Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 21.02.2018 Ran by [removed] (administrator) on DESKTOP-679GB3N (21-02-2018 23:10:21) Running from C:\Users\[removed]\Downloads [removed] Platform: Windows 10 Home Version 1709 16299.248 (X64) Language: English (United States) Internet Explorer Version 11 (Default browser: Chrome) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (TOSHIBA CORPORATION) C:\Windows\System32\ninbaugsvc.exe (Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\ki125183.inf_amd64_cb49708b33bad074\igfxCUIService.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe (Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\ki125183.inf_amd64_cb49708b33bad074\igfxEM.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe (Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe (Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\ki125183.inf_amd64_cb49708b33bad074\IntelCpHDCPSvc.exe (SEIKO EPSON CORPORATION) C:\Program Files\EPSON\EpsonCustomerResearchParticipation\EPCP.exe (Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe (PC Drivers HeadQuarters LP) C:\Program Files (x86)\Driver Support\svc\DriverSupportAOsvc.exe (Intel Corporation) C:\Windows\System32\Intel\DPTF\esif_uf.exe (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Intel Corporation) C:\Windows\System32\ibtsiva.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Security Assist\isaHelperService.exe (Nanoheal) C:\Program Files\Nanoheal\Client\srvc.exe (Intuit) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe (Intuit Inc.) C:\Program Files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe () C:\Windows\windefender.exe (Waves Audio Ltd.) C:\Program Files\Waves\MaxxAudio\WavesSysSvc64.exe (Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe (Intel Corporation) C:\Windows\Temp\DPTF\esif_assist_64.exe (Nanoheal) C:\Program Files\Nanoheal\Client\cust.exe (Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe (Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\ki125183.inf_amd64_cb49708b33bad074\IntelCpHeciSvc.exe (PC Drivers HeadQuarters LP) C:\Program Files (x86)\Driver Support\svc\DriverSupportAO.exe (Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1803.279.0_x64__kzf8qxf38zg5c\SkypeHost.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe () C:\Windows\Temp\g7887.tmp.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe (Nanoheal) C:\Program Files\Nanoheal\Client\cutil.exe (Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe (Waves Audio Ltd.) C:\Program Files\Waves\MaxxAudio\WavesSvc64.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Rzj51) C:\Program Files\Windows Portable Devices\CCRPDYKVVQ\HJCSGVKPCP.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe () C:\Windows\rss\csrss.exe () C:\Users\grant\AppData\Local\Temp\b7f0a41d25b94c14bb522bf9f7f8119c\YqEG4EJp.exe (SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXRCV.exe (SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe (Elaborate Bytes AG) C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe (SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\AdobeIPCBroker.exe (Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\acrotray.exe (Stamps.com) C:\Program Files (x86)\Stamps.com Connect\StampsPlugin.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\CCXProcess.exe (Node.js) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\libs\node.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe () C:\Users\grant\AppData\Local\csnbvou\csnbvou.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe () C:\Users\grant\AppData\Local\zaeidng\vsonard.exe (EpicNet Inc.) C:\Users\grant\AppData\Local\Temp\csrss\cloudnet.exe (Dell Inc.) C:\Program Files\Dell\DellDataVault\DDVRulesProcessor.exe (Dell Inc.) C:\Program Files (x86)\Dell Customer Connect\DCCService.exe (Dell Inc.) C:\Program Files\Dell\Dell Help & Support\MDLCSvc.exe (Dell) C:\Program Files\Dell\SARemediation\agent\DellSupportAssistRemedationService.exe (Dell Products, LP.) C:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe (Dell Inc.) C:\Program Files (x86)\Dell Update\DellUpService.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Dell Inc.) C:\Program Files (x86)\Dell Update\DellUpTray.exe (Dell) C:\Program Files\Dell\Dell Product Registration\PRSvc.exe (Dell Inc.) C:\Program Files\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe (Dell Inc.) C:\Program Files\Dell\DellDataVault\DDVDataCollector.exe (Dell Inc.) C:\Program Files\Dell\DellDataVault\DDVCollectorSvcApi.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google) C:\Users\grant\AppData\Local\Google\Chrome\User Data\SwReporter\25.141.202\software_reporter_tool.exe (Google) C:\Users\grant\AppData\Local\Google\Chrome\User Data\SwReporter\25.141.202\software_reporter_tool.exe (Google) C:\Users\grant\AppData\Local\Google\Chrome\User Data\SwReporter\25.141.202\software_reporter_tool.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe () C:\Users\grant\AppData\Local\csnbvou\vdbgpik.exe () C:\Users\grant\AppData\Local\csnbvou\vdbgpik.exe () C:\Users\grant\AppData\Local\csnbvou\vdbgpik.exe () C:\Users\grant\AppData\Local\csnbvou\vdbgpik.exe () C:\Users\grant\AppData\Local\csnbvou\vdbgpik.exe (Microsoft Corporation) C:\Windows\System32\smartscreen.exe () C:\Users\grant\AppData\Local\csnbvou\vdbgpik.exe () C:\Users\grant\AppData\Local\csnbvou\vdbgpik.exe ==================== Registry (Whitelisted) =========================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [630168 2017-09-29] (Microsoft Corporation) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [9237968 2017-06-09] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg_PushButton] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1497048 2017-06-09] (Realtek Semiconductor) HKLM\...\Run: [QuickSet] => c:\Program Files\Dell\QuickSet\QuickSet.exe [3893296 2016-05-17] (Dell Inc.) HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [320568 2016-09-20] (Intel Corporation) HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508128 2016-07-01] (Adobe Systems Incorporated) HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [297784 2017-09-11] (Apple Inc.) HKLM\...\Run: [WavesSvc] => C:\Program Files\Waves\MaxxAudio\WavesSvc64.exe [976768 2017-05-08] (Waves Audio Ltd.) HKLM\...\Run: [AdobeGCInvoker-1.0] => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe [315880 2018-01-05] (Adobe Systems, Incorporated) HKLM\...\Run: [macworld] => "C:\Program Files (x86)\Dobler\ballgame.exe" HKLM\...\Run: [macworldpretends] => "C:\Program Files (x86)\emancipation\aix.exe" HKLM\...\Run: [macworldmacworld] => "C:\Program Files (x86)\Dyker\ballgame.exe" HKLM\...\Run: [NanohealCApp] => C:\Program Files\Nanoheal\Client\capp.exe -l HKLM-x32\...\Run: [FUFAXRCV] => C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXRCV.exe [650784 2015-01-20] (SEIKO EPSON CORPORATION) HKLM-x32\...\Run: [FUFAXSTM] => C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe [863776 2015-01-20] (SEIKO EPSON CORPORATION) HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-10] (Elaborate Bytes AG) HKLM-x32\...\Run: [Intuit SyncManager] => C:\Program Files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe [3792648 2016-03-07] (Intuit Inc. All rights reserved.) HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [1065024 2014-06-10] (SEIKO EPSON CORPORATION) HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2383040 2016-10-12] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1160408 2017-03-28] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Acrotray.exe [3499640 2017-03-28] (Adobe Systems Inc.) HKLM-x32\...\Run: [Stamps.com] => C:\Program Files (x86)\Stamps.com Connect\StampsPlugin.exe [5130240 2017-05-03] (Stamps.com) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2017-12-19] (Oracle Corporation) HKLM-x32\...\Run: [kassebaum] => "C:\Program Files (x86)\Dobler\ballgame.exe" HKLM-x32\...\Run: [kassebaumunfiltered] => "C:\Program Files (x86)\emancipation\aix.exe" HKLM-x32\...\Run: [kassebaumkassebaum] => "C:\Program Files (x86)\Dyker\ballgame.exe" HKLM\...\RunOnce: [Lahin_Raw_barra_al3eb_b3id_JEEDPTZYII.exe] => C:\Program Files\Dell Support Center\JDEAHFETNW\JEEDPTZYII.exe [971776 2018-02-20] (2VdgNe) HKLM\ DisallowedCertificates: 03D22C9C66915D58C88912B64C1F984B8344EF09 (Comodo Security Solutions) <==== ATTENTION HKLM\ DisallowedCertificates: 0F684EC1163281085C6AF20528878103ACEFCAAB (F-Secure Corporation) <==== ATTENTION HKLM\ DisallowedCertificates: 1667908C9E22EFBD0590E088715CC74BE4C60884 (FRISK Software International/F-Prot) <==== ATTENTION HKLM\ DisallowedCertificates: 18DEA4EFA93B06AE997D234411F3FD72A677EECE (Bitdefender SRL) <==== ATTENTION HKLM\ DisallowedCertificates: 2026D13756EB0DB753DF26CB3B7EEBE3E70BB2CF (G DATA Software AG) <==== ATTENTION HKLM\ DisallowedCertificates: 249BDA38A611CD746A132FA2AF995A2D3C941264 (Malwarebytes Corporation) <==== ATTENTION HKLM\ DisallowedCertificates: 31AC96A6C17C425222C46D55C3CCA6BA12E54DAF (Symantec Corporation) <==== ATTENTION HKLM\ DisallowedCertificates: 331E2046A1CCA7BFEF766724394BE6112B4CA3F7 (Trend Micro) <==== ATTENTION HKLM\ DisallowedCertificates: 3353EA609334A9F23A701B9159E30CB6C22D4C59 (Webroot Inc.) <==== ATTENTION HKLM\ DisallowedCertificates: 373C33726722D3A5D1EDD1F1585D5D25B39BEA1A (SUPERAntiSpyware.com) <==== ATTENTION HKLM\ DisallowedCertificates: 3850EDD77CC74EC9F4829AE406BBF9C21E0DA87F (Kaspersky Lab) <==== ATTENTION HKLM\ DisallowedCertificates: 3D496FA682E65FC122351EC29B55AB94F3BB03FC (AVG Technologies CZ) <==== ATTENTION HKLM\ DisallowedCertificates: 4243A03DB4C3C15149CEA8B38EEA1DA4F26BD159 (PC Tools) <==== ATTENTION HKLM\ DisallowedCertificates: 42727E052C0C2E1B35AB53E1005FD9EDC9DE8F01 (K7 Computing Pvt Ltd) <==== ATTENTION HKLM\ DisallowedCertificates: 4420C99742DF11DD0795BC15B7B0ABF090DC84DF (Doctor Web Ltd.) <==== ATTENTION HKLM\ DisallowedCertificates: 4C0AF5719009B7C9D85C5EAEDFA3B7F090FE5FFF (Emsisoft Ltd) <==== ATTENTION HKLM\ DisallowedCertificates: 5240AB5B05D11B37900AC7712A3C6AE42F377C8C (Check Point Software Technologies Ltd.) <==== ATTENTION HKLM\ DisallowedCertificates: 5DD3D41810F28B2A13E9A004E6412061E28FA48D (Emsisoft Ltd) <==== ATTENTION HKLM\ DisallowedCertificates: 7457A3793086DBB58B3858D6476889E3311E550E (K7 Computing Pvt Ltd) <==== ATTENTION HKLM\ DisallowedCertificates: 76A9295EF4343E12DFC5FE05DC57227C1AB00D29 (BullGuard Ltd) <==== ATTENTION HKLM\ DisallowedCertificates: 775B373B33B9D15B58BC02B184704332B97C3CAF (McAfee) <==== ATTENTION HKLM\ DisallowedCertificates: 872CD334B7E7B3C3D1C6114CD6B221026D505EAB (Comodo Security Solutions) <==== ATTENTION HKLM\ DisallowedCertificates: 88AD5DFE24126872B33175D1778687B642323ACF (McAfee) <==== ATTENTION HKLM\ DisallowedCertificates: 9132E8B079D080E01D52631690BE18EBC2347C1E (Adaware Software) <==== ATTENTION HKLM\ DisallowedCertificates: 982D98951CF3C0CA2A02814D474A976CBFF6BDB1 (Safer Networking Ltd.) <==== ATTENTION HKLM\ DisallowedCertificates: 9A08641F7C5F2CCA0888388BE3E5DBDDAAA3B361 (Webroot Inc.) <==== ATTENTION HKLM\ DisallowedCertificates: 9C43F665E690AB4D486D4717B456C5554D4BCEB5 (ThreatTrack Security) <==== ATTENTION HKLM\ DisallowedCertificates: 9E3F95577B37C74CA2F70C1E1859E798B7FC6B13 (CURIOLAB S.M.B.A.) <==== ATTENTION HKLM\ DisallowedCertificates: A1F8DCB086E461E2ABB4B46ADCFA0B48C58B6E99 (Avira Operations GmbH & Co. KG) <==== ATTENTION HKLM\ DisallowedCertificates: A5341949ABE1407DD7BF7DFE75460D9608FBC309 (BullGuard Ltd) <==== ATTENTION HKLM\ DisallowedCertificates: A59CC32724DD07A6FC33F7806945481A2D13CA2F (ESET) <==== ATTENTION HKLM\ DisallowedCertificates: AB7E760DA2485EA9EF5A6EEE7647748D4BA6B947 (AVG Technologies CZ) <==== ATTENTION HKLM\ DisallowedCertificates: AD4C5429E10F4FF6C01840C20ABA344D7401209F (Avast Antivirus/Software) <==== ATTENTION HKLM\ DisallowedCertificates: AD96BB64BA36379D2E354660780C2067B81DA2E0 (Symantec Corporation) <==== ATTENTION HKLM\ DisallowedCertificates: B8EBF0E696AF77F51C96DB4D044586E2F4F8FD84 (Malwarebytes Corporation) <==== ATTENTION HKLM\ DisallowedCertificates: CDC37C22FE9272D8F2610206AD397A45040326B8 (Trend Micro) <==== ATTENTION HKLM\ DisallowedCertificates: D3F78D747E7C5D6D3AE8ABFDDA7522BFB4CBD598 (Kaspersky Lab) <==== ATTENTION HKLM\ DisallowedCertificates: DB303C9B61282DE525DC754A535CA2D6A9BD3D87 (ThreatTrack Security) <==== ATTENTION HKLM\ DisallowedCertificates: DB77E5CFEC34459146748B667C97B185619251BA (Avast Antivirus/Software) <==== ATTENTION HKLM\ DisallowedCertificates: E22240E837B52E691C71DF248F12D27F96441C00 (Total Defense, Inc.) <==== ATTENTION HKLM\ DisallowedCertificates: E513EAB8610CFFD7C87E00BCA15C23AAB407FCEF (AVG Technologies CZ) <==== ATTENTION HKLM\ DisallowedCertificates: ED841A61C0F76025598421BC1B00E24189E68D54 (Bitdefender SRL) <==== ATTENTION HKLM\ DisallowedCertificates: F83099622B4A9F72CB5081F742164AD1B8D048C9 (ESET) <==== ATTENTION HKLM\ DisallowedCertificates: FBB42F089AF2D570F2BF6F493D107A3255A9BB1A (Panda Security S.L) <==== ATTENTION HKLM\ DisallowedCertificates: FFFA650F2CB2ABC0D80527B524DD3F9FC172C138 (Doctor Web Ltd.) <==== ATTENTION HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION HKU\S-1-5-21-106698449-1581471573-1421150475-1001\...\Run: [HJCSGVKPCP.exe] => C:\Program Files\Windows Portable Devices\CCRPDYKVVQ\HJCSGVKPCP.exe [636416 2018-02-20] (Rzj51) HKU\S-1-5-21-106698449-1581471573-1421150475-1001\...\Run: [3IHXj4TO.exe] => C:\Users\grant\AppData\Local\81a7d49ceb264925bdd01c26fab1a132\3IHXj4TO.exe HKU\S-1-5-21-106698449-1581471573-1421150475-1001\...\Run: [achpow] => rundll32.exe "C:\Users\grant\AppData\Local\achpow.dll",achpow <==== ATTENTION HKU\S-1-5-21-106698449-1581471573-1421150475-1001\...\Run: [unfiltered] => "C:\Program Files (x86)\Dobler\ballgame.exe" HKU\S-1-5-21-106698449-1581471573-1421150475-1001\...\Run: [unfilteredkassebaum] => "C:\Program Files (x86)\emancipation\aix.exe" HKU\S-1-5-21-106698449-1581471573-1421150475-1001\...\Run: [unfilteredunfiltered] => "C:\Program Files (x86)\Dyker\ballgame.exe" HKU\S-1-5-21-106698449-1581471573-1421150475-1001\...\Run: [pretends] => "C:\Program Files (x86)\Dobler\ballgame.exe" HKU\S-1-5-21-106698449-1581471573-1421150475-1001\...\Run: [pretendsmacworld] => "C:\Program Files (x86)\emancipation\aix.exe" HKU\S-1-5-21-106698449-1581471573-1421150475-1001\...\Run: [pretendspretends] => "C:\Program Files (x86)\Dyker\ballgame.exe" HKU\S-1-5-21-106698449-1581471573-1421150475-1001\...\Run: [enhancer] => C:\Program Files (x86)\objectification\enhancer.exe [66819 2018-02-20] () HKU\S-1-5-21-106698449-1581471573-1421150475-1001\...\Run: [mammon] => "C:\Program Files (x86)\Dobler\ballgame.exe" HKU\S-1-5-21-106698449-1581471573-1421150475-1001\...\Run: [IcyTree] => C:\WINDOWS\rss\csrss.exe [3739648 2018-02-20] () <==== ATTENTION HKU\S-1-5-21-106698449-1581471573-1421150475-1001\...\Run: [szfKlMoPVI.exe] => C:\ProgramData\078d7aee85c442e39516c70c1b9f8dfa\szfKlMoPVI.exe HKU\S-1-5-21-106698449-1581471573-1421150475-1001\...\Run: [THARBEKOHH.exe] => C:\Users\grant\AppData\Local\Temp\6ca3f632d7474002924f51d8fc26b5af\THARBEKOHH.exe <==== ATTENTION HKU\S-1-5-21-106698449-1581471573-1421150475-1001\...\Run: [CloudNet] => C:\Users\grant\AppData\Roaming\EpicNet Inc\CloudNet\cloudnet.exe [680960 2018-02-21] (EpicNet Inc.) HKU\S-1-5-21-106698449-1581471573-1421150475-1001\...\Run: [YqEG4EJp.exe] => C:\Users\grant\AppData\Local\Temp\b7f0a41d25b94c14bb522bf9f7f8119c\YqEG4EJp.exe [538112 2018-02-21] () <==== ATTENTION HKU\S-1-5-21-106698449-1581471573-1421150475-1001\...\Winlogon: [Shell] - <==== ATTENTION Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Intuit Data Protect.lnk [2017-06-17] ShortcutTarget: Intuit Data Protect.lnk -> C:\Program Files (x86)\Common Files\Intuit\DataProtect\IntuitDataProtect.exe (Intuit Inc.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk [2017-06-17] ShortcutTarget: QuickBooks Update Agent.lnk -> C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe (Intuit Inc.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\QuickBooks_Standard_21.lnk [2017-06-17] ShortcutTarget: QuickBooks_Standard_21.lnk -> C:\Program Files (x86)\Intuit\QuickBooks 2016\QBW32.EXE (Intuit Inc.) Startup: C:\Users\grant\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ricostruzione.lnk [2018-02-20] ShortcutTarget: ricostruzione.lnk -> C:\Program Files (x86)\Dobler\ballgame.exe (No File) Startup: C:\Users\grant\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ricostruzionericostruzione.lnk [2018-02-20] ShortcutTarget: ricostruzionericostruzione.lnk -> C:\Program Files (x86)\emancipation\aix.exe (No File) GroupPolicy: Restriction <==== ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 Tcpip\..\Interfaces\{3f9414b9-d7af-42bf-8084-5959865b0162}: [DhcpNameServer] 192.168.1.1 Internet Explorer: ================== HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://go.microsoft.com/fwlink/p/?LinkId=255141 HKU\S-1-5-21-106698449-1581471573-1421150475-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKU\S-1-5-21-106698449-1581471573-1421150475-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome SearchScopes: HKU\S-1-5-21-106698449-1581471573-1421150475-1001 -> DefaultScope {8F7222BF-7E67-4D5F-8F2E-49F5F9D2121A} URL = hxxps://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=756901&p={searchTerms} SearchScopes: HKU\S-1-5-21-106698449-1581471573-1421150475-1001 -> {19270EE3-6861-4AE3-9AF0-4E36B1DA36C5} URL = SearchScopes: HKU\S-1-5-21-106698449-1581471573-1421150475-1001 -> {8F7222BF-7E67-4D5F-8F2E-49F5F9D2121A} URL = hxxps://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=756901&p={searchTerms} BHO: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2017-03-28] (Adobe Systems Incorporated) BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office16\GROOVEEX.DLL [2016-05-17] (Microsoft Corporation) BHO: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2017-03-28] (Adobe Systems Incorporated) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_161\bin\ssv.dll [2018-01-17] (Oracle Corporation) BHO-x32: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2017-03-28] (Adobe Systems Incorporated) BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office16\GROOVEEX.DLL [2016-05-17] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_161\bin\jp2ssv.dll [2018-01-17] (Oracle Corporation) BHO-x32: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2017-03-28] (Adobe Systems Incorporated) Toolbar: HKLM - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2017-03-28] (Adobe Systems Incorporated) Toolbar: HKLM-x32 - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2017-03-28] (Adobe Systems Incorporated) Toolbar: HKU\S-1-5-21-106698449-1581471573-1421150475-1001 -> Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2017-03-28] (Adobe Systems Incorporated) Handler-x32: intu-help-qb9 - {C1252096-0E63-4C06-A38B-03DF9A16AA12} - C:\Program Files (x86)\Intuit\QuickBooks 2016\HelpAsyncPluggableProtocol.dll [2016-03-07] (Intuit, Inc.) Handler: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - C:\Program Files\Microsoft Office\Office16\MSOSB.DLL [2016-05-20] (Microsoft Corporation) Handler-x32: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2016-05-20] (Microsoft Corporation) Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\Office16\MSOSB.DLL [2016-05-20] (Microsoft Corporation) Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2016-05-20] (Microsoft Corporation) Handler-x32: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - C:\WINDOWS\system32\mscoree.dll [2017-09-29] (Microsoft Corporation) FireFox: ======== FF HKLM-x32\...\Firefox\Extensions: [[removed]] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn FF Extension: (Adobe Acrobat - Create PDF) - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn [2017-10-12] [Legacy] FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\MICROS~1\Office16\NPSPWRAP.DLL [2015-07-31] (Microsoft Corporation) FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2016-10-12] (Adobe Systems) FF Plugin-x32: @java.com/DTPlugin,version=11.161.2 -> C:\Program Files (x86)\Java\jre1.8.0_161\bin\dtplugin\npDeployJava1.dll [2018-01-17] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.161.2 -> C:\Program Files (x86)\Java\jre1.8.0_161\bin\plugin2\npjp2.dll [2018-01-17] (Oracle Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\MICROS~1\Office16\NPSPWRAP.DLL [2015-07-31] (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-14] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-14] (Google Inc.) FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Air\nppdf32.dll [2017-03-28] (Adobe Systems Inc.) FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2016-10-12] (Adobe Systems) FF Plugin HKU\S-1-5-21-106698449-1581471573-1421150475-1001: @zoom.us/ZoomVideoPlugin -> C:\Users\grant\AppData\Roaming\Zoom\bin\npzoomplugin.dll [2017-06-15] (Zoom Video Communications, Inc.) Chrome: ======= CHR Profile: C:\Users\grant\AppData\Local\Google\Chrome\User Data\Default [2018-02-21] CHR Extension: (Slides) - C:\Users\grant\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2018-02-21] CHR Extension: (Docs) - C:\Users\grant\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2018-02-21] CHR Extension: (Google Drive) - C:\Users\grant\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2018-02-21] CHR Extension: (YouTube) - C:\Users\grant\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2018-02-21] CHR Extension: (Adobe Acrobat) - C:\Users\grant\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2018-02-21] CHR Extension: (Sheets) - C:\Users\grant\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2018-02-21] CHR Extension: (Google Docs Offline) - C:\Users\grant\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2018-02-21] CHR Extension: (Chrome Web Store Payments) - C:\Users\grant\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-02-21] CHR Extension: (Gmail) - C:\Users\grant\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2018-02-21] CHR Extension: (Chrome Media Router) - C:\Users\grant\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-02-21] CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCChromeExtn\WCChromeExtn.crx [2017-03-28] ==================== Services (Whitelisted) ==================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) HKLM\SYSTEM\CurrentControlSet\Services\nhambpd <==== ATTENTION (Rootkit!) R2 AdobeUpdateService; C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [744640 2016-10-12] (Adobe Systems Incorporated) R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2319848 2018-01-05] (Adobe Systems, Incorporated) R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2017-09-07] (Apple Inc.) R2 DDVCollectorSvcApi; C:\Program Files\Dell\DellDataVault\DDVCollectorSvcApi.exe [208792 2017-12-14] (Dell Inc.) R2 DDVDataCollector; C:\Program Files\Dell\DellDataVault\DDVDataCollector.exe [3294608 2017-12-14] (Dell Inc.) R2 DDVRulesProcessor; C:\Program Files\Dell\DellDataVault\DDVRulesProcessor.exe [217488 2017-12-14] (Dell Inc.) R2 Dell Customer Connect; C:\Program Files (x86)\Dell Customer Connect\DCCService.exe [130936 2017-09-19] (Dell Inc.) R2 Dell Help & Support; C:\Program Files\Dell\Dell Help & Support\MDLCSvc.exe [40976 2017-09-18] (Dell Inc.) R2 Dell SupportAssist Remediation; C:\Program Files\Dell\SARemediation\agent\DellSupportAssistRemedationService.exe [122400 2017-10-13] (Dell) R2 DellUpdate; C:\Program Files (x86)\Dell Update\DellUpService.exe [232320 2017-11-21] (Dell Inc.) R2 DSAO; C:\Program Files (x86)\driver support\svc\DriverSupportAOsvc.exe [2033104 2016-10-22] (PC Drivers HeadQuarters LP) R2 EpsonCustomerResearchParticipation; C:\Program Files\EPSON\EpsonCustomerResearchParticipation\EPCP.exe [677880 2017-04-25] (SEIKO EPSON CORPORATION) R2 EpsonScanSvc; C:\WINDOWS\system32\EscSvc64.exe [144560 2012-05-17] (Seiko Epson Corporation) R2 esifsvc; C:\WINDOWS\system32\Intel\DPTF\esif_uf.exe [2223864 2017-01-05] (Intel Corporation) R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [17976 2016-09-20] (Intel Corporation) R2 ibtsiva; C:\WINDOWS\system32\ibtsiva.exe [190216 2016-10-15] (Intel Corporation) R3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [974632 2016-02-19] (Intel(R) Corporation) S3 Intel(R) Security Assist; C:\Program Files (x86)\Intel\Intel(R) Security Assist\isa.exe [335872 2016-03-02] (Intel Corporation) [File not signed] R2 isaHelperSvc; C:\Program Files (x86)\Intel\Intel(R) Security Assist\isaHelperService.exe [8704 2016-03-02] (Intel Corporation) [File not signed] R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [215328 2016-05-16] (Intel Corporation) R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6234056 2017-11-01] (Malwarebytes) [File not signed] S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [268704 2017-02-13] () R2 Nanoheal Client; C:\Program Files\Nanoheal\Client\srvc.exe [104848 2016-12-26] (Nanoheal) R2 Product Registration; C:\Program Files\Dell\Dell Product Registration\PRSvc.exe [47144 2017-04-06] (Dell) R2 QBCFMonitorService; C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe [45056 2016-03-07] (Intuit) [File not signed] S3 QBFCService; C:\Program Files (x86)\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe [65536 2016-03-07] (Intuit Inc.) [File not signed] R2 QBVSS; C:\Program Files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe [1248256 2016-03-07] (Intuit Inc.) [File not signed] R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [333264 2017-06-09] (Realtek Semiconductor) R2 SupportAssistAgent; C:\Program Files\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe [41432 2017-12-22] (Dell Inc.) R2 WavesSysSvc; C:\Program Files\Waves\MaxxAudio\WavesSysSvc64.exe [592776 2017-05-08] (Waves Audio Ltd.) S3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18011-0\NisSrv.exe [356168 2018-01-20] (Microsoft Corporation) S3 WinDefend; C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18011-0\MsMpEng.exe [105792 2018-01-20] (Microsoft Corporation) R2 WinDefender; C:\WINDOWS\windefender.exe [1377280 2018-02-21] () R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3743648 2017-02-13] (Intel® Corporation) S2 dbupdate; "C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /svc [X] S3 dbupdatem; "C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /medsvc [X] S2 DbxSvc; %SystemRoot%\system32\DbxSvc.exe [X] ===================== Drivers (Whitelisted) ====================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R3 DDDriver; C:\WINDOWS\system32\drivers\DDDriver64Dcsa.sys [41608 2017-12-14] (Dell Inc.) R3 DellProf; C:\WINDOWS\system32\drivers\DellProf.sys [41208 2017-12-14] (Dell Computer Corporation) R2 DpmLiteDrv; c:\Program Files\Dell\QuickSet\DpmLiteDrv64.sys [15080 2014-10-15] (Wistron Corp.) R3 dptf_acpi; C:\WINDOWS\System32\drivers\dptf_acpi.sys [79928 2017-01-05] (Intel Corporation) R3 dptf_cpu; C:\WINDOWS\System32\drivers\dptf_cpu.sys [75320 2017-01-05] (Intel Corporation) R3 esif_lf; C:\WINDOWS\system32\DRIVERS\esif_lf.sys [358968 2017-01-05] (Intel Corporation) R3 HidEventFilter; C:\WINDOWS\System32\drivers\HidEventFilter.sys [63496 2017-01-12] (Intel Corporation) R3 HID_PCI; C:\WINDOWS\System32\drivers\HID_PCI.sys [30816 2016-05-24] (Intel) R3 ibtusb; C:\WINDOWS\system32\DRIVERS\ibtusb.sys [250624 2016-10-15] (Intel Corporation) R3 ISH; C:\WINDOWS\System32\drivers\ISH.sys [140896 2016-06-05] (Intel) R3 ISH_BusDriver; C:\WINDOWS\System32\drivers\ISH_BusDriver.sys [78432 2016-06-08] (Intel) R3 Netwtw04; C:\WINDOWS\System32\drivers\Netwtw04.sys [7689728 2017-09-29] (Intel Corporation) S3 RTSUER; C:\WINDOWS\system32\Drivers\RtsUer.sys [413912 2015-12-22] (Realsil Semiconductor Corporation) R3 rtsuvc; C:\WINDOWS\system32\DRIVERS\rtsuvc.sys [3149824 2016-11-14] (Realtek Semiconductor Corp.) S3 tapoas; C:\WINDOWS\System32\drivers\tapoas.sys [27136 2016-04-21] (The OpenVPN Project) R3 VirtualButtons; C:\WINDOWS\System32\drivers\VirtualButtons.sys [41992 2017-03-31] (Intel Corporation) S3 WdBoot; C:\WINDOWS\system32\drivers\wd\WdBoot.sys [46072 2018-01-20] (Microsoft Corporation) S3 WdFilter; C:\WINDOWS\system32\drivers\wd\WdFilter.sys [288848 2018-01-20] (Microsoft Corporation) S3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [129616 2018-01-20] (Microsoft Corporation) S3 qttttw; system32\drivers\jnnnqq.sys [X] R3 svybfi; system32\drivers\ybeilo.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One Month Created files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2018-02-21 23:10 - 2018-02-21 23:10 - 000036384 _____ C:\Users\grant\Downloads\FRST.txt 2018-02-21 23:10 - 2018-02-21 23:10 - 000000000 ____D C:\FRST 2018-02-21 23:09 - 2018-02-21 23:09 - 002403328 _____ (Farbar) C:\Users\grant\Downloads\FRST64.exe 2018-02-21 23:08 - 2018-02-21 23:08 - 001763328 _____ (Farbar) C:\Users\grant\Downloads\FRST.exe 2018-02-21 22:52 - 2018-02-21 22:52 - 000143184 ____N C:\WINDOWS\system32\Drivers\avdtwzgj.sys 2018-02-21 17:23 - 2018-02-21 17:23 - 000072280 _____ () C:\WINDOWS\system32\Drivers\rmiigeup.sys 2018-02-21 17:23 - 2018-02-21 17:23 - 000000000 ____D C:\Users\grant\AppData\Roaming\SystemHealer 2018-02-21 17:23 - 2018-02-21 17:23 - 000000000 ____D C:\Users\grant\AppData\Roaming\FastDataX 2018-02-21 17:23 - 2018-02-21 17:23 - 000000000 ____D C:\Program Files (x86)\ProxyGate 2018-02-21 17:23 - 2018-02-21 17:23 - 000000000 ____D C:\Program Files (x86)\FastDataX 2018-02-21 17:22 - 2018-02-21 17:22 - 000930816 _____ C:\Users\grant\AppData\Local\po.db 2018-02-21 17:22 - 2018-02-21 17:22 - 000140800 _____ C:\Users\grant\AppData\Local\installer.dat 2018-02-21 17:22 - 2018-02-21 17:22 - 000016892 _____ C:\WINDOWS\System32\Tasks\Multimedia Video Converter 2018-02-21 17:22 - 2018-02-21 17:22 - 000011568 _____ C:\Users\grant\AppData\Local\InstallationConfiguration.xml 2018-02-21 17:22 - 2018-02-21 17:22 - 000000000 ____D C:\ProgramData\18ed170d81ad45d7901979a88d26bb87 2018-02-21 13:40 - 2018-02-21 13:40 - 000000000 ____D C:\Users\grant\AppData\Roaming\f35fcca1221b468983f998bbdb1e5d0a 2018-02-21 13:40 - 2018-02-21 13:40 - 000000000 ____D C:\Users\grant\AppData\Local\323aee8b6afa4fc0b0022cca60eb4f2b 2018-02-21 13:36 - 2018-02-21 13:36 - 001245956 _____ C:\WINDOWS\Minidump\022118-7921-01.dmp 2018-02-21 13:31 - 2018-02-21 13:31 - 000000000 ____D C:\Users\grant\AppData\Local\a7a2f4ab703f41038c1032ac2f7e9b4a 2018-02-21 13:31 - 2018-02-21 13:31 - 000000000 ____D C:\ProgramData\e854148845974cf3a80cfe0456b50280 2018-02-21 13:30 - 2018-02-21 13:30 - 001358820 _____ C:\WINDOWS\Minidump\022118-8046-01.dmp 2018-02-21 04:18 - 2018-02-21 04:19 - 000002095 _____ C:\Users\Public\Desktop\mlb.lnk 2018-02-21 04:18 - 2018-02-21 04:18 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes 2018-02-21 04:18 - 2018-02-21 04:18 - 000000000 ____D C:\ProgramData\Malwarebytes 2018-02-21 04:18 - 2017-11-29 09:11 - 000077432 _____ C:\WINDOWS\system32\Drivers\mbae64.sys 2018-02-21 03:52 - 2018-02-21 04:25 - 000000001 _____ C:\ProgramData\SRTCTUacSts.txt 2018-02-21 03:51 - 2018-02-21 22:49 - 000000000 ____D C:\Users\grant\AppData\Local\CrashDumps 2018-02-21 03:51 - 2018-02-21 03:51 - 000001831 _____ C:\Users\Public\Desktop\Nanoheal Client.lnk 2018-02-21 03:51 - 2018-02-21 03:51 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nanoheal Client 2018-02-21 03:51 - 2018-02-21 03:51 - 000000000 ____D C:\Program Files\Nanoheal 2018-02-21 03:50 - 2018-02-21 03:50 - 067961984 _____ (Malwarebytes ) C:\Users\grant\Downloads\baseball.exe 2018-02-21 03:45 - 2018-02-21 03:45 - 000000000 ____D C:\Users\grant\AppData\Roaming\EpicNet Inc 2018-02-21 03:33 - 2018-02-21 03:46 - 389361840 _____ (AVG Technologies CZ, s.r.o.) C:\Users\grant\Downloads\AVG_Ultimate_x64_1828 (1).exe 2018-02-21 03:17 - 2018-02-21 03:17 - 000752296 _____ C:\Users\grant\Downloads\Adware Removal Tool by TSA.exe 2018-02-21 03:17 - 2018-02-21 03:17 - 000290304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\subinacl.exe 2018-02-21 03:17 - 2018-02-21 03:17 - 000000000 ____D C:\Program Files (x86)\Adware Removal Tool by TSA 2018-02-21 02:08 - 2018-02-21 17:32 - 000028272 _____ C:\WINDOWS\system32\Drivers\TrueSight.sys 2018-02-21 02:08 - 2018-02-21 03:17 - 000000000 ____D C:\ProgramData\RogueKiller 2018-02-21 02:08 - 2018-02-21 02:08 - 000000901 _____ C:\Users\Public\Desktop\RogueKiller.lnk 2018-02-21 02:08 - 2018-02-21 02:08 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RogueKiller 2018-02-21 02:08 - 2018-02-21 02:08 - 000000000 ____D C:\Program Files\RogueKiller 2018-02-21 02:07 - 2018-02-21 02:07 - 036470472 _____ (Adlice Software ) C:\Users\grant\Downloads\RogueKiller_setup_ref3.exe 2018-02-21 01:44 - 2018-02-21 01:52 - 389361840 _____ (AVG Technologies CZ, s.r.o.) C:\Users\grant\Downloads\AVG_Ultimate_x64_1828.exe 2018-02-21 01:38 - 2018-02-21 01:38 - 003647592 _____ (AVG Technologies CZ, s.r.o.) C:\Users\grant\Downloads\AVG_Ultimate_826.exe 2018-02-21 01:31 - 2018-02-21 01:31 - 000000023 _____ C:\Users\grant\Desktop\avg.txt 2018-02-21 01:05 - 2018-02-21 01:05 - 000000000 ____D C:\WINDOWS\pss 2018-02-21 00:56 - 2018-02-21 00:56 - 000000000 ____D C:\Users\grant\AppData\Roaming\Hard Disk Sentinel 2018-02-21 00:55 - 2018-02-21 00:56 - 000000000 ____D C:\Users\grant\Downloads\hdsentinel_pro_portable 2018-02-21 00:46 - 2018-02-21 00:46 - 027262214 _____ C:\Users\grant\Downloads\hdsentinel_pro_portable.zip 2018-02-21 00:43 - 2018-02-21 00:43 - 000000756 _____ C:\Users\grant\Desktop\Documents - Shortcut.lnk 2018-02-21 00:40 - 2018-02-21 00:40 - 002118144 _____ (AVG Technologies CZ) C:\Users\grant\Downloads\AutoExec.exe 2018-02-21 00:40 - 2018-02-21 00:40 - 002118144 _____ (AVG Technologies CZ) C:\Users\grant\Downloads\AutoExec (1).exe 2018-02-21 00:31 - 2018-02-21 00:31 - 000000000 ____D C:\Users\grant\AppData\Local\GoToAssist Corporate 2018-02-21 00:31 - 2018-02-21 00:31 - 000000000 ____D C:\Program Files (x86)\LogMeIn 2018-02-21 00:19 - 2018-02-21 00:20 - 007306280 _____ (AVG Technologies CZ, s.r.o.) C:\Users\grant\Downloads\avg_antivirus_free_setup_w2b.exe 2018-02-20 23:52 - 2018-02-20 23:52 - 067961984 _____ (Malwarebytes ) C:\Users\grant\Downloads\mb3-setup-consumer-3.3.1.2183-1.0.262-1.0.4014.exe 2018-02-20 23:52 - 2018-02-20 23:52 - 000000000 ____D C:\Program Files\Malwarebytes 2018-02-20 23:14 - 2018-02-20 23:14 - 000072280 _____ () C:\WINDOWS\system32\Drivers\aeukxhjp.sys 2018-02-20 23:14 - 2018-02-20 23:14 - 000016880 _____ C:\WINDOWS\System32\Tasks\GalaxyTebusSpring Builder 2018-02-20 23:09 - 2018-02-20 23:09 - 000000000 _____ C:\WINDOWS\EEventManager.INI 2018-02-20 21:59 - 2018-02-20 21:59 - 000072280 _____ () C:\WINDOWS\system32\Drivers\qkgaujmc.sys 2018-02-20 21:59 - 2018-02-20 21:59 - 000016842 _____ C:\WINDOWS\System32\Tasks\Enhanced Paradise 2018-02-20 21:58 - 2018-02-21 03:16 - 000000000 ____D C:\Users\grant\AppData\Roaming\a5698d859cd94d51b95d52a008ac289a 2018-02-20 21:58 - 2018-02-21 03:16 - 000000000 ____D C:\ProgramData\078d7aee85c442e39516c70c1b9f8dfa 2018-02-20 21:56 - 2018-02-21 13:36 - 1136723935 _____ C:\WINDOWS\MEMORY.DMP 2018-02-20 21:56 - 2018-02-21 13:36 - 000000000 ____D C:\WINDOWS\Minidump 2018-02-20 21:56 - 2018-02-20 21:56 - 001368268 _____ C:\WINDOWS\Minidump\022018-9015-01.dmp 2018-02-20 21:47 - 2018-02-21 23:10 - 000000000 ____D C:\Users\grant\AppData\Local\sehzmxi 2018-02-20 21:46 - 2018-02-21 04:15 - 001377280 ____H C:\WINDOWS\windefender.exe 2018-02-20 21:45 - 2018-02-20 21:45 - 003174912 _____ C:\WINDOWS\winsrv.exe 2018-02-20 21:44 - 2018-02-20 21:44 - 000556032 _____ (www.update.com) C:\ProgramData\MicrosoftUpd.exe 2018-02-20 21:44 - 2018-02-20 21:44 - 000000000 ___HD C:\WINDOWS\rss 2018-02-20 21:42 - 2018-02-20 21:42 - 000000000 ____D C:\ProgramData\122749b6-6991-1 2018-02-20 21:42 - 2018-02-20 21:42 - 000000000 ____D C:\ProgramData\122749b6-33e5-0 2018-02-20 21:41 - 2018-02-21 23:08 - 000000000 ____D C:\Users\grant\AppData\Local\csnbvou 2018-02-20 21:41 - 2018-02-20 21:44 - 000000000 ____D C:\Users\grant\AppData\Local\zaeidng 2018-02-20 21:41 - 2018-02-20 21:41 - 000016908 _____ C:\WINDOWS\System32\Tasks\Pinber ImGame Access Database 2018-02-20 21:40 - 2018-02-21 22:52 - 002888704 _____ (TOSHIBA CORPORATION) C:\WINDOWS\system32\ninbaugsvc.exe 2018-02-20 21:40 - 2018-02-21 17:25 - 000000103 _____ C:\WINDOWS\SysWOW64\del.bat 2018-02-20 21:40 - 2018-02-21 03:10 - 000000003 _____ C:\ProgramData\updater.txt 2018-02-20 21:40 - 2018-02-20 23:14 - 000000000 ____D C:\ProgramData\updater 2018-02-20 21:40 - 2018-02-20 21:41 - 000000012 _____ C:\WINDOWS\b24382178 2018-02-20 21:40 - 2018-02-20 21:40 - 000072280 _____ () C:\WINDOWS\system32\Drivers\ghtrmljy.sys 2018-02-20 21:40 - 2018-02-20 21:40 - 000003924 _____ C:\WINDOWS\System32\Tasks\practicing-generator 2018-02-20 21:40 - 2018-02-20 21:40 - 000003878 _____ C:\WINDOWS\System32\Tasks\bearing_equip 2018-02-20 21:40 - 2018-02-20 21:40 - 000003860 _____ C:\WINDOWS\System32\Tasks\find tempera 2018-02-20 21:40 - 2018-02-20 21:40 - 000003860 _____ C:\WINDOWS\System32\Tasks\capitulate 2018-02-20 21:40 - 2018-02-20 21:40 - 000003844 _____ C:\WINDOWS\System32\Tasks\fawcett 2018-02-20 21:40 - 2018-02-20 21:40 - 000003820 _____ C:\WINDOWS\System32\Tasks\tspracticing-generatorpracticing-generator 2018-02-20 21:40 - 2018-02-20 21:40 - 000003758 _____ C:\WINDOWS\System32\Tasks\tsbearing_equipbearing_equip 2018-02-20 21:40 - 2018-02-20 21:40 - 000003742 _____ C:\WINDOWS\System32\Tasks\tsfind temperafind tempera 2018-02-20 21:40 - 2018-02-20 21:40 - 000003738 _____ C:\WINDOWS\System32\Tasks\tscapitulatecapitulate 2018-02-20 21:40 - 2018-02-20 21:40 - 000003714 _____ C:\WINDOWS\System32\Tasks\tsfawcettfawcett 2018-02-20 21:40 - 2018-02-20 21:40 - 000000000 ___HD C:\Program Files (x86)\objectification 2018-02-20 21:40 - 2018-02-20 21:40 - 000000000 ____D C:\Users\grant\AppData\Local\xpacztdvn 2018-02-20 21:39 - 2018-02-21 22:53 - 000000258 __RSH C:\ProgramData\ntuser.pol 2018-02-20 21:39 - 2018-02-21 03:16 - 000000000 ____D C:\Users\grant\AppData\Local\97f13a6f79d240209ab5bc6ab603bf83 2018-02-20 21:39 - 2018-02-21 03:16 - 000000000 ____D C:\ProgramData\8db7e0383e114f738eccacf7e5b78f60 2018-02-20 21:39 - 2018-02-20 21:39 - 018514008 _____ ( ) C:\Users\grant\AppData\Roaming\mysetup.exe 2018-02-20 21:39 - 2018-02-20 21:39 - 000016754 _____ C:\WINDOWS\System32\Tasks\Tabs 2018-02-20 21:39 - 2018-02-20 21:39 - 000012800 _____ C:\Users\grant\AppData\Local\achpow.dll 2018-02-20 21:39 - 2018-02-20 21:39 - 000000000 ____D C:\WINDOWS\SysWOW64\auhmzoc 2018-02-20 21:39 - 2018-02-20 21:39 - 000000000 ____D C:\WINDOWS\system32\auhmzoc 2018-02-20 21:39 - 2018-02-20 21:39 - 000000000 ____D C:\Users\grant\AppData\Roaming\et 2018-02-20 21:39 - 2018-02-20 21:39 - 000000000 ____D C:\ProgramData\1519187963 2018-02-20 21:38 - 2018-02-21 03:16 - 000000000 ____D C:\Users\grant\AppData\Local\d5839d84931d49d1ae5d62c133fd9120 2018-02-20 21:13 - 2018-02-20 21:13 - 000003414 _____ C:\WINDOWS\System32\Tasks\AGProxyCheck 2018-02-20 21:11 - 2018-02-20 21:11 - 000084086 _____ C:\Users\grant\Downloads\20170728 A Priori.pdf 2018-02-20 00:46 - 2018-02-20 00:46 - 000041472 _____ C:\WINDOWS\meets.exe 2018-02-16 23:16 - 2018-02-20 19:23 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd 2018-02-16 10:18 - 2018-02-16 10:18 - 000001748 _____ C:\Users\grant\Downloads\FBA15BV691VK.tsv 2018-02-14 21:30 - 2018-02-14 21:30 - 000003628 _____ C:\WINDOWS\System32\Tasks\[removed] 2018-02-13 21:38 - 2018-02-09 23:24 - 000270744 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll 2018-02-13 21:38 - 2018-02-09 23:23 - 001577880 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll 2018-02-13 21:38 - 2018-02-09 23:23 - 000758168 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll 2018-02-13 21:38 - 2018-02-09 23:23 - 000613272 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll 2018-02-13 21:38 - 2018-02-09 23:23 - 000138136 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe 2018-02-13 21:38 - 2018-02-09 23:22 - 002003352 _____ (Microsoft Corporation) C:\WINDOWS\system32\aitstatic.exe 2018-02-13 21:38 - 2018-02-09 23:22 - 000662936 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll 2018-02-13 21:38 - 2018-02-09 23:22 - 000460696 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcntel.dll 2018-02-13 21:38 - 2018-02-09 23:22 - 000387480 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll 2018-02-13 21:38 - 2018-02-09 23:22 - 000272800 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll 2018-02-13 21:38 - 2018-02-09 23:22 - 000070040 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32appinventorycsp.dll 2018-02-13 21:38 - 2018-02-09 23:22 - 000035224 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceCensus.exe 2018-02-13 21:38 - 2018-02-09 23:21 - 001092016 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi 2018-02-13 21:38 - 2018-02-09 23:21 - 000479912 _____ (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase_enclave.dll 2018-02-13 21:38 - 2018-02-09 23:21 - 000279456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msiscsi.sys 2018-02-13 21:38 - 2018-02-09 23:20 - 001206680 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe 2018-02-13 21:38 - 2018-02-09 23:20 - 001055640 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe 2018-02-13 21:38 - 2018-02-09 23:20 - 000924648 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe 2018-02-13 21:38 - 2018-02-09 23:20 - 000599448 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe 2018-02-13 21:38 - 2018-02-09 23:20 - 000077208 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.dll 2018-02-13 21:38 - 2018-02-09 23:19 - 001133888 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVP9DEC.dll 2018-02-13 21:38 - 2018-02-09 23:18 - 001193192 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepositoryPS.dll 2018-02-13 21:38 - 2018-02-09 23:18 - 000319864 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64.dll 2018-02-13 21:38 - 2018-02-09 23:18 - 000098272 _____ (Microsoft Corporation) C:\WINDOWS\system32\FsIso.exe 2018-02-13 21:38 - 2018-02-09 23:18 - 000022400 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64cpu.dll 2018-02-13 21:38 - 2018-02-09 23:17 - 001209240 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe 2018-02-13 21:38 - 2018-02-09 23:16 - 008603032 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe 2018-02-13 21:38 - 2018-02-09 23:16 - 002406456 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2vdec.dll 2018-02-13 21:38 - 2018-02-09 23:16 - 000739696 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsapi.dll 2018-02-13 21:38 - 2018-02-09 23:15 - 002514944 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll 2018-02-13 21:38 - 2018-02-09 23:15 - 001954048 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll 2018-02-13 21:38 - 2018-02-09 23:15 - 001415296 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi 2018-02-13 21:38 - 2018-02-09 23:15 - 000471968 _____ (Microsoft Corporation) C:\WINDOWS\system32\hal.dll 2018-02-13 21:38 - 2018-02-09 23:14 - 004504464 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe 2018-02-13 21:38 - 2018-02-09 23:14 - 002395032 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys 2018-02-13 21:38 - 2018-02-09 23:14 - 001002592 _____ (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase.dll 2018-02-13 21:38 - 2018-02-09 23:13 - 001416392 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3D12.dll 2018-02-13 21:38 - 2018-02-09 23:13 - 000535960 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netio.sys 2018-02-13 21:38 - 2018-02-09 23:13 - 000408984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys 2018-02-13 21:38 - 2018-02-09 23:13 - 000373656 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys 2018-02-13 21:38 - 2018-02-09 23:12 - 004537040 _____ (Microsoft Corporation) C:\WINDOWS\system32\setupapi.dll 2018-02-13 21:38 - 2018-02-09 23:12 - 001313016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Taskmgr.exe 2018-02-13 21:38 - 2018-02-09 23:12 - 001277848 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys 2018-02-13 21:38 - 2018-02-09 23:12 - 000712600 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys 2018-02-13 21:38 - 2018-02-09 23:11 - 001029528 _____ (Microsoft Corporation) C:\WINDOWS\system32\efscore.dll 2018-02-13 21:38 - 2018-02-09 23:11 - 000711432 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll 2018-02-13 21:38 - 2018-02-09 23:11 - 000677784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys 2018-02-13 21:38 - 2018-02-09 23:11 - 000494496 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcasvc.dll 2018-02-13 21:38 - 2018-02-09 23:10 - 002447768 _____ (Microsoft Corporation) C:\WINDOWS\system32\UpdateAgent.dll 2018-02-13 21:38 - 2018-02-09 23:10 - 000749976 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys 2018-02-13 21:38 - 2018-02-09 23:10 - 000614160 _____ (Microsoft Corporation) C:\WINDOWS\system32\StateRepository.Core.dll 2018-02-13 21:38 - 2018-02-09 23:10 - 000246168 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll 2018-02-13 21:38 - 2018-02-09 23:10 - 000154520 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepositoryClient.dll 2018-02-13 21:38 - 2018-02-09 23:09 - 003904296 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe 2018-02-13 21:38 - 2018-02-09 23:09 - 000755712 _____ (Microsoft Corporation) C:\WINDOWS\system32\evr.dll 2018-02-13 21:38 - 2018-02-09 23:09 - 000525208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wimserv.exe 2018-02-13 21:38 - 2018-02-09 23:09 - 000491264 _____ (Microsoft Corporation) C:\WINDOWS\system32\policymanager.dll 2018-02-13 21:38 - 2018-02-09 23:09 - 000075160 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecurityHealthProxyStub.dll 2018-02-13 21:38 - 2018-02-09 23:08 - 021351624 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll 2018-02-13 21:38 - 2018-02-09 23:08 - 007675784 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll 2018-02-13 21:38 - 2018-02-09 23:08 - 003010248 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d11.dll 2018-02-13 21:38 - 2018-02-09 23:08 - 002574232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys 2018-02-13 21:38 - 2018-02-09 23:08 - 000687552 _____ (Microsoft Corporation) C:\WINDOWS\system32\StructuredQuery.dll 2018-02-13 21:38 - 2018-02-09 23:08 - 000398824 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlows.exe 2018-02-13 21:38 - 2018-02-09 23:08 - 000096200 _____ (Microsoft Corporation) C:\WINDOWS\system32\winbrand.dll 2018-02-13 21:38 - 2018-02-09 23:08 - 000048112 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe 2018-02-13 21:38 - 2018-02-09 23:07 - 004506576 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll 2018-02-13 21:38 - 2018-02-09 23:07 - 002710728 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll 2018-02-13 21:38 - 2018-02-09 23:07 - 000705944 _____ (Microsoft Corporation) C:\WINDOWS\system32\wimgapi.dll 2018-02-13 21:38 - 2018-02-09 23:07 - 000436632 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHostCommon.dll 2018-02-13 21:38 - 2018-02-09 23:06 - 004486904 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepository.dll 2018-02-13 21:38 - 2018-02-09 23:06 - 000824896 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipSVC.dll 2018-02-13 21:38 - 2018-02-09 23:06 - 000727448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fvevol.sys 2018-02-13 21:38 - 2018-02-09 23:06 - 000594048 _____ (Microsoft Corporation) C:\WINDOWS\system32\mf.dll 2018-02-13 21:38 - 2018-02-09 23:06 - 000519144 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecurityHealthService.exe 2018-02-13 21:38 - 2018-02-09 23:06 - 000494488 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb.sys 2018-02-13 21:38 - 2018-02-09 23:06 - 000362904 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pci.sys 2018-02-13 21:38 - 2018-02-09 23:06 - 000356952 _____ (Microsoft Corporation) C:\WINDOWS\system32\wintrust.dll 2018-02-13 21:38 - 2018-02-09 23:06 - 000189336 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecurityHealthAgent.dll 2018-02-13 21:38 - 2018-02-09 23:06 - 000100248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepositoryBroker.dll 2018-02-13 21:38 - 2018-02-09 23:06 - 000087384 _____ (Microsoft Corporation) C:\WINDOWS\system32\remoteaudioendpoint.dll 2018-02-13 21:38 - 2018-02-09 23:05 - 000688064 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll 2018-02-13 21:38 - 2018-02-09 23:05 - 000413888 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll 2018-02-13 21:38 - 2018-02-09 23:05 - 000097176 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdstor.sys 2018-02-13 21:38 - 2018-02-09 23:05 - 000070856 _____ (Microsoft Corporation) C:\WINDOWS\system32\wldp.dll 2018-02-13 21:38 - 2018-02-09 23:04 - 007384576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll 2018-02-13 21:38 - 2018-02-09 23:04 - 006791984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll 2018-02-13 21:38 - 2018-02-09 23:04 - 001430760 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcMon.exe 2018-02-13 21:38 - 2018-02-09 23:04 - 001426672 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll 2018-02-13 21:38 - 2018-02-09 23:04 - 001254144 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll 2018-02-13 21:38 - 2018-02-09 23:04 - 001170008 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll 2018-02-13 21:38 - 2018-02-09 23:04 - 000614296 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\afd.sys 2018-02-13 21:38 - 2018-02-09 23:04 - 000603920 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe 2018-02-13 21:38 - 2018-02-09 23:04 - 000374032 _____ (Microsoft Corporation) C:\WINDOWS\system32\vac.exe 2018-02-13 21:38 - 2018-02-09 23:04 - 000339872 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkBindingEngineMigPlugin.dll 2018-02-13 21:38 - 2018-02-09 23:04 - 000260896 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll 2018-02-13 21:38 - 2018-02-09 23:04 - 000212880 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsensorgroup.dll 2018-02-13 21:38 - 2018-02-09 23:04 - 000093592 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll 2018-02-13 21:38 - 2018-02-09 23:03 - 001619808 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll 2018-02-13 21:38 - 2018-02-09 23:03 - 000849304 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicensingWinRT.dll 2018-02-13 21:38 - 2018-02-09 23:03 - 000722616 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppwinob.dll 2018-02-13 21:38 - 2018-02-09 23:03 - 000706600 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditionUpgradeManagerObj.dll 2018-02-13 21:38 - 2018-02-09 23:03 - 000404888 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHost.dll 2018-02-13 21:38 - 2018-02-09 23:03 - 000098712 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceReactivation.dll 2018-02-13 21:38 - 2018-02-09 23:02 - 002773400 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys 2018-02-13 21:38 - 2018-02-09 23:02 - 001103768 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\http.sys 2018-02-13 21:38 - 2018-02-09 23:02 - 000628632 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvcp_win.dll 2018-02-13 21:38 - 2018-02-09 23:02 - 000617304 _____ (Microsoft Corporation) C:\WINDOWS\system32\TextInputFramework.dll 2018-02-13 21:38 - 2018-02-09 22:22 - 001930224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll 2018-02-13 21:38 - 2018-02-09 22:21 - 001615712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll 2018-02-13 21:38 - 2018-02-09 22:18 - 001384288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVP9DEC.dll 2018-02-13 21:38 - 2018-02-09 22:17 - 002255112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2vdec.dll 2018-02-13 21:38 - 2018-02-09 22:17 - 000597160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dnsapi.dll 2018-02-13 21:38 - 2018-02-09 22:17 - 000542856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepositoryPS.dll 2018-02-13 21:38 - 2018-02-09 22:17 - 000211864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aepic.dll 2018-02-13 21:38 - 2018-02-09 22:15 - 001145624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ucrtbase.dll 2018-02-13 21:38 - 2018-02-09 22:12 - 004382032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\setupapi.dll 2018-02-13 21:38 - 2018-02-09 22:11 - 001250528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Taskmgr.exe 2018-02-13 21:38 - 2018-02-09 22:10 - 000422592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\policymanager.dll 2018-02-13 21:38 - 2018-02-09 22:09 - 006092152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll 2018-02-13 21:38 - 2018-02-09 22:09 - 003485392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe 2018-02-13 21:38 - 2018-02-09 22:09 - 002338776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11.dll 2018-02-13 21:38 - 2018-02-09 22:09 - 001123456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3D12.dll 2018-02-13 21:38 - 2018-02-09 22:09 - 000559976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StructuredQuery.dll 2018-02-13 21:38 - 2018-02-09 22:09 - 000354200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CloudExperienceHostCommon.dll 2018-02-13 21:38 - 2018-02-09 22:08 - 003980720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepository.dll 2018-02-13 21:38 - 2018-02-09 22:08 - 002193168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll 2018-02-13 21:38 - 2018-02-09 22:08 - 000592792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wimgapi.dll 2018-02-13 21:38 - 2018-02-09 22:07 - 025253376 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll 2018-02-13 21:38 - 2018-02-09 22:07 - 020286120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll 2018-02-13 21:38 - 2018-02-09 22:07 - 000543920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll 2018-02-13 21:38 - 2018-02-09 22:07 - 000527864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StateRepository.Core.dll 2018-02-13 21:38 - 2018-02-09 22:07 - 000284112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wintrust.dll 2018-02-13 21:38 - 2018-02-09 22:07 - 000123808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepositoryClient.dll 2018-02-13 21:38 - 2018-02-09 22:07 - 000089504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepositoryBroker.dll 2018-02-13 21:38 - 2018-02-09 22:07 - 000083216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winbrand.dll 2018-02-13 21:38 - 2018-02-09 22:07 - 000061024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wldp.dll 2018-02-13 21:38 - 2018-02-09 22:06 - 006481640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll 2018-02-13 21:38 - 2018-02-09 22:06 - 006014688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll 2018-02-13 21:38 - 2018-02-09 22:06 - 004670728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll 2018-02-13 21:38 - 2018-02-09 22:06 - 000982528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll 2018-02-13 21:38 - 2018-02-09 22:05 - 001246432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll 2018-02-13 21:38 - 2018-02-09 22:05 - 001149272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll 2018-02-13 21:38 - 2018-02-09 22:05 - 000718232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicensingWinRT.dll 2018-02-13 21:38 - 2018-02-09 22:05 - 000662208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\evr.dll 2018-02-13 21:38 - 2018-02-09 22:05 - 000654456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EditionUpgradeManagerObj.dll 2018-02-13 21:38 - 2018-02-09 22:05 - 000551672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mf.dll 2018-02-13 21:38 - 2018-02-09 22:05 - 000386424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll 2018-02-13 21:38 - 2018-02-09 22:05 - 000193248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsensorgroup.dll 2018-02-13 21:38 - 2018-02-09 22:05 - 000129184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfps.dll 2018-02-13 21:38 - 2018-02-09 22:05 - 000079256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DeviceReactivation.dll 2018-02-13 21:38 - 2018-02-09 22:05 - 000077552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CloudNotifications.exe 2018-02-13 21:38 - 2018-02-09 22:05 - 000074992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\remoteaudioendpoint.dll 2018-02-13 21:38 - 2018-02-09 22:03 - 000505160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcp_win.dll 2018-02-13 21:38 - 2018-02-09 21:50 - 003665408 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys 2018-02-13 21:38 - 2018-02-09 21:50 - 001313792 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallService.dll 2018-02-13 21:38 - 2018-02-09 21:50 - 001294848 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll 2018-02-13 21:38 - 2018-02-09 21:50 - 000849920 _____ (Microsoft Corporation) C:\WINDOWS\system32\uDWM.dll 2018-02-13 21:38 - 2018-02-09 21:50 - 000496128 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatehandlers.dll 2018-02-13 21:38 - 2018-02-09 21:49 - 001664512 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll 2018-02-13 21:38 - 2018-02-09 21:49 - 000848896 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll 2018-02-13 21:38 - 2018-02-09 21:49 - 000536576 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgeIso.dll 2018-02-13 21:38 - 2018-02-09 21:49 - 000385536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cldflt.sys 2018-02-13 21:38 - 2018-02-09 21:49 - 000329728 _____ (Microsoft Corporation) C:\WINDOWS\system32\AcGenral.dll 2018-02-13 21:38 - 2018-02-09 21:49 - 000326656 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe 2018-02-13 21:38 - 2018-02-09 21:49 - 000232960 _____ (Microsoft Corporation) C:\WINDOWS\system32\convertvhd.exe 2018-02-13 21:38 - 2018-02-09 21:49 - 000211456 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotificationUx.exe 2018-02-13 21:38 - 2018-02-09 21:49 - 000107520 _____ (Microsoft Corporation) C:\WINDOWS\system32\musdialoghandlers.dll 2018-02-13 21:38 - 2018-02-09 21:48 - 002890240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.dll 2018-02-13 21:38 - 2018-02-09 21:48 - 000033280 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mskssrv.sys 2018-02-13 21:38 - 2018-02-09 21:48 - 000025088 _____ (Microsoft Corporation) C:\WINDOWS\system32\EnterpriseAppMgmtClient.dll 2018-02-13 21:38 - 2018-02-09 21:47 - 017160704 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll 2018-02-13 21:38 - 2018-02-09 21:47 - 013704192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll 2018-02-13 21:38 - 2018-02-09 21:47 - 000331264 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserexport.exe 2018-02-13 21:38 - 2018-02-09 21:47 - 000201728 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeManager.dll 2018-02-13 21:38 - 2018-02-09 21:47 - 000201216 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedPCCSP.dll 2018-02-13 21:38 - 2018-02-09 21:47 - 000143872 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssprxy.dll 2018-02-13 21:38 - 2018-02-09 21:47 - 000140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll 2018-02-13 21:38 - 2018-02-09 21:47 - 000055808 _____ (Microsoft Corporation) C:\WINDOWS\system32\virtdisk.dll 2018-02-13 21:38 - 2018-02-09 21:47 - 000046080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidparse.sys 2018-02-13 21:38 - 2018-02-09 21:47 - 000043520 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcimage.dll 2018-02-13 21:38 - 2018-02-09 21:47 - 000033792 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll 2018-02-13 21:38 - 2018-02-09 21:47 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\system32\tzres.dll 2018-02-13 21:38 - 2018-02-09 21:46 - 002902528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys 2018-02-13 21:38 - 2018-02-09 21:46 - 002393600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AcGenral.dll 2018-02-13 21:38 - 2018-02-09 21:46 - 001470976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll 2018-02-13 21:38 - 2018-02-09 21:46 - 001008640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallService.dll 2018-02-13 21:38 - 2018-02-09 21:46 - 000344576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgeIso.dll 2018-02-13 21:38 - 2018-02-09 21:46 - 000225792 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\winnat.sys 2018-02-13 21:38 - 2018-02-09 21:46 - 000199168 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDeviceRegistration.dll 2018-02-13 21:38 - 2018-02-09 21:46 - 000173568 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepositoryUpgrade.dll 2018-02-13 21:38 - 2018-02-09 21:46 - 000169472 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhosdeployment.dll 2018-02-13 21:38 - 2018-02-09 21:46 - 000162304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\IndexedDbLegacy.dll 2018-02-13 21:38 - 2018-02-09 21:46 - 000135680 _____ (Microsoft Corporation) C:\WINDOWS\system32\shsetup.dll 2018-02-13 21:38 - 2018-02-09 21:46 - 000082432 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll 2018-02-13 21:38 - 2018-02-09 21:46 - 000026112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\setup16.exe 2018-02-13 21:38 - 2018-02-09 21:46 - 000018432 _____ (Microsoft Corporation) C:\WINDOWS\system32\PCShellCommonProxyStub.dll 2018-02-13 21:38 - 2018-02-09 21:46 - 000004608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user.exe 2018-02-13 21:38 - 2018-02-09 21:45 - 007545344 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll 2018-02-13 21:38 - 2018-02-09 21:45 - 000675328 _____ (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll 2018-02-13 21:38 - 2018-02-09 21:45 - 000306688 _____ (Microsoft Corporation) C:\WINDOWS\system32\FSClient.dll 2018-02-13 21:38 - 2018-02-09 21:45 - 000288768 _____ (Microsoft Corporation) C:\WINDOWS\system32\authz.dll 2018-02-13 21:38 - 2018-02-09 21:45 - 000288256 _____ (Microsoft Corporation) C:\WINDOWS\system32\winsku.dll 2018-02-13 21:38 - 2018-02-09 21:45 - 000115200 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatepolicy.dll 2018-02-13 21:38 - 2018-02-09 21:45 - 000093696 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll 2018-02-13 21:38 - 2018-02-09 21:45 - 000079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlaapi.dll 2018-02-13 21:38 - 2018-02-09 21:45 - 000066048 _____ (Microsoft Corporation) C:\WINDOWS\system32\winsrv.dll 2018-02-13 21:38 - 2018-02-09 21:45 - 000043008 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshhttp.dll 2018-02-13 21:38 - 2018-02-09 21:45 - 000016384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EnterpriseAppMgmtClient.dll 2018-02-13 21:38 - 2018-02-09 21:44 - 001498112 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebRuntimeManager.dll 2018-02-13 21:38 - 2018-02-09 21:44 - 000800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\Magnify.exe 2018-02-13 21:38 - 2018-02-09 21:44 - 000579072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Payments.dll 2018-02-13 21:38 - 2018-02-09 21:44 - 000539136 _____ (Microsoft Corporation) C:\WINDOWS\system32\HolographicExtensions.dll 2018-02-13 21:38 - 2018-02-09 21:44 - 000503296 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_User.dll 2018-02-13 21:38 - 2018-02-09 21:44 - 000431616 _____ (Microsoft Corporation) C:\WINDOWS\system32\msIso.dll 2018-02-13 21:38 - 2018-02-09 21:44 - 000427008 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneCoreCommonProxyStub.dll 2018-02-13 21:38 - 2018-02-09 21:44 - 000388608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Search.ProtocolHandler.MAPI2.dll 2018-02-13 21:38 - 2018-02-09 21:44 - 000336896 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppLockerCSP.dll 2018-02-13 21:38 - 2018-02-09 21:44 - 000302592 _____ (Microsoft Corporation) C:\WINDOWS\system32\EnterpriseAppMgmtSvc.dll 2018-02-13 21:38 - 2018-02-09 21:44 - 000276992 _____ (Microsoft Corporation) C:\WINDOWS\system32\shutdownux.dll 2018-02-13 21:38 - 2018-02-09 21:44 - 000276480 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll 2018-02-13 21:38 - 2018-02-09 21:44 - 000208384 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringservice.dll 2018-02-13 21:38 - 2018-02-09 21:44 - 000155648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EdgeManager.dll 2018-02-13 21:38 - 2018-02-09 21:44 - 000059392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssprxy.dll 2018-02-13 21:38 - 2018-02-09 21:44 - 000048640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\virtdisk.dll 2018-02-13 21:38 - 2018-02-09 21:44 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tzres.dll 2018-02-13 21:38 - 2018-02-09 21:43 - 018923008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll 2018-02-13 21:38 - 2018-02-09 21:43 - 008020480 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll 2018-02-13 21:38 - 2018-02-09 21:43 - 006466560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll 2018-02-13 21:38 - 2018-02-09 21:43 - 003756032 _____ (Microsoft Corporation) C:\WINDOWS\system32\bootux.dll 2018-02-13 21:38 - 2018-02-09 21:43 - 000580608 _____ (Microsoft Corporation) C:\WINDOWS\system32\webio.dll 2018-02-13 21:38 - 2018-02-09 21:43 - 000570368 _____ (Microsoft Corporation) C:\WINDOWS\system32\TileDataRepository.dll 2018-02-13 21:38 - 2018-02-09 21:43 - 000566272 _____ (Microsoft Corporation) C:\WINDOWS\system32\DevicePairing.dll 2018-02-13 21:38 - 2018-02-09 21:43 - 000456704 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll 2018-02-13 21:38 - 2018-02-09 21:43 - 000394752 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ks.sys 2018-02-13 21:38 - 2018-02-09 21:43 - 000391168 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll 2018-02-13 21:38 - 2018-02-09 21:43 - 000311808 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeveloperOptionsSettingsHandlers.dll 2018-02-13 21:38 - 2018-02-09 21:43 - 000268288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll 2018-02-13 21:38 - 2018-02-09 21:43 - 000247296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winsku.dll 2018-02-13 21:38 - 2018-02-09 21:43 - 000181248 _____ (Microsoft Corporation) C:\WINDOWS\system32\twext.dll 2018-02-13 21:38 - 2018-02-09 21:43 - 000147456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.StateRepositoryUpgrade.dll 2018-02-13 21:38 - 2018-02-09 21:43 - 000110080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shsetup.dll 2018-02-13 21:38 - 2018-02-09 21:43 - 000106496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll 2018-02-13 21:38 - 2018-02-09 21:43 - 000086528 _____ (Microsoft Corporation) C:\WINDOWS\system32\cldapi.dll 2018-02-13 21:38 - 2018-02-09 21:43 - 000084480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppCapture.dll 2018-02-13 21:38 - 2018-02-09 21:43 - 000013312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PCShellCommonProxyStub.dll 2018-02-13 21:38 - 2018-02-09 21:42 - 023671808 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2018-02-13 21:38 - 2018-02-09 21:42 - 001425408 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettings.Handlers.dll 2018-02-13 21:38 - 2018-02-09 21:42 - 001216000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.Vpn.dll 2018-02-13 21:38 - 2018-02-09 21:42 - 001113600 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvr.exe 2018-02-13 21:38 - 2018-02-09 21:42 - 001015296 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthport.sys 2018-02-13 21:38 - 2018-02-09 21:42 - 000975872 _____ (Microsoft Corporation) C:\WINDOWS\system32\wbiosrvc.dll 2018-02-13 21:38 - 2018-02-09 21:42 - 000950784 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasgcw.dll 2018-02-13 21:38 - 2018-02-09 21:42 - 000837632 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll 2018-02-13 21:38 - 2018-02-09 21:42 - 000813568 _____ (Microsoft Corporation) C:\WINDOWS\system32\bisrv.dll 2018-02-13 21:38 - 2018-02-09 21:42 - 000792064 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssvp.dll 2018-02-13 21:38 - 2018-02-09 21:42 - 000731136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Magnify.exe 2018-02-13 21:38 - 2018-02-09 21:42 - 000708096 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll 2018-02-13 21:38 - 2018-02-09 21:42 - 000634880 _____ (Microsoft Corporation) C:\WINDOWS\system32\efswrt.dll 2018-02-13 21:38 - 2018-02-09 21:42 - 000459776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webplatstorageserver.dll 2018-02-13 21:38 - 2018-02-09 21:42 - 000403968 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpAXHolder.dll 2018-02-13 21:38 - 2018-02-09 21:42 - 000397824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll 2018-02-13 21:38 - 2018-02-09 21:42 - 000286720 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsrslvr.dll 2018-02-13 21:38 - 2018-02-09 21:42 - 000270336 _____ (Microsoft Corporation) C:\WINDOWS\system32\ListSvc.dll 2018-02-13 21:38 - 2018-02-09 21:42 - 000236032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FSClient.dll 2018-02-13 21:38 - 2018-02-09 21:42 - 000234496 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkDesktopSettings.dll 2018-02-13 21:38 - 2018-02-09 21:42 - 000233984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppLockerCSP.dll 2018-02-13 21:38 - 2018-02-09 21:42 - 000228352 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe 2018-02-13 21:38 - 2018-02-09 21:42 - 000225280 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchFilterHost.exe 2018-02-13 21:38 - 2018-02-09 21:42 - 000184832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authz.dll 2018-02-13 21:38 - 2018-02-09 21:42 - 000160768 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockScreenContent.dll 2018-02-13 21:38 - 2018-02-09 21:42 - 000160256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDeviceRegistration.dll 2018-02-13 21:38 - 2018-02-09 21:42 - 000130048 _____ (Microsoft Corporation) C:\WINDOWS\system32\rshx32.dll 2018-02-13 21:38 - 2018-02-09 21:42 - 000112640 _____ (Microsoft Corporation) C:\WINDOWS\system32\IdCtrls.dll 2018-02-13 21:38 - 2018-02-09 21:42 - 000098304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\updatepolicy.dll 2018-02-13 21:38 - 2018-02-09 21:42 - 000078336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll 2018-02-13 21:38 - 2018-02-09 21:42 - 000035328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshhttp.dll 2018-02-13 21:38 - 2018-02-09 21:42 - 000024064 _____ (Microsoft Corporation) C:\WINDOWS\system32\regsvr32.exe 2018-02-13 21:38 - 2018-02-09 21:41 - 019352576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2018-02-13 21:38 - 2018-02-09 21:41 - 001495552 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll 2018-02-13 21:38 - 2018-02-09 21:41 - 000859648 _____ (Microsoft Corporation) C:\WINDOWS\system32\appwiz.cpl 2018-02-13 21:38 - 2018-02-09 21:41 - 000820224 _____ (Microsoft Corporation) C:\WINDOWS\system32\netlogon.dll 2018-02-13 21:38 - 2018-02-09 21:41 - 000815616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieproxy.dll 2018-02-13 21:38 - 2018-02-09 21:41 - 000721408 _____ (Microsoft Corporation) C:\WINDOWS\system32\LogonController.dll 2018-02-13 21:38 - 2018-02-09 21:41 - 000504832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DevicePairing.dll 2018-02-13 21:38 - 2018-02-09 21:41 - 000466432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\efswrt.dll 2018-02-13 21:38 - 2018-02-09 21:41 - 000451072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TileDataRepository.dll 2018-02-13 21:38 - 2018-02-09 21:41 - 000405504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Payments.dll 2018-02-13 21:38 - 2018-02-09 21:41 - 000401408 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll 2018-02-13 21:38 - 2018-02-09 21:41 - 000377856 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchProtocolHost.exe 2018-02-13 21:38 - 2018-02-09 21:41 - 000369152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msIso.dll 2018-02-13 21:38 - 2018-02-09 21:41 - 000365568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieproxy.dll 2018-02-13 21:38 - 2018-02-09 21:41 - 000288768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Search.ProtocolHandler.MAPI2.dll 2018-02-13 21:38 - 2018-02-09 21:41 - 000255488 _____ (Microsoft Corporation) C:\WINDOWS\system32\edputil.dll 2018-02-13 21:38 - 2018-02-09 21:41 - 000221184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netplwiz.dll 2018-02-13 21:38 - 2018-02-09 21:41 - 000124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sendmail.dll 2018-02-13 21:38 - 2018-02-09 21:41 - 000063488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nlaapi.dll 2018-02-13 21:38 - 2018-02-09 21:40 - 012831744 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll 2018-02-13 21:38 - 2018-02-09 21:40 - 008110080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll 2018-02-13 21:38 - 2018-02-09 21:40 - 004498432 _____ (Microsoft Corporation) C:\WINDOWS\system32\xpsrchvw.exe 2018-02-13 21:38 - 2018-02-09 21:40 - 004113408 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll 2018-02-13 21:38 - 2018-02-09 21:40 - 003405824 _____ (Microsoft Corporation) C:\WINDOWS\system32\tquery.dll 2018-02-13 21:38 - 2018-02-09 21:40 - 003367936 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncCenter.dll 2018-02-13 21:38 - 2018-02-09 21:40 - 002873344 _____ (Microsoft Corporation) C:\WINDOWS\system32\themeui.dll 2018-02-13 21:38 - 2018-02-09 21:40 - 001234432 _____ (Microsoft Corporation) C:\WINDOWS\system32\SEMgrSvc.dll 2018-02-13 21:38 - 2018-02-09 21:40 - 001002496 _____ (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll 2018-02-13 21:38 - 2018-02-09 21:40 - 000940544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.Vpn.dll 2018-02-13 21:38 - 2018-02-09 21:40 - 000939520 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasdlg.dll 2018-02-13 21:38 - 2018-02-09 21:40 - 000930816 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasmans.dll 2018-02-13 21:38 - 2018-02-09 21:40 - 000886784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcastdvr.exe 2018-02-13 21:38 - 2018-02-09 21:40 - 000856576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rasgcw.dll 2018-02-13 21:38 - 2018-02-09 21:40 - 000756736 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll 2018-02-13 21:38 - 2018-02-09 21:40 - 000691200 _____ (Microsoft Corporation) C:\WINDOWS\system32\dsreg.dll 2018-02-13 21:38 - 2018-02-09 21:40 - 000601088 _____ (Microsoft Corporation) C:\WINDOWS\system32\ipnathlp.dll 2018-02-13 21:38 - 2018-02-09 21:40 - 000559104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll 2018-02-13 21:38 - 2018-02-09 21:40 - 000526336 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll 2018-02-13 21:38 - 2018-02-09 21:40 - 000508416 _____ (Microsoft Corporation) C:\WINDOWS\system32\timedate.cpl 2018-02-13 21:38 - 2018-02-09 21:40 - 000499200 _____ (Microsoft Corporation) C:\WINDOWS\system32\rastls.dll 2018-02-13 21:38 - 2018-02-09 21:40 - 000463360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\timedate.cpl 2018-02-13 21:38 - 2018-02-09 21:40 - 000421376 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputSwitch.dll 2018-02-13 21:38 - 2018-02-09 21:40 - 000386560 _____ (Microsoft Corporation) C:\WINDOWS\system32\zipfldr.dll 2018-02-13 21:38 - 2018-02-09 21:40 - 000366080 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll 2018-02-13 21:38 - 2018-02-09 21:40 - 000343040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll 2018-02-13 21:38 - 2018-02-09 21:40 - 000298496 _____ (Microsoft Corporation) C:\WINDOWS\system32\netplwiz.dll 2018-02-13 21:38 - 2018-02-09 21:40 - 000232960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edputil.dll 2018-02-13 21:38 - 2018-02-09 21:40 - 000195072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OneCoreCommonProxyStub.dll 2018-02-13 21:38 - 2018-02-09 21:40 - 000177152 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditionUpgradeHelper.dll 2018-02-13 21:38 - 2018-02-09 21:39 - 011925504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll 2018-02-13 21:38 - 2018-02-09 21:39 - 005500928 _____ (Microsoft Corporation) C:\WINDOWS\system32\aclui.dll 2018-02-13 21:38 - 2018-02-09 21:39 - 004748288 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll 2018-02-13 21:38 - 2018-02-09 21:39 - 004592640 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsThresholdAdminFlowUI.dll 2018-02-13 21:38 - 2018-02-09 21:39 - 002976256 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.pcshell.dll 2018-02-13 21:38 - 2018-02-09 21:39 - 002741248 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssrch.dll 2018-02-13 21:38 - 2018-02-09 21:39 - 002677760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tquery.dll 2018-02-13 21:38 - 2018-02-09 21:39 - 002490880 _____ (Microsoft Corporation) C:\WINDOWS\system32\themecpl.dll 2018-02-13 21:38 - 2018-02-09 21:39 - 002209280 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll 2018-02-13 21:38 - 2018-02-09 21:39 - 001669120 _____ (Microsoft Corporation) C:\WINDOWS\system32\Wpc.dll 2018-02-13 21:38 - 2018-02-09 21:39 - 000908800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontext.dll 2018-02-13 21:38 - 2018-02-09 21:39 - 000721920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssvp.dll 2018-02-13 21:38 - 2018-02-09 21:39 - 000680960 _____ (Microsoft Corporation) C:\WINDOWS\system32\sud.dll 2018-02-13 21:38 - 2018-02-09 21:39 - 000658432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netlogon.dll 2018-02-13 21:38 - 2018-02-09 21:39 - 000648704 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserLanguagesCpl.dll 2018-02-13 21:38 - 2018-02-09 21:39 - 000621056 _____ (Microsoft Corporation) C:\WINDOWS\system32\hgcpl.dll 2018-02-13 21:38 - 2018-02-09 21:39 - 000462848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webio.dll 2018-02-13 21:38 - 2018-02-09 21:39 - 000447488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rastls.dll 2018-02-13 21:38 - 2018-02-09 21:39 - 000346112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\zipfldr.dll 2018-02-13 21:38 - 2018-02-09 21:39 - 000315904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sysdm.cpl 2018-02-13 21:38 - 2018-02-09 21:39 - 000157696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twext.dll 2018-02-13 21:38 - 2018-02-09 21:39 - 000096256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\IdCtrls.dll 2018-02-13 21:38 - 2018-02-09 21:39 - 000020992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\regsvr32.exe 2018-02-13 21:38 - 2018-02-09 21:38 - 006722560 _____ (Microsoft Corporation) C:\WINDOWS\system32\mspaint.exe 2018-02-13 21:38 - 2018-02-09 21:38 - 006567936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll 2018-02-13 21:38 - 2018-02-09 21:38 - 005833216 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll 2018-02-13 21:38 - 2018-02-09 21:38 - 004815360 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll 2018-02-13 21:38 - 2018-02-09 21:38 - 003334144 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll 2018-02-13 21:38 - 2018-02-09 21:38 - 003169280 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll 2018-02-13 21:38 - 2018-02-09 21:38 - 003125760 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputService.dll 2018-02-13 21:38 - 2018-02-09 21:38 - 002857984 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll 2018-02-13 21:38 - 2018-02-09 21:38 - 002184192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssrch.dll 2018-02-13 21:38 - 2018-02-09 21:38 - 002086400 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys 2018-02-13 21:38 - 2018-02-09 21:38 - 002082304 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl 2018-02-13 21:38 - 2018-02-09 21:38 - 001968640 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll 2018-02-13 21:38 - 2018-02-09 21:38 - 001597952 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll 2018-02-13 21:38 - 2018-02-09 21:38 - 001547776 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll 2018-02-13 21:38 - 2018-02-09 21:38 - 001353728 _____ (Microsoft Corporation) C:\WINDOWS\system32\usercpl.dll 2018-02-13 21:38 - 2018-02-09 21:38 - 001228800 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll 2018-02-13 21:38 - 2018-02-09 21:38 - 001167360 _____ (Microsoft Corporation) C:\WINDOWS\system32\ISM.dll 2018-02-13 21:38 - 2018-02-09 21:38 - 001166336 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll 2018-02-13 21:38 - 2018-02-09 21:38 - 001057792 _____ (Microsoft Corporation) C:\WINDOWS\system32\comdlg32.dll 2018-02-13 21:38 - 2018-02-09 21:38 - 000982016 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchIndexer.exe 2018-02-13 21:38 - 2018-02-09 21:38 - 000939520 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasapi32.dll 2018-02-13 21:38 - 2018-02-09 21:38 - 000885248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Search.dll 2018-02-13 21:38 - 2018-02-09 21:38 - 000863744 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntshrui.dll 2018-02-13 21:38 - 2018-02-09 21:38 - 000755712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\appwiz.cpl 2018-02-13 21:38 - 2018-02-09 21:38 - 000699904 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsm.dll 2018-02-13 21:38 - 2018-02-09 21:38 - 000668160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll 2018-02-13 21:38 - 2018-02-09 21:38 - 000653312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sud.dll 2018-02-13 21:38 - 2018-02-09 21:38 - 000598528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll 2018-02-13 21:38 - 2018-02-09 21:38 - 000556544 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockAppBroker.dll 2018-02-13 21:38 - 2018-02-09 21:38 - 000524800 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.immersiveshell.serviceprovider.dll 2018-02-13 21:38 - 2018-02-09 21:38 - 000509440 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSync.dll 2018-02-13 21:38 - 2018-02-09 21:38 - 000506880 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.dll 2018-02-13 21:38 - 2018-02-09 21:38 - 000462336 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll 2018-02-13 21:38 - 2018-02-09 21:38 - 000401920 _____ (Microsoft Corporation) C:\WINDOWS\system32\rascustom.dll 2018-02-13 21:38 - 2018-02-09 21:38 - 000324608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchProtocolHost.exe 2018-02-13 21:38 - 2018-02-09 21:38 - 000174592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EditionUpgradeHelper.dll 2018-02-13 21:38 - 2018-02-09 21:37 - 004839424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll 2018-02-13 21:38 - 2018-02-09 21:37 - 004772352 _____ (Microsoft Corporation) C:\WINDOWS\system32\ExplorerFrame.dll 2018-02-13 21:38 - 2018-02-09 21:37 - 003678720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll 2018-02-13 21:38 - 2018-02-09 21:37 - 003578368 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRH.dll 2018-02-13 21:38 - 2018-02-09 21:37 - 003419136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xpsrchvw.exe 2018-02-13 21:38 - 2018-02-09 21:37 - 003287040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SyncCenter.dll 2018-02-13 21:38 - 2018-02-09 21:37 - 002784256 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll 2018-02-13 21:38 - 2018-02-09 21:37 - 002523648 _____ (Microsoft Corporation) C:\WINDOWS\system32\gameux.dll 2018-02-13 21:38 - 2018-02-09 21:37 - 001822208 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll 2018-02-13 21:38 - 2018-02-09 21:37 - 001488384 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll 2018-02-13 21:38 - 2018-02-09 21:37 - 000965632 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontext.dll 2018-02-13 21:38 - 2018-02-09 21:37 - 000862208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rasdlg.dll 2018-02-13 21:38 - 2018-02-09 21:37 - 000456704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LockAppBroker.dll 2018-02-13 21:38 - 2018-02-09 21:37 - 000417792 _____ (Microsoft Corporation) C:\WINDOWS\system32\stobject.dll 2018-02-13 21:38 - 2018-02-09 21:37 - 000365568 _____ (Microsoft Corporation) C:\WINDOWS\system32\srchadmin.dll 2018-02-13 21:38 - 2018-02-09 21:37 - 000308224 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupSvc.dll 2018-02-13 21:38 - 2018-02-09 21:37 - 000199680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchFilterHost.exe 2018-02-13 21:38 - 2018-02-09 21:37 - 000198656 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingMonitor.dll 2018-02-13 21:38 - 2018-02-09 21:36 - 006031360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll 2018-02-13 21:38 - 2018-02-09 21:36 - 002869760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll 2018-02-13 21:38 - 2018-02-09 21:36 - 002859520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SRH.dll 2018-02-13 21:38 - 2018-02-09 21:36 - 002464768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll 2018-02-13 21:38 - 2018-02-09 21:36 - 002462208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\themecpl.dll 2018-02-13 21:38 - 2018-02-09 21:36 - 002035712 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll 2018-02-13 21:38 - 2018-02-09 21:36 - 001759744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpncore.dll 2018-02-13 21:38 - 2018-02-09 21:36 - 001739264 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Immersive.dll 2018-02-13 21:38 - 2018-02-09 21:36 - 001559552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll 2018-02-13 21:38 - 2018-02-09 21:36 - 001342464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Wpc.dll 2018-02-13 21:38 - 2018-02-09 21:36 - 001230848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\usercpl.dll 2018-02-13 21:38 - 2018-02-09 21:36 - 000915968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll 2018-02-13 21:38 - 2018-02-09 21:36 - 000695296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Search.dll 2018-02-13 21:38 - 2018-02-09 21:36 - 000685056 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll 2018-02-13 21:38 - 2018-02-09 21:36 - 000666624 _____ (Microsoft Corporation) C:\WINDOWS\system32\DbgModel.dll 2018-02-13 21:38 - 2018-02-09 21:36 - 000599552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Core.TextInput.dll 2018-02-13 21:38 - 2018-02-09 21:36 - 000576512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hgcpl.dll 2018-02-13 21:38 - 2018-02-09 21:36 - 000559104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserLanguagesCpl.dll 2018-02-13 21:38 - 2018-02-09 21:36 - 000403968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sppcomapi.dll 2018-02-13 21:38 - 2018-02-09 21:36 - 000383488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\stobject.dll 2018-02-13 21:38 - 2018-02-09 21:36 - 000141824 _____ (Microsoft Corporation) C:\WINDOWS\system32\FontProvider.dll 2018-02-13 21:38 - 2018-02-09 21:36 - 000076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cldapi.dll 2018-02-13 21:38 - 2018-02-09 21:35 - 005388800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aclui.dll 2018-02-13 21:38 - 2018-02-09 21:35 - 004384768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExplorerFrame.dll 2018-02-13 21:38 - 2018-02-09 21:35 - 002814976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\themeui.dll 2018-02-13 21:38 - 2018-02-09 21:35 - 002413568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gameux.dll 2018-02-13 21:38 - 2018-02-09 21:35 - 002349568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputService.dll 2018-02-13 21:38 - 2018-02-09 21:35 - 002013184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl 2018-02-13 21:38 - 2018-02-09 21:35 - 001474560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll 2018-02-13 21:38 - 2018-02-09 21:35 - 000963584 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorSvc.dll 2018-02-13 21:38 - 2018-02-09 21:35 - 000943104 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.BackgroundMediaPlayback.dll 2018-02-13 21:38 - 2018-02-09 21:35 - 000941568 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Playback.BackgroundMediaPlayer.dll 2018-02-13 21:38 - 2018-02-09 21:35 - 000918528 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Playback.MediaPlayer.dll 2018-02-13 21:38 - 2018-02-09 21:35 - 000862208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rasapi32.dll 2018-02-13 21:38 - 2018-02-09 21:35 - 000842240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comdlg32.dll 2018-02-13 21:38 - 2018-02-09 21:35 - 000826880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchIndexer.exe 2018-02-13 21:38 - 2018-02-09 21:35 - 000796160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntshrui.dll 2018-02-13 21:38 - 2018-02-09 21:35 - 000667136 _____ (Microsoft Corporation) C:\WINDOWS\system32\FrameServer.dll 2018-02-13 21:38 - 2018-02-09 21:35 - 000455680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll 2018-02-13 21:38 - 2018-02-09 21:35 - 000433664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.dll 2018-02-13 21:38 - 2018-02-09 21:35 - 000402944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSync.dll 2018-02-13 21:38 - 2018-02-09 21:35 - 000332288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\srchadmin.dll 2018-02-13 21:38 - 2018-02-09 21:35 - 000329728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputSwitch.dll 2018-02-13 21:38 - 2018-02-09 21:34 - 006532096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mspaint.exe 2018-02-13 21:38 - 2018-02-09 21:34 - 004249600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll 2018-02-13 21:38 - 2018-02-09 21:34 - 002983936 _____ (Microsoft Corporation) C:\WINDOWS\system32\mmcndmgr.dll 2018-02-13 21:38 - 2018-02-09 21:34 - 000624640 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMVXENCD.DLL 2018-02-13 21:38 - 2018-02-09 21:34 - 000464384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Core.TextInput.dll 2018-02-13 21:38 - 2018-02-09 21:34 - 000433152 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMVSENCD.DLL 2018-02-13 21:38 - 2018-02-09 21:34 - 000111104 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Playback.ProxyStub.dll 2018-02-13 21:38 - 2018-02-09 21:33 - 001936384 _____ (Microsoft Corporation) C:\WINDOWS\system32\mmc.exe 2018-02-13 21:38 - 2018-02-09 21:33 - 001661440 _____ (Microsoft Corporation) C:\WINDOWS\system32\vssapi.dll 2018-02-13 21:38 - 2018-02-09 21:33 - 001570816 _____ (Microsoft Corporation) C:\WINDOWS\system32\RecoveryDrive.exe 2018-02-13 21:38 - 2018-02-09 21:33 - 001557504 _____ (Microsoft Corporation) C:\WINDOWS\system32\VSSVC.exe 2018-02-13 21:38 - 2018-02-09 21:33 - 001509888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Immersive.dll 2018-02-13 21:38 - 2018-02-09 21:33 - 000621568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.BackgroundMediaPlayback.dll 2018-02-13 21:38 - 2018-02-09 21:33 - 000620544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Playback.BackgroundMediaPlayer.dll 2018-02-13 21:38 - 2018-02-09 21:33 - 000604672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Playback.MediaPlayer.dll 2018-02-13 21:38 - 2018-02-09 21:33 - 000482816 _____ (Microsoft Corporation) C:\WINDOWS\system32\srcore.dll 2018-02-13 21:38 - 2018-02-09 21:33 - 000341504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mmcbase.dll 2018-02-13 21:38 - 2018-02-09 21:33 - 000266752 _____ (Microsoft Corporation) C:\WINDOWS\system32\rstrui.exe 2018-02-13 21:38 - 2018-02-09 21:33 - 000217088 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebClnt.dll 2018-02-13 21:38 - 2018-02-09 21:33 - 000125952 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxSysprep.dll 2018-02-13 21:38 - 2018-02-09 21:33 - 000093696 _____ (Microsoft Corporation) C:\WINDOWS\system32\davclnt.dll 2018-02-13 21:38 - 2018-02-09 21:32 - 002427904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mmcndmgr.dll 2018-02-13 21:38 - 2018-02-09 21:32 - 000681472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMVXENCD.DLL 2018-02-13 21:38 - 2018-02-09 21:32 - 000392704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMVSENCD.DLL 2018-02-13 21:38 - 2018-02-09 21:32 - 000073216 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\npfs.sys 2018-02-13 21:38 - 2018-02-09 21:32 - 000056832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Playback.ProxyStub.dll 2018-02-13 21:38 - 2018-02-09 21:32 - 000050176 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcalua.exe 2018-02-13 21:38 - 2018-02-09 21:31 - 001488896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mmc.exe 2018-02-13 21:38 - 2018-02-09 21:31 - 001159680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vssapi.dll 2018-02-13 21:38 - 2018-02-09 21:31 - 000301056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mmcbase.dll 2018-02-13 21:38 - 2018-02-09 21:31 - 000190464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WebClnt.dll 2018-02-13 21:38 - 2018-02-09 21:31 - 000078848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\davclnt.dll 2018-02-13 21:38 - 2018-02-09 19:59 - 000804240 _____ C:\WINDOWS\SysWOW64\locale.nls 2018-02-13 21:38 - 2018-02-09 19:59 - 000804240 _____ C:\WINDOWS\system32\locale.nls 2018-02-13 21:38 - 2018-02-08 20:35 - 004959688 _____ (Microsoft Corporation) C:\WINDOWS\system32\rtmpltfm.dll 2018-02-13 21:38 - 2018-02-08 20:35 - 001234888 _____ (Microsoft Corporation) C:\WINDOWS\system32\rtmpal.dll 2018-02-13 21:38 - 2018-02-08 20:35 - 001002952 _____ (Microsoft Corporation) C:\WINDOWS\system32\rtmcodecs.dll 2018-02-13 21:38 - 2018-02-08 20:35 - 000892872 _____ (Microsoft Corporation) C:\WINDOWS\system32\ortcengine.dll 2018-02-13 21:38 - 2018-02-08 20:35 - 000065992 _____ (Microsoft Corporation) C:\WINDOWS\system32\rtmmvrortc.dll 2018-02-13 21:38 - 2018-02-01 20:36 - 003903944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rtmpltfm.dll 2018-02-13 21:38 - 2018-02-01 20:36 - 000921032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rtmpal.dll 2018-02-13 21:38 - 2018-02-01 20:36 - 000854976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rtmcodecs.dll 2018-02-13 21:38 - 2018-02-01 20:36 - 000649672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ortcengine.dll 2018-02-13 21:38 - 2018-02-01 20:36 - 000054720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rtmmvrortc.dll 2018-02-12 19:17 - 2018-02-12 19:17 - 000720922 _____ C:\Users\grant\Downloads\package (1).pdf 2018-02-12 18:07 - 2018-02-12 18:07 - 000010115 _____ C:\Users\grant\Downloads\products (3).pdf 2018-02-02 13:17 - 2018-02-02 13:17 - 000193860 _____ C:\Users\grant\Documents\img20180202_13174743.pdf 2018-02-02 12:50 - 2018-02-02 12:50 - 000071612 _____ C:\Users\grant\Downloads\Account Representative Designation Request.pdf 2018-02-01 16:17 - 2018-02-01 16:17 - 000142572 _____ C:\Users\grant\Downloads\UCC3 Grant Durtschi 444391201443.pdf 2018-02-01 16:16 - 2018-02-01 16:16 - 000142575 _____ C:\Users\grant\Downloads\UCC3 Grant Durtschi 444389201449.pdf 2018-01-26 13:30 - 2018-01-26 13:30 - 000023092 _____ C:\Users\grant\Documents\transfer funds form.pdf 2018-01-26 13:13 - 2018-02-07 12:39 - 000000209 _____ C:\Users\grant\Desktop\ira.txt 2018-01-22 13:51 - 2018-01-22 13:51 - 001019049 _____ C:\Users\grant\Documents\img20180122_13515934.pdf ==================== One Month Modified files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2018-02-21 22:59 - 2017-12-19 00:35 - 001327428 _____ C:\WINDOWS\system32\PerfStringBackup.INI 2018-02-21 22:53 - 2017-12-19 00:30 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT 2018-02-21 22:53 - 2016-10-06 09:49 - 000000000 __SHD C:\Users\grant\IntelGraphicsProfiles 2018-02-21 22:52 - 2017-09-29 01:45 - 029360128 _____ C:\WINDOWS\system32\config\HARDWARE 2018-02-21 22:52 - 2017-09-29 01:45 - 001048576 _____ C:\WINDOWS\system32\config\BBI 2018-02-21 22:23 - 2017-12-19 00:24 - 000000000 ____D C:\WINDOWS\system32\SleepStudy 2018-02-21 13:32 - 2016-11-29 12:23 - 000000000 ____D C:\Users\grant\AppData\Roaming\Azureus 2018-02-21 13:31 - 2017-12-19 00:26 - 000000000 ____D C:\Users\grant 2018-02-21 13:30 - 2017-09-29 06:46 - 000000000 ____D C:\WINDOWS\LiveKernelReports 2018-02-21 13:28 - 2016-11-29 12:25 - 000000000 ____D C:\Users\grant\Documents\Vuze Downloads 2018-02-21 13:12 - 2017-09-29 06:46 - 000000000 ____D C:\WINDOWS\AppReadiness 2018-02-21 02:42 - 2017-12-19 00:26 - 000000000 ____D C:\Users\grant\AppData\Local\Packages 2018-02-21 02:04 - 2017-02-15 12:09 - 000000000 ____D C:\Users\grant\AppData\Local\Adobe 2018-02-21 00:48 - 2017-05-03 11:28 - 000000000 ____D C:\Users\grant\Desktop\Sta Barb loc px 2017feb 2018-02-21 00:48 - 2017-02-10 21:00 - 000000000 ____D C:\Users\grant\Desktop\Crio 2018-02-20 21:56 - 2017-09-29 06:44 - 000000000 ____D C:\WINDOWS\INF 2018-02-20 21:39 - 2015-10-30 00:24 - 000000000 ___HD C:\WINDOWS\system32\GroupPolicy 2018-02-20 21:38 - 2018-01-13 00:31 - 000000000 ____D C:\Program Files\Dell Support Center 2018-02-20 21:38 - 2017-09-29 06:46 - 000000000 ____D C:\Program Files\Windows Portable Devices 2018-02-20 21:37 - 2017-09-29 06:46 - 000000000 ____D C:\WINDOWS\DeliveryOptimization 2018-02-20 20:21 - 2016-10-06 09:51 - 000000000 ___RD C:\Users\grant\OneDrive 2018-02-20 13:15 - 2017-09-29 06:46 - 000000000 ___HD C:\Program Files\WindowsApps 2018-02-15 11:11 - 2017-09-29 06:46 - 000000000 ____D C:\WINDOWS\rescache 2018-02-14 21:24 - 2017-12-19 00:34 - 000000000 ___RD C:\Users\grant\3D Objects 2018-02-14 21:24 - 2016-04-25 13:36 - 000000000 __RHD C:\Users\Public\AccountPictures 2018-02-14 21:11 - 2017-12-19 00:24 - 000406120 _____ C:\WINDOWS\system32\FNTCACHE.DAT 2018-02-14 21:10 - 2017-09-29 06:46 - 000000000 ____D C:\WINDOWS\TextInput 2018-02-14 21:10 - 2017-09-29 06:46 - 000000000 ____D C:\WINDOWS\system32\oobe 2018-02-14 21:10 - 2017-09-29 06:46 - 000000000 ____D C:\WINDOWS\system32\appraiser 2018-02-14 21:10 - 2017-09-29 06:46 - 000000000 ____D C:\WINDOWS\ShellExperiences 2018-02-14 21:10 - 2017-09-29 06:46 - 000000000 ____D C:\WINDOWS\bcastdvr 2018-02-13 21:40 - 2017-09-29 06:37 - 000000000 ____D C:\WINDOWS\CbsTemp 2018-02-13 21:02 - 2016-10-08 08:58 - 000000000 ____D C:\WINDOWS\system32\MRT 2018-02-13 21:01 - 2017-10-10 19:37 - 130067560 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT-KB890830.exe 2018-02-13 21:00 - 2016-10-08 08:58 - 130067560 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe 2018-02-11 16:55 - 2018-01-06 12:47 - 000000000 ____D C:\Users\grant\Documents\Amazon orders 2018-02-10 22:37 - 2016-10-11 01:20 - 000000000 ____D C:\Users\grant\AppData\Roaming\vlc 2018-02-10 13:02 - 2017-11-09 18:56 - 000000000 ____D C:\Users\grant\Documents\Taxes 2018-02-08 19:37 - 2016-10-06 09:50 - 000000000 ___RD C:\Users\grant\Dropbox 2018-02-07 12:29 - 2017-04-13 08:58 - 000000000 ____D C:\Users\grant\AppData\Local\Citrix 2018-02-05 19:49 - 2017-09-29 06:49 - 000835576 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe 2018-02-05 19:49 - 2017-09-29 06:49 - 000177648 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl 2018-02-03 14:47 - 2016-09-28 17:46 - 000000000 ____D C:\ProgramData\Dell 2018-02-03 14:47 - 2016-09-28 17:05 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell 2018-02-03 14:47 - 2016-09-28 17:05 - 000000000 ____D C:\Program Files\Dell 2018-01-26 16:02 - 2017-12-01 02:40 - 000025868 _____ C:\Users\grant\Downloads\Sales to pay tax on.xlsx 2018-01-24 19:44 - 2016-11-28 13:49 - 000548000 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe 2018-01-22 11:23 - 2016-09-28 17:05 - 000000000 ____D C:\ProgramData\PCDr ==================== Files in the root of some directories ======= 2018-02-20 21:44 - 2018-02-20 21:44 - 000556032 _____ (www.update.com) C:\ProgramData\MicrosoftUpd.exe 2017-09-27 17:56 - 2017-10-10 10:17 - 000000034 _____ () C:\Users\grant\AppData\Roaming\AdobeWLCMCache.dat 2018-02-20 21:39 - 2018-02-20 21:39 - 018514008 _____ ( ) C:\Users\grant\AppData\Roaming\mysetup.exe 2018-02-20 21:39 - 2018-02-20 21:39 - 000012800 _____ () C:\Users\grant\AppData\Local\achpow.dll 2018-02-21 17:22 - 2018-02-21 17:22 - 000011568 _____ () C:\Users\grant\AppData\Local\InstallationConfiguration.xml 2018-02-21 17:22 - 2018-02-21 17:22 - 000140800 _____ () C:\Users\grant\AppData\Local\installer.dat 2018-02-21 17:22 - 2018-02-21 17:22 - 000930816 _____ () C:\Users\grant\AppData\Local\po.db Files to move or delete: ==================== C:\WINDOWS\rss\csrss.exe C:\Users\grant\AppData\Local\Temp\b7f0a41d25b94c14bb522bf9f7f8119c\YqEG4EJp.exe Some files in TEMP: ==================== 2018-02-20 21:13 - 2018-02-20 21:13 - 000920448 _____ () C:\Users\grant\AppData\Local\Temp\AnonymizerGadgetSetup.1.000.1680.exe 2018-02-20 21:12 - 2018-02-20 21:12 - 004426131 _____ (Indigo Rose Corporation) C:\Users\grant\AppData\Local\Temp\body.exe 2018-02-20 21:12 - 2018-02-20 21:12 - 000024576 _____ (1010 Vine Street) C:\Users\grant\AppData\Local\Temp\capi.exe 2018-02-20 21:12 - 2018-02-20 21:12 - 000020480 _____ (329 Haul Road) C:\Users\grant\AppData\Local\Temp\cubesta.exe 2018-02-21 02:08 - 2018-02-09 23:15 - 001954048 _____ (Microsoft Corporation) C:\Users\grant\AppData\Local\Temp\dllnt_dump.dll 2018-02-15 22:46 - 2018-02-21 13:33 - 000035680 _____ () C:\Users\grant\AppData\Local\Temp\i4jdel0.exe 2018-02-21 01:11 - 2018-02-20 23:52 - 067961984 _____ (Malwarebytes ) C:\Users\grant\AppData\Local\Temp\mb3-setup-consumer-3.3.1.2183-1.0.262-1.0.4014.exe 2018-02-20 21:38 - 2018-02-20 21:38 - 000655350 _____ ( ) C:\Users\grant\AppData\Local\Temp\OneSystemCare.exe 2018-02-20 21:12 - 2018-02-20 21:12 - 001792071 _____ () C:\Users\grant\AppData\Local\Temp\pi.exe 2018-02-20 21:13 - 2018-02-20 21:13 - 000450048 _____ () C:\Users\grant\AppData\Local\Temp\setup (1).exe 2018-02-20 21:13 - 2018-02-20 21:13 - 000412672 _____ (Simon Tatham) C:\Users\grant\AppData\Local\Temp\setup.exe 2018-02-20 21:37 - 2018-02-20 21:37 - 000386793 _____ (ZRFXRD ) C:\Users\grant\AppData\Local\Temp\SetupTextToTalk.exe 2018-02-20 21:36 - 2018-02-20 21:36 - 000000000 _____ () C:\Users\grant\AppData\Local\Temp\setupWQQ.exe ==================== Bamital & volsnap ====================== (There is no automatic fix for files that do not pass verification.) C:\WINDOWS\system32\winlogon.exe => File is digitally signed C:\WINDOWS\system32\wininit.exe => File is digitally signed C:\WINDOWS\explorer.exe => File is digitally signed C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed C:\WINDOWS\system32\svchost.exe => File is digitally signed C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed C:\WINDOWS\system32\services.exe => File is digitally signed C:\WINDOWS\system32\User32.dll => File is digitally signed C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed C:\WINDOWS\system32\userinit.exe => File is digitally signed C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed C:\WINDOWS\system32\rpcss.dll => File is digitally signed C:\WINDOWS\system32\dnsapi.dll => File is digitally signed C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed C:\WINDOWS\system32\drivers\avdtwzgj.sys -> Access Denied <======= ATTENTION LastRegBack: 2018-02-19 01:20 ==================== End of FRST.txt ============================