drivers\avgKbd.sys
\SystemRoot\System32\drivers\kbdclass.sys
\SystemRoot\System32\drivers\mouclass.sys
\SystemRoot\System32\drivers\ibmpmdrv.sys
\SystemRoot\System32\drivers\cdrom.sys
\SystemRoot\system32\DRIVERS\Smb_driver_Intel.sys
\SystemRoot\System32\drivers\wmiacpi.sys
\SystemRoot\System32\DriverStore\FileRepository\uefi.inf_amd64_c1628ffa62c8e54c\UEFI.sys
\SystemRoot\System32\drivers\NdisVirtualBus.sys
\SystemRoot\System32\drivers\mssmbios.sys
\SystemRoot\System32\DriverStore\FileRepository\swenum.inf_amd64_16a14542b63c02af\swenum.sys
\SystemRoot\System32\drivers\rdpbus.sys
\SystemRoot\System32\drivers\mouhid.sys
\SystemRoot\System32\Drivers\fastfat.SYS
\SystemRoot\System32\Drivers\dump_diskdump.sys
\SystemRoot\System32\drivers\dump_iaStorA.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\win32kbase.sys
\SystemRoot\System32\win32kfull.sys
\SystemRoot\System32\drivers\dxgmms2.sys
\SystemRoot\System32\cdd.dll
\SystemRoot\system32\drivers\ndisuio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\drivers\msquic.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\System32\drivers\WUDFRd.sys
\SystemRoot\System32\drivers\condrv.sys
\SystemRoot\System32\drivers\vwifimp.sys
\??\C:\WINDOWS\system32\drivers\mbamchameleon.sys
\??\C:\WINDOWS\system32\drivers\554565E3.sys
----------- End -----------
Done!

Scan started
Database versions:
  main:    v2021.11.25.07
  rootkit: v2021.11.25.07

<<<2>>>
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffd7036a92e060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
--------- Disk Stack ------
DevicePointer: 0xffffd7036a91bbe0, DeviceName: Unknown, DriverName: \Driver\avgArDisk\
DevicePointer: 0xffffd7036a8378d0, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffd7036a92f040, DeviceName: Unknown, DriverName: \Driver\Shockprf\
DevicePointer: 0xffffd7036a92e060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
DevicePointer: 0xffffd7036a640d50, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xffffd7036a710050, DeviceName: \Device\00000031\, DriverName: \Driver\iaStorA\
------------ End ----------
Alternate DeviceName: Unknown, DriverName: \Driver\partmgr\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
Done!
Drive 0
This is a System drive
Scanning MBR on drive 0...
Inspecting partition table:
This drive is a GPT Drive.
MBR Signature: 55AA
Disk Signature: 958FF0C5

GPT Protective MBR Partition information:

    Partition 0 type is EFI-GPT (0xee)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 1  Numsec = 4294967295

    Partition 1 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0

    Partition 2 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0

GPT Partition information:

    GPT Header Signature 4546492050415254
    GPT Header Revision 65536 Size 92 CRC 2738086151
    GPT Header CurrentLba = 1 BackupLba 976773167
    GPT Header FirstUsableLba 34  LastUsableLba 976773134
    GPT Header Guid 646e9438-a4ea-4b3f-bf77-e97ef73f19
    GPT Header Contains 128 partition entries starting at LBA 2
    GPT Header Partition entry size = 128

    Backup GPT header Signature 4546492050415254
    Backup GPT header Revision 65536 Size 92 CRC 2738086151
    Backup GPT header CurrentLba = 976773167 BackupLba 1
    Backup GPT header FirstUsableLba 34  LastUsableLba 976773134
    Backup GPT header Guid 646e9438-a4ea-4b3f-bf77-e97ef73f19
    Backup GPT header Contains 128 partition entries starting at LBA 976773135
    Backup GPT header Partition entry size = 128

    Partition 0 Type de94bba4-6d1-4d40-a16a-bfd5179d6ac
    Partition ID 43b6f830-8aaa-4a88-a139-2ff2e2bbc978
    FirstLBA 2048  Last LBA 923647
    Attributes 1
    Partition Name                 Basic data partition

    Partition 1 Type c12a7328-f81f-11d2-ba4b-0a0c93ec93b
    Partition ID 41109329-dfaa-43ab-be58-97ebccf14ffa
    FirstLBA 923648  Last LBA 1128447
    Attributes 0
    Partition Name                 EFI system partition

    GPT Partition 1 is bootable
    Partition 2 Type e3c9e316-b5c-4db8-817d-f92df0215ae
    Partition ID 7191c083-dbe9-476c-97c5-a32fb7dfd251
    FirstLBA 1128448  Last LBA 1161215
    Attributes 0
    Partition Name         Microsoft reserved partition

    Partition 3 Type ebd0a0a2-b9e5-4433-87c0-68b6b72699c7
    Partition ID 2c1ebfc6-a0f2-48e3-b6f9-56c44d2d9423
    FirstLBA 1161216  Last LBA 238312855
    Attributes 0
    Partition Name                 Basic data partition

    Partition 4 Type de94bba4-6d1-4d40-a16a-bfd5179d6ac
    Partition ID e78112c0-7acc-491d-80fe-63fe23bbf8b
    FirstLBA 238313472  Last LBA 239491071
    Attributes 1
    Partition Name                                     

    Partition 5 Type ebd0a0a2-b9e5-4433-87c0-68b6b72699c7
    Partition ID 22603118-6849-4c00-8bd4-235d7e7f60ee
    FirstLBA 239493120  Last LBA 976773119
    Attributes 0
    Partition Name                 Basic data partition

Disk Size: 500107862016 bytes
Sector size: 512 bytes

Done!
File "C:\Windows\System32\KERNELBASE.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\apphelp.dll" is sparse (flags = 32768)
File "C:\Windows\System32\psapi.dll" is sparse (flags = 32768)
File "C:\Windows\System32\user32.dll" is sparse (flags = 32768)
File "C:\Windows\System32\win32u.dll" is sparse (flags = 32768)
File "C:\Windows\System32\gdi32.dll" is sparse (flags = 32768)
File "C:\Windows\System32\GDI32FULL.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\MSVCP_WIN.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\ucrtbase.dll" is sparse (flags = 32768)
File "C:\Windows\System32\advapi32.dll" is sparse (flags = 32768)
File "C:\Windows\System32\msvcrt.dll" is sparse (flags = 32768)
File "C:\Windows\System32\sechost.dll" is sparse (flags = 32768)
File "C:\Windows\System32\rpcrt4.dll" is sparse (flags = 32768)
File "C:\Windows\System32\imm32.dll" is sparse (flags = 32768)
File "C:\Windows\System32\shell32.dll" is sparse (flags = 32768)
File "C:\Windows\System32\ole32.dll" is sparse (flags = 32768)
File "C:\Windows\System32\combase.dll" is sparse (flags = 32768)
File "C:\Windows\System32\shlwapi.dll" is sparse (flags = 32768)
File "C:\Windows\System32\wintrust.dll" is sparse (flags = 32768)
File "C:\Windows\System32\version.dll" is sparse (flags = 32768)
File "C:\Windows\System32\ws2_32.dll" is sparse (flags = 32768)
File "C:\Windows\System32\imagehlp.dll" is sparse (flags = 32768)
File "C:\Windows\System32\netapi32.dll" is sparse (flags = 32768)
File "C:\Windows\System32\userenv.dll" is sparse (flags = 32768)
File "C:\Windows\System32\wininet.dll" is sparse (flags = 32768)
File "C:\Windows\System32\IPHLPAPI.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\netutils.dll" is sparse (flags = 32768)
File "C:\Windows\System32\mpr.dll" is sparse (flags = 32768)
File "C:\Windows\System32\comdlg32.dll" is sparse (flags = 32768)
File "C:\Windows\System32\SHCore.dll" is sparse (flags = 32768)
File "C:\Windows\System32\oleaut32.dll" is sparse (flags = 32768)
File "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.19041.1110_none_c0da534e38c01f4d\comctl32.dll" is sparse (flags = 32768)
File "C:\Windows\System32\winmm.dll" is sparse (flags = 32768)
File "C:\Windows\System32\winspool.drv" is sparse (flags = 32768)
File "C:\Windows\System32\sfc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\sfc_os.dll" is sparse (flags = 32768)
File "C:\Windows\System32\cryptsp.dll" is sparse (flags = 32768)
File "C:\Windows\System32\rsaenh.dll" is sparse (flags = 32768)
File "C:\Windows\System32\bcrypt.dll" is sparse (flags = 32768)
File "C:\Windows\System32\CRYPTBASE.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\BCRYPTPRIMITIVES.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\crypt32.dll" is sparse (flags = 32768)
File "C:\Windows\System32\msasn1.dll" is sparse (flags = 32768)
File "C:\Windows\System32\wkscli.dll" is sparse (flags = 32768)
File "C:\Windows\System32\cscapi.dll" is sparse (flags = 32768)
File "C:\Windows\System32\uxtheme.dll" is sparse (flags = 32768)
File "C:\Windows\System32\iertutil.dll" is sparse (flags = 32768)
File "C:\Windows\System32\sspicli.dll" is sparse (flags = 32768)
File "C:\Windows\System32\WINDOWS.STORAGE.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\wldp.dll" is sparse (flags = 32768)
File "C:\Windows\System32\profapi.dll" is sparse (flags = 32768)
File "C:\Windows\System32\KERNEL.APPCORE.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\clbcatq.dll" is sparse (flags = 32768)
File "C:\Windows\System32\ONDEMANDCONNROUTEHELPER.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\winhttp.dll" is sparse (flags = 32768)
File "C:\Windows\System32\mswsock.dll" is sparse (flags = 32768)
File "C:\Windows\System32\nsi.dll" is sparse (flags = 32768)
File "C:\Windows\System32\winnsi.dll" is sparse (flags = 32768)
File "C:\Windows\System32\urlmon.dll" is sparse (flags = 32768)
File "C:\Windows\System32\srvcli.dll" is sparse (flags = 32768)
File "C:\Windows\System32\dnsapi.dll" is sparse (flags = 32768)
File "C:\Windows\System32\rasadhlp.dll" is sparse (flags = 32768)
File "C:\Windows\System32\FWPUCLNT.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\schannel.dll" is sparse (flags = 32768)
File "C:\Windows\System32\MSKEYPROTECT.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\ntasn1.dll" is sparse (flags = 32768)
File "C:\Windows\System32\dpapi.dll" is sparse (flags = 32768)
File "C:\Windows\System32\cryptnet.dll" is sparse (flags = 32768)
File "C:\Windows\System32\ncrypt.dll" is sparse (flags = 32768)
File "C:\Windows\System32\NCRYPTSSLP.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\msctf.dll" is sparse (flags = 32768)
File "C:\Windows\System32\dhcpcsvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\ntmarta.dll" is sparse (flags = 32768)
File "C:\Windows\System32\cfgmgr32.dll" is sparse (flags = 32768)
File "C:\Windows\System32\TEXTINPUTFRAMEWORK.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\COREMESSAGING.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\COREUICOMPONENTS.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\WinTypes.dll" is sparse (flags = 32768)
File "C:\Windows\System32\wtsapi32.dll" is sparse (flags = 32768)
File "C:\Windows\System32\winsta.dll" is sparse (flags = 32768)
File "C:\Windows\System32\propsys.dll" is sparse (flags = 32768)
File "C:\Windows\System32\WINDOWS.STATEREPOSITORYPS.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\WINDOWS.FILEEXPLORER.COMMON.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\coml2.dll" is sparse (flags = 32768)
File "C:\Windows\System32\smss.exe" is sparse (flags = 32768)
File "C:\Windows\System32\csrss.exe" is sparse (flags = 32768)
File "C:\Windows\System32\wininit.exe" is sparse (flags = 32768)
File "C:\Windows\System32\winlogon.exe" is sparse (flags = 32768)
File "C:\Windows\System32\services.exe" is sparse (flags = 32768)
File "C:\Windows\System32\lsass.exe" is sparse (flags = 32768)
File "C:\Windows\System32\svchost.exe" is sparse (flags = 32768)
File "C:\Windows\System32\FONTDRVHOST.EXE" is sparse (flags = 32768)
File "C:\Windows\System32\dwm.exe" is sparse (flags = 32768)
File "C:\Windows\System32\sihost.exe" is sparse (flags = 32768)
File "C:\Windows\explorer.exe" is sparse (flags = 32768)
File "C:\Windows\SYSTEMAPPS\MICROSOFT.WINDOWS.STARTMENUEXPERIENCEHOST_CW5N1H2TXYEWY\STARTMENUEXPERIENCEHOST.EXE" is sparse (flags = 32768)
File "C:\Windows\System32\RUNTIMEBROKER.EXE" is sparse (flags = 32768)
File "C:\Windows\SYSTEMAPPS\MICROSOFT.WINDOWS.SEARCH_CW5N1H2TXYEWY\SEARCHAPP.EXE" is sparse (flags = 32768)
File "C:\Windows\System32\dllhost.exe" is sparse (flags = 32768)
File "C:\Windows\HelpPane.exe" is sparse (flags = 32768)
File "C:\Windows\System32\APPLICATIONFRAMEHOST.EXE" is sparse (flags = 32768)
File "C:\Windows\SYSTEMAPPS\SHELLEXPERIENCEHOST_CW5N1H2TXYEWY\SHELLEXPERIENCEHOST.EXE" is sparse (flags = 32768)
File "C:\Windows\System32\wbem\WmiPrvSE.exe" is sparse (flags = 32768)
File "C:\Windows\SYSTEMAPPS\MICROSOFTWINDOWS.CLIENT.CBS_CW5N1H2TXYEWY\InputApp\TEXTINPUTHOST.EXE" is sparse (flags = 32768)
File "C:\Windows\System32\SMARTSCREEN.EXE" is sparse (flags = 32768)
File "C:\Windows\System32\TEXTSHAPING.DLL" is sparse (flags = 32768)
File "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984\comctl32.dll" is sparse (flags = 32768)
File "C:\Windows\System32\WINDOWSCODECS.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\THUMBCACHE.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\POLICYMANAGER.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\MSVCP110_WIN.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\EXPLORERFRAME.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\edputil.dll" is sparse (flags = 32768)
File "C:\Windows\System32\APPRESOLVER.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\BCP47LANGS.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\slc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\sppc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\ONECORECOMMONPROXYSTUB.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\ONECOREUAPCOMMONPROXYSTUB.DLL" is sparse (flags = 32768)
File "C:\Windows\SysWOW64\cmd.exe" is sparse (flags = 32768)
File "C:\Windows\System32\cmdext.dll" is sparse (flags = 32768)
File "C:\Windows\System32\conhost.exe" is sparse (flags = 32768)
File "C:\Windows\System32\oobe\USEROOBEBROKER.EXE" is sparse (flags = 32768)
File "C:\Windows\System32\credssp.dll" is sparse (flags = 32768)
File "C:\Windows\System32\userinit.exe" is sparse (flags = 32768)
File "C:\Windows\System32\scecli.dll" is sparse (flags = 32768)
File "C:\Windows\System32\msv1_0.dll" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\appid.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\AcpiDev.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\1394ohci.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\flpydisk.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\mspclock.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\acpiex.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\acpi.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\asyncmac.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\amdk8.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\acpipagr.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\isapnp.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\acpitime.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\ufx01000.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\Ucx01000.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\Acx01000.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\mrxsmb20.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\mpsdrv.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\ndisuio.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\MSGPIOCLX.SYS" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\afd.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\hidi2c.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\afunix.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\sdstor.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\ahcache.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\amdppm.sys" is sparse (flags = 32768)
File "C:\Windows\System32\alg.exe" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\IPMIDrv.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\APPLOCKERFLTR.SYS" is sparse (flags = 32768)
File "C:\Windows\System32\SECURITYHEALTHSERVICE.EXE" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\wcnfs.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\wcifs.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\srv2.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\atapi.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\cdfs.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\clfs.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\HVSERVICE.SYS" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\pciide.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\fdc.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\bindflt.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\PktMon.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\bowser.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\storufs.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\bthenum.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\HYPERVIDEO.SYS" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\MICROSOFT.BLUETOOTH.LEGACY.LEENUMERATOR.SYS" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\portcfg.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\BthMini.SYS" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\bthport.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\BTHUSB.SYS" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\bttflt.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\BUTTONCONVERTER.SYS" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\cng.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\cdrom.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\cldflt.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\mup.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\CmBatt.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\condrv.sys" is sparse (flags = 32768)
File "C:\Windows\System32\CREDENTIALENROLLMENTMANAGER.EXE" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\dam.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\dfsc.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\disk.sys" is sparse (flags = 32768)
File "C:\Windows\System32\DiagSvcs\DIAGNOSTICSHUB.STANDARDCOLLECTOR.SERVICE.EXE" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\dmvsc.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\drmkaud.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\serial.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\dxgkrnl.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\EHSTORCLASS.SYS" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\EHSTORTCGDRV.SYS" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\errdev.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\fileinfo.sys" is sparse (flags = 32768)
File "C:\Windows\System32\FXSSVC.exe" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\vmstorfl.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\ipfltdrv.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\FILETRACE.SYS" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\fltMgr.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\FSDEPENDS.SYS" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\STORQOSFLT.SYS" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\fvevol.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\rasl2tp.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\mrxsmb.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\HdAudio.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\hdaudbus.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\hidbatt.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\hidbth.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\HIDINTERRUPT.SYS" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\hidspi.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\hidusb.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\http.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\stornvme.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\hwpolicy.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\hyperkbd.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\ndproxy.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\i8042prt.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\pacer.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\INDIRECTKMD.SYS" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\intelide.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\intelpep.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\intelppm.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\iorate.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\scfilter.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\msiscsi.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\kbdclass.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\kbdhid.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\ksecdd.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\ksecpkg.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\ksthunk.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\luafv.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\MbbCx.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\mmcss.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\mskssrv.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\wimmount.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\mrxdav.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\modem.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\mspqm.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\monitor.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\mouclass.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\mouhid.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\msquic.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\mountmgr.sys" is sparse (flags = 32768)
File "C:\Windows\System32\VSSVC.exe" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\MSHIDKMDF.SYS" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\msisadrv.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\mstee.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\mssmbios.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\MTConfig.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\nwifi.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\netbios.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\netvsc.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\ndis.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\NDISIMPLATFORM.SYS" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\ndistapi.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\NDISVIRTUALBUS.SYS" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\ndiswan.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\NETADAPTERCX.SYS" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\netbt.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\NPSVCTRIG.SYS" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\nsiproxy.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\parport.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\partmgr.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\pci.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\pcw.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\pdc.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\pcmcia.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\PEAuth.sys" is sparse (flags = 32768)
File "C:\Windows\System32\PERCEPTIONSIMULATION\PERCEPTIONSIMULATIONSERVICE.EXE" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\RDPVIDEOMINIPORT.SYS" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\raspptp.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\processr.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\ramdisk.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\rasacd.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\agilevpn.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\raspppoe.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\rassstp.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\rdbss.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\rdpdr.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\sbp2port.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\sdbus.sys" is sparse (flags = 32768)
File "C:\Windows\System32\SENSORDATASERVICE.EXE" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\SerCx.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\SpbCx.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\serenum.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\SerCx2.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\sermouse.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\sfloppy.sys" is sparse (flags = 32768)
File "C:\Windows\System32\SGRMBROKER.EXE" is sparse (flags = 32768)
File "C:\Windows\System32\Spectrum.exe" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\SPACEPORT.SYS" is sparse (flags = 32768)
File "C:\Windows\System32\spoolsv.exe" is sparse (flags = 32768)
File "C:\Windows\System32\sppsvc.exe" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\srvnet.sys" is sparse (flags = 32768)
File "C:\Windows\System32\OpenSSH\SSH-AGENT.EXE" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\storahci.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\storvsc.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\tcpip.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\tpm.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\tdx.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\vdrvroot.sys" is sparse (flags = 32768)
File "C:\Windows\System32\TIERINGENGINESERVICE.EXE" is sparse (flags = 32768)
File "C:\Windows\SERVICING\TRUSTEDINSTALLER.EXE" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\TsUsbGD.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\uaspstor.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\Udecx.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\UcmCx.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\UCMUCSICX.SYS" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\udfs.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\umpass.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\usbvideo.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\USBAUDIO.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\usbccgp.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\USBXHCI.SYS" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\usbuhci.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\usbohci.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\usbehci.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\usbhub.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\USBHUB3.SYS" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\usbprint.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\usbser.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\USBSTOR.SYS" is sparse (flags = 32768)
File "C:\Windows\System32\vds.exe" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\VERIFIEREXT.SYS" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\vhdmp.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\Vid.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\vhf.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\vmbus.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\VMBusHID.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\volmgr.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\volmgrx.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\volsnap.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\volume.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\vsmraid.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\vwifibus.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\vwififlt.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\vwifimp.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\wacompen.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\wanarp.sys" is sparse (flags = 32768)
File "C:\Windows\System32\wbengine.exe" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\Wdf01000.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\WdiWiFi.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\wfplwfs.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\winnat.sys" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\wmiacpi.sys" is sparse (flags = 32768)
File "C:\Windows\System32\wbem\WmiApSrv.exe" is sparse (flags = 32768)
File "C:\Windows\System32\drivers\ws2ifsl.sys" is sparse (flags = 32768)
File "C:\Windows\System32\SEARCHINDEXER.EXE" is sparse (flags = 32768)
File "C:\Windows\System32\NATURALAUTH.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\umpnpmgr.dll" is sparse (flags = 32768)
File "C:\Windows\System32\AarSvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\rpcss.dll" is sparse (flags = 32768)
File "C:\Windows\System32\appinfo.dll" is sparse (flags = 32768)
File "C:\Windows\System32\DISPBROKER.DESKTOP.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\MESSAGINGSERVICE.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\MICROSOFT.BLUETOOTH.USERSERVICE.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\appidsvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\AUTOTIMESVC.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\smphost.dll" is sparse (flags = 32768)
File "C:\Windows\System32\GRAPHICSPERFSVC.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\psmsrv.dll" is sparse (flags = 32768)
File "C:\Windows\System32\APPREADINESS.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\WINDOWS.STATEREPOSITORY.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\AUDIOENDPOINTBUILDER.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\WALLETSERVICE.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\APPXDEPLOYMENTSERVER.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\BCASTDVRUSERSERVICE.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\audiosrv.dll" is sparse (flags = 32768)
File "C:\Windows\System32\wwansvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\wlidsvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\wlansvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\wcncsvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\wevtsvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\AxInstSv.dll" is sparse (flags = 32768)
File "C:\Windows\System32\RpcEpMap.dll" is sparse (flags = 32768)
File "C:\Windows\System32\CDPUSERSVC.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\dssvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\bdesvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\CAPTURESERVICE.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\BFE.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\XBLAUTHMANAGER.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\netman.dll" is sparse (flags = 32768)
File "C:\Windows\System32\DEVICESETUPMANAGER.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\cdpsvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\umpo.dll" is sparse (flags = 32768)
File "C:\Windows\System32\qmgr.dll" is sparse (flags = 32768)
File "C:\Windows\System32\CBDHSvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\ClipSVC.dll" is sparse (flags = 32768)
File "C:\Windows\System32\BTAGSERVICE.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\BTHAVCTPSVC.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\vac.dll" is sparse (flags = 32768)
File "C:\Windows\System32\das.dll" is sparse (flags = 32768)
File "C:\Windows\System32\profsvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\pnrpsvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\CAPABILITYACCESSMANAGER.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\certprop.dll" is sparse (flags = 32768)
File "C:\Windows\System32\CONSENTUXCLIENT.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\XBOXGIPSVC.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\TETHERINGSERVICE.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\cryptsvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\DEFRAGSVC.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\DEVICEACCESS.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\WINDOWS.DEVICES.PICKER.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\DEVICESFLOWBROKER.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\dhcpcore.dll" is sparse (flags = 32768)
File "C:\Windows\System32\DiagSvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\dot3svc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\DIAGTRACK.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\MICROSOFT.GRAPHICS.DISPLAY.DISPLAYENHANCEMENTSERVICE.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\WINDOWS.INTERNAL.MANAGEMENT.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\dnsrslvr.dll" is sparse (flags = 32768)
File "C:\Windows\System32\WERCPLSUPPORT.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\eapsvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\efssvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\EMBEDDEDMODESVC.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\ENTERPRISEAPPMGMTSVC.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\FntCache.dll" is sparse (flags = 32768)
File "C:\Windows\System32\es.dll" is sparse (flags = 32768)
File "C:\Windows\System32\sdrsvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\srvsvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\FRAMESERVER.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\upnphost.dll" is sparse (flags = 32768)
File "C:\Windows\System32\fhsvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\gpsvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\hidserv.dll" is sparse (flags = 32768)
File "C:\Windows\System32\lltdsvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\ListSvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\IKEEXT.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\INSTALLSERVICE.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\iphlpsvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\keyiso.dll" is sparse (flags = 32768)
File "C:\Windows\System32\wscsvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\WsmSvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\wersvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\wecsvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\wcmsvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\wkssvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\LICENSEMANAGERSVC.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\lpasvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\lmhsvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\ipnathlp.dll" is sparse (flags = 32768)
File "C:\Windows\System32\lsm.dll" is sparse (flags = 32768)
File "C:\Windows\System32\WORKFOLDERSSVC.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\LANGUAGEOVERLAYSERVER.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\MIXEDREALITYRUNTIME.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\MPSSVC.dll" is sparse (flags = 32768)
File "C:\Windows\System32\iscsiexe.dll" is sparse (flags = 32768)
File "C:\Windows\System32\nsisvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\nlasvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\ngcsvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\NCBSERVICE.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\netlogon.dll" is sparse (flags = 32768)
File "C:\Windows\System32\NETPROFMSVC.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\NETSETUPSVC.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\icsvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\NGCCTNRSVC.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\APHOSTSERVICE.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\pcasvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\PHONESERVICE.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\PIMINDEXMAINTENANCE.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\icsvcext.dll" is sparse (flags = 32768)
File "C:\Windows\System32\IPSECSVC.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\PRINTWORKFLOWSERVICE.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\PUSHTOINSTALL.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\rasauto.dll" is sparse (flags = 32768)
File "C:\Windows\System32\rasmans.dll" is sparse (flags = 32768)
File "C:\Windows\System32\mprdim.dll" is sparse (flags = 32768)
File "C:\Windows\System32\RDXSERVICE.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\RMapi.dll" is sparse (flags = 32768)
File "C:\Windows\System32\schedsvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\SCardSvr.dll" is sparse (flags = 32768)
File "C:\Windows\System32\XBLGAMESAVE.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\SCDEVICEENUM.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\SEMgrSvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\SENSORSERVICE.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\SessEnv.dll" is sparse (flags = 32768)
File "C:\Windows\System32\SHAREDREALITYSVC.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\WINDOWS.SHAREDPC.ACCOUNTMANAGER.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\SMSROUTERSVC.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\StorSvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\sstpsvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\ssdpsrv.dll" is sparse (flags = 32768)
File "C:\Windows\System32\wiaservc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\svsvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\swprv.dll" is sparse (flags = 32768)
File "C:\Windows\System32\sysmain.dll" is sparse (flags = 32768)
File "C:\Windows\System32\SYSTEMEVENTSBROKERSERVER.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\TabSvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\termsrv.dll" is sparse (flags = 32768)
File "C:\Windows\System32\tapisrv.dll" is sparse (flags = 32768)
File "C:\Windows\System32\TIMEBROKERSERVER.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\TOKENBROKER.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\MITIGATIONCLIENT.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\TZAUTOUPDATE.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\WINDOWSUDK.SHELLCOMMON.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\umrdp.dll" is sparse (flags = 32768)
File "C:\Windows\System32\Unistore.dll" is sparse (flags = 32768)
File "C:\Windows\System32\USERDATASERVICE.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\usermgr.dll" is sparse (flags = 32768)
File "C:\Windows\System32\usosvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\vaultsvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\w32time.dll" is sparse (flags = 32768)
File "C:\Windows\System32\WAASMEDICSVC.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\wbiosrvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\WebClnt.dll" is sparse (flags = 32768)
File "C:\Windows\System32\WFDSCONMGRSVC.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\wiarpc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\wbem\WMIsvc.dll" is sparse (flags = 32768)
File "C:\Windows\System32\FLIGHTSETTINGS.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\WINDOWS.MANAGEMENT.SERVICE.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\WPCDESKTOPMONSVC.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\WPDBUSENUM.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\WPNSERVICE.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\WPNUSERSERVICE.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\wuaueng.dll" is sparse (flags = 32768)
File "C:\Windows\System32\XBOXNETAPISVC.DLL" is sparse (flags = 32768)
File "C:\Windows\System32\ie4uinit.exe" is sparse (flags = 32768)
File "C:\Windows\System32\rundll32.exe" is sparse (flags = 32768)
File "C:\Windows\SysWOW64\rundll32.exe" is sparse (flags = 32768)
Infected: C:\Users\b-rch\Downloads\avast_free_antivirus_setup_online.exe --> [Trojan.Dropper]
Scan finished
Creating System Restore point...
Could not create restore point...
Cleaning up...
Removal scheduling successful. System shutdown needed.
System shutdown occurred
=======================================


Removal queue found; removal started
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...
Removal finished

Malwarebytes Anti-Rootkit BETA 1.10.3.1001
www.malwarebytes.org

Database version:
  main:    v2021.11.25.07
  rootkit: v2021.11.25.07

Windows 10 x64 NTFS (Safe Mode/Networking)
Internet Explorer 11.789.19041.0
b-rch :: DESKTOP-C692K8O [administrator]

25/11/2021 14:55:26
mbar-log-2021-11-25 (14-55-26).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled: 
Objects scanned: 182763
Time elapsed: 22 minute(s), 45 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\Users\b-rch\Downloads\avast_free_antivirus_setup_online.exe (Trojan.Dropper) -> Delete on reboot. [15a6f21de10692a4cdaee90de31ea858]

Physical Sectors Detected: 0
(No malicious items detected)

(end)

TDSSKiller

16:38:49.0022 0x06bc  TDSS rootkit removing tool 3.1.0.28 Apr  9 2019 21:11:46
16:38:49.0037 0x06bc  UEFI system
16:38:53.0381 0x06bc  ============================================================
16:38:53.0381 0x06bc  Current date / time: 2021/11/25 16:38:53.0381
16:38:53.0381 0x06bc  SystemInfo:
16:38:53.0381 0x06bc  
16:38:53.0381 0x06bc  OS Version: 10.0.19042 ServicePack: 0.0
16:38:53.0381 0x06bc  Product type: Workstation
16:38:53.0381 0x06bc  ComputerName: DESKTOP-C692K8O
16:38:53.0381 0x06bc  UserName: b-rch
16:38:53.0381 0x06bc  Windows directory: C:\WINDOWS
16:38:53.0381 0x06bc  System windows directory: C:\WINDOWS
16:38:53.0381 0x06bc  Running under WOW64
16:38:53.0381 0x06bc  Processor architecture: Intel x64
16:38:53.0381 0x06bc  Number of processors: 4
16:38:53.0381 0x06bc  Page size: 0x1000
16:38:53.0381 0x06bc  Boot type: Safe boot with network
16:38:53.0381 0x06bc  CodeIntegrityOptions = 0x00000001
16:38:53.0381 0x06bc  ============================================================
16:38:53.0381 0x06bc  KLMD ARK init status: drvProperties = 0xEF0F02, osBuild = 19041.0, osProperties = 0x1D
16:38:53.0397 0x06bc  KLMD BG init status: drvProperties = 0xEF0F02, osBuild = 19041.0, osProperties = 0x1D
16:38:53.0397 0x06bc  BG loaded
16:38:53.0459 0x06bc  System UUID: {8135884C-ED2C-1ADB-0309-89BD0A206689}
16:38:53.0662 0x06bc  !crdlk
16:38:53.0834 0x06bc  Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 ( 465.76 Gb ), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'A'
16:38:53.0834 0x06bc  ============================================================
16:38:53.0834 0x06bc  \Device\Harddisk0\DR0:
16:38:53.0850 0x06bc  GPT partitions:
16:38:53.0850 0x06bc  \Device\Harddisk0\DR0\Partition1: GPT, TypeGUID: {DE94BBA4-06D1-4D40-A16A-BFD50179D6AC}, UniqueGUID: {43B6F830-8AAA-4A88-A139-2FF2E2BBC978}, Name: Basic data partition, StartLBA 0x800, BlocksNum 0xE1000
16:38:53.0850 0x06bc  \Device\Harddisk0\DR0\Partition2: GPT, TypeGUID: {C12A7328-F81F-11D2-BA4B-00A0C93EC93B}, UniqueGUID: {41109329-DFAA-43AB-BE58-97EBCCF14FFA}, Name: EFI system partition, StartLBA 0xE1800, BlocksNum 0x32000
16:38:53.0850 0x06bc  \Device\Harddisk0\DR0\Partition3: GPT, TypeGUID: {E3C9E316-0B5C-4DB8-817D-F92DF00215AE}, UniqueGUID: {7191C083-DBE9-476C-97C5-A32FB7DFD251}, Name: Microsoft reserved partition, StartLBA 0x113800, BlocksNum 0x8000
16:38:53.0850 0x06bc  \Device\Harddisk0\DR0\Partition4: GPT, TypeGUID: {EBD0A0A2-B9E5-4433-87C0-68B6B72699C7}, UniqueGUID: {2C1EBFC6-A0F2-48E3-B6F9-56C44D2D9423}, Name: Basic data partition, StartLBA 0x11B800, BlocksNum 0xE22A598
16:38:53.0850 0x06bc  \Device\Harddisk0\DR0\Partition5: GPT, TypeGUID: {DE94BBA4-06D1-4D40-A16A-BFD50179D6AC}, UniqueGUID: {E78112C0-7ACC-491D-80FE-63FE023BBF8B}, Name: , StartLBA 0xE346000, BlocksNum 0x11F800
16:38:53.0850 0x06bc  \Device\Harddisk0\DR0\Partition6: GPT, TypeGUID: {EBD0A0A2-B9E5-4433-87C0-68B6B72699C7}, UniqueGUID: {22603118-6849-4C00-8BD4-235D7E7F60EE}, Name: Basic data partition, StartLBA 0xE466000, BlocksNum 0x2BF20000
16:38:53.0850 0x06bc  MBR partitions:
16:38:53.0850 0x06bc  ============================================================
16:38:53.0881 0x06bc  C: <-> \Device\Harddisk0\DR0\Partition4
16:38:53.0912 0x06bc  D: <-> \Device\Harddisk0\DR0\Partition6
16:38:53.0912 0x06bc  ============================================================
16:38:53.0912 0x06bc  Initialize success
16:38:53.0912 0x06bc  ============================================================
16:39:13.0364 0x0c0c  ============================================================
16:39:13.0364 0x0c0c  Scan started
16:39:13.0364 0x0c0c  Mode: Manual; SigCheck; TDLFS; 
16:39:13.0364 0x0c0c  ============================================================
16:39:13.0364 0x0c0c  KSN ping started
16:39:13.0879 0x0c0c  KSN ping finished: true
16:39:17.0535 0x0c0c  ================ Scan BIOS =================================
16:39:17.0551 0x0c0c  BIOS info: vendor = LENOVO, version = GMET90WW (2.38 ), releaseDate = 04/13/2020
16:39:17.0551 0x0c0c  Base board info: manufacturer = LENOVO, product = 20BFA16500, version = SDK0E50515 Std
16:39:19.0566 0x0c0c  [ C56F8E6C1C59137C4F7B12BFE1D32B52, 628E4009E90678681BCE4D750F86DE0BD5E212258926D0C6D9E703F876D29E70 ] BIOS
16:39:19.0566 0x0c0c  BIOS - ok
16:39:19.0566 0x0c0c  ================ Scan system memory ========================
16:39:19.0582 0x0c0c  System memory - ok
16:39:19.0582 0x0c0c  ================ Scan services =============================
16:39:19.0738 0x0c0c  1394ohci - ok
16:39:19.0738 0x0c0c  3ware - ok
16:39:19.0754 0x0c0c  AarSvc - ok
16:39:19.0801 0x0c0c  ACPI - ok
16:39:19.0801 0x0c0c  AcpiDev - ok
16:39:19.0801 0x0c0c  acpiex - ok
16:39:19.0801 0x0c0c  acpipagr - ok
16:39:19.0832 0x0c0c  [ 33B5ED555018128792AFFCDC9AF7AFD2, 1E7C5FADA2486EE31289A4BEFB70AEA173190671C64995441651903CF31E5033 ] AcpiPmi         C:\WINDOWS\System32\drivers\acpipmi.sys
16:39:20.0113 0x0c0c  AcpiPmi - ok
16:39:20.0129 0x0c0c  acpitime - ok
16:39:20.0129 0x0c0c  Acx01000 - ok
16:39:20.0129 0x0c0c  ADP80XX - ok
16:39:20.0145 0x0c0c  AFD - ok
16:39:20.0160 0x0c0c  afunix - ok
16:39:20.0176 0x0c0c  ahcache - ok
16:39:20.0191 0x0c0c  [ 526FE18DB976D9A1AE19FBC53FA690B1, 4E2623243A9BB61F7211E591C24EDB70B07974A7FA21E3F14C683F27E975777F ] AJRouter        C:\WINDOWS\System32\AJRouter.dll
16:39:20.0473 0x0c0c  AJRouter - ok
16:39:20.0488 0x0c0c  ALG - ok
16:39:20.0488 0x0c0c  amdgpio2 - ok
16:39:20.0488 0x0c0c  amdi2c - ok
16:39:20.0488 0x0c0c  AmdK8 - ok
16:39:20.0504 0x0c0c  AmdPPM - ok
16:39:20.0504 0x0c0c  amdsata - ok
16:39:20.0504 0x0c0c  amdsbs - ok
16:39:20.0504 0x0c0c  amdxata - ok
16:39:20.0504 0x0c0c  AppID - ok
16:39:20.0520 0x0c0c  AppIDSvc - ok
16:39:20.0535 0x0c0c  Appinfo - ok
16:39:20.0566 0x0c0c  [ 4E59668442D1A2479E17F2FB5F819A7B, 0A0F185C9A713B8B3A5E0DA62E489A4D4F6204A13074AD4B56207972A1A783C7 ] AppleKmdfFilter C:\WINDOWS\System32\drivers\AppleKmdfFilter.sys
16:39:20.0598 0x0c0c  AppleKmdfFilter - ok
16:39:20.0629 0x0c0c  [ 0122ECE34AEEC95212A211C016270937, 09272421CEC30D9F732F734161D9FB3968E5A83BAC1F02F0B9D9B927C878D08A ] AppleLowerFilter C:\WINDOWS\System32\drivers\AppleLowerFilter.sys
16:39:20.0645 0x0c0c  AppleLowerFilter - ok
16:39:20.0645 0x0c0c  applockerfltr - ok
16:39:20.0660 0x0c0c  AppReadiness - ok
16:39:20.0676 0x0c0c  AppXSvc - ok
16:39:20.0676 0x0c0c  arcsas - ok
16:39:20.0676 0x0c0c  AsyncMac - ok
16:39:20.0676 0x0c0c  atapi - ok
16:39:20.0691 0x0c0c  AudioEndpointBuilder - ok
16:39:20.0691 0x0c0c  Audiosrv - ok
16:39:20.0707 0x0c0c  autotimesvc - ok
16:39:20.0801 0x0c0c  [ DCCD42C793D425157E8C9149D1B0D116, 20D5A32EDF487CB30DE61242BAE32D11844D1C00E2087A24A1882A1C735F3B13 ] AVG Antivirus   C:\Program Files\AVG\Antivirus\AVGSvc.exe
16:39:20.0848 0x0c0c  AVG Antivirus - ok
16:39:20.0894 0x0c0c  [ F032D38C22F9810DE42E3892E841618C, 113B316FC478AF8DDB4876B70F65BFBE4123C38CC93DBA8C2EA6B95A587B6977 ] AVG Tools       C:\Program Files\AVG\Antivirus\avgToolsSvc.exe
16:39:20.0910 0x0c0c  AVG Tools - ok
16:39:20.0926 0x0c0c  [ 19C3332134E4D0C0A2422244BB3736C9, 830DEA61BC77CFCC67C1D0D64C69FBBD0EC5741A499524A6796B92A952879562 ] avgArDisk       C:\WINDOWS\system32\drivers\avgArDisk.sys
16:39:20.0973 0x0c0c  avgArDisk - ok
16:39:20.0988 0x0c0c  [ C8E2C699D46CA12F469BAC64B940473E, 56A8F6E752D7520D6C88BFF62A7F2049509D96F38A3B1EB9FC996AC29A4237CE ] avgArPot        C:\WINDOWS\system32\drivers\avgArPot.sys
16:39:21.0004 0x0c0c  avgArPot - ok
16:39:21.0207 0x0c0c  [ 41302B2A31FA84A12D35064AB0493DAE, 459BB1EC07D886E6C72008DB402C7333FA0E00E64EB59DA626BC2F9601A4B81F ] avgbIDSAgent    C:\Program Files\AVG\Antivirus\aswidsagent.exe
16:39:21.0488 0x0c0c  avgbIDSAgent - ok
16:39:21.0519 0x0c0c  [ A47EB30EED81FC62A47D76E96842BD5C, EBB23F7CD7A2E0654A3A2E42F69F83B442AD0EDE5D3EA454BEF84FEB50C1889B ] avgbidsdriver   C:\WINDOWS\system32\drivers\avgbidsdriver.sys
16:39:21.0535 0x0c0c  avgbidsdriver - ok
16:39:21.0566 0x0c0c  [ D6B4E3BBFFC5B23D6C936ACAC37A496E, 3CA966EA5B65A6AE6FEC36CCEDC5C105F5E243E857C646E3836D068E7645B843 ] avgbidsh        C:\WINDOWS\system32\drivers\avgbidsh.sys
16:39:21.0582 0x0c0c  avgbidsh - ok
16:39:21.0613 0x0c0c  [ 1C825D72AAEC8660C48EAEF06ED992AB, 4E923CDAC4AF7A1DD220DBD51437A062252EF3802E720A5ECDD3B1B218462D04 ] avgbuniv        C:\WINDOWS\system32\drivers\avgbuniv.sys
16:39:21.0613 0x0c0c  avgbuniv - ok
16:39:21.0629 0x0c0c  [ 6F8ECE4248AB344EB018B7DDCAEEACE3, 871191CF999816108047749E67A35225E2BD271C4B482C7F6E412DDA41C0C458 ] avgElam         C:\WINDOWS\system32\drivers\avgElam.sys
16:39:21.0644 0x0c0c  avgElam - ok
16:39:21.0644 0x0c0c  [ CFE5BCDDECBD0DF75DDBB2C82DC970A1, F7C868B77BA218C07DA69A8B548AE8D27C8F19A4F766268F96E0AAE0D7C6E59A ] avgKbd          C:\WINDOWS\system32\drivers\avgKbd.sys
16:39:21.0644 0x0c0c  avgKbd - ok
16:39:21.0660 0x0c0c  [ 32B098162051084A895C4AD5136235C9, A879E64DF5B5DDF9BE0A36265348237187938558732FF786FBA963DEC7DFA52F ] avgMonFlt       C:\WINDOWS\system32\drivers\avgMonFlt.sys
16:39:21.0676 0x0c0c  avgMonFlt - ok
16:39:21.0707 0x0c0c  [ FEF2D46423477D16E57BDE23E709F37E, 169D8441A5D83CD882789C92213BD5D957BA04B6037C2C2018E637EC8A350AD3 ] avgNetHub       C:\WINDOWS\system32\drivers\avgNetHub.sys
16:39:21.0723 0x0c0c  avgNetHub - ok
16:39:21.0738 0x0c0c  [ 89CD5C7A0400C8E94D43482CF539992D, E30D93DD4DB8980D2A5C795341EE7B135DC57316831599A46AD1F63050D0F9CA ] avgRdr          C:\WINDOWS\system32\drivers\avgRdr2.sys
16:39:21.0754 0x0c0c  avgRdr - ok
16:39:21.0754 0x0c0c  [ A7F7429924935867C87C42B7379AFEBA, A308682ED155B31DBDB853737ACA6CB30A9401EF06D82FAB683F19873F9BFEFB ] avgRvrt         C:\WINDOWS\system32\drivers\avgRvrt.sys
16:39:21.0769 0x0c0c  avgRvrt - ok
16:39:21.0816 0x0c0c  [ 519780793872BC6E1B6BC3F8CA78456D, 6DC8B9C260C06F52956156E41E4246646BCF4E983DEBAD0DBAD05C9B2B10CB88 ] avgSnx          C:\WINDOWS\system32\drivers\avgSnx.sys
16:39:21.0832 0x0c0c  avgSnx - ok
16:39:21.0863 0x0c0c  [ 50A81BFA62EC9F3A6680F1BFA9624D7D, 3154941EF863D8BFD92D96FB7FDE0CFE3EC2BC5199F330BBA3D1ED8EAD26D408 ] avgSP           C:\WINDOWS\system32\drivers\avgSP.sys
16:39:21.0879 0x0c0c  avgSP - ok
16:39:21.0910 0x0c0c  [ EDD21DFEA079A79ED17A8E2938D0A442, 04AC009C31AB46BD54C8A37BAD72FFD211AAC0DA27CC573C588E7B0BBE489690 ] avgStm          C:\WINDOWS\system32\drivers\avgStm.sys
16:39:21.0926 0x0c0c  avgStm - ok
16:39:21.0957 0x0c0c  [ 819AE5D0B5B1680623127A81726C57B0, C9DB31D51038CA0B8DBD25BECC512B42DBFE105BE559B61EFBAB1EA250FBC335 ] avgVmm          C:\WINDOWS\system32\drivers\avgVmm.sys
16:39:21.0973 0x0c0c  avgVmm - ok
16:39:21.0988 0x0c0c  [ 75CA8458D560E6F26A7EE0475E650458, CF9C722DE59B6A7EBBA99620E45693F6F9AFFA8BE26A361FB5D6662E539DAC3A ] AvgWscReporter  C:\Program Files\AVG\Antivirus\wsc_proxy.exe
16:39:22.0019 0x0c0c  AvgWscReporter - ok
16:39:22.0051 0x0c0c  AxInstSV - ok
16:39:22.0051 0x0c0c  b06bdrv - ok
16:39:22.0082 0x0c0c  [ 26E2320D24C66EB72B36EB71EBEF2558, 7D06B6499FE915480DF4DAD658281C8B85F7AD71F49B089A270AE0B45713F2E9 ] bam             C:\WINDOWS\system32\drivers\bam.sys
16:39:22.0098 0x0c0c  bam - ok
16:39:22.0144 0x0c0c  BasicDisplay - ok
16:39:22.0160 0x0c0c  BasicRender - ok
16:39:22.0176 0x0c0c  BcastDVRUserService - ok
16:39:22.0191 0x0c0c  [ 739D089777D2B66DBE7201E5EA4BA2D7, 9AD12E18A042C5B8EFB19297BC2E7BD1FEF75A138FEFB64C6BF0261FD3E53AB1 ] bcmfn2          C:\WINDOWS\System32\drivers\bcmfn2.sys
16:39:22.0269 0x0c0c  bcmfn2 - ok
16:39:22.0301 0x0c0c  [ F0C0C875DEEAEDF63305C1FBA6F602A9, 987832A12933B09E2C7EDD527C1986AC03C4E6A9AEF590687FF945E1F47F8357 ] bcmsmbsp        C:\WINDOWS\System32\drivers\bcmsmbsp.sys
16:39:22.0316 0x0c0c  bcmsmbsp - ok
16:39:22.0332 0x0c0c  BDESVC - ok
16:39:22.0363 0x0c0c  [ 4280B427B81EB8C265F3206E2298761E, 121AF03BBE6ECC1622C2540805A30AE9555EB5D5FE25B55939C045ECE7FC37EB ] Beep            C:\WINDOWS\system32\drivers\Beep.sys
16:39:22.0426 0x0c0c  Beep - ok
16:39:22.0457 0x0c0c  BFE - ok
16:39:22.0473 0x0c0c  bindflt - ok
16:39:22.0488 0x0c0c  BITS - ok
16:39:22.0488 0x0c0c  BluetoothUserService - ok
16:39:22.0519 0x0c0c  bowser - ok
16:39:22.0535 0x0c0c  BrokerInfrastructure - ok
16:39:22.0551 0x0c0c  BTAGService - ok
16:39:22.0566 0x0c0c  [ 7F09708B8C651A0C0E2A2725136BA254, 0442A18BBED4E323265C66561C8F8C171D8E934E9089C12B94D1DFDBB057B737 ] BthA2dp         C:\WINDOWS\System32\drivers\BthA2dp.sys
16:39:22.0613 0x0c0c  BthA2dp - detected UnsignedFile.Multi.Generic ( 1 )
16:39:23.0176 0x0c0c  Detect skipped due to KSN trusted
16:39:23.0176 0x0c0c  BthA2dp - ok
16:39:23.0176 0x0c0c  BthAvctpSvc - ok
16:39:23.0191 0x0c0c  BthEnum - ok
16:39:23.0207 0x0c0c  [ 7AE44E94C6B1DF488AA309824DEAD643, 91C72C54142A0D4E5A5F33268850CEB8315AA30C2F0B74A9FFA962887ABAC797 ] BthHFEnum       C:\WINDOWS\System32\drivers\bthhfenum.sys
16:39:23.0254 0x0c0c  BthHFEnum - detected UnsignedFile.Multi.Generic ( 1 )
16:39:23.0707 0x0c0c  Detect skipped due to KSN trusted
16:39:23.0707 0x0c0c  BthHFEnum - ok
16:39:23.0707 0x0c0c  BthLEEnum - ok
16:39:23.0707 0x0c0c  BthMini - ok
16:39:23.0738 0x0c0c  [ 11D609CC74F0EB1DF6C0171331CDE9A1, 9412DC92F16C0B8A937D6FB1AD83D7169F4EC0F08FAE0E2B244346428CE99EE1 ] BTHMODEM        C:\WINDOWS\System32\drivers\bthmodem.sys
16:39:23.0769 0x0c0c  BTHMODEM - ok
16:39:23.0769 0x0c0c  BTHPORT - ok
16:39:23.0801 0x0c0c  [ D293AC628357F2F75B8579087F732970, 1E536D8863D695944214D55E9B0B4BFE04F705DB7ECA18A0CF8B37AAF4893B1E ] bthserv         C:\WINDOWS\system32\bthserv.dll
16:39:24.0300 0x0c0c  bthserv - ok
16:39:24.0300 0x0c0c  BTHUSB - ok
16:39:24.0300 0x0c0c  bttflt - ok
16:39:24.0316 0x0c0c  buttonconverter - ok
16:39:24.0332 0x0c0c  [ E7690568D2A5FA3D4E6D28B42358A122, CDBD820B6D383EC0A8151EA4300435C2BAD085EC55DB185C5E16CAF961443888 ] CAD             C:\WINDOWS\System32\drivers\CAD.sys
16:39:24.0347 0x0c0c  CAD - ok
16:39:24.0347 0x0c0c  camsvc - ok
16:39:24.0347 0x0c0c  CaptureService - ok
16:39:24.0379 0x0c0c  cbdhsvc - ok
16:39:24.0394 0x0c0c  cdfs - ok
16:39:24.0394 0x0c0c  CDPSvc - ok
16:39:24.0394 0x0c0c  CDPUserSvc - ok
16:39:24.0410 0x0c0c  cdrom - ok
16:39:24.0425 0x0c0c  CertPropSvc - ok
16:39:24.0425 0x0c0c  cht4iscsi - ok
16:39:24.0425 0x0c0c  cht4vbd - ok
16:39:24.0425 0x0c0c  CimFS - ok
16:39:24.0457 0x0c0c  [ 115CC1E142CE29C9006D59943108DF47, 564FA08C5BEC6DAF1A83C80C9139A6E1AA7E05D251DB3BA379B57C9FDAE83E1B ] circlass        C:\WINDOWS\System32\drivers\circlass.sys
16:39:24.0488 0x0c0c  circlass - ok
16:39:24.0504 0x0c0c  CldFlt - ok
16:39:24.0504 0x0c0c  CLFS - ok
16:39:24.0504 0x0c0c  ClipSVC - ok
16:39:24.0504 0x0c0c  CmBatt - ok
16:39:24.0519 0x0c0c  CNG - ok
16:39:24.0535 0x0c0c  [ A46B4D1484227900F7615FE2A569D828, A06B8002E7A708890222C777DDF8B67FED7015C0943C1FC4F9036E9F9DC14494 ] cnghwassist     C:\WINDOWS\system32\DRIVERS\cnghwassist.sys
16:39:24.0566 0x0c0c  cnghwassist - ok
16:39:24.0582 0x0c0c  [ 99392FDADF3CE5EB47403E5A52866E6F, 63CEF51971EB85D9823CE9A95F1ED9907D20525ED8E32230068CC36E9082A8C3 ] CompositeBus    C:\WINDOWS\System32\DriverStore\FileRepository\compositebus.inf_amd64_7500cffa210c6946\CompositeBus.sys
16:39:24.0613 0x0c0c  CompositeBus - ok
16:39:24.0613 0x0c0c  COMSysApp - ok
16:39:24.0613 0x0c0c  condrv - ok
16:39:24.0613 0x0c0c  ConsentUxUserSvc - ok
16:39:24.0660 0x0c0c  CoreMessagingRegistrar - ok
16:39:24.0722 0x0c0c  [ 008D3431DFA9F1EC2261BC4C0DFA61C3, AC59496A7CEE596A308DF42643B02A95CE7ABA8952AC887CB0029108A93698C7 ] cphs            C:\WINDOWS\SysWow64\IntelCpHeciSvc.exe
16:39:25.0691 0x0c0c  cphs - ok
16:39:25.0738 0x0c0c  CredentialEnrollmentManagerUserSvc - ok
16:39:25.0738 0x0c0c  CredentialEnrollmentManagerUserSvc_38c22 - ok
16:39:25.0754 0x0c0c  CryptSvc - ok
16:39:25.0785 0x0c0c  dam - ok
16:39:25.0785 0x0c0c  DcomLaunch - ok
16:39:25.0800 0x0c0c  defragsvc - ok
16:39:25.0847 0x0c0c  DeviceAssociationBrokerSvc - ok
16:39:25.0894 0x0c0c  DeviceAssociationService - ok
16:39:25.0910 0x0c0c  DeviceInstall - ok
16:39:25.0910 0x0c0c  DevicePickerUserSvc - ok
16:39:25.0925 0x0c0c  DevicesFlowUserSvc - ok
16:39:25.0957 0x0c0c  [ F8BE99B9EA9B110F7CB3F46BA844C1FF, EABF953864C0AE4FB6426C0B7E92DD81EE4A8852081F9D2EA02B61D4C8DB6188 ] DevQueryBroker  C:\WINDOWS\system32\DevQueryBroker.dll
16:39:26.0582 0x0c0c  DevQueryBroker - ok
16:39:26.0582 0x0c0c  Dfsc - ok
16:39:26.0582 0x0c0c  Dhcp - ok
16:39:26.0628 0x0c0c  diagnosticshub.standardcollector.service - ok
16:39:26.0628 0x0c0c  diagsvc - ok
16:39:26.0628 0x0c0c  DiagTrack - ok
16:39:26.0644 0x0c0c  disk - ok
16:39:26.0644 0x0c0c  DispBrokerDesktopSvc - ok
16:39:26.0660 0x0c0c  DisplayEnhancementService - ok
16:39:26.0660 0x0c0c  DmEnrollmentSvc - ok
16:39:26.0675 0x0c0c  dmvsc - ok
16:39:26.0691 0x0c0c  [ 2E8A026D6680C301ADF6D4B301A4CE8B, 2FDB34E2A61457308B0FEC938A2D6351F63D02BB67DC87FE4F2534E0048C8E89 ] dmwappushservice C:\WINDOWS\system32\dmwappushsvc.dll
16:39:26.0894 0x0c0c  dmwappushservice - ok
16:39:26.0910 0x0c0c  Dnscache - ok
16:39:26.0925 0x0c0c  dot3svc - ok
16:39:26.0957 0x0c0c  [ 9E65C33CB7FB50453F7F4407070EAF53, A8707BD19D584DAECA39990A2E791194140AFCA4FCE31F23CC7E931DF8C17361 ] DPS             C:\WINDOWS\system32\dps.dll
16:39:27.0082 0x0c0c  DPS - ok
16:39:27.0082 0x0c0c  drmkaud - ok
16:39:27.0082 0x0c0c  DsmSvc - ok
16:39:27.0097 0x0c0c  DsSvc - ok
16:39:27.0128 0x0c0c  [ 81DF23EC4009D307479D5C169539CD67, 65AEE1E876CBE801A763F14930D15CF2E6A10697620B5903AA04BA30585A5676 ] DusmSvc         C:\WINDOWS\System32\dusmsvc.dll
16:39:27.0285 0x0c0c  DusmSvc - ok
16:39:27.0300 0x0c0c  DXGKrnl - ok
16:39:27.0363 0x0c0c  [ FD6A6E753077D76C0FBF403518B3BD42, 2D7D15B6AA611F2A027143AD54E215CC54863B3B41BA312BBE13DF7CB4E4215A ] e1dexpress      C:\WINDOWS\System32\DriverStore\FileRepository\e1d68x64.inf_amd64_9b04ae4c30c0d829\e1d68x64.sys
16:39:27.0378 0x0c0c  e1dexpress - ok
16:39:27.0394 0x0c0c  Eaphost - ok
16:39:27.0394 0x0c0c  ebdrv - ok
16:39:27.0472 0x0c0c  [ D21437C262283650E8349AFA573AC03A, 9C256D462F0640855E1AB3D2C658CB4EDD7E061EB2782FD03481196D5ED93DB5 ] edgeupdate      C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
16:39:27.0488 0x0c0c  edgeupdate - ok
16:39:27.0503 0x0c0c  [ D21437C262283650E8349AFA573AC03A, 9C256D462F0640855E1AB3D2C658CB4EDD7E061EB2782FD03481196D5ED93DB5 ] edgeupdatem     C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
16:39:27.0519 0x0c0c  edgeupdatem - ok
16:39:27.0535 0x0c0c  EFS - ok
16:39:27.0550 0x0c0c  EhStorClass - ok
16:39:27.0566 0x0c0c  EhStorTcgDrv - ok
16:39:27.0582 0x0c0c  embeddedmode - ok
16:39:27.0597 0x0c0c  EntAppSvc - ok
16:39:27.0613 0x0c0c  [ 0350337887263A518AA03EDB5BA96A04, BF8254C1BCEAD68D8561635330A279C4DBA59F24E96C4A4AA1F3EDCF6403EB76 ] EpsonScanSvc    C:\Windows\system32\EscSvc64.exe
16:39:27.0769 0x0c0c  EpsonScanSvc - ok
16:39:27.0769 0x0c0c  ErrDev - ok
16:39:27.0769 0x0c0c  EventLog - ok
16:39:27.0769 0x0c0c  EventSystem - ok
16:39:27.0831 0x0c0c  [ 21A1A2A5BCDECCDFEC7116D2E5261977, D3982019036DFC256336BF73917F1E138A8D50AC5B38382C571213FA30D32EC4 ] EvtEng          C:\Program Files\Intel\WiFi\bin\EvtEng.exe
16:39:27.0847 0x0c0c  EvtEng - ok
16:39:27.0878 0x0c0c  [ 0BF32186C3EC11315C33CC29EA8DD86C, 82B43762A5BC9C0AB7B5D1F96DC47B34700924B598070A7CCB30C92EB5EE1599 ] ew_usbccgpfilter C:\WINDOWS\System32\drivers\ew_usbccgpfilter.sys
16:39:27.0988 0x0c0c  ew_usbccgpfilter - ok
16:39:27.0988 0x0c0c  exfat - ok
16:39:27.0988 0x0c0c  fastfat - ok
16:39:28.0019 0x0c0c  Fax - ok
16:39:28.0019 0x0c0c  fdc - ok
16:39:28.0035 0x0c0c  [ 0439B82F6034ADA3E71C0C9F169082BD, 0918728669077235B2F2DB7EE22CE819FA570D8A7A497BA5F11E76774EA75099 ] fdPHost         C:\WINDOWS\system32\fdPHost.dll
16:39:28.0160 0x0c0c  fdPHost - ok
16:39:28.0191 0x0c0c  [ AD64C91B3CC71226785DCE688842E5AB, 056E1091468D268E7970045AB329EB3DFF48BB6B22448046A14C309678847B6E ] FDResPub        C:\WINDOWS\system32\fdrespub.dll
16:39:28.0238 0x0c0c  FDResPub - ok
16:39:28.0253 0x0c0c  fhsvc - ok
16:39:28.0285 0x0c0c  [ 8E59D944EE4EFAED65A341A71297C4CD, CFFFD7007AB7FB04ECB44D0079BFE8EEB53AECC988135199C388AF425EBCF2AD ] FileCrypt       C:\WINDOWS\system32\drivers\filecrypt.sys
16:39:28.0347 0x0c0c  FileCrypt - ok
16:39:28.0347 0x0c0c  FileInfo - ok
16:39:28.0363 0x0c0c  Filetrace - ok
16:39:28.0378 0x0c0c  flpydisk - ok
16:39:28.0378 0x0c0c  FltMgr - ok
16:39:28.0410 0x0c0c  FontCache - ok
16:39:28.0425 0x0c0c  FrameServer - ok
16:39:28.0441 0x0c0c  FsDepends - ok
16:39:28.0441 0x0c0c  Fs_Rec - ok
16:39:28.0456 0x0c0c  fvevol - ok
16:39:28.0472 0x0c0c  [ A1E06E4E8CB863C74DE428D4D6681185, DA46502C009FD4C847A547610DEE2684A5A583467BF76009BD46104AAE2F6B1B ] gencounter      C:\WINDOWS\System32\drivers\vmgencounter.sys
16:39:28.0816 0x0c0c  gencounter - ok
16:39:28.0863 0x0c0c  genericusbfn - ok
16:39:28.0910 0x0c0c  [ 058716AC41A50E66810C8663D22839B3, 9E77D6F2F5904100464B7C8DD3C6D5A4A743793D0C83EAF5E7F9E88F0A914659 ] googledrivefs3525 C:\WINDOWS\system32\DRIVERS\googledrivefs3525.sys
16:39:28.0925 0x0c0c  googledrivefs3525 - ok
16:39:28.0941 0x0c0c  GPIOClx0101 - ok
16:39:28.0941 0x0c0c  gpsvc - ok
16:39:28.0972 0x0c0c  [ 8C06046B6A8C1ACDAEA15682058FDFB4, 3E0CC301249B7D8D5BEB932F4DFD1EAB8037679EC153772F63B430713903B0AC ] GpuEnergyDrv    C:\WINDOWS\system32\drivers\gpuenergydrv.sys
16:39:29.0081 0x0c0c  GpuEnergyDrv - ok
16:39:29.0081 0x0c0c  GraphicsPerfSvc - ok
16:39:29.0128 0x0c0c  [ 59EA38ACBCA05610BFEE326DA3F2D96B, CB7F48F36C649BDB12FD09D8FCB60D99EFBFF44729515FA3CC77F4CDB18D99B7 ] gupdate         C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
16:39:29.0144 0x0c0c  gupdate - ok
16:39:29.0144 0x0c0c  [ 59EA38ACBCA05610BFEE326DA3F2D96B, CB7F48F36C649BDB12FD09D8FCB60D99EFBFF44729515FA3CC77F4CDB18D99B7 ] gupdatem        C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
16:39:29.0144 0x0c0c  gupdatem - ok
16:39:29.0159 0x0c0c  HdAudAddService - ok
16:39:29.0159 0x0c0c  HDAudBus - ok
16:39:29.0175 0x0c0c  HidBatt - ok
16:39:29.0175 0x0c0c  HidBth - ok
16:39:29.0175 0x0c0c  hidi2c - ok
16:39:29.0175 0x0c0c  hidinterrupt - ok
16:39:29.0191 0x0c0c  [ 6B46E3061EC0523CB46ED28060FCD946, 6089305AF73CC584963865482448CD5CA4252EC9BD3E72AF16D45E4F95C3EBF2 ] HidIr           C:\WINDOWS\System32\drivers\hidir.sys
16:39:29.0222 0x0c0c  HidIr - ok
16:39:29.0238 0x0c0c  hidserv - ok
16:39:29.0238 0x0c0c  hidspi - ok
16:39:29.0238 0x0c0c  HidUsb - ok
16:39:29.0238 0x0c0c  HpSAMD - ok
16:39:29.0253 0x0c0c  HTTP - ok
16:39:29.0285 0x0c0c  [ 849A66D34BC2DAD0044FAC2FEE1AF956, A5F6858AA556D9180C303EA3ED02EB6D6D8EB55A100B3918654281A01198D8E8 ] hvcrash         C:\WINDOWS\System32\drivers\hvcrash.sys
16:39:29.0285 0x0c0c  hvcrash - ok
16:39:29.0316 0x0c0c  [ 855F55BB462B7D8B6BC31A94A592DF3D, 776C772E69CF9D81D8511201813DD79F2106DC7D2547B4FA700432AE9B73C202 ] HvHost          C:\WINDOWS\System32\hvhostsvc.dll
16:39:29.0800 0x0c0c  HvHost - ok
16:39:29.0831 0x0c0c  hvservice - ok
16:39:29.0847 0x0c0c  [ 8CF9D085951CF0D6DE2AC4105E440DE0, 300198709982026EF999CE5B341EC2BDB23351D8B4BD03C0190EE21F953CBF85 ] HWHandSet       C:\WINDOWS\System32\drivers\hw_quusbmdm.sys
16:39:29.0925 0x0c0c  HWHandSet - ok
16:39:29.0956 0x0c0c  [ 5DC7DFED5FEDD923B874B51D0C6752BB, 69714A8B74EB02282572B34E156051FFC10693B816905CE18A8C6C8CCB95B846 ] HwNClx0101      C:\WINDOWS\system32\Drivers\mshwnclx.sys
16:39:29.0972 0x0c0c  HwNClx0101 - ok
16:39:29.0988 0x0c0c  hwpolicy - ok
16:39:30.0019 0x0c0c  [ C6FCF40CFF3B8380723BD61158AF111E, 5758A0814CA8AA1E7447E1CBDF94352266EDEEE547AB896FCFF97727D8ECDE53 ] hwusb_cdcacm    C:\WINDOWS\System32\drivers\hw_cdcacm.sys
16:39:30.0066 0x0c0c  hwusb_cdcacm - ok
16:39:30.0081 0x0c0c  [ 7920776AB1C59BD6EC70424952CC5FD4, FF4CFCE77613703BA1F5C58AF366CF96E982F6CB5DBCDA30173F957FD1117A74 ] hw_usbdev       C:\WINDOWS\System32\drivers\hw_usbdev.sys
16:39:30.0159 0x0c0c  hw_usbdev - ok
16:39:30.0206 0x0c0c  hyperkbd - ok
16:39:30.0206 0x0c0c  HyperVideo - ok
16:39:30.0222 0x0c0c  i8042prt - ok
16:39:30.0222 0x0c0c  iagpio - ok
16:39:30.0222 0x0c0c  iai2c - ok
16:39:30.0222 0x0c0c  iaLPSS2i_GPIO2 - ok
16:39:30.0238 0x0c0c  iaLPSS2i_GPIO2_BXT_P - ok
16:39:30.0238 0x0c0c  iaLPSS2i_GPIO2_CNL - ok
16:39:30.0238 0x0c0c  iaLPSS2i_GPIO2_GLK - ok
16:39:30.0253 0x0c0c  iaLPSS2i_I2C - ok
16:39:30.0253 0x0c0c  iaLPSS2i_I2C_BXT_P - ok
16:39:30.0253 0x0c0c  iaLPSS2i_I2C_CNL - ok
16:39:30.0253 0x0c0c  iaLPSS2i_I2C_GLK - ok
16:39:30.0269 0x0c0c  iaLPSSi_GPIO - ok
16:39:30.0269 0x0c0c  iaLPSSi_I2C - ok
16:39:30.0300 0x0c0c  [ 350735A5E5B1EB6C733F8D3E01545E3D, 160541B3DB37EF1BC8BCDDAD95FEEDF973DF5D4DC89E5434412C70A43B1D8CE5 ] iaStorA         C:\WINDOWS\system32\drivers\iaStorA.sys
16:39:30.0363 0x0c0c  iaStorA - ok
16:39:30.0363 0x0c0c  iaStorAVC - ok
16:39:30.0378 0x0c0c  iaStorV - ok
16:39:30.0378 0x0c0c  ibbus - ok
16:39:30.0409 0x0c0c  [ 4D4E1E92DDCEAD9C26118FFF05677963, DE3C7DB1DC389F04DFA2F02FA8B45E7CFBBDC8EB806E00677848FBA852B1345E ] IBMPMDRV        C:\WINDOWS\System32\drivers\ibmpmdrv.sys
16:39:30.0409 0x0c0c  IBMPMDRV - ok
16:39:30.0441 0x0c0c  [ 8F989C4C0ECD823BCD07FB3D6D04DFC6, 9ED67B9CFCA4D67A2DFAB9890A784C8F3F51EEC32F02FB7327DA77FB64A2DD27 ] IBMPMSVC        C:\WINDOWS\System32\ibmpmsvc.exe
16:39:30.0488 0x0c0c  IBMPMSVC - ok
16:39:30.0488 0x0c0c  ibtsiva - ok
16:39:30.0503 0x0c0c  [ 3501750E1D543A5C6A32D1ED5BBAA125, 95D351DEB154BC4B5A4F4D477D945845218736E35C776264BA549471E37D3CF4 ] ibtusb          C:\WINDOWS\system32\DRIVERS\ibtusb.sys
16:39:30.0519 0x0c0c  ibtusb - ok
16:39:30.0519 0x0c0c  icssvc - ok
16:39:30.0722 0x0c0c  [ 0B45D9A500A7082278C1F1CB047FBFA9, 697F4163182560C043F5CDFE60C51A8E87D26328AAA474A1F255DEE1BB547D6E ] igfx            C:\WINDOWS\system32\DRIVERS\igdkmd64.sys
16:39:30.0956 0x0c0c  igfx - ok
16:39:30.0988 0x0c0c  [ 858E6773FF3D746A60A6961333F6837F, 2D584AA2187ACE747BE67FDBFF5F822B3C5195490D7DE3D5C0F0AF93CC1655D5 ] igfxCUIService2.0.0.0 C:\WINDOWS\system32\igfxCUIService.exe
16:39:31.0066 0x0c0c  igfxCUIService2.0.0.0 - ok
16:39:31.0066 0x0c0c  IKEEXT - ok
16:39:31.0128 0x0c0c  [ 9ABD06B3279C3E3D2AE5E59113A3B9FF, CC06E04E5B50E9C27E772D9DE06E4FFEA38AA7B90BADC61491EAF20A91BE3692 ] ImControllerService C:\WINDOWS\Lenovo\ImController\Service\Lenovo.Modern.ImController.exe
16:39:31.0144 0x0c0c  ImControllerService - ok
16:39:31.0159 0x0c0c  IndirectKmd - ok
16:39:31.0175 0x0c0c  InstallService - ok
16:39:31.0347 0x0c0c  [ 28EC95475FBD1B7D3023E7A408840917, 2460B6D0D74035A2CE049F1D1902B519097F99D3D1CDFC7E2C210B2BC41E2ACA ] IntcAzAudAddService C:\WINDOWS\system32\drivers\RTKVHD64.sys
16:39:31.0566 0x0c0c  IntcAzAudAddService - ok
16:39:31.0581 0x0c0c  [ EAE20DB9DC1366B9A1C558C58229AD65, 966D79304A766DD38EAB1B7B71DDE0ECB23323C07F29C8CBB21EA94654F75DF1 ] IntcDAud        C:\WINDOWS\System32\drivers\IntcDAud.sys
16:39:31.0597 0x0c0c  IntcDAud - ok
16:39:31.0612 0x0c0c  [ 2159516F6832CE0ABF237DF5B018EE2E, E7022D7F985BB0460CDBD7CF68538E64BCD349CEEE021AEAD6804095BF0E9B12 ] IntelHSWPcc     C:\WINDOWS\system32\drivers\IntelPcc.sys
16:39:31.0612 0x0c0c  IntelHSWPcc - ok
16:39:31.0644 0x0c0c  intelide - ok
16:39:31.0644 0x0c0c  intelpep - ok
16:39:31.0675 0x0c0c  [ AECBF5BE2F9A2A50B978E0BF31041A81, A62F436C66DEFEB438A7891857DFB830995714A7E4FE4BDCA6B4EB1606BD2101 ] intelpmax       C:\WINDOWS\System32\drivers\intelpmax.sys
16:39:31.0706 0x0c0c  intelpmax - ok
16:39:31.0737 0x0c0c  intelppm - ok
16:39:31.0737 0x0c0c  iorate - ok
16:39:31.0753 0x0c0c  IpFilterDriver - ok
16:39:31.0753 0x0c0c  iphlpsvc - ok
16:39:31.0753 0x0c0c  IPMIDRV - ok
16:39:31.0784 0x0c0c  [ F63572DF4295C78B3F7036AEDA878176, B71EB3CC4EC95BC9A3FA217736C6C36C756935714D7E16E34C05D913B829CB9C ] IPNAT           C:\WINDOWS\system32\drivers\ipnat.sys
16:39:31.0816 0x0c0c  IPNAT - ok
16:39:31.0831 0x0c0c  [ B5B6D1F86E40E785D6650DB923DB6BEA, 7A2D92A2274E0379B5FA6351D18E2F0DD55960BB783EA3528FE9E303E1A4256D ] IPT             C:\WINDOWS\System32\drivers\ipt.sys
16:39:31.0847 0x0c0c  IPT - ok
16:39:31.0862 0x0c0c  [ 77494E26B28465D2A09B9455F8A3B34E, B778D4BC71A5F5CF687175CA53AC342E4740156D4B96E6E96D918BD46C2C1459 ] IpxlatCfgSvc    C:\WINDOWS\System32\IpxlatCfg.dll
16:39:31.0987 0x0c0c  IpxlatCfgSvc - ok
16:39:32.0019 0x0c0c  isapnp - ok
16:39:32.0034 0x0c0c  iScsiPrt - ok
16:39:32.0050 0x0c0c  ItSas35i - ok
16:39:32.0050 0x0c0c  kbdclass - ok
16:39:32.0050 0x0c0c  kbdhid - ok
16:39:32.0050 0x0c0c  kdnic - ok
16:39:32.0050 0x0c0c  KeyIso - ok
16:39:32.0066 0x0c0c  KSecDD - ok
16:39:32.0081 0x0c0c  KSecPkg - ok
16:39:32.0081 0x0c0c  ksthunk - ok
16:39:32.0112 0x0c0c  [ DAE67BD7EC6ED569438F5CA38BFBB458, 672CA98525D6DD799A01A3BC3A62AB7B4544D62ECEB3615FAC05BFB97B389D23 ] KtmRm           C:\WINDOWS\system32\msdtckrm.dll
16:39:32.0800 0x0c0c  KtmRm - ok
16:39:32.0862 0x0c0c  LanmanServer - ok
16:39:32.0862 0x0c0c  LanmanWorkstation - ok
16:39:32.0925 0x0c0c  [ 62B77D1B92300F69A86E055F13600180, 45E3DDFF88DC581AD4D83888474BEBBDC28F97583675D24E077DFEFF7CCE7D87 ] LenovoVantageService C:\Program Files (x86)\Lenovo\VantageService\3.9.23.0\LenovoVantageService.exe
16:39:32.0956 0x0c0c  LenovoVantageService - ok
16:39:32.0972 0x0c0c  [ A997488F4EDAAD59C748CF9FB1D9DAC0, A0B145041F984DD4E0A6F8D0E9C8363DA6F2DA7460E140F028C320CEAC03759C ] lfsvc           C:\WINDOWS\System32\lfsvc.dll
16:39:33.0097 0x0c0c  lfsvc - ok
16:39:33.0097 0x0c0c  LicenseManager - ok
16:39:33.0159 0x0c0c  [ 78779BD92081CB27967E77561683AFBE, 05EC91E194336D1BB1EE323E70FAC54F6DC0CEF53FD4925F394399531A37A0DD ] lltdio          C:\WINDOWS\system32\drivers\lltdio.sys
16:39:33.0222 0x0c0c  lltdio - ok
16:39:33.0222 0x0c0c  lltdsvc - ok
16:39:33.0222 0x0c0c  lmhosts - ok
16:39:33.0284 0x0c0c  [ 0FFC5F9BEF218AE75BEC171992153142, 19DAC047975809EC2580299E2BEB1017545D275BBD33E4314130FAD7BD97FA05 ] LPlatSvc        C:\WINDOWS\System32\LPlatSvc.exe
16:39:33.0315 0x0c0c  LPlatSvc - ok
16:39:33.0347 0x0c0c  LSI_SAS - ok
16:39:33.0347 0x0c0c  LSI_SAS2i - ok
16:39:33.0362 0x0c0c  LSI_SAS3i - ok
16:39:33.0362 0x0c0c  LSI_SSS - ok
16:39:33.0378 0x0c0c  LSM - ok
16:39:33.0378 0x0c0c  luafv - ok
16:39:33.0394 0x0c0c  LxpSvc - ok
16:39:33.0409 0x0c0c  [ AE03D8F1B7863268EAED2FE0105ED75F, F5172A1A3E24FC5271FCB0118861EA0EC33AA8ABB01AE9CAD50E2F032B92486C ] MapsBroker      C:\WINDOWS\System32\moshost.dll
16:39:33.0456 0x0c0c  MapsBroker - ok
16:39:33.0456 0x0c0c  mausbhost - ok
16:39:33.0456 0x0c0c  mausbip - ok
16:39:33.0487 0x0c0c  MbbCx - ok
16:39:33.0487 0x0c0c  megasas - ok
16:39:33.0487 0x0c0c  megasas2i - ok
16:39:33.0487 0x0c0c  megasas35i - ok
16:39:33.0503 0x0c0c  megasr - ok
16:39:33.0534 0x0c0c  [ F1E754DEEB3369BCCE2228D5C10DE101, ECC894FCF4C3F2364883BA55242C432E9E416D93E71B67985DF24ECB39F9BAC4 ] MEIx64          C:\WINDOWS\System32\drivers\TeeDriverW8x64.sys
16:39:33.0550 0x0c0c  MEIx64 - ok
16:39:33.0565 0x0c0c  MessagingService - ok
16:39:33.0612 0x0c0c  Microsoft SharePoint Workspace Audit Service - ok
16:39:33.0690 0x0c0c  MicrosoftEdgeElevationService - ok
16:39:33.0722 0x0c0c  [ B74FFC6301B3312A9F59E04E487BC72A, 76F71824E80D10EB71BEDE5EE3A64CAD7CAC3DDFBB6670D1537E6B75FF0217E9 ] Microsoft_Bluetooth_AvrcpTransport C:\WINDOWS\System32\drivers\Microsoft.Bluetooth.AvrcpTransport.sys
16:39:33.0753 0x0c0c  Microsoft_Bluetooth_AvrcpTransport - ok
16:39:33.0769 0x0c0c  MixedRealityOpenXRSvc - ok
16:39:33.0769 0x0c0c  mlx4_bus - ok
16:39:33.0769 0x0c0c  MMCSS - ok
16:39:33.0784 0x0c0c  Modem - ok
16:39:33.0800 0x0c0c  monitor - ok
16:39:33.0800 0x0c0c  mouclass - ok
16:39:33.0800 0x0c0c  mouhid - ok
16:39:33.0800 0x0c0c  mountmgr - ok
16:39:33.0800 0x0c0c  mpsdrv - ok
16:39:33.0815 0x0c0c  mpssvc - ok
16:39:33.0831 0x0c0c  MRxDAV - ok
16:39:33.0847 0x0c0c  mrxsmb - ok
16:39:33.0847 0x0c0c  mrxsmb20 - ok
16:39:33.0878 0x0c0c  [ E587396A4C8151ABBF13A96C4465DE31, A3AA5D51E34657479CFCDC3DBB7821B7255F7CB57D5686B7F709A7953AD537EB ] MsBridge        C:\WINDOWS\system32\drivers\bridge.sys
16:39:33.0972 0x0c0c  MsBridge - ok
16:39:34.0003 0x0c0c  [ 2EF846AC66E181BE820B513DBC15B5D2, EDFE71025C352D0DABEC7B9506C5945BB0EC11F8DB540DB8CB1116C2EA1648A8 ] MSDTC           C:\WINDOWS\System32\msdtc.exe
16:39:34.0112 0x0c0c  MSDTC - ok
16:39:34.0112 0x0c0c  Msfs - ok
16:39:34.0159 0x0c0c  [ 6092FD060EC4132A799BDAD61845DDB7, B45F9D3A71FC8A73AED3C5B8CF6F14A25EBDD3D4D47C9F39FFCD75C7D22F4A9E ] msgpiowin32     C:\WINDOWS\System32\drivers\msgpiowin32.sys
16:39:34.0175 0x0c0c  msgpiowin32 - ok
16:39:34.0175 0x0c0c  mshidkmdf - ok
16:39:34.0222 0x0c0c  [ 9E90FE6DF363D2427A5C773120E7B27D, 1FDB7E28CCAF757603C4B754E1AC9C470E5E60E85DE067375902F108F5E34608 ] mshidumdf       C:\WINDOWS\System32\drivers\mshidumdf.sys
16:39:34.0268 0x0c0c  mshidumdf - ok
16:39:34.0284 0x0c0c  msisadrv - ok
16:39:34.0300 0x0c0c  MSiSCSI - ok
16:39:34.0315 0x0c0c  msiserver - ok
16:39:34.0315 0x0c0c  MSKSSRV - ok
16:39:34.0331 0x0c0c  [ 9FB5040C8CEAE4C32B7884ECBBCAFDAF, 0EC3E53C5B1B202440DE22A5BF7E1EBE9AF5BBB6BA69DB9D018A6D8EC97B477E ] MsLldp          C:\WINDOWS\system32\drivers\mslldp.sys
16:39:34.0425 0x0c0c  MsLldp - ok
16:39:34.0425 0x0c0c  MSPCLOCK - ok
16:39:34.0425 0x0c0c  MSPQM - ok
16:39:34.0440 0x0c0c  MsQuic - ok
16:39:34.0440 0x0c0c  MsRPC - ok
16:39:34.0440 0x0c0c  mssmbios - ok
16:39:34.0456 0x0c0c  MSTEE - ok
16:39:34.0456 0x0c0c  MTConfig - ok
16:39:34.0456 0x0c0c  Mup - ok
16:39:34.0456 0x0c0c  mvumis - ok
16:39:34.0534 0x0c0c  [ B3BDA3044B2C643B28143275FA731C6B, 1F050015B84DBB43106057DBCD25A86E281ECD8098B9C757A27735614B718534 ] MyWiFiDHCPDNS   C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
16:39:34.0534 0x0c0c  MyWiFiDHCPDNS - ok
16:39:34.0565 0x0c0c  NativeWifiP - ok
16:39:34.0597 0x0c0c  NaturalAuthentication - ok
16:39:34.0628 0x0c0c  [ D47A20839608B8213065D7AFC8C42195, 7B0187BE9705ED2F925616C13B3744BAC0A9C96B21BE503D96BC9EE7EE125B33 ] NcaSvc          C:\WINDOWS\System32\ncasvc.dll
16:39:34.0893 0x0c0c  NcaSvc - ok
16:39:34.0940 0x0c0c  NcbService - ok
16:39:34.0956 0x0c0c  [ 8C938E851CDF2CE30BBEA14555B61820, F853F526C811893BD40B1124BAEC543099381E7BF091729B6A6665DF3CE10B94 ] NcdAutoSetup    C:\WINDOWS\System32\NcdAutoSetup.dll
16:39:35.0018 0x0c0c  NcdAutoSetup - ok
16:39:35.0034 0x0c0c  ndfltr - ok
16:39:35.0034 0x0c0c  NDIS - ok
16:39:35.0065 0x0c0c  [ 6BEC0929C7A7BF2A7C44F585ECC7DAEB, 5F6395268CBD26A4B90960479040C114B2C8A3F24C188C2D5F62D6AB43A637D1 ] NdisCap         C:\WINDOWS\system32\drivers\ndiscap.sys
16:39:35.0081 0x0c0c  NdisCap - ok
16:39:35.0097 0x0c0c  NdisImPlatform - ok
16:39:35.0097 0x0c0c  NdisTapi - ok
16:39:35.0097 0x0c0c  Ndisuio - ok
16:39:35.0112 0x0c0c  NdisVirtualBus - ok
16:39:35.0112 0x0c0c  NdisWan - ok
16:39:35.0112 0x0c0c  ndiswanlegacy - ok
16:39:35.0128 0x0c0c  [ 33CDAEDC7CBE8339A8324CEC2461BFB4, DAAEACDB4506D2BDDED61957D92FB4983E11D9CE6E7B25119B4CBFB431C945F4 ] NDKPing         C:\WINDOWS\system32\drivers\NDKPing.sys
16:39:35.0143 0x0c0c  NDKPing - ok
16:39:35.0143 0x0c0c  ndproxy - ok
16:39:35.0190 0x0c0c  [ 77621E74FD79B267071A0D12C643A48A, 8228B7D1237A0FFABCCC150B299EA494C8F0CB4CCB51AB0DBFF08CBAA9EFC4BB ] Ndu             C:\WINDOWS\system32\drivers\Ndu.sys
16:39:35.0222 0x0c0c  Ndu - ok
16:39:35.0237 0x0c0c  NetAdapterCx - ok
16:39:35.0253 0x0c0c  NetBIOS - ok
16:39:35.0253 0x0c0c  NetBT - ok
16:39:35.0253 0x0c0c  Netlogon - ok
16:39:35.0253 0x0c0c  Netman - ok
16:39:35.0268 0x0c0c  netprofm - ok
16:39:35.0268 0x0c0c  NetSetupSvc - ok
16:39:35.0362 0x0c0c  [ B9D455C60292DF5FCB064834CA5802AA, 75DCE4E5FA08CCEAF4D3D30FE8E26903FCDD14CC852E820F63B40F374C706DBD ] NetTcpPortSharing C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
16:39:35.0503 0x0c0c  NetTcpPortSharing - ok
16:39:35.0518 0x0c0c  netvsc - ok
16:39:35.0612 0x0c0c  [ 87EA78E543A3F78CB7D928C5ED9FA122, 1C24E9EA2DC3D168212A31C51BE420517784BE9CDF61228AE57BF933DC09AE3D ] NETwNb64        C:\WINDOWS\System32\drivers\Netwbw02.sys
16:39:35.0737 0x0c0c  NETwNb64 - ok
16:39:35.0753 0x0c0c  NgcCtnrSvc - ok
16:39:35.0893 0x0c0c  NgcSvc - ok
16:39:35.0909 0x0c0c  NlaSvc - ok
16:39:35.0909 0x0c0c  Npfs - ok
16:39:35.0925 0x0c0c  npsvctrig - ok
16:39:35.0925 0x0c0c  nsi - ok
16:39:35.0925 0x0c0c  nsiproxy - ok
16:39:35.0925 0x0c0c  Ntfs - ok
16:39:35.0940 0x0c0c  Null - ok
16:39:35.0940 0x0c0c  nvdimm - ok
16:39:35.0940 0x0c0c  nvraid - ok
16:39:35.0940 0x0c0c  nvstor - ok
16:39:35.0987 0x0c0c  [ 2DC49F990DDC302C9608BA0A97FEF58B, 0C950D16F7C6B19851FCFC8B8805BE78824DDFD6D7AEA1EEA865C965824001B2 ] NW1900          C:\WINDOWS\System32\drivers\NW1900.sys
16:39:35.0987 0x0c0c  NW1900 - ok
16:39:36.0003 0x0c0c  [ D12FA6055E4C22C8AF8CE1F2760D2CAC, 1791EC3B535F4D4984361079BC56FE34DB631ECD454BBA5134B3F117F3C25FAB ] NWLowRider      C:\WINDOWS\System32\drivers\NWLowRider.sys
16:39:36.0003 0x0c0c  NWLowRider - ok
16:39:36.0034 0x0c0c  [ A0A870F8CB2C853D599D081A0984012F, D005D7CA6057CB53E878BCF4E1B632577C167F8B98BF91294FE1DCADEAE37916 ] NWVoltron       C:\WINDOWS\System32\drivers\NWVoltron.sys
16:39:36.0034 0x0c0c  NWVoltron - ok
16:39:36.0050 0x0c0c  OneSyncSvc - ok
16:39:36.0096 0x0c0c  [ 9D10F99A6712E28F8ACD5641E3A7EA6B, 70964A0ED9011EA94044E15FA77EDD9CF535CC79ED8E03A3721FF007E69595CC ] ose             C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
16:39:36.0112 0x0c0c  ose - ok
16:39:36.0378 0x0c0c  [ 61BFFB5F57AD12F83AB64B7181829B34, 1DD0DD35E4158F95765EE6639F217DF03A0A19E624E020DBA609268C08A13846 ] osppsvc         C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
16:39:36.0534 0x0c0c  osppsvc - ok
16:39:36.0550 0x0c0c  p2pimsvc - ok
16:39:36.0581 0x0c0c  [ DA97CD5815EC123BC88382C08D465B9E, 46F5EA2E3D590FB10E14BC811612B6EF87C805B359A652D2C6BFE4840D5D6AA2 ] p2psvc          C:\WINDOWS\system32\p2psvc.dll
16:39:36.0987 0x0c0c  p2psvc - ok
16:39:36.0987 0x0c0c  Parport - ok
16:39:37.0018 0x0c0c  partmgr - ok
16:39:37.0018 0x0c0c  PcaSvc - ok
16:39:37.0034 0x0c0c  pci - ok
16:39:37.0034 0x0c0c  pciide - ok
16:39:37.0034 0x0c0c  pcmcia - ok
16:39:37.0050 0x0c0c  pcw - ok
16:39:37.0050 0x0c0c  pdc - ok
16:39:37.0112 0x0c0c  [ 1FABA74CEA705ECB2CDA5398F3477212, 07D8952C60A8D89F249985206746B132596909E8BABC3A0C5B6E33A22FFD65CF ] PDF24           C:\Program Files\PDF24\pdf24.exe
16:39:37.0143 0x0c0c  PDF24 - ok
16:39:37.0159 0x0c0c  PEAUTH - ok
16:39:37.0175 0x0c0c  perceptionsimulation - ok
16:39:37.0190 0x0c0c  percsas2i - ok
16:39:37.0190 0x0c0c  percsas3i - ok
16:39:37.0253 0x0c0c  [ 2FC7CFCEDBF7E038351C7CEB1036D2E1, 41D7DA706F0CF613DF768B6795CD09C5C1035F9F101051FB58F5042EB4352DB6 ] PerfHost        C:\WINDOWS\SysWow64\perfhost.exe
16:39:37.0909 0x0c0c  PerfHost - ok
16:39:37.0924 0x0c0c  PhoneSvc - ok
16:39:37.0940 0x0c0c  PimIndexMaintenanceSvc - ok
16:39:37.0940 0x0c0c  PktMon - ok
16:39:38.0003 0x0c0c  [ 9E431A5D697432DD6F4DB48C9A185104, 44C16E194258C9143A45F4022F9C5DE229E217D6FF7F944F105FE631BE9EF4A7 ] pla             C:\WINDOWS\system32\pla.dll
16:39:38.0268 0x0c0c  pla - ok
16:39:38.0284 0x0c0c  PlugPlay - ok
16:39:38.0299 0x0c0c  [ D257B3A5E243E04867D1ABD2DA13B6F8, 163EF53B0AAFBAD09309E5A1FA2E16B6EEE508496CCD9F3B18B2EAF0B0F5E11B ] PMDRVS          C:\WINDOWS\system32\drivers\pmdrvs.sys
16:39:38.0315 0x0c0c  PMDRVS - ok
16:39:38.0315 0x0c0c  pmem - ok
16:39:38.0331 0x0c0c  [ 2769F200292C0F941A10BD60C33EA4A6, B8345C32585C45E6248D7194B1071F2B8617718E7C9B270AAF44C132D029DB4C ] PNPMEM          C:\WINDOWS\System32\drivers\pnpmem.sys
16:39:38.0362 0x0c0c  PNPMEM - ok
16:39:38.0393 0x0c0c  [ 6AAAC8AD69AEFBE5FE04738B687EE85E, 83427082298E2FC021D5D39A43DB4A5783D95213F2CA8D3A997DB6C815BD9CB2 ] PNRPAutoReg     C:\WINDOWS\system32\pnrpauto.dll
16:39:38.0518 0x0c0c  PNRPAutoReg - ok
16:39:38.0518 0x0c0c  PNRPsvc - ok
16:39:38.0534 0x0c0c  PolicyAgent - ok
16:39:38.0565 0x0c0c  portcfg - ok
16:39:38.0565 0x0c0c  Power - ok
16:39:38.0565 0x0c0c  PptpMiniport - ok
16:39:38.0721 0x0c0c  [ 127682EFCBC718AE83C591CF12EDBE9E, EDA3BBCA39385ECFC53D6726E2E0311F86033F2E29BB2744A92339947D2498BD ] PrintNotify     C:\WINDOWS\system32\spool\drivers\x64\3\PrintConfig.dll
16:39:38.0924 0x0c0c  PrintNotify - ok
16:39:38.0940 0x0c0c  PrintWorkflowUserSvc - ok
16:39:38.0971 0x0c0c  Processor - ok
16:39:38.0971 0x0c0c  ProfSvc - ok
16:39:38.0987 0x0c0c  Psched - ok
16:39:38.0987 0x0c0c  PushToInstall - ok
16:39:39.0018 0x0c0c  [ 2F3808790D517E5E5E6ABF7177875C02, BE1A79A6498697EB86FC29638324A853197B49BC06AE3EB1130793F710926998 ] QWAVE           C:\WINDOWS\system32\qwave.dll
16:39:39.0143 0x0c0c  QWAVE - ok
16:39:39.0174 0x0c0c  [ CE51A9A997D2830C6C64A36D7F8D8879, 706D683CAF92C259C121222446D34ED43F6E8872407C3615E2ED118ACD24D21D ] QWAVEdrv        C:\WINDOWS\system32\drivers\qwavedrv.sys
16:39:39.0190 0x0c0c  QWAVEdrv - ok
16:39:39.0190 0x0c0c  Ramdisk - ok
16:39:39.0206 0x0c0c  RasAcd - ok
16:39:39.0221 0x0c0c  RasAgileVpn - ok
16:39:39.0221 0x0c0c  RasAuto - ok
16:39:39.0221 0x0c0c  Rasl2tp - ok
16:39:39.0237 0x0c0c  RasMan - ok
16:39:39.0237 0x0c0c  RasPppoe - ok
16:39:39.0237 0x0c0c  RasSstp - ok
16:39:39.0237 0x0c0c  rdbss - ok
16:39:39.0268 0x0c0c  [ B7BAD23CA994EFF8EA11261626326004, 056495FB4A54984CE9D28D7B45550990D4A4B0736669F0F69138BEF51A695EFA ] rdpbus          C:\WINDOWS\System32\drivers\rdpbus.sys
16:39:39.0284 0x0c0c  rdpbus - ok
16:39:39.0299 0x0c0c  RDPDR - ok
16:39:39.0315 0x0c0c  RdpVideoMiniport - ok
16:39:39.0331 0x0c0c  [ B4A6F3BFB5A07DAF4E18C14A6337A226, F906865E349390D24A3DCBC563154BBB9F307B97361832BE93BC9D44A9F3B486 ] rdyboost        C:\WINDOWS\system32\drivers\rdyboost.sys
16:39:39.0346 0x0c0c  rdyboost - ok
16:39:39.0362 0x0c0c  ReFS - ok
16:39:39.0362 0x0c0c  ReFSv1 - ok
16:39:39.0393 0x0c0c  [ 3E53D61A9E0C41D3370197FF4D2D38C3, 21C49489A64931EEB3E1CF8E3F02AD4B9A20B4B21FAE91CFD24EDB574F33801D ] RegSrvc         C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
16:39:39.0409 0x0c0c  RegSrvc - ok
16:39:39.0440 0x0c0c  RemoteAccess - ok
16:39:39.0487 0x0c0c  [ 58B3C0A2B0C130838588EF519ADCE495, 60360DD8EA1802C8F95EB93531FF9666BE1148253E6A1BD706D4CA98955C0F6E ] RemoteRegistry  C:\WINDOWS\system32\regsvc.dll
16:39:39.0659 0x0c0c  RemoteRegistry - ok
16:39:39.0659 0x0c0c  RetailDemo - ok
16:39:39.0706 0x0c0c  [ D2EE9CCE0187C616E50D61EB30ECA262, 825C918D22FC8DBF3EE9BDB41D121A0AC3CCBFFBA147E2B26F0197552E0675DE ] RFCOMM          C:\WINDOWS\System32\drivers\rfcomm.sys
16:39:39.0721 0x0c0c  RFCOMM - ok
16:39:39.0752 0x0c0c  [ 4DD0EFE49F0C020DAFEAE6F5F231362C, DF04978AF6CD34C8251B3DDE381CD77518684DCB1D2B16BD2DAFEE63AC9D5858 ] rhproxy         C:\WINDOWS\System32\drivers\rhproxy.sys
16:39:39.0768 0x0c0c  rhproxy - ok
16:39:39.0768 0x0c0c  RmSvc - ok
16:39:39.0784 0x0c0c  RpcEptMapper - ok
16:39:39.0815 0x0c0c  [ D45676C47616B9ABBFAEC97DD3B240A8, E13985D667F66B7A0082356F23270F61A57B8C2DD211B1E09D66D7970D7B4D6A ] RpcLocator      C:\WINDOWS\system32\locator.exe
16:39:39.0909 0x0c0c  RpcLocator - ok
16:39:39.0909 0x0c0c  RpcSs - ok
16:39:39.0956 0x0c0c  [ EABD30C39742A79913B595A5B6F809D4, 9067160F566220A2B21FEEE181729A796A3F3EECF75FFB75815BE5CCC7BBA64F ] rspndr          C:\WINDOWS\system32\drivers\rspndr.sys
16:39:39.0971 0x0c0c  rspndr - ok
16:39:40.0018 0x0c0c  [ 88C3A100D2F37B9D122023EA1FBE7D9A, 504190ACD4585D717FA3204FFA11FC8CB69B70440A19E0C83984F3257B3734EC ] RtkAudioService C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
16:39:40.0018 0x0c0c  RtkAudioService - ok
16:39:40.0065 0x0c0c  [ 739880D90D6EDE2EDCF7E030665A2D4F, DC8B7EEE04AF59BEEF171011D9433559476FED67EED87FE165AF31144D236C65 ] RTSPER          C:\WINDOWS\system32\DRIVERS\RtsPer.sys
16:39:40.0096 0x0c0c  RTSPER - ok
16:39:40.0112 0x0c0c  [ 5914CC0C1E99A3C1711BDB1E224526D1, 54BB8636F27282B396D487B3FEA8BD73F2F6FE6DA4DE8D718EE498F75A6A5DCE ] s3cap           C:\WINDOWS\System32\drivers\vms3cap.sys
16:39:40.0112 0x0c0c  s3cap - ok
16:39:40.0127 0x0c0c  SamSs - ok
16:39:40.0159 0x0c0c  sbp2port - ok
16:39:40.0159 0x0c0c  SCardSvr - ok
16:39:40.0159 0x0c0c  ScDeviceEnum - ok
16:39:40.0159 0x0c0c  scfilter - ok
16:39:40.0174 0x0c0c  Schedule - ok
16:39:40.0174 0x0c0c  scmbus - ok
16:39:40.0174 0x0c0c  SCPolicySvc - ok
16:39:40.0190 0x0c0c  sdbus - ok
16:39:40.0206 0x0c0c  [ 3200667DB433F0A2032FAF4DC02E2089, 5E940CA63AD21CEA08C334AC61D985BAFDBA7DCB2D388F355B5C72EFA3E23E0A ] SDFRd           C:\WINDOWS\System32\drivers\SDFRd.sys
16:39:40.0221 0x0c0c  SDFRd - ok
16:39:40.0237 0x0c0c  SDRSVC - ok
16:39:40.0237 0x0c0c  sdstor - ok
16:39:40.0252 0x0c0c  [ 016706A76857F914C99D2472B1E79BF9, 39A114EB591E243E0429DA7279413F046626DE7B52E057DDBCD26A0A1BF327FB ] seclogon        C:\WINDOWS\system32\seclogon.dll
16:39:40.0409 0x0c0c  seclogon - ok
16:39:40.0424 0x0c0c  SecurityHealthService - ok
16:39:40.0440 0x0c0c  SEMgrSvc - ok
16:39:40.0456 0x0c0c  [ 1EA7972A4C7163FF1D3EFE9988404D4E, 56A94B1617815C1E8A79D832B0F0CBA683C3080105CC4C87DBB9B8EAB4CD2690 ] SENS            C:\WINDOWS\System32\sens.dll
16:39:40.0487 0x0c0c  SENS - ok
16:39:40.0487 0x0c0c  SensorDataService - ok
16:39:40.0502 0x0c0c  SensorService - ok
16:39:40.0518 0x0c0c  [ 0BCFFAD6F3B180DD60C941B01768F733, A0B73C1BF636F14504B69606999287B6FE148C958A4F6E31E9022FF129A048E0 ] SensrSvc        C:\WINDOWS\system32\sensrsvc.dll
16:39:40.0565 0x0c0c  SensrSvc - ok
16:39:40.0565 0x0c0c  SerCx - ok
16:39:40.0565 0x0c0c  SerCx2 - ok
16:39:40.0581 0x0c0c  Serenum - ok
16:39:40.0581 0x0c0c  Serial - ok
16:39:40.0581 0x0c0c  sermouse - ok
16:39:40.0596 0x0c0c  SessionEnv - ok
16:39:40.0612 0x0c0c  sfloppy - ok
16:39:40.0627 0x0c0c  [ C05648C2BE6176BE557D9C7F02916388, C65D8FEDDCD9A52B04F42C64DAD2A499BF51246D36042E8DC09DD04C4C0B7BEE ] SgrmAgent       C:\WINDOWS\system32\drivers\SgrmAgent.sys
16:39:40.0643 0x0c0c  SgrmAgent - ok
16:39:40.0643 0x0c0c  SgrmBroker - ok
16:39:40.0659 0x0c0c  SharedAccess - ok
16:39:40.0674 0x0c0c  SharedRealitySvc - ok
16:39:40.0690 0x0c0c  [ BE44F2B19C4F61FED874C7FE26DF92AA, 07888C7575A1D7D46AE375B1CE6C13665CCEE0F0672EA8FDE71B955B5BC0EA70 ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll
16:39:40.0956 0x0c0c  ShellHWDetection - ok
16:39:41.0002 0x0c0c  [ D1AC677E7066D3278356C875628B16D4, FBB0E872FBF4EF179204787AC1C4D8008A407FD8E91B8CCA3FCDAC691D7593BC ] Shockprf        C:\WINDOWS\system32\DRIVERS\Apsx64.sys
16:39:41.0018 0x0c0c  Shockprf - ok
16:39:41.0018 0x0c0c  shpamsvc - ok
16:39:41.0018 0x0c0c  SiSRaid2 - ok
16:39:41.0018 0x0c0c  SiSRaid4 - ok
16:39:41.0049 0x0c0c  [ BCE703FE67976C57B789F19A77C4C7D1, 6D249386924AA443B3237BF71D9EFDB8C6D2CEE6E40823519694554224FB1538 ] SMARTMouseFilterx64 C:\WINDOWS\System32\drivers\SMARTMouseFilterx64.sys
16:39:41.0112 0x0c0c  SMARTMouseFilterx64 - ok
16:39:41.0112 0x0c0c  SmartSAMD - ok
16:39:41.0127 0x0c0c  [ C02C2D6EBC48A52C0C2922BD86CCEEDE, 07FB67B4EFEF315E071671884FFCCE5B39B486C8901BF9C8D62AEBF3CACF6937 ] SMARTVHidMiniVistaAmd64 C:\WINDOWS\System32\drivers\SMARTVHidMiniVistaAmd64.sys
16:39:41.0190 0x0c0c  SMARTVHidMiniVistaAmd64 - ok
16:39:41.0221 0x0c0c  [ CB4765B055D922E3A8F9C0C47CD82AA7, 3C830E82D46E8C835FEF3E7E5CD8EE1252F3A0B72CCF7FA50D185F764B31E602 ] SmbDrv          C:\WINDOWS\System32\drivers\Smb_driver_AMDASF.sys
16:39:41.0237 0x0c0c  SmbDrv - ok
16:39:41.0252 0x0c0c  [ 38F010FA1E511C28E5A4FF511085F4C1, C8766723B0710F6CD85F0C17D235210160A7D846F284874CBAE076467B6ED011 ] SmbDrvI         C:\WINDOWS\system32\DRIVERS\Smb_driver_Intel.sys
16:39:41.0268 0x0c0c  SmbDrvI - ok
16:39:41.0299 0x0c0c  [ 94A36F00D894E4558D0243D4D9844323, E3BEB854587049DE54E0E3ACD8F739AACBEAA43113D825542424A2A7B3FA18DD ] SMIDriverGen    C:\WINDOWS\system32\DRIVERS\smi.sys
16:39:41.0299 0x0c0c  SMIDriverGen - ok
16:39:41.0299 0x0c0c  smphost - ok
16:39:41.0315 0x0c0c  SmsRouter - ok
16:39:41.0346 0x0c0c  [ 1971BBC71602B928CF9257759E3C05E8, 9D665698FF26ED333AD385B4B7A6C0F2B6806371D278E281FA4188002A5317E8 ] SNMPTRAP        C:\WINDOWS\System32\snmptrap.exe
16:39:41.0377 0x0c0c  SNMPTRAP - ok
16:39:41.0424 0x0c0c  [ 27B7D9E872939EBB34C30343F991893D, 879AFDC8C50487ED0D3CB58C70A206E185F94BE75C25C31C387F3F08740771F9 ] spaceparser     C:\WINDOWS\system32\drivers\spaceparser.sys
16:39:41.0455 0x0c0c  spaceparser - ok
16:39:41.0455 0x0c0c  spaceport - ok
16:39:41.0502 0x0c0c  [ AB3BDEC793187CEDF1229AC98BB7DEDF, D2EA0C5FC534C89310207AA26A8816B30FEEF3F2708A067D8BB93D3CFF9C3936 ] SpatialGraphFilter C:\WINDOWS\system32\drivers\SpatialGraphFilter.sys
16:39:41.0502 0x0c0c  SpatialGraphFilter - ok
16:39:41.0518 0x0c0c  SpbCx - ok
16:39:41.0534 0x0c0c  spectrum - ok
16:39:41.0534 0x0c0c  Spooler - ok
16:39:41.0549 0x0c0c  sppsvc - ok
16:39:41.0549 0x0c0c  srv2 - ok
16:39:41.0565 0x0c0c  srvnet - ok
16:39:41.0580 0x0c0c  SSDPSRV - ok
16:39:41.0612 0x0c0c  ssh-agent - ok
16:39:41.0627 0x0c0c  SstpSvc - ok
16:39:41.0627 0x0c0c  StateRepository - ok
16:39:41.0752 0x0c0c  [ 58E7B7ADAA4680E5FB09D1477071EF42, 706613A017C5650AEEED94C77BF61B3FA2C0D2874AE15A7F3D7B9EC5534F5EA2 ] Steam Client Service C:\Program Files (x86)\Common Files\Steam\steamservice.exe
16:39:41.0877 0x0c0c  Steam Client Service - ok
16:39:41.0893 0x0c0c  stexstor - ok
16:39:41.0924 0x0c0c  stisvc - ok
16:39:41.0940 0x0c0c  storahci - ok
16:39:41.0971 0x0c0c  storflt - ok
16:39:41.0971 0x0c0c  stornvme - ok
16:39:41.0971 0x0c0c  storqosflt - ok
16:39:41.0971 0x0c0c  StorSvc - ok
16:39:41.0987 0x0c0c  storufs - ok
16:39:42.0002 0x0c0c  storvsc - ok
16:39:42.0049 0x0c0c  [ 2AA42DECBBC92848B2C72B0A8EF3C4A2, D716C8C611FF2FBC7B5B9CE319823DB459C0B1AD2D98898CD4A9B3BA1F5E0619 ] SUService       C:\Program Files (x86)\Lenovo\System Update\SUService.exe
16:39:42.0049 0x0c0c  SUService - ok
16:39:42.0049 0x0c0c  svsvc - ok
16:39:42.0080 0x0c0c  swenum - ok
16:39:42.0096 0x0c0c  swprv - ok
16:39:42.0112 0x0c0c  Synth3dVsc - ok
16:39:42.0159 0x0c0c  [ 5286F9B8FCFD0FC43A3836F55BC3F3AD, 5DAAEEE6C10D372F6E3C3ED3075A85DE785368B223D2F720BE39FFDE0562117A ] SynTP           C:\WINDOWS\system32\DRIVERS\SynTP.sys
16:39:42.0190 0x0c0c  SynTP - ok
16:39:42.0221 0x0c0c  [ DB9E3F6217CBAAE2F749D3E90A57A545, FB43B3A7353EFE558CE283CFBE6DB055109BCE6D5208F75184882752F9888AAC ] SynTPEnhService C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
16:39:42.0237 0x0c0c  SynTPEnhService - ok
16:39:42.0284 0x0c0c  SysMain - ok
16:39:42.0315 0x0c0c  SystemEventsBroker - ok
16:39:42.0330 0x0c0c  TabletInputService - ok
16:39:42.0330 0x0c0c  TapiSrv - ok
16:39:42.0346 0x0c0c  Tcpip - ok
16:39:42.0346 0x0c0c  Tcpip6 - ok
16:39:42.0377 0x0c0c  [ 57BE670CF1D93717B628271B404D658A, EDD4C58EDAB985C87D6101D9CA5620146EE2BB8A1B899C635DD4CD36541DD46E ] tcpipreg        C:\WINDOWS\system32\drivers\tcpipreg.sys
16:39:42.0393 0x0c0c  tcpipreg - ok
16:39:42.0424 0x0c0c  tdx - ok
16:39:42.0424 0x0c0c  Telemetry - ok
16:39:42.0455 0x0c0c  [ C225B94F2B27AC97C3E66C0550AEA249, 6F88375DD12A648B77BB6EB4BE527FF6678EE76A2059DB5B4CC971CDB31D0DB8 ] terminpt        C:\WINDOWS\System32\drivers\terminpt.sys
16:39:42.0455 0x0c0c  terminpt - ok
16:39:42.0487 0x0c0c  TermService - ok
16:39:42.0502 0x0c0c  [ 8EC4197962A0349DFFBDC11586099DB8, 8DD5348A4983C376F63E6B209227D4D02300555F8C80A0E0DB2EA16074ABC334 ] Themes          C:\WINDOWS\system32\themeservice.dll
16:39:42.0799 0x0c0c  Themes - ok
16:39:42.0799 0x0c0c  TieringEngineService - ok
16:39:42.0799 0x0c0c  TimeBrokerSvc - ok
16:39:42.0799 0x0c0c  TokenBroker - ok
16:39:42.0830 0x0c0c  [ D43EB8666214C14AB97080D4B11F5CAF, 3EF108E16627FFD7E4578E7A6DEE23D076C9A11524EF8FCCCC45A6B930CFBEE1 ] TPDIGIMN        C:\WINDOWS\system32\DRIVERS\ApsHM64.sys
16:39:42.0830 0x0c0c  TPDIGIMN - ok
16:39:42.0877 0x0c0c  [ EAB5AF16EE4D864A548C367D15BFABAF, 7BC3C22933F997BCC98696B7618466DCCA3C64F1A03CBC700E3DA8B8415F4C5E ] TPHKLOAD        C:\WINDOWS\System32\DriverStore\FileRepository\fn.inf_amd64_700aca387f1cbd51\driver\TPHKLOAD.exe
16:39:42.0924 0x0c0c  TPHKLOAD - ok
16:39:42.0924 0x0c0c  TPM - ok
16:39:42.0940 0x0c0c  [ 78A238084E9DCE6DEEC24AC9A3C5BFB1, 12069823B0B852DAB7A2E8609EACBDF18F28005113A812D474314C994534E7B8 ] TPPWRIF         C:\WINDOWS\system32\drivers\Tppwr64v.sys
16:39:42.0955 0x0c0c  TPPWRIF - ok
16:39:42.0987 0x0c0c  [ 62636F77E0C51D59F043D9197C897AD4, F121E79E0A15ED6E362D7DEF72F9C1D2D5CC50BBEC3541DFAB91691BC3AFB191 ] TrkWks          C:\WINDOWS\System32\trkwks.dll
16:39:43.0049 0x0c0c  TrkWks - ok
16:39:43.0065 0x0c0c  TroubleshootingSvc - ok
16:39:43.0096 0x0c0c  TrustedInstaller - ok
16:39:43.0127 0x0c0c  [ F613A8618CC19DD96D1E0C81C5DCB7D1, AD6DE675AC033BE6BF75FF6303EAED4B5C672689D3AEC6DB94816D60E19B7030 ] TsUsbFlt        C:\WINDOWS\system32\drivers\tsusbflt.sys
16:39:43.0143 0x0c0c  TsUsbFlt - ok
16:39:43.0158 0x0c0c  TsUsbGD - ok
16:39:43.0174 0x0c0c  [ 6244FD1056BF170E38245B4B9042BFDF, C32908B3C5800CD52EF9BDD26C77B8162831CFD19DBF1D399941B17FB909AD94 ] tunnel          C:\WINDOWS\system32\drivers\tunnel.sys
16:39:43.0205 0x0c0c  tunnel - ok
16:39:43.0205 0x0c0c  tzautoupdate - ok
16:39:43.0221 0x0c0c  UASPStor - ok
16:39:43.0221 0x0c0c  UcmCx0101 - ok
16:39:43.0252 0x0c0c  [ 229B33B8499F4F2AAB1F3B590423611F, E70A2D9EEEF0C6894A0DB7990CFF6ECE3B8F389FD30B7B1949FCBDD3300B6148 ] UcmTcpciCx0101  C:\WINDOWS\system32\Drivers\UcmTcpciCx.sys
16:39:43.0268 0x0c0c  UcmTcpciCx0101 - ok
16:39:43.0299 0x0c0c  [ 7FDC3A6FD8547468CE554C8821640103, 3626760AEE42EE36E047DA6899A81E0646DFBA344A234270EAE5D635F049BE37 ] UcmUcsiAcpiClient C:\WINDOWS\System32\drivers\UcmUcsiAcpiClient.sys
16:39:43.0330 0x0c0c  UcmUcsiAcpiClient - ok
16:39:43.0330 0x0c0c  UcmUcsiCx0101 - ok
16:39:43.0346 0x0c0c  Ucx01000 - ok
16:39:43.0346 0x0c0c  UdeCx - ok
16:39:43.0346 0x0c0c  udfs - ok
16:39:43.0362 0x0c0c  UdkUserSvc - ok
16:39:43.0362 0x0c0c  UEFI - ok
16:39:43.0377 0x0c0c  Ufx01000 - ok
16:39:43.0393 0x0c0c  UfxChipidea - ok
16:39:43.0393 0x0c0c  ufxsynopsys - ok
16:39:43.0471 0x0c0c  [ 3CE7ADECE2CDAD638CFC04A685D132D3, CFC126A7F129D8D24511B500411FDDB07D0608F5DE838424CDF6C35AEBAF7ABE ] uhssvc          C:\Program Files\Microsoft Update Health Tools\uhssvc.exe
16:39:43.0487 0x0c0c  uhssvc - ok
16:39:43.0487 0x0c0c  umbus - ok
16:39:43.0487 0x0c0c  UmPass - ok
16:39:43.0502 0x0c0c  UmRdpService - ok
16:39:43.0518 0x0c0c  UnistoreSvc - ok
16:39:43.0518 0x0c0c  upnphost - ok
16:39:43.0533 0x0c0c  [ 5C33B91675BE0C9693358C1AAA723D20, A5BB54ABBB0F7B13ACCA0997F567A81395688C6D68EB87F67F688737DC16918F ] UrsChipidea     C:\WINDOWS\System32\DriverStore\FileRepository\urschipidea.inf_amd64_78ad1c14e33df968\urschipidea.sys
16:39:43.0549 0x0c0c  UrsChipidea - ok
16:39:43.0565 0x0c0c  [ ADFAB87405AE22290E24D0E8E6141AF1, BC0982BEFE4CABEA1E260C8A3266EA18A4CA158A07D1C5176890A04CC3B6A84A ] UrsCx01000      C:\WINDOWS\system32\drivers\urscx01000.sys
16:39:43.0580 0x0c0c  UrsCx01000 - ok
16:39:43.0612 0x0c0c  [ BBDE7BF496327115DD744E7D4105C7BC, 5A8CC47603A1C9D58A30A5E897F1BCDC56199B08317B9FF319D469D6DD6CAAF0 ] UrsSynopsys     C:\WINDOWS\System32\DriverStore\FileRepository\urssynopsys.inf_amd64_057fa37902020500\urssynopsys.sys
16:39:43.0627 0x0c0c  UrsSynopsys - ok
16:39:43.0643 0x0c0c  usbaudio - ok
16:39:43.0674 0x0c0c  [ FB9F25ACEBCBAEABFE30CACCB17D4EE6, 7D38FA294DA179E5535E3E481746F07E2AE47CE57192C2D1C5B780B583FD9C6D ] usbaudio2       C:\WINDOWS\System32\drivers\usbaudio2.sys
16:39:43.0690 0x0c0c  usbaudio2 - ok
16:39:43.0690 0x0c0c  usbccgp - ok
16:39:43.0721 0x0c0c  [ 11561FC5BAA2DEB5AC8B179B591A882E, 2AD595BF4ABC146D8F533981848FF8271E983038566937BEB48A6A8F09BC60FB ] usbcir          C:\WINDOWS\System32\drivers\usbcir.sys
16:39:43.0752 0x0c0c  usbcir - ok
16:39:43.0752 0x0c0c  usbehci - ok
16:39:43.0752 0x0c0c  usbhub - ok
16:39:43.0768 0x0c0c  USBHUB3 - ok
16:39:43.0768 0x0c0c  usbohci - ok
16:39:43.0783 0x0c0c  usbprint - ok
16:39:43.0799 0x0c0c  [ 4D073745FA6C40483A3EF02225D20B19, 3FE72BE1BD429697DB8142A582455CD3341DE798D32EA780ACFA01904437A0D7 ] usbscan         C:\WINDOWS\system32\DRIVERS\usbscan.sys
16:39:43.0830 0x0c0c  usbscan - ok
16:39:43.0830 0x0c0c  usbser - ok
16:39:43.0830 0x0c0c  USBSTOR - ok
16:39:43.0830 0x0c0c  usbuhci - ok
16:39:43.0846 0x0c0c  usbvideo - ok
16:39:43.0846 0x0c0c  USBXHCI - ok
16:39:43.0846 0x0c0c  UserDataSvc - ok
16:39:43.0862 0x0c0c  UserManager - ok
16:39:43.0877 0x0c0c  UsoSvc - ok
16:39:43.0893 0x0c0c  VacSvc - ok
16:39:43.0924 0x0c0c  [ 580C1E4BBDB0163DB40A6F06BD6036C8, B4767BDAB1C589663F55DDF74993A132BC8A77E4F2D1B227ACBC59AE7B3326E2 ] valWBFPolicyService C:\WINDOWS\system32\valWBFPolicyService.exe
16:39:44.0049 0x0c0c  valWBFPolicyService - ok
16:39:44.0080 0x0c0c  [ 61C571043A09ACF399934EC8B66F6CB5, A954603A35499C7EACC20DF71A4F40A15DBD6C504AA8598CC2178C16FC62F6BF ] valWbioSyncSvc  C:\WINDOWS\system32\valWbioSyncSvc.exe
16:39:44.0096 0x0c0c  valWbioSyncSvc - ok
16:39:44.0112 0x0c0c  VaultSvc - ok
16:39:44.0112 0x0c0c  vdrvroot - ok
16:39:44.0127 0x0c0c  vds - ok
16:39:44.0143 0x0c0c  VerifierExt - ok
16:39:44.0143 0x0c0c  vhdmp - ok
16:39:44.0143 0x0c0c  vhf - ok
16:39:44.0143 0x0c0c  Vid - ok
16:39:44.0174 0x0c0c  [ B37F0BF662BB504F0A9C247F24C281AD, 6281D573D9AD9AA204778C3823737726E882B17657B23CF5458C012FF7990E52 ] VirtualRender   C:\WINDOWS\System32\DriverStore\FileRepository\vrd.inf_amd64_81fbd405ff2470fc\vrd.sys
16:39:44.0268 0x0c0c  VirtualRender - ok
16:39:44.0268 0x0c0c  vmbus - ok
16:39:44.0283 0x0c0c  VMBusHID - ok
16:39:44.0299 0x0c0c  [ E5BB075B6B5A1DA3C3F48CA5DFF54E77, E13E8F9523F51F976084561C9D0A843CAF550FA233521FF13FFE1C5634CA6472 ] vmgid           C:\WINDOWS\System32\drivers\vmgid.sys
16:39:44.0315 0x0c0c  vmgid - ok
16:39:44.0315 0x0c0c  vmicguestinterface - ok
16:39:44.0330 0x0c0c  vmicheartbeat - ok
16:39:44.0330 0x0c0c  vmickvpexchange - ok
16:39:44.0330 0x0c0c  vmicrdv - ok
16:39:44.0330 0x0c0c  vmicshutdown - ok
16:39:44.0346 0x0c0c  vmictimesync - ok
16:39:44.0346 0x0c0c  vmicvmsession - ok
16:39:44.0346 0x0c0c  vmicvss - ok
16:39:44.0362 0x0c0c  volmgr - ok
16:39:44.0362 0x0c0c  volmgrx - ok
16:39:44.0377 0x0c0c  volsnap - ok
16:39:44.0377 0x0c0c  volume - ok
16:39:44.0408 0x0c0c  [ A37A7788DABE4FF6E33FE50D7A33D8E8, 9E99D9D27BA3DFA6F89C77B9AD91BE495F15E4F612BB63B209157DFA13BCD7E0 ] vpci            C:\WINDOWS\system32\drivers\vpci.sys
16:39:44.0424 0x0c0c  vpci - ok
16:39:44.0424 0x0c0c  vsmraid - ok
16:39:44.0440 0x0c0c  VSS - ok
16:39:44.0440 0x0c0c  VSTXRAID - ok
16:39:44.0455 0x0c0c  vwifibus - ok
16:39:44.0455 0x0c0c  vwififlt - ok
16:39:44.0455 0x0c0c  vwifimp - ok
16:39:44.0471 0x0c0c  W32Time - ok
16:39:44.0486 0x0c0c  WaaSMedicSvc - ok
16:39:44.0486 0x0c0c  WacomPen - ok
16:39:44.0502 0x0c0c  WalletService - ok
16:39:44.0502 0x0c0c  wanarp - ok
16:39:44.0502 0x0c0c  wanarpv6 - ok
16:39:44.0533 0x0c0c  [ 8449398F11D49864117105679B539816, 8FD3B9C72066D6A983D062DE72EEF9769339EACBF4E0D303B9E12343C9D5DE6C ] WarpJITSvc      C:\WINDOWS\System32\Windows.WARP.JITService.dll
16:39:45.0205 0x0c0c  WarpJITSvc - ok
16:39:45.0236 0x0c0c  wbengine - ok
16:39:45.0252 0x0c0c  WbioSrvc - ok
16:39:45.0252 0x0c0c  wcifs - ok
16:39:45.0252 0x0c0c  Wcmsvc - ok
16:39:45.0268 0x0c0c  wcncsvc - ok
16:39:45.0268 0x0c0c  wcnfs - ok
16:39:45.0283 0x0c0c  [ 5925250BDDB94B0A5FA0E7FEED36C520, 0845344F7BFAA94AF90920A5346078E6261EEA3A1A77795DDA5B70B38609348B ] WdBoot          C:\WINDOWS\system32\drivers\WdBoot.sys
16:39:45.0299 0x0c0c  WdBoot - ok
16:39:45.0315 0x0c0c  Wdf01000 - ok
16:39:45.0346 0x0c0c  [ C150CD7072592B0BCBB7DACFFC6904CD, 0F4D31410401CC564A5D1FCEF5ED2898DAFB7418C1B39D746E88451CC3518ACA ] WdFilter        C:\WINDOWS\system32\drivers\WdFilter.sys
16:39:45.0377 0x0c0c  WdFilter - ok
16:39:45.0393 0x0c0c  [ BB37AF6E45E0F69222E057A74B4AFE1E, 4662064205BEC0DB7B10F1412E0A09A6E5E3B16DE443AEF7F79ACA3ACE24A51D ] WdiServiceHost  C:\WINDOWS\system32\wdi.dll
16:39:45.0424 0x0c0c  WdiServiceHost - ok
16:39:45.0440 0x0c0c  [ BB37AF6E45E0F69222E057A74B4AFE1E, 4662064205BEC0DB7B10F1412E0A09A6E5E3B16DE443AEF7F79ACA3ACE24A51D ] WdiSystemHost   C:\WINDOWS\system32\wdi.dll
16:39:45.0455 0x0c0c  WdiSystemHost - ok
16:39:45.0471 0x0c0c  wdiwifi - ok
16:39:45.0486 0x0c0c  [ A6C92A5F2982EBB8788E0690C19048C4, 85C54A99DD43DC1FAC7FD2A31288CEC7501F795DE8FA86857790F4CCD5AF7C18 ] WdmCompanionFilter C:\WINDOWS\system32\drivers\WdmCompanionFilter.sys
16:39:45.0486 0x0c0c  WdmCompanionFilter - ok
16:39:45.0518 0x0c0c  [ C5552A3A54408AB9A0DC341E21F5EF67, 67838896B7E04EBBE2AA089F09913789A5E8C4B7E7436397135F1F68BB86F03A ] WdNisDrv        C:\WINDOWS\system32\Drivers\WdNisDrv.sys
16:39:45.0533 0x0c0c  WdNisDrv - ok
16:39:45.0565 0x0c0c  WdNisSvc - ok
16:39:45.0580 0x0c0c  WebClient - ok
16:39:45.0580 0x0c0c  Wecsvc - ok
16:39:45.0596 0x0c0c  [ CBA85827716DE89106F8E4AD7430620C, EF2FEAD68FE003DAC52BC2098962F397DF80B7DCD79A8F45012A050C7C0E2DB1 ] WEPHOSTSVC      C:\WINDOWS\system32\wephostsvc.dll
16:39:45.0611 0x0c0c  WEPHOSTSVC - ok
16:39:45.0643 0x0c0c  wercplsupport - ok
16:39:45.0643 0x0c0c  WerSvc - ok
16:39:45.0643 0x0c0c  WFDSConMgrSvc - ok
16:39:45.0658 0x0c0c  WFPLWFS - ok
16:39:45.0658 0x0c0c  WiaRpc - ok
16:39:45.0658 0x0c0c  WIMMount - ok
16:39:45.0658 0x0c0c  WinDefend - ok
16:39:45.0690 0x0c0c  [ B434A84F46C70F4E67B70ED70F024B7F, 64EEB8093BA2590E83D83C5AF7C2A025B88AF5681143BCA83671104266FEEA99 ] WindowsTrustedRT C:\WINDOWS\system32\drivers\WindowsTrustedRT.sys
16:39:45.0721 0x0c0c  WindowsTrustedRT - ok
16:39:45.0752 0x0c0c  [ 982774B74EE1419D641CEB66E394A4BA, 090C4CE6B76B3904B5AE73E4F1EEBCE619194C358874D7584537012F954C54BE ] WindowsTrustedRTProxy C:\WINDOWS\system32\drivers\WindowsTrustedRTProxy.sys
16:39:45.0752 0x0c0c  WindowsTrustedRTProxy - ok
16:39:45.0768 0x0c0c  WinHttpAutoProxySvc - ok
16:39:45.0768 0x0c0c  WinMad - ok
16:39:45.0783 0x0c0c  Winmgmt - ok
16:39:45.0783 0x0c0c  WinNat - ok
16:39:45.0799 0x0c0c  WinRM - ok
16:39:45.0815 0x0c0c  [ 91D3DC62C6EDDB6554CE14C0E0B4290F, 6F8F89B350FC6BC0D23A50C593F02514854AB7D6CD234D8C8AD4B5DDDD586BA0 ] WINUSB          C:\WINDOWS\System32\drivers\WinUSB.SYS
16:39:45.0846 0x0c0c  WINUSB - ok
16:39:45.0846 0x0c0c  WinVerbs - ok
16:39:45.0861 0x0c0c  wisvc - ok
16:39:45.0877 0x0c0c  WlanSvc - ok
16:39:45.0877 0x0c0c  wlidsvc - ok
16:39:45.0893 0x0c0c  wlpasvc - ok
16:39:45.0893 0x0c0c  WManSvc - ok
16:39:45.0893 0x0c0c  WmiAcpi - ok
16:39:45.0893 0x0c0c  wmiApSrv - ok
16:39:45.0924 0x0c0c  WMPNetworkSvc - ok
16:39:45.0924 0x0c0c  Wof - ok
16:39:45.0940 0x0c0c  workfolderssvc - ok
16:39:45.0971 0x0c0c  WpcMonSvc - ok
16:39:45.0971 0x0c0c  WPDBusEnum - ok
16:39:46.0002 0x0c0c  [ 024924C9E79F51560B9133EEAB866BBF, F4D464BC02C7B96EF72AA9229A99A1AD32F56390F97972C33525EF0D85304261 ] WpdUpFltr       C:\WINDOWS\system32\drivers\WpdUpFltr.sys
16:39:46.0018 0x0c0c  WpdUpFltr - ok
16:39:46.0018 0x0c0c  WpnService - ok
16:39:46.0018 0x0c0c  WpnUserService - ok
16:39:46.0018 0x0c0c  ws2ifsl - ok
16:39:46.0111 0x0c0c  [ B94CB55612DB205B75014B7CFC084DC6, 441BABD94D992E83D254D6C914F57F470D7B8B6ACFA7F6BC260AA26B75A8EA18 ] WsAppService    C:\Program Files (x86)\Wondershare\WAF\2.4.3.242\WsAppService.exe
16:39:46.0127 0x0c0c  WsAppService - ok
16:39:46.0174 0x0c0c  wscsvc - ok
16:39:46.0174 0x0c0c  WSearch - ok
16:39:46.0174 0x0c0c  wuauserv - ok
16:39:46.0205 0x0c0c  [ 7FC0072ECE3F5F860990EF4E10D3F8F4, 15444A3E540EAD214A674FF0EB99CD42899D6A1139E59D69DE1C2B6BA364A9E0 ] WudfPf          C:\WINDOWS\system32\drivers\WudfPf.sys
16:39:46.0268 0x0c0c  WudfPf - ok
16:39:46.0299 0x0c0c  [ 24B093F34B25076A2A6605DDAC8A629B, 64BEEA0C054C91AD2CEB9F6B9238A8ED3696FC20B8CC4753D88B8BC482D766C0 ] WUDFRd          C:\WINDOWS\System32\drivers\WUDFRd.sys
16:39:46.0330 0x0c0c  WUDFRd - ok
16:39:46.0346 0x0c0c  [ 24B093F34B25076A2A6605DDAC8A629B, 64BEEA0C054C91AD2CEB9F6B9238A8ED3696FC20B8CC4753D88B8BC482D766C0 ] WUDFWpdFs       C:\WINDOWS\system32\DRIVERS\WUDFRd.sys
16:39:46.0361 0x0c0c  WUDFWpdFs - ok
16:39:46.0377 0x0c0c  [ 24B093F34B25076A2A6605DDAC8A629B, 64BEEA0C054C91AD2CEB9F6B9238A8ED3696FC20B8CC4753D88B8BC482D766C0 ] WUDFWpdMtp      C:\WINDOWS\system32\DRIVERS\WUDFRd.sys
16:39:46.0408 0x0c0c  WUDFWpdMtp - ok
16:39:46.0424 0x0c0c  WwanSvc - ok
16:39:46.0424 0x0c0c  XblAuthManager - ok
16:39:46.0424 0x0c0c  XblGameSave - ok
16:39:46.0439 0x0c0c  xboxgip - ok
16:39:46.0439 0x0c0c  XboxGipSvc - ok
16:39:46.0455 0x0c0c  XboxNetApiSvc - ok
16:39:46.0455 0x0c0c  xinputhid - ok
16:39:46.0627 0x0c0c  [ 092C26E1609FA800321B89690FA5CA39, 5473C424412D0904E41D448DFD0D58D70564AAD570D113D31085688DF115CB78 ] ZeroConfigService C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
16:39:46.0752 0x0c0c  ZeroConfigService - ok
16:39:46.0752 0x0c0c  ================ Scan global ===============================
16:39:46.0799 0x0c0c  [ Global ] - ok
16:39:46.0799 0x0c0c  ================ Scan MBR ==================================
16:39:46.0814 0x0c0c  [ 5FB38429D5D77768867C76DCBDB35194 ] \Device\Harddisk0\DR0
16:39:46.0908 0x0c0c  \Device\Harddisk0\DR0 - ok
16:39:46.0908 0x0c0c  ================ Scan VBR ==================================
16:39:46.0939 0x0c0c  [ 3F2E593247565022B4E74F3C2961A5AD ] \Device\Harddisk0\DR0\Partition1
16:39:46.0939 0x0c0c  \Device\Harddisk0\DR0\Partition1 - ok
16:39:46.0955 0x0c0c  [ A31A07303B2A927C5EFD7A96A54CCDD4 ] \Device\Harddisk0\DR0\Partition2
16:39:46.0955 0x0c0c  \Device\Harddisk0\DR0\Partition2 - ok
16:39:46.0955 0x0c0c  [ 548FFF8CD3643B30FDD1D369DD53A631 ] \Device\Harddisk0\DR0\Partition3
16:39:46.0955 0x0c0c  \Device\Harddisk0\DR0\Partition3 - ok
16:39:46.0955 0x0c0c  [ E09178F37CA2FE637A31A17E1F1D6092 ] \Device\Harddisk0\DR0\Partition4
16:39:46.0971 0x0c0c  \Device\Harddisk0\DR0\Partition4 - ok
16:39:46.0971 0x0c0c  [ 44EA2705CB521174C93DC6393C039D48 ] \Device\Harddisk0\DR0\Partition5
16:39:46.0986 0x0c0c  \Device\Harddisk0\DR0\Partition5 - ok
16:39:46.0986 0x0c0c  [ FADC8C6032A55EBC745B57BFAF653D60 ] \Device\Harddisk0\DR0\Partition6
16:39:46.0986 0x0c0c  \Device\Harddisk0\DR0\Partition6 - ok
16:39:46.0986 0x0c0c  ================ Scan active images ========================
16:39:46.0986 0x0c0c  ================ Scan generic autorun ======================
16:39:47.0033 0x0c0c  [ 783C99AFD4C2AE6950FA5694389D2CFA, 570B37A7A3FFDAFCCECCC33CBC1968FEB857B73CA3CB4DFFEDC2E67E9ABD0878 ] C:\WINDOWS\system32\SecurityHealthSystray.exe
16:39:47.0080 0x0c0c  SecurityHealth - ok
16:39:47.0127 0x0c0c  [ 1FABA74CEA705ECB2CDA5398F3477212, 07D8952C60A8D89F249985206746B132596909E8BABC3A0C5B6E33A22FFD65CF ] C:\Program Files\PDF24\pdf24.exe
16:39:47.0158 0x0c0c  PDF24 - ok
16:39:47.0205 0x0c0c  [ E66724F3B2E3AE7882A4B4A398E911A3, ABC91EC2EC25068D2A884ACB7B89930184B0E85144AED044EC53FCF1875F0A25 ] C:\Program Files\AVG\Antivirus\AvLaunch.exe
16:39:47.0221 0x0c0c  AVGUI.exe - ok
16:39:47.0221 0x0c0c  WindowsDefender - ok
16:39:47.0252 0x0c0c  [ 03C21928B3B0C76D36EF663C7C3832A3, 7773C44CF15111E49E3A5815388FC14E39C1BFEF217DA35EEBCF7502A4992B96 ] C:\Program Files (x86)\Adobe\Adobe Creative Cloud Experience\CCXProcess.exe
16:39:47.0252 0x0c0c  Adobe CCXProcess - ok
16:39:47.0252 0x0c0c  {A55E6E49-BC4A-4BD3-8785-D19F9FB87474} - ok
16:39:47.0299 0x0c0c  OneDriveSetup - ok
16:39:47.0361 0x0c0c  GoogleDriveFS - ok
16:39:47.0361 0x0c0c  OneDriveSetup - ok
16:39:47.0361 0x0c0c  GoogleDriveFS - ok
16:39:47.0533 0x0c0c  [ 28A21AFB4BDC543B4B0309BB78B8BA4A, 672AEB85A07EC1A25DBCF48B64D3BDE24DD0691C2BB27ED74A536776F63B5D27 ] C:\Users\b-rch\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe
16:39:47.0643 0x0c0c  Opera GX Browser Assistant - ok
16:39:47.0721 0x0c0c  [ 6C8960319F05FB5E1513E3BF95BA1719, B23EFD13439CF0A9FD5F64E3C0C0FCB419E879078BDCC52DA02BC5C2A1EEC342 ] C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIUPE.EXE
16:39:47.0736 0x0c0c  EPLTarget\P0000000000000001 - ok
16:39:48.0174 0x0c0c  [ 10FBAA7454807A54DA780CCD50FA9D11, 13FD99C0B22984D2601714A4F9D6E82E908371072758EE289416F209410F03C9 ] C:\Users\b-rch\AppData\Roaming\Spotify\Spotify.exe
16:39:48.0799 0x0c0c  Spotify - ok
16:39:48.0814 0x0c0c  GoogleDriveFS - ok
16:39:48.0814 0x0c0c  Waiting for KSN requests completion. In queue: 187
16:39:50.0408 0x0c0c  AV detected via SS2: Windows Defender, windowsdefender:// (  ), 0x60100 ( disabled : updated )
16:39:50.0408 0x0c0c  AV detected via SS2: AVG Antivirus, C:\Program Files\AVG\Antivirus\wsc_proxy.exe ( 21.4.6162.0 ), 0x41000 ( enabled : updated )
16:39:50.0408 0x0c0c  AV detected via SS2: Malwarebytes, C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe (  ), 0x60010 ( disabled : outofdate )
16:39:50.0470 0x0c0c  Win FW state via NFP2: enabled ( trusted )
16:39:50.0877 0x0c0c  ============================================================
16:39:50.0877 0x0c0c  Scan finished
16:39:50.0877 0x0c0c  ============================================================
16:39:50.0877 0x085c  Detected object count: 0
16:39:50.0877 0x085c  Actual detected object count: 0

Y de dejo además el reporte del Rkill que se generó en mi escritorio, por si acaso.

RKILL

Rkill 2.9.1 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2021 BleepingComputer.com
More Information about Rkill can be found at this link:
 http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 11/25/2021 04:35:36 PM in x64 mode. (Safe Mode)
Windows Version: Windows 10 Home Single Language 

Checking for Windows services to stop:

 * No malware services found to stop.

Checking for processes to terminate:

 * No malware processes found to kill.

Checking Registry for malware related settings:

 * No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

Te comento que en Modo Seguro, la PC me anda de maravilla, sin embargo he notado en los reinicios que he hecho, que incluso en modo seguro, el Explorador de Windows se cuelga apenas inicia en modo seguro, me sale la ventana que me dice que el proceso no responde y le doy a “Terminar Proceso”; luego de ello la pantalla parpadea y luego inicia el explorador de Windows de manera normal. Me pareció un poco raro por eso te lo comento. Gracias por la ayuda!

1 me gusta

OK.

OK.

:one: EN BUSCA / ELIMINACIÓN DE MALWARE

(Mantén conectados todos tus dispositivos externos que tengas como: USBs, discos duros externos, etc).

Por favor, descarga todo el software de los enlaces que pongo/de sus respectivos manuales.

Ahora ejecutarás una serie de herramientas respetando el orden los pasos con todos los programas cerrados incluidos los navegadores.

Conectas todos tus dispositivos externos (todos los discos duros externos que tengas, así como todas las USB que tengas y discos duros externos si también tienes.

Realiza los pasos que te pongo a continuación, sin cambiar el orden y síguelos al pie de la letra:

0) Descarga Ccleaner Aquí te dejo su manual: Manual de CCleaner , para que sepas como usarlo y configurarlo correctamente.

Lo instalas y lo ejecutas. En la pestaña Limpieza personalizada dejas la configuración predeterminada. Haces clic en Analizar y esperas a que termine. Seguidamente haz clic en Ejecutar Limpiador. Clic en la pestaña Registro > clic en Buscar Problemas esperas que termine. Finalmente clic en Reparar Seleccionadas y realizas una Copia de Seguridad del registro de Windows.

1) Descarga, instala, actualiza y ejecuta Malwarebytes’ Anti-Malware. Aquí te dejo su manual: Manual de Malwarebytes, para que sepas como usarlo y configurarlo correctamente.

  • Realizas un Análisis Personalizado, marcando Todas las casillas de la Derecha y de la Izquierda, actualizando si te lo pide. Es decir: conectas todos tus dispositivos externos (todos los discos duros externos que tengas, así como todas las USB que tengas, incluida la que me has dicho anteriormente y marcas todas las unidades de disco disponibles y las siguientes casillas:

1. Analizar objetos en memoria

2. Analizar configuracion de inicio y registro

3. Analizar dentro de los archivos

  • Pulsar en “Eliminar Seleccionados” para enviar las infecciones a la cuarentena y Reinicias el ordenador.
  • Para acceder posteriormente al informe del análisis te diriges a: Informes >> Registro de análisis >> pulsas en Exportar >> Copiar al Portapapeles y pones el informe en tu próxima respuesta.

2) Descarga Adwcleaner en el escritorio.

  • Desactiva tu antivirus :arrow_forward: Como deshabilitar temporalmente un antivirus y cualquier programa de seguridad que tengas activado.
  • Ejecuta Adwcleaner.exe (Si usas Windows Vista/7/8 u 10 presiona clic derecho y selecciona “Ejecutar como Administrador.”)
  • Pulsar en el botón Analizar Ahora, y espera a que se termine el análisis. Inmediatamente pulsa sobre el botón Iniciar Reparación.
  • Espera a que termine y sigue las instrucciones que te aparezcan. Si te pidiera Reiniciar, pues reinicias el ordenador pulsando en Aceptar.
  • Si no encuentra nada, pulsa en Omitir Reparación.
  • El log lo encontrarás en la pestaña Informes, volviendo a abrir el programa, si es necesario o en la siguiente ubicación: C:\AdwCleaner\Logs\AdwCleaner[C0].txt.
  • Para más información aquí te dejo su manual: Manual de Adwcleaner.
  • Activa de nuevo tu antivirus y cualquier programa de seguridad que tengas activado.

3) Utiliza nuevamente CCleaner tal como te dije en el punto 0.

Pegas los reportes de Malwarebytes y AdwCleaner y comentas como va el problema inicial planteado por el cual abriste este tema. También responde a las preguntas que te haya realizado a lo largo de este Post, siempre que te haya hecho alguna, si no, no

NOTA IMPORTANTE

Por Favor, mientras estemos desinfectando tu maquina o terminando de hacerlo:

  • No realices pasos/acciones que NOSOTROS no te hayamos indicado.
  • No descargues NADA de Internet y/o conectes dispositivos externos a tu equipo.
  • No instales NADA (programas/software/complementos/extensiones del navegador…).
  • No ejecutes otros programas de seguridad (Antivirus, Antimalware, ANTINADA…).
  • No realices por tu cuenta otros procedimientos.
  • Usa tu equipo EXCLUSIVAMENTE para desinfectarlo siguiendo nuestras indicaciones.

:warning: Muy Importante :warning: Coloca los diferentes reportes que te he pedido como se muestra en la siguiente imagen:

Salu2.

Buenas @Marr0n aqui te dejo los reportes solicitados

MALWAREBYTES ANTIMALWARE

Malwarebytes
www.malwarebytes.com

-Detalles del registro-
Fecha del análisis: 30/11/21
Hora del análisis: 16:24
Archivo de registro: e0c6c5fc-5223-11ec-ad0a-54ee751a2b76.json

-Información del software-
Versión: 4.4.11.149
Versión de los componentes: 1.0.1513
Versión del paquete de actualización: 1.0.47932
Licencia: Prueba

-Información del sistema-
SO: Windows 10 (Build 19042.1348)
CPU: x64
Sistema de archivos: NTFS
Usuario: DESKTOP-C692K8O\b-rch

-Resumen del análisis-
Tipo de análisis: Análisis personalizado
Análisis iniciado por:: Manual
Resultado: Completado
Objetos analizados: 529679
Amenazas detectadas: 4
Amenazas en cuarentena: 4
Tiempo transcurrido: 2 hr, 9 min, 26 seg

-Opciones de análisis-
Memoria: Activado
Inicio: Activado
Sistema de archivos: Activado
Archivo: Activado
Rootkits: Desactivado
Heurística: Activado
PUP: Detectar
PUM: Detectar

-Detalles del análisis-
Proceso: 0
(No hay elementos maliciosos detectados)

Módulo: 0
(No hay elementos maliciosos detectados)

Clave del registro: 0
(No hay elementos maliciosos detectados)

Valor del registro: 0
(No hay elementos maliciosos detectados)

Datos del registro: 0
(No hay elementos maliciosos detectados)

Secuencia de datos: 0
(No hay elementos maliciosos detectados)

Carpeta: 0
(No hay elementos maliciosos detectados)

Archivo: 4
Generic.Malware/Suspicious, C:\USERS\B-RCH\DOCUMENTS\ANITA\VARIOS\PENAL ESPECIAL\STREAMERDATA\STREAMER.EXE, En cuarentena, 0, 392686, 1.0.47932, , shuriken, , 040CD888E971F2872D6D5DAFD52E6194, 77C2372364B6DD56BC787FDA46E6F4240AAA0353EAD1E3071224D454038A545E
Generic.Malware/Suspicious, C:\USERS\B-RCH\DOCUMENTS\ANITA\VARIOS\POSTULACION\ONPE\STREAMERDATA\STREAMER.EXE, En cuarentena, 0, 392686, 1.0.47932, , shuriken, , 040CD888E971F2872D6D5DAFD52E6194, 77C2372364B6DD56BC787FDA46E6F4240AAA0353EAD1E3071224D454038A545E
Generic.Malware/Suspicious, C:\USERS\B-RCH\DOCUMENTS\ANITA\VARIOS\POSTULACION\STREAMERDATA\STREAMER.EXE, En cuarentena, 0, 392686, 1.0.47932, , shuriken, , 040CD888E971F2872D6D5DAFD52E6194, 77C2372364B6DD56BC787FDA46E6F4240AAA0353EAD1E3071224D454038A545E
RiskWare.KMS, C:\USERS\B-RCH\DOWNLOADS\KMSAUTO.NET.2016.V1.5.3.PORTABLE-RATIBORUS.ZIP, En cuarentena, 901, 632069, 1.0.47932, , ame, , AA9AF9E42B046B88C64590BDC7B0C02D, C1058F703E65DD2295320154125EBE63797B5CC9EE20545349E7EF3F5B51BB5C

Sector físico: 0
(No hay elementos maliciosos detectados)

WMI: 0
(No hay elementos maliciosos detectados)


(end)

ADWCLEANER

# -------------------------------
# Malwarebytes AdwCleaner 8.3.1.0
# -------------------------------
# Build:    11-18-2021
# Database: 2021-11-18.1 (Cloud)
# Support:  https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Scan
# -------------------------------
# Start:    12-01-2021
# Duration: 00:00:10
# OS:       Windows 10 Home Single Language
# Scanned:  32011
# Detected: 14


***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

No malicious folders found.

***** [ Files ] *****

No malicious files found.

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

No malicious tasks found.

***** [ Registry ] *****

No malicious registry entries found.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries found.

***** [ Chromium URLs ] *****

No malicious Chromium URLs found.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries found.

***** [ Firefox URLs ] *****

No malicious Firefox URLs found.

***** [ Hosts File Entries ] *****

No malicious hosts file entries found.

***** [ Preinstalled Software ] *****

Preinstalled.LenovoHotkeyManager   Folder   C:\Program Files\LENOVO\HOTKEY 
Preinstalled.LenovoHotkeyManager   Registry   HKLM\Software\Classes\CLSID\{A48CA1A4-C36B-44f2-8090-19E08DF4365E} 
Preinstalled.LenovoIMController   Folder   C:\ProgramData\LENOVO\IMCONTROLLER 
Preinstalled.LenovoIMController   Folder   C:\Users\b-rch\AppData\Local\LENOVO\IMCONTROLLER 
Preinstalled.LenovoIMController   Folder   C:\Windows\LENOVO\IMCONTROLLER 
Preinstalled.LenovoIMController   Folder   C:\Windows\System32\Tasks\LENOVO\IMCONTROLLER 
Preinstalled.LenovoIMController   Registry   HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Uninstall\Lenovo Dependency Package_is1 
Preinstalled.LenovoPowerManager   Folder   C:\Windows\SysWOW64\LENOVO\POWERMGR 
Preinstalled.LenovoPowerManager   Folder   C:\Windows\System32\LENOVO\POWERMGR 
Preinstalled.LenovoServiceBridge   Folder   C:\Users\b-rch\AppData\Local\PROGRAMS\LENOVO\LENOVO SERVICE BRIDGE 
Preinstalled.LenovoServiceBridge   Registry   HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{2C74547D-EF88-47F4-85F5-BE46A31E26B7}_is1 
Preinstalled.LenovoUpdate   Folder   C:\Program Files (x86)\LENOVO\SYSTEM UPDATE 
Preinstalled.LenovoUpdate   Registry   HKLM\Software\Wow6432Node\\Classes\CLSID\{03C6CC92-68F2-4961-9A73-CAECA350BD08} 
Preinstalled.LenovoUpdate   Registry   HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Uninstall\TVSU_is1 


AdwCleaner[S00].txt - [2817 octets] - [30/06/2021 16:46:31]
AdwCleaner[S01].txt - [2878 octets] - [01/12/2021 11:02:38]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[S02].txt ##########

Sobre mi problema, he notado que la PC sigue lenta como cuando empezamos, pero esta vez es por muchísmimo menos tiempo (unos 4 a 5 minutos) a comparación de la hora y pico que tomaba,es una mejoría grande pero aun tengo el problema de arranque, sin embargo en comparación, está muchísimo mejor la verdad :smiley: