GMER 2.2.19882 - http://www.gmer.net Rootkit scan 2016-09-19 14:53:55 Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\0000003c NVMe____ rev.1B0Q 238,47GB Running: gmer-2.2.19882.exe; Driver: C:\Users\n3rk3\AppData\Local\Temp\uxldifod.sys ---- User code sections - GMER 2.2 ---- ? C:\WINDOWS\SYSTEM32\iertutil.dll [2164] entry point in ".rdata" section 00000000722c00e0 ? C:\WINDOWS\SYSTEM32\NTASN1.dll [2164] entry point in ".rdata" section 000000006f8da020 ? C:\WINDOWS\system32\ncryptsslp.dll [2164] entry point in ".rdata" section 000000006f3c04f0 ? C:\WINDOWS\system32\apphelp.dll [8500] entry point in ".rdata" section 000000007099f7c0 ---- Threads - GMER 2.2 ---- Thread C:\WINDOWS\system32\svchost.exe [1236:2412] 00007ff9cf02c5a0 Thread C:\WINDOWS\system32\svchost.exe [1236:2744] 00007ff9cee0af40 Thread C:\WINDOWS\system32\svchost.exe [1236:2780] 00007ff9cee0ca00 Thread C:\WINDOWS\system32\svchost.exe [1236:2900] 00007ff9cf02eab0 Thread C:\WINDOWS\system32\svchost.exe [1236:2988] 00007ff9cf02d2d0 Thread C:\WINDOWS\system32\svchost.exe [1236:2992] 00007ff9cf02e100 Thread C:\WINDOWS\system32\svchost.exe [1236:4160] 00007ff9c83a1240 Thread C:\WINDOWS\system32\svchost.exe [1236:4164] 00007ff9c83da3b0 Thread C:\WINDOWS\system32\svchost.exe [1236:4168] 00007ff9c81525e0 Thread C:\WINDOWS\system32\svchost.exe [1236:2136] 00007ff9c7f13bc0 Thread C:\WINDOWS\system32\svchost.exe [1236:4244] 00007ff9c7f12080 Thread C:\WINDOWS\system32\svchost.exe [1884:2044] 00007ff9d00c5bc0 Thread C:\WINDOWS\system32\svchost.exe [1884:2020] 00007ff9d00d7d70 Thread C:\WINDOWS\system32\svchost.exe [1884:2320] 00007ff9cf76b180 Thread C:\WINDOWS\system32\svchost.exe [1884:2324] 00007ff9cf76f5f0 Thread C:\WINDOWS\system32\svchost.exe [2028:460] 00007ff9cfbae830 Thread C:\WINDOWS\system32\svchost.exe [2028:1304] 00007ff9cfb410a0 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:1608] 0000000000a2eaa4 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:2084] 00000000730bfcb0 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:2248] 0000000072528290 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:2272] 00000000724966f0 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3200] 00000000713496c0 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3332] 000000007297d9d0 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3336] 000000007297d9d0 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3340] 000000007297d9d0 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3344] 000000007297d9d0 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3348] 000000007297d9d0 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3352] 000000007297d9d0 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3356] 000000007297d9d0 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3360] 000000007297d9d0 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3364] 000000007297d9d0 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3368] 000000007297d9d0 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3372] 000000007297eac0 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3376] 000000007297eac0 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3380] 000000007297df00 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3384] 00000000729fdfb0 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3388] 00000000729fcb50 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3392] 00000000729fcf80 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3396] 0000000072980d80 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3400] 0000000072980d80 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3404] 0000000072980d80 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3408] 0000000072980d80 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3412] 0000000072980d80 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3416] 0000000072980d80 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3420] 0000000072980d80 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3424] 0000000072980d80 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3428] 0000000072980d80 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3432] 0000000072980d80 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3436] 0000000072980a30 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3440] 00000000712b1080 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3456] 0000000071271d30 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3492] 00000000729a9c10 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3496] 0000000072980410 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3532] 000000007238b990 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3540] 0000000072ae43c0 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3652] 0000000072ca8fc0 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3656] 00000000712b16d0 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3704] 0000000070ca9390 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3712] 0000000072d331d0 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3716] 0000000072d36730 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3796] 0000000070bbb460 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3800] 0000000070bbb460 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3804] 0000000070bbb460 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3808] 0000000070bbb460 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3812] 0000000070bbb460 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3816] 0000000070bbb460 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3868] 0000000072901980 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3984] 00000000724f0440 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:4012] 0000000071277040 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:4016] 0000000071277040 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:4692] 0000000072901980 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:216] 0000000072901980 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:7248] 0000000072b4e7a0 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:7468] 0000000072b4e7a0 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:6940] 0000000072b4e7a0 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:5632] 0000000072b4e7a0 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:4480] 0000000072901980 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:7632] 0000000071349550 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:7816] 0000000071349550 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:6988] 0000000072901980 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:3776] 00000000707bd5c0 Thread C:\WINDOWS\SYSTEM32\ntdll.dll [1560:2812] 0000000071e48420 Thread C:\WINDOWS\System32\spoolsv.exe [2156:4940] 00007ff9d00c5bc0 Thread C:\WINDOWS\System32\spoolsv.exe [2156:5104] 00007ff9cbfa2740 Thread C:\WINDOWS\System32\spoolsv.exe [2156:4100] 00007ff9bfb71180 Thread C:\WINDOWS\System32\spoolsv.exe [2156:5132] 00007ff9bfbb8e40 Thread C:\WINDOWS\system32\svchost.exe [2616:2080] 00007ff9d00c5bc0 Thread C:\WINDOWS\system32\svchost.exe [2616:1788] 00007ff9cbfa2740 Thread C:\WINDOWS\system32\wbem\wmiprvse.exe [3524:7912] 00007ff9b9a629c0 Thread C:\WINDOWS\system32\csrss.exe [5560:4700] ffff97b6267f6c20 Thread C:\WINDOWS\Explorer.EXE [1216:8204] 00000000596477b0 Thread C:\WINDOWS\Explorer.EXE [1216:212] 00007ff9d45d5110 Thread C:\WINDOWS\Explorer.EXE [1216:8836] 00007ff9d76dfaa0 Thread C:\WINDOWS\Explorer.EXE [1216:3244] 00007ff9c9ec20e0 Thread C:\WINDOWS\Explorer.EXE [1216:6652] 00007ff9bbba36f0 Thread C:\WINDOWS\Explorer.EXE [1216:1604] 00007ff9bbbb20e0 Thread C:\WINDOWS\Explorer.EXE [1216:8072] 00007ff9bbbb20e0 Thread C:\WINDOWS\Explorer.EXE [1216:6888] 00007ff9bbbb20e0 Thread C:\WINDOWS\Explorer.EXE [1216:4444] 00007ff9bbbb20e0 Thread C:\WINDOWS\Explorer.EXE [1216:5100] 00007ff9bbbb20e0 Thread C:\WINDOWS\Explorer.EXE [1216:8272] 00007ff9bbbb20e0 Thread C:\WINDOWS\Explorer.EXE [1216:6984] 00007ff9bbbb20e0 Thread C:\WINDOWS\Explorer.EXE [1216:6372] 00007ff9bbbb20e0 Thread C:\WINDOWS\Explorer.EXE [1216:7852] 00007ff9bbbb20e0 Thread C:\WINDOWS\Explorer.EXE [1216:8992] 00007ff9bbbb20e0 Thread C:\WINDOWS\Explorer.EXE [1216:2680] 00007ff9bbbb20e0 Thread C:\WINDOWS\Explorer.EXE [1216:3580] 00007ff9bbbb20e0 Thread C:\WINDOWS\Explorer.EXE [1216:5452] 00007ff9bbbb20e0 Thread C:\WINDOWS\Explorer.EXE [1216:6076] 00007ff9bbbb20e0 Thread C:\WINDOWS\Explorer.EXE [1216:7608] 00007ff9bbbb20e0 Thread C:\WINDOWS\Explorer.EXE [1216:2556] 00007ff9bbbb20e0 Thread C:\WINDOWS\Explorer.EXE [1216:4784] 00007ff9bbbb20e0 Thread C:\WINDOWS\Explorer.EXE [1216:5584] 00007ff9bbbb20e0 Thread C:\WINDOWS\Explorer.EXE [1216:2520] 00007ff9bbbb20e0 Thread C:\WINDOWS\Explorer.EXE [1216:3896] 00007ff9bbbb20e0 Thread C:\WINDOWS\Explorer.EXE [1216:4600] 00007ff9bbbb20e0 Thread C:\WINDOWS\Explorer.EXE [1216:3604] 00007ff9bbbb20e0 Thread C:\WINDOWS\Explorer.EXE [1216:8688] 00007ff9bbbb20e0 Thread C:\WINDOWS\Explorer.EXE [1216:284] 00007ff9bbbb20e0 Thread C:\WINDOWS\Explorer.EXE [1216:8788] 00007ff9bbbb20e0 Thread C:\WINDOWS\Explorer.EXE [1216:3248] 00007ff9bbbb20e0 Thread C:\WINDOWS\Explorer.EXE [1216:6172] 00007ff9bbbb20e0 Thread C:\WINDOWS\Explorer.EXE [1216:488] 00007ff9bbbb20e0 Thread C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe [9048:9024] 00007ff9db4258f0 Thread C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe [9048:5940] 00007ff9cb2548e0 Thread C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe [9048:5016] 00007ff9d90b59c0 Thread C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe [9048:8120] 00007ff9be862bc0 Thread C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe [9048:836] 00007ff9c03a52f0 Thread C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe [9048:5228] 00007ff9d90b70d0 Thread C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe [9048:8392] 00007ff9db4258f0 Thread C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe [9048:8776] 00007ff9d8ada1e0 Thread C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe [9048:8960] 00007ff9cae8e010 Thread C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe [9048:4588] 00007ff9d6a711a0 Thread C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe [9048:7720] 00007ff9d384c87c Thread C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe [9048:8956] 00007ff9db4258f0 Thread C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe [9048:8516] 00007ff9d941b310 Thread C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe [9048:4772] 00007ff9d941b310 Thread C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe [9048:9100] 00007ff9d941b310 Thread C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe [9048:7220] 00007ff9b88d0830 Thread C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe [9048:8400] 00007ff9b894abe0 Thread C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe [9048:5020] 00007ff9b8908100 Thread C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe [9048:8644] 00007ff9b894abe0 Thread C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe [9048:3128] 00007ff9d941b310 Thread C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe [9048:6168] 00007ff9d941b310 Thread C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe [9048:8424] 00007ff9d941b310 Thread C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe [9048:7208] 00007ff9b894abe0 Thread C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe [9048:8284] 00007ff9b89528d0 Thread C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe [9048:984] 00007ff9d384c87c Thread C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe [9048:1308] 00007ff9d941b310 Thread C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe [9048:9152] 00007ff9d941b310 Thread C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe [9048:2212] 00007ff9d83725b0 Thread C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe [9048:5264] 00007ff9be728ff0 Thread C:\WINDOWS\system32\SettingSyncHost.exe [8460:4828] 00007ff9d90b59c0 Thread C:\WINDOWS\ImmersiveControlPanel\SystemSettings.exe [4876:9200] 00007ff9db4258f0 Thread C:\WINDOWS\ImmersiveControlPanel\SystemSettings.exe [4876:8108] 00007ff9d90b59c0 Thread C:\WINDOWS\ImmersiveControlPanel\SystemSettings.exe [4876:5680] 00007ff9be862bc0 Thread C:\WINDOWS\ImmersiveControlPanel\SystemSettings.exe [4876:4668] 00007ff9d90b70d0 Thread C:\WINDOWS\ImmersiveControlPanel\SystemSettings.exe [4876:4824] 00007ff9d5ff2880 Thread C:\WINDOWS\ImmersiveControlPanel\SystemSettings.exe [4876:3648] 00007ff9d90b59c0 Thread C:\WINDOWS\ImmersiveControlPanel\SystemSettings.exe [4876:3012] 00007ff9db4258f0 Thread C:\WINDOWS\ImmersiveControlPanel\SystemSettings.exe [4876:3840] 00007ff9db4258f0 Thread C:\WINDOWS\ImmersiveControlPanel\SystemSettings.exe [4876:2400] 00007ff9db4258f0 Thread C:\WINDOWS\ImmersiveControlPanel\SystemSettings.exe [4876:5192] 00007ff9d6a711a0 Thread C:\WINDOWS\ImmersiveControlPanel\SystemSettings.exe [4876:7464] 00007ff9cae8e010 Thread C:\WINDOWS\ImmersiveControlPanel\SystemSettings.exe [4876:796] 00007ff9d384c87c Thread C:\WINDOWS\ImmersiveControlPanel\SystemSettings.exe [4876:988] 00007ff9be728ff0 Thread C:\Program Files\WindowsApps\Microsoft.Office.Excel_17.7341.50381.0_x64__8wekyb3d8bbwe\xlim.exe [8048:3988] 00007ff9db4258f0 Thread C:\Program Files\WindowsApps\Microsoft.Office.Excel_17.7341.50381.0_x64__8wekyb3d8bbwe\xlim.exe [8048:4260] 00007ff9d90b59c0 Thread C:\Program Files\WindowsApps\Microsoft.Office.Excel_17.7341.50381.0_x64__8wekyb3d8bbwe\xlim.exe [8048:4628] 00007ff9be862bc0 Thread C:\Program Files\WindowsApps\Microsoft.Office.Excel_17.7341.50381.0_x64__8wekyb3d8bbwe\xlim.exe [8048:604] 00007ff9cb2548e0 Thread C:\Program Files\WindowsApps\Microsoft.Office.Excel_17.7341.50381.0_x64__8wekyb3d8bbwe\xlim.exe [8048:1076] 00007ff9d90b70d0 Thread C:\Program Files\WindowsApps\Microsoft.Office.Excel_17.7341.50381.0_x64__8wekyb3d8bbwe\xlim.exe [8048:6788] 00007ff9cae8e010 Thread C:\Program Files\WindowsApps\Microsoft.Office.Excel_17.7341.50381.0_x64__8wekyb3d8bbwe\xlim.exe [8048:7792] 00007ff9cb70c820 Thread C:\Program Files\WindowsApps\Microsoft.Office.Excel_17.7341.50381.0_x64__8wekyb3d8bbwe\xlim.exe [8048:7920] 00007ff9cb70c820 Thread C:\Program Files\WindowsApps\Microsoft.Office.Excel_17.7341.50381.0_x64__8wekyb3d8bbwe\xlim.exe [8048:7252] 00007ff9d384c87c Thread C:\Program Files\WindowsApps\Microsoft.Office.Excel_17.7341.50381.0_x64__8wekyb3d8bbwe\xlim.exe [8048:3928] 00007ff9db4258f0 Thread C:\Program Files\WindowsApps\Microsoft.Office.Excel_17.7341.50381.0_x64__8wekyb3d8bbwe\xlim.exe [8048:4372] 00007ff9d6a711a0 Thread C:\Program Files\WindowsApps\Microsoft.Office.Excel_17.7341.50381.0_x64__8wekyb3d8bbwe\xlim.exe [8048:8332] 00007ff9d83725b0 Thread C:\Program Files\WindowsApps\Microsoft.Office.Excel_17.7341.50381.0_x64__8wekyb3d8bbwe\xlim.exe [8048:868] 00007ff9be6e8600 Thread C:\Program Files\WindowsApps\Microsoft.Office.Excel_17.7341.50381.0_x64__8wekyb3d8bbwe\xlim.exe [8048:8728] 00007ff9be6e8600 Thread C:\Program Files\WindowsApps\Microsoft.Office.Excel_17.7341.50381.0_x64__8wekyb3d8bbwe\xlim.exe [8048:3768] 00007ff9be6e8600 Thread C:\Program Files\WindowsApps\Microsoft.Office.Excel_17.7341.50381.0_x64__8wekyb3d8bbwe\xlim.exe [8048:4564] 00007ff9be6e8600 Thread C:\Program Files\WindowsApps\Microsoft.Office.Excel_17.7341.50381.0_x64__8wekyb3d8bbwe\xlim.exe [8048:8116] 00007ff9d384c87c Thread C:\Program Files\WindowsApps\Microsoft.Office.Excel_17.7341.50381.0_x64__8wekyb3d8bbwe\xlim.exe [8048:6472] 00007ff9be728ff0 ---- Registry - GMER 2.2 ---- Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel\RNG@RNGAuxiliarySeed -1073257783 Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\SecureTimeLimits@SecureTimeEstimated 0xEB 0x0A 0x58 0x7B ... Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\SecureTimeLimits@SecureTimeHigh 0xEB 0x72 0x1C 0xDD ... Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\SecureTimeLimits@SecureTimeLow 0xEB 0xA2 0x93 0x19 ... Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\0@Rw 0x64 0x62 0x03 0x00 ... Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\0@RwMask 0x64 0x62 0x03 0x00 ... Reg HKLM\SYSTEM\Setup\Upgrade\Pnp\CurrentControlSet\Control\DeviceMigration\Devices\SWD\DAFUPNPPROVIDER\UUID:1017DF82-000E-1000-A825-90F1AAA895EB\Interfaces\{d0875fb4-2196-4c7a-a63d-e416addd60a1}\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000E@ 0x64 0x62 0x04 0x00 ... Reg HKLM\SYSTEM\Setup\Upgrade\Pnp\CurrentControlSet\Control\DeviceMigration\Devices\SWD\DAFUPNPPROVIDER\UUID:1017DF82-000E-1000-A825-90F1AAA895EB\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000E@ 0x64 0x62 0x04 0x00 ... Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\JumplistData@Chrome 0xD0 0x81 0xC8 0xF9 ... Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{6BD32CD6-A565-4960-BF95-2D19CABE88EC}@LastAccessedTime 0x70 0x10 0x2A 0xF7 ... Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{6BD32CD6-A565-4960-BF95-2D19CABE88EC}@LaunchCount 69 ---- EOF - GMER 2.2 ----