ComboFix Log Analizi

Luciquad · 25 May 2019

Arkadaşlar Şu Logun Analizini Nasıl Yapabilirim veya Yapabilecek Biri Var Mı ?

Kod:

ComboFix 18-08-08.01 - Fern 25.05.2019   1:24.2.4 - x64
Microsoft Windows 7 Ultimate   6.1.7601.1.1254.90.1055.18.8054.5640 [GMT 3:00]
Running from: c:\users\Fern\Downloads\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {71A27EC9-3DA6-45FC-60A7-004F623C6189}
SP: Microsoft Security Essentials *Disabled/Updated* {CAC39F2D-1B9C-4A72-5A17-3B3D19BB2B34}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Fern\AppData\Roaming\DRPSu
c:\users\Fern\AppData\Roaming\DRPSu\DRIVERS\Intel-drp.zip
c:\users\Fern\AppData\Roaming\DRPSu\DRIVERS\Intel-drp.zip.torrent
c:\users\Fern\AppData\Roaming\DRPSu\DRIVERS\Intel-FORCED-MEI-WinAll-1x3A_9.0-drp.zip
c:\users\Fern\AppData\Roaming\DRPSu\DRIVERS\Intel-FORCED-MEI-WinAll-1x3A_9.0-drp.zip.torrent
c:\users\Fern\AppData\Roaming\DRPSu\DRIVERS\Lenovo-FORCED-ACPI-7x64-drp.zip
c:\users\Fern\AppData\Roaming\DRPSu\DRIVERS\Lenovo-FORCED-ACPI-7x64-drp.zip.torrent
c:\users\Fern\AppData\Roaming\DRPSu\DRIVERS\Realtek-FORCED-710x64-51xx_10.0.17763.31244-drp.zip
c:\users\Fern\AppData\Roaming\DRPSu\DRIVERS\Realtek-FORCED-710x64-51xx_10.0.17763.31244-drp.zip.torrent
c:\users\Fern\AppData\Roaming\DRPSu\DRIVERS\Realtek-matchver-FORCED-7x64-PCIe_7.122.0320.2019-drp.zip
c:\users\Fern\AppData\Roaming\DRPSu\DRIVERS\Realtek-matchver-FORCED-7x64-PCIe_7.122.0320.2019-drp.zip.torrent
c:\users\Fern\AppData\Roaming\DRPSu\Internet\WifiInterface.txt
c:\users\Fern\AppData\Roaming\DRPSu\Logs\log___2019-05-24-01-32-42.html
c:\users\Fern\AppData\Roaming\DRPSu\PROGRAMS\7-Zip.exe
c:\users\Fern\AppData\Roaming\DRPSu\PROGRAMS\7-Zip.exe.torrent
c:\users\Fern\AppData\Roaming\DRPSu\PROGRAMS\AvastAntivirusWorldwideA.exe
c:\users\Fern\AppData\Roaming\DRPSu\PROGRAMS\DotNet.exe
c:\users\Fern\AppData\Roaming\DRPSu\PROGRAMS\empty.cmd
c:\users\Fern\AppData\Roaming\DRPSu\PROGRAMS\Firefox64en.exe
c:\users\Fern\AppData\Roaming\DRPSu\PROGRAMS\Firefox64en.exe.torrent
c:\users\Fern\AppData\Roaming\DRPSu\PROGRAMS\K-Lite.exe
c:\users\Fern\AppData\Roaming\DRPSu\PROGRAMS\K-Lite.exe.torrent
c:\users\Fern\AppData\Roaming\DRPSu\PROGRAMS\OperaBlink64.exe
c:\users\Fern\AppData\Roaming\DRPSu\PROGRAMS\OperaBlink64.exe.torrent
c:\users\Fern\AppData\Roaming\DRPSu\PROGRAMS\RuntimePack.exe
c:\users\Fern\AppData\Roaming\DRPSu\PROGRAMS\RuntimePack.exe.torrent
c:\users\Fern\AppData\Roaming\DRPSu\PROGRAMS\TeamViewer.exe
c:\users\Fern\AppData\Roaming\DRPSu\PROGRAMS\TeamViewer.exe.torrent
c:\users\Fern\AppData\Roaming\DRPSu\PROGRAMS\windows7-kb4012212-x64.msu
c:\users\Fern\AppData\Roaming\DRPSu\temp\devcon_19136.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\devcon_35716.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\devcon_35725.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\devcon_36736.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\devcon_43753.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\devcon_47529.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\devcon_54058.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\devcon_62928.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\devcon_6650.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\devcon_68720.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\devcon_89967.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\devcon_97298.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\installing_23928.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\installing_26271.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\installing_27376.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\installing_32632.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\installing_34574.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\installing_46121.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\installing_46272.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\installing_46829.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\installing_46888.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\installing_48613.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\installing_49952.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\installing_61753.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\installing_69988.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\installing_7412.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\installing_80048.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\installing_80094.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\installing_8251.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\installing_83698.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\installing_84485.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\installing_93844.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\log_zip_file_19136.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\log_zip_file_25655.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\log_zip_file_35716.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\log_zip_file_35725.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\log_zip_file_36736.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\log_zip_file_43753.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\log_zip_file_47529.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\log_zip_file_53597.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\log_zip_file_54058.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\log_zip_file_62928.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\log_zip_file_6650.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\log_zip_file_68720.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\log_zip_file_7184.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\log_zip_file_89967.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\log_zip_file_97298.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\ps.jw18f4ea.of2ns.cmd.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\ps.jw18f4ea.of2ns.stderr.log
c:\users\Fern\AppData\Roaming\DRPSu\temp\ps.jw18f4ea.of2ns.stdout.log
c:\users\Fern\AppData\Roaming\DRPSu\temp\ps.jw18f4lf.ukt7z.ps1
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_12285.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_12524.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_14473.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_16936.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_17747.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_20709.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_21706.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_21851.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_26700.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_27567.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_2870.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_2923.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_29362.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_29636.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_30795.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_31777.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_39214.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_39305.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_39525.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_44488.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_44794.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_45209.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_46724.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_48912.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_50338.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_5743.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_57593.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_5916.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_63186.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_64249.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_6663.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_670.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_68118.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_68999.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_69838.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_72224.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_7237.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_74191.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_76372.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_78670.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_80983.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_81990.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_8245.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_84585.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_86272.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_86878.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_89707.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_90120.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_92566.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_97210.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_98341.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\run_command_98647.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\service_mode_output.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\service_mode_temp_output.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\unzipping_19136.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\unzipping_25655.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\unzipping_35716.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\unzipping_35725.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\unzipping_36736.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\unzipping_43753.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\unzipping_47529.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\unzipping_53597.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\unzipping_54058.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\unzipping_62928.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\unzipping_6650.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\unzipping_68720.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\unzipping_7184.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\unzipping_89967.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\unzipping_97298.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\wget_finished_19310.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\wget_finished_27265.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\wget_finished_47606.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\wget_finished_5362.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\wget_finished_8674.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\wget_finished_8848.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\wget_finished_92079.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\wget_finished_98368.txt
c:\users\Fern\AppData\Roaming\DRPSu\temp\wget_log_19310.log
c:\users\Fern\AppData\Roaming\DRPSu\temp\wget_log_27265.log
c:\users\Fern\AppData\Roaming\DRPSu\temp\wget_log_47606.log
c:\users\Fern\AppData\Roaming\DRPSu\temp\wget_log_5362.log
c:\users\Fern\AppData\Roaming\DRPSu\temp\wget_log_8674.log
c:\users\Fern\AppData\Roaming\DRPSu\temp\wget_log_8848.log
c:\users\Fern\AppData\Roaming\DRPSu\temp\wget_log_92079.log
c:\users\Fern\AppData\Roaming\DRPSu\temp\wget_log_98368.log
.
.
(((((((((((((((((((((((((   Files Created from 2019-04-24 to 2019-05-24  )))))))))))))))))))))))))))))))
.
.
2019-05-24 22:29 . 2019-05-24 22:29    --------    d-----w-    c:\users\Default\AppData\Local\temp
2019-05-24 17:13 . 2019-05-24 17:13    --------    d-----w-    c:\program files (x86)\Microsoft XNA
2019-05-24 14:04 . 2019-05-24 14:04    842296    ----a-w-    c:\windows\SysWow64\FlashPlayerApp.exe
2019-05-24 14:04 . 2019-05-24 14:04    175160    ----a-w-    c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2019-05-24 14:04 . 2019-05-24 14:04    --------    d-----w-    c:\windows\system32\Macromed
2019-05-24 14:04 . 2019-05-24 14:04    --------    d-----w-    c:\windows\SysWow64\Macromed
2019-05-24 14:03 . 2019-05-24 14:03    --------    d-----w-    c:\program files (x86)\Common Files\Java
2019-05-24 14:03 . 2019-05-24 14:03    --------    d-----w-    c:\program files (x86)\Common Files\Oracle
2019-05-24 14:01 . 2019-05-24 14:01    466456    ----a-w-    c:\windows\system32\wrap_oal.dll
2019-05-24 14:01 . 2019-05-24 14:01    444952    ----a-w-    c:\windows\SysWow64\wrap_oal.dll
2019-05-24 14:01 . 2019-05-24 14:01    122904    ----a-w-    c:\windows\system32\OpenAL32.dll
2019-05-24 14:01 . 2019-05-24 14:01    109080    ----a-w-    c:\windows\SysWow64\OpenAL32.dll
2019-05-24 14:01 . 2019-05-24 14:01    --------    d-----w-    c:\program files (x86)\OpenAL
2019-05-24 13:59 . 2019-05-24 13:59    --------    d-----w-    c:\program files\Microsoft Silverlight
2019-05-24 13:59 . 2019-05-24 13:59    --------    d-----w-    c:\program files (x86)\Microsoft Silverlight
2019-05-24 13:58 . 2019-05-24 13:59    --------    d-----w-    c:\program files (x86)\Microsoft Games for Windows - LIVE
2019-05-24 13:52 . 2019-05-24 13:52    69840    ----a-w-    c:\windows\system32\drivers\nvvad64v.sys
2019-05-24 13:50 . 2019-05-24 13:50    122752    ----a-w-    c:\windows\system32\RtNicProp64.dll
2019-05-24 13:50 . 2019-05-24 13:50    1106720    ----a-w-    c:\windows\system32\drivers\Rt64win7.sys
2019-05-24 13:47 . 2019-05-24 13:47    69088    ----a-w-    c:\windows\system32\drivers\iBtFltCoex.sys
2019-05-24 13:47 . 2019-05-24 13:47    1448248    ----a-w-    c:\windows\system32\drivers\btmhsf.sys
2019-05-24 13:47 . 2019-05-24 13:47    1721216    ----a-w-    c:\windows\system32\WdfCoInstaller01009.dll
2019-05-24 13:45 . 2019-05-24 13:45    181304    ----a-w-    c:\windows\system32\drivers\TeeDriverx64.sys
2019-05-24 13:45 . 2019-05-24 13:45    1795952    ----a-w-    c:\windows\system32\WdfCoInstaller01011.dll
2019-05-24 13:25 . 2019-04-07 15:17    617984    ----a-w-    c:\windows\SysWow64\wmdrmsdk.dll
2019-05-24 13:21 . 2019-05-24 13:21    --------    d-----w-    c:\programdata\ProductData
2019-05-24 13:20 . 2019-05-24 13:20    27552    ----a-w-    c:\windows\SysWow64\drivers\HWiNFO64A.SYS
2019-05-24 13:20 . 2019-05-24 13:20    --------    d-----w-    c:\program files (x86)\IObit
2019-05-24 13:20 . 2019-05-24 13:21    --------    d-----w-    c:\programdata\IObit
2019-05-24 13:10 . 2019-05-24 13:50    118712    ----a-w-    c:\windows\system32\RTNUninst64.dll
2019-05-24 01:11 . 2019-05-24 01:11    --------    d-----w-    c:\program files\AMD
2019-05-24 00:11 . 2019-05-24 00:11    --------    d-----w-    c:\program files (x86)\Driver Identifier
2019-05-24 00:07 . 2018-11-21 18:33    53800    ----a-w-    c:\windows\system32\drivers\Smb_driver_Intel.sys
2019-05-23 23:49 . 2019-05-24 00:48    --------    d-----w-    c:\windows\SysWow64\NV
2019-05-23 23:49 . 2019-05-24 00:48    --------    d-----w-    c:\windows\system32\NV
2019-05-23 23:43 . 2019-05-23 20:13    15075152    ----a-w-    c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{EAA430F6-F655-4AE1-9EA5-CCBCA45A05C7}\mpengine.dll
2019-05-23 23:38 . 2019-04-09 13:30    1323320    ----a-w-    c:\windows\system32\NvRtmpStreamer64.dll
2019-05-23 23:38 . 2019-04-09 13:30    2769720    ----a-w-    c:\windows\system32\nvspcap64.dll
2019-05-23 23:38 . 2019-04-09 13:30    2149688    ----a-w-    c:\windows\SysWow64\nvspcap.dll
2019-05-23 23:37 . 2019-04-09 13:30    203304    ----a-w-    c:\windows\system32\nvaudcap64v.dll
2019-05-23 23:37 . 2019-04-09 13:30    179240    ----a-w-    c:\windows\SysWow64\nvaudcap32v.dll
2019-05-23 23:37 . 2019-04-09 13:30    1951    ----a-w-    c:\windows\NvTelemetryContainerRecovery.bat
2019-05-23 23:36 . 2019-04-09 11:43    82984    ----a-w-    c:\windows\system32\nv3dappshextr.dll
2019-05-23 23:36 . 2019-04-09 11:43    651576    ----a-w-    c:\windows\system32\nv3dappshext.dll
2019-05-23 23:36 . 2019-04-09 11:43    2624824    ----a-w-    c:\windows\system32\nvsvc64.dll
2019-05-23 23:36 . 2019-04-09 11:43    1767736    ----a-w-    c:\windows\system32\nvsvcr.dll
2019-05-23 23:36 . 2019-04-09 11:43    124784    ----a-w-    c:\windows\system32\nvshext.dll
2019-05-23 23:36 . 2019-04-09 10:08    8530822    ----a-w-    c:\windows\system32\nvcoproc.bin
2019-05-23 23:36 . 2019-04-09 11:43    5365744    ----a-w-    c:\windows\system32\nvcpl.dll
2019-05-23 23:36 . 2019-04-09 11:43    450872    ----a-w-    c:\windows\system32\nvmctray.dll
2019-05-23 23:36 . 2019-04-09 11:43    148848    ----a-w-    c:\windows\SysWow64\oemdspif.dll
2019-05-23 23:36 . 2019-05-24 20:52    --------    d-----w-    c:\programdata\NVIDIA
2019-05-23 23:36 . 2019-03-30 09:37    1951    ----a-w-    c:\windows\NvContainerRecovery.bat
2019-05-23 23:35 . 2019-05-23 23:38    --------    d-----w-    c:\program files (x86)\NVIDIA Corporation
2019-05-23 23:35 . 2019-05-23 23:35    --------    d-----w-    c:\windows\system32\drivers\NVIDIA Corporation
2019-05-23 23:32 . 2019-05-23 23:38    --------    d-----w-    c:\program files\NVIDIA Corporation
2019-05-23 23:25 . 2019-05-23 23:27    --------    d-----w-    c:\windows\system32\appmgmt
2019-05-23 22:59 . 2019-05-23 23:04    --------    d-----w-    c:\program files (x86)\TeamViewer
2019-05-23 22:57 . 2019-05-23 23:03    --------    d-----w-    c:\program files (x86)\K-Lite Codec Pack
2019-05-23 22:56 . 2019-05-23 22:56    --------    d-----w-    c:\program files (x86)\7-Zip
2019-05-23 22:47 . 2019-05-23 22:47    --------    d-----w-    c:\program files\Common Files\AVAST Software
2019-05-23 22:43 . 2019-05-23 22:44    --------    d-----w-    c:\program files (x86)\Mozilla Maintenance Service
2019-05-23 22:43 . 2019-05-23 22:43    --------    d-----w-    c:\program files\Mozilla Firefox
2019-05-23 22:08 . 2019-05-23 22:08    --------    d-----w-    c:\program files (x86)\Common Files\Intel
2019-05-23 22:07 . 2019-05-23 22:07    --------    d-----w-    C:\Intel
2019-05-23 21:58 . 2019-05-23 21:58    --------    d-----w-    c:\program files\WinRAR
2019-05-23 21:47 . 2019-05-23 21:47    --------    d-----w-    c:\program files\Common Files\Uncheater
2019-05-23 21:41 . 2019-05-24 13:49    --------    d-----w-    c:\windows\system32\DAX2
2019-05-23 21:41 . 2019-05-24 13:56    --------    d-----w-    c:\program files\Realtek
2019-05-23 21:41 . 2019-05-24 13:49    --------    d-----w-    c:\windows\SysWow64\RTCOM
2019-05-23 21:40 . 2017-06-29 15:55    677664    ----a-w-    c:\windows\system32\MaxxVolumeSDAPO.dll
2019-05-23 21:40 . 2017-06-29 15:54    678176    ----a-w-    c:\windows\system32\MaxxAudioAPO30.dll
2019-05-23 21:40 . 2017-06-29 15:54    330552    ----a-w-    c:\windows\system32\MaxxAudioAPO20.dll
2019-05-23 21:40 . 2017-06-29 15:51    2050176    ----a-w-    c:\windows\system32\MaxxAudioEQ64.dll
2019-05-23 21:40 . 2017-06-29 15:54    4059960    ----a-w-    c:\windows\system32\FMAPO64.dll
2019-05-23 21:40 . 2019-05-24 13:09    --------    d-----w-    c:\program files (x86)\Realtek
2019-05-23 21:40 . 2017-06-29 15:52    118592    ----a-w-    c:\windows\system32\AERTAR64.dll
2019-05-23 21:40 . 2017-06-29 15:52    574752    ----a-w-    c:\windows\system32\AERTAC64.dll
2019-05-23 21:40 . 2019-05-24 13:56    --------    d--h--w-    c:\program files (x86)\InstallShield Installation Information
2019-05-23 21:39 . 2019-05-24 01:07    --------    d--h--w-    c:\program files (x86)\Temp
2019-05-23 21:39 . 2018-01-15 12:40    2856800    ----a-w-    c:\windows\RtlExUpd.dll
2019-05-23 21:23 . 2019-05-23 21:23    --------    d-----w-    c:\program files\CPUID
2019-05-23 20:45 . 2019-05-23 20:45    --------    d-----w-    C:\NVIDIA
2019-05-23 20:14 . 2019-05-23 20:14    1094320    ----a-w-    c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DF84D637-6500-45D5-BED2-CEC82FAC0DA6}\gapaengine.dll
2019-05-23 20:13 . 2019-05-24 14:03    110968    ----a-w-    c:\windows\system32\WindowsAccessBridge-64.dll
2019-05-23 20:13 . 2019-05-23 20:13    --------    d-----w-    c:\programdata\Oracle
2019-05-23 20:13 . 2019-05-24 14:02    --------    d-----w-    c:\program files\Java
2019-05-23 20:09 . 2009-03-16 11:18    235352    ----a-w-    c:\windows\SysWow64\xactengine3_4.dll
2019-05-23 20:05 . 2019-05-23 20:05    --------    d-----w-    c:\programdata\PUBG
2019-05-23 19:23 . 2019-05-23 21:31    --------    d-----w-    c:\program files (x86)\PUBGLite
2019-05-23 19:19 . 2019-05-23 19:19    --------    d-----w-    c:\program files (x86)\Microsoft.NET
2019-05-23 19:08 . 2019-05-23 19:09    --------    d-----w-    C:\066f938c774c4c98418e5ec63b7ca8
2019-05-23 18:48 . 2019-05-23 18:49    --------    d-----w-    c:\program files (x86)\Google
2019-05-23 15:38 . 2019-05-24 13:56    --------    d--h--w-    c:\windows\system32\WLANProfiles
2019-05-23 15:38 . 2019-05-23 15:38    --------    d-----w-    c:\users\Public\Roaming
2019-05-23 15:38 . 2019-05-23 15:38    --------    d-----w-    c:\users\Default\Roaming
2019-05-23 15:38 . 2019-05-23 15:38    --------    d-----w-    c:\programdata\Roaming
2019-05-23 15:38 . 2019-05-24 14:17    --------    d-----w-    c:\programdata\Intel
2019-05-23 15:38 . 2019-05-23 22:45    --------    d-----w-    c:\program files (x86)\Intel
2019-05-23 15:38 . 2019-05-23 15:38    --------    d-----w-    c:\program files\Common Files\Intel
2019-05-23 15:38 . 2019-05-23 15:38    --------    d-----w-    c:\program files (x86)\Cisco
2019-05-23 15:37 . 2019-05-23 22:08    --------    d-----w-    c:\program files\Intel
2019-05-23 15:37 . 2019-05-24 17:15    --------    d-sh--w-    c:\windows\Installer
2019-05-23 15:37 . 2019-05-24 14:04    --------    d-----w-    c:\programdata\Package Cache
2019-05-23 15:36 . 2019-05-24 01:03    --------    d-----w-    C:\DRIVERS
2019-05-23 14:17 . 2019-05-23 13:57    --------    d-----w-    c:\windows\Panther
2019-05-23 13:57 . 2019-05-24 12:57    --------    d-----w-    c:\users\Fern
2019-05-23 13:56 . 2019-05-23 13:56    --------    d-----w-    C:\Recovery
2019-05-23 13:56 . 2019-05-23 13:56    --------    d-sh--we    c:\users\Default\Belgelerim
2019-05-23 13:56 . 2019-05-23 13:56    --------    d-sh--we    c:\programdata\Sık Kullanılanlar
2019-05-23 13:56 . 2019-05-23 13:56    --------    d-sh--we    c:\programdata\Belgeler
2019-05-14 11:59 . 2019-05-14 11:59    316760    ----a-w-    c:\windows\system32\igfxCUIService.exe
2019-05-14 11:59 . 2019-05-14 11:59    4381016    ----a-w-    c:\windows\system32\Gfxv4_0.exe
2019-05-14 11:59 . 2019-05-14 11:59    543576    ----a-w-    c:\windows\system32\DPTopologyAppv2_0.exe
2019-05-14 11:59 . 2019-05-14 11:59    4377432    ----a-w-    c:\windows\system32\Gfxv2_0.exe
2019-05-14 11:59 . 2019-05-14 11:59    397656    ----a-w-    c:\windows\system32\CustomModeAppv2_0.exe
2019-05-14 11:49 . 2019-05-14 11:49    226192    ----a-w-    c:\windows\system32\igfxCoIn_v5069.dll
2019-05-14 11:49 . 2013-09-20 02:22    4432896    ----a-w-    c:\windows\system32\igdusc64.dll
2019-05-14 11:49 . 2013-09-20 02:22    12100096    ----a-w-    c:\windows\system32\igdumdim64.dll
2019-05-14 11:49 . 2013-09-20 02:21    13760512    ----a-w-    c:\windows\system32\igd10iumd64.dll
2019-04-28 19:58 . 2013-01-23 14:57    64624    ----a-w-    c:\windows\system32\drivers\HECIx64.sys
2019-04-28 19:58 . 2019-01-04 00:53    450152    ----a-w-    c:\windows\system32\drivers\RtsUer.sys
2019-04-28 19:58 . 2019-01-04 00:53    9909000    ----a-w-    c:\windows\SysWow64\RsCRIcon.dll
2019-04-28 19:44 . 2014-04-27 17:40    34552    ----a-w-    c:\windows\system32\drivers\AcpiVpc.sys
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2019-04-19 02:50 . 2019-05-24 13:26    44032    ----a-w-    c:\windows\apppatch\acwow64.dll
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"USB3MON"="c:\program files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2013-12-10 292088]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2019-04-01 645456]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 GoogleChromeElevationService;Google Chrome Elevation Service;c:\program files (x86)\Google\Chrome\Application\74.0.3729.169\elevation_service.exe;c:\program files (x86)\Google\Chrome\Application\74.0.3729.169\elevation_service.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 Intel(R) SUR QC SAM;Intel(R) SUR QC Software Asset Manager;c:\program files\Intel\SUR\QUEENCREEK\Updater\bin\IntelSoftwareAssetManagerService.exe;c:\program files\Intel\SUR\QUEENCREEK\Updater\bin\IntelSoftwareAssetManagerService.exe [x]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft Ağ İnceleme;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 NvContainerNetworkService;NVIDIA NetworkService Container;c:\program files\NVIDIA Corporation\NvContainer\nvcontainer.exe;c:\program files\NVIDIA Corporation\NvContainer\nvcontainer.exe [x]
R3 NvStreamKms;NVIDIA KMS;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 rtkio;rtkio;c:\users\Fern\AppData\Local\Temp\rtkio64.sys;c:\users\Fern\AppData\Local\Temp\rtkio64.sys [x]
R3 SmbDrvI;SmbDrvI;c:\windows\system32\DRIVERS\Smb_driver_Intel.sys;c:\windows\SYSNATIVE\DRIVERS\Smb_driver_Intel.sys [x]
R3 stornvme;stornvme;c:\windows\system32\drivers\stornvme.sys;c:\windows\SYSNATIVE\drivers\stornvme.sys [x]
R3 Synth3dVsc;Microsoft Virtual 3D Video Transport Driver;c:\windows\system32\drivers\Synth3dVsc.sys;c:\windows\SYSNATIVE\drivers\Synth3dVsc.sys [x]
R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys;c:\windows\SYSNATIVE\drivers\terminpt.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]
R3 uncheater_bgl;Uncheater for BattleGroundsLite_SE;c:\program files\Common Files\Uncheater\uncheater_bgl.exe;c:\program files\Common Files\Uncheater\uncheater_bgl.exe [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]
R3 WiaRpc;Resim Alma Olayları;c:\windows\system32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
R3 xhunter1;xhunter1;c:\windows\xhunter1.sys;c:\windows\xhunter1.sys [x]
S0 iusb3hcs;Intel(R) USB 3.0 Ana Bilgisayar Denetleyici Değiştirici Sürücüsü;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]
S1 HWiNFO32;HWiNFO32/64 Kernel Driver;c:\windows\SysWOW64\drivers\HWiNFO64A.SYS;c:\windows\SysWOW64\drivers\HWiNFO64A.SYS [x]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 DSAService;Intel(R) Driver & Support Assistant;c:\program files (x86)\Intel\Driver and Support Assistant\DSAService.exe;c:\program files (x86)\Intel\Driver and Support Assistant\DSAService.exe [x]
S2 NvContainerLocalSystem;NVIDIA LocalSystem Container;c:\program files\NVIDIA Corporation\NvContainer\nvcontainer.exe;c:\program files\NVIDIA Corporation\NvContainer\nvcontainer.exe [x]
S2 NVDisplay.ContainerLocalSystem;NVIDIA Display Container LS;c:\program files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe;c:\program files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [x]
S2 NvTelemetryContainer;NVIDIA Telemetry Container;c:\program files\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe;c:\program files\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe [x]
S2 ZeroConfigService;Intel(R) PROSet/Wireless Zero Configuration Service;c:\program files\Intel\WiFi\bin\ZeroConfigService.exe;c:\program files\Intel\WiFi\bin\ZeroConfigService.exe [x]
S3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\DRIVERS\AcpiVpc.sys;c:\windows\SYSNATIVE\DRIVERS\AcpiVpc.sys [x]
S3 btmhsf;btmhsf;c:\windows\system32\DRIVERS\btmhsf.sys;c:\windows\SYSNATIVE\DRIVERS\btmhsf.sys [x]
S3 DSAUpdateService;Intel(R) Driver & Support Assistant Updater;c:\program files (x86)\Intel\Driver and Support Assistant\DSAUpdateService.exe;c:\program files (x86)\Intel\Driver and Support Assistant\DSAUpdateService.exe [x]
S3 iBtFltCoex;iBtFltCoex;c:\windows\system32\DRIVERS\iBtFltCoex.sys;c:\windows\SYSNATIVE\DRIVERS\iBtFltCoex.sys [x]
S3 ICCS;Intel(R) Integrated Clock Controller Service - Intel(R) ICCS;c:\program files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe;c:\program files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [x]
S3 IntcDAud;Intel(R) Ekran İçin Ses;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 iusb3hub;Intel(R) USB 3.0 Hub Sürücüsü;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
S3 iusb3xhc;Intel(R) USB 3.0 Genişletilebilir Ana Bilgisayar Denetleyici Sürücüsü;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 nvvhci;NVVHCI Enumerator Service;c:\windows\system32\DRIVERS\nvvhci.sys;c:\windows\SYSNATIVE\DRIVERS\nvvhci.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 RTSUER;Realtek USB Card Reader - UER;c:\windows\system32\Drivers\RtsUer.sys;c:\windows\SYSNATIVE\Drivers\RtsUer.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation    REG_MULTI_SZ       SSDPSRV upnphost SCardSvr QWAVE wcncsvc
.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost  - LocalSystemNetworkRestricted
WiaRpc
.
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2016-11-14 1353680]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2019-05-24 18391120]
"RtHDVBg_Dolby"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2019-05-24 1506384]
"RtHDVBg_LENOVO_DOLBYDRAGON"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2019-05-24 1506384]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2013-09-20 391128]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2013-09-20 771032]
"Persistence"="c:\windows\system32\igfxpers.exe" [2013-09-20 769496]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - LocalSystemNetworkRestricted
WiaRpc
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath -
.
- - - - ORPHANS REMOVED - - - -
.
ShellIconOverlayIdentifiers-{472083B0-C522-11CF-8763-00608CC02F24} - (no file)
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_32_0_0_192_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_32_0_0_192_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_32_0_0_192_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_32_0_0_192_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_32_0_0_192.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.32"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_32_0_0_192.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_32_0_0_192.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_32_0_0_192.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\AVAST Software]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
   00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2019-05-25  01:31:05
ComboFix-quarantined-files.txt  2019-05-24 22:31
ComboFix2.txt  2019-05-23 21:30
.
Pre-Run: 155.740.413.952 bayt boş
Post-Run: 156.897.488.896 bayt boş
.
- - End Of File - - C0B490D2C3F0482F3A1ABE627616B4D4
A36C5E4F47E84449FF07ED3517B43A31

Ara

ComboFix Log Analizi

Luciquad

Benzer Konular