Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Cryptowall 3.0 will not remove


  • This topic is locked This topic is locked
30 replies to this topic

#1 cappatown

cappatown

  • Members
  • 93 posts
  • OFFLINE
  •  
  • Local time:03:12 PM

Posted 26 January 2015 - 02:53 PM

     I have googled to try and find information on how to remove this virus. I've tried removing this in safe mode with networking by using anti-malwarebytes scans. It will find trojans but when I remove, and scan a few hours later- there is another one. I tried following directions on manually removing this from the registry and it didn't work. My earliest system restore point was from 2 weeks ago, I restored and still is infected.

Any help is appreciated.



BC AdBot (Login to Remove)

 


#2 cappatown

cappatown
  • Topic Starter

  • Members
  • 93 posts
  • OFFLINE
  •  
  • Local time:03:12 PM

Posted 26 January 2015 - 02:59 PM

Here are the logs:

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-01-2015 01
Ran by Bo$$ Brenna (administrator) on BOSSBRENNA-PC on 26-01-2015 11:57:22
Running from C:\Users\Bo$$ Brenna\Downloads
Loaded Profiles: Bo$$ Brenna &  (Available profiles: Bo$$ Brenna)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(DeviceVM, Inc.) C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(DT Soft Ltd) C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
(Akamai Technologies, Inc.) C:\Users\Bo$$ Brenna\AppData\Local\Akamai\netsession_win.exe
(SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
(Akamai Technologies, Inc.) C:\Users\Bo$$ Brenna\AppData\Local\Akamai\netsession_win.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(DeviceVM, Inc.) C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
() C:\Users\Bo$$ Brenna\AppData\Roaming\OAS\oas.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
() C:\Users\Bo$$ Brenna\AppData\Roaming\OAS\mcc.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Awesomium Technologies) C:\Users\Bo$$ Brenna\AppData\Roaming\OAS\oas-module
(Awesomium Technologies) C:\Users\Bo$$ Brenna\AppData\Roaming\OAS\oas-module
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Awesomium Technologies) C:\Users\Bo$$ Brenna\AppData\Roaming\OAS\oas-module
(Microsoft Corporation) C:\Windows\System32\CompatTel\wicainventory.exe
(Awesomium Technologies) C:\Users\Bo$$ Brenna\AppData\Roaming\OAS\oas-module
(Microsoft Corporation) C:\Windows\System32\rundll32.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [Launch LCore] => C:\Program Files\Logitech Gaming Software\LCore.exe [7406392 2012-11-28] (Logitech Inc.)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2404296 2014-08-08] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [2439072 2010-05-24] (VIA)
HKLM-x32\...\Run: [BCU] => C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe [411864 2010-03-05] (DeviceVM, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [ROC_roc_ssl_v12] => "C:\Program Files (x86)\AVG Secure Search\ROC_roc_ssl_v12.exe" / /PROMPT /CMPID=roc_ssl_v12
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKLM-x32\...\Run: [YTDownloader] => "C:\Program Files (x86)\YTDownloader\YTDownloader.exe" /boot
HKLM-x32\...\RunOnce: [AvgUninstallURL] => cmd.exe /c start http://www.avg.com/ww.special-uninstallation-feedback-app?lic="&"inst=NwA3AC0AMQA0ADIANgA1ADIAMwAzADUANwAtAEQARABUACsAMAAtAFMAVAA5ADAAQQBQAFAAKwAxAC0AUABMACsAOQAtAE4AMQBEACsAMQAtAEYAT (the data entry has 60 more characters).
HKU\S-1-5-21-997025152-3087782429-1578093462-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [1942720 2015-01-23] (Valve Corporation)
HKU\S-1-5-21-997025152-3087782429-1578093462-1001\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [4910912 2011-08-01] (DT Soft Ltd)
HKU\S-1-5-21-997025152-3087782429-1578093462-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Bo$$ Brenna\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-29] (Akamai Technologies, Inc.)
HKU\S-1-5-21-997025152-3087782429-1578093462-1001\...\Run: [EA Core] => "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent
HKU\S-1-5-21-997025152-3087782429-1578093462-1001\...\Run: [YTDownloader] => "C:\Program Files (x86)\YTDownloader\YTDownloader.exe" /boot
HKU\S-1-5-21-997025152-3087782429-1578093462-1001\...\Run: [Online Ad Scanner] => C:\Users\Bo$$ Brenna\AppData\Roaming\OAS\oasupd.exe [28672 2014-09-22] ()
HKU\S-1-5-21-997025152-3087782429-1578093462-1001\...\Run: [Itibiti.exe] => C:\Program Files (x86)\Itibiti Soft Phone\Itibiti.exe
HKU\S-1-5-21-997025152-3087782429-1578093462-1001\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [7780120 2014-12-15] (SUPERAntiSpyware)
HKU\S-1-5-21-997025152-3087782429-1578093462-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [1942720 2015-01-23] (Valve Corporation)
HKU\S-1-5-21-997025152-3087782429-1578093462-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [4910912 2011-08-01] (DT Soft Ltd)
HKU\S-1-5-21-997025152-3087782429-1578093462-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Akamai NetSession Interface] => C:\Users\Bo$$ Brenna\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-29] (Akamai Technologies, Inc.)
HKU\S-1-5-21-997025152-3087782429-1578093462-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [EA Core] => "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent
HKU\S-1-5-21-997025152-3087782429-1578093462-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [YTDownloader] => "C:\Program Files (x86)\YTDownloader\YTDownloader.exe" /boot
HKU\S-1-5-21-997025152-3087782429-1578093462-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Online Ad Scanner] => C:\Users\Bo$$ Brenna\AppData\Roaming\OAS\oasupd.exe [28672 2014-09-22] ()
HKU\S-1-5-21-997025152-3087782429-1578093462-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Itibiti.exe] => C:\Program Files (x86)\Itibiti Soft Phone\Itibiti.exe
HKU\S-1-5-21-997025152-3087782429-1578093462-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [7780120 2014-12-15] (SUPERAntiSpyware)
AppInit_DLLs-x32: => "" File Not Found

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:50023;https=127.0.0.1:50023
HKU\S-1-5-21-997025152-3087782429-1578093462-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.splashtop.com/asusexpressgate/mb/searchAPI.php?SE=yahoo&QS=http%3A%2F%2Fsearch.yahoo.com%2Fsearch%3Ffr%3Dfp-devicevm%26type%3DWEB01
HKU\S-1-5-21-997025152-3087782429-1578093462-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.com
HKU\S-1-5-21-997025152-3087782429-1578093462-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.splashtop.com/asusexpressgate/mb/searchAPI.php?SE=yahoo&QS=http%3A%2F%2Fsearch.yahoo.com%2Fsearch%3Ffr%3Dfp-devicevm%26type%3DWEB01
HKU\S-1-5-21-997025152-3087782429-1578093462-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.com
URLSearchHook: HKU\S-1-5-21-997025152-3087782429-1578093462-1001 - SearchHook Class - {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\AddressBarSearch64.dll (DeviceVM, Inc.)
URLSearchHook: HKU\S-1-5-21-997025152-3087782429-1578093462-1001 - SearchHook Class - {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll (DeviceVM, Inc.)
URLSearchHook: HKU\S-1-5-21-997025152-3087782429-1578093462-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 - SearchHook Class - {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\AddressBarSearch64.dll (DeviceVM, Inc.)
URLSearchHook: HKU\S-1-5-21-997025152-3087782429-1578093462-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 - SearchHook Class - {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll (DeviceVM, Inc.)
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM -> DefaultScope {21A51130-7285-49FE-B3F6-2385CC71CDEA} URL = http://www.bing.com/search?q={searchTerms}&form=MNMTDF&pc=MANM&src=IE-SearchBox
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {21A51130-7285-49FE-B3F6-2385CC71CDEA} URL = http://www.bing.com/search?q={searchTerms}&form=MNMTDF&pc=MANM&src=IE-SearchBox
SearchScopes: HKLM -> {CC865B26-C31D-4D23-B17B-96548EEF03F6} URL =
SearchScopes: HKLM-x32 -> DefaultScope {21A51130-7285-49FE-B3F6-2385CC71CDEA} URL = http://www.bing.com/search?q={searchTerms}&form=MNMTDF&pc=MANM&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {21A51130-7285-49FE-B3F6-2385CC71CDEA} URL = http://www.bing.com/search?q={searchTerms}&form=MNMTDF&pc=MANM&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-997025152-3087782429-1578093462-1001 -> DefaultScope {C60F1051-1C73-4447-BE4D-9A6706496455} URL = http://groovorio.com/results.php?f=4&q={searchTerms}&a=grv_dwnldius_14_18&cd=2XzuyEtN2Y1L1Qzu0FyEyC0DtDyE0A0D0E0DyD0FyC0D0EyEtN0D0Tzu0StCtDtDyEtN1L2XzutAtFtBtFtCtFtDtN1L1Czu1N1C2X1V1Q2W1G1I1Q1L2Y1B1VtCyE1VtCzztN1L1G1B1V1N2Y1L1Qzu2StD0A0DyBtBtAzy0EtGyC0BtD0AtGtDtDyEtDtG0EtCzyzztGtByC0B0ByC0AyEyE0ByDtAtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0DyC0BtBtA0E0FyCtG0C0EtByEtGyE0F0F0DtGzy0E0AyDtG0D0ByCtByCtCyC0Azy0BtByD2Q&cr=211907928&ir=
SearchScopes: HKU\S-1-5-21-997025152-3087782429-1578093462-1001 -> {3E5DFA6D-3D8B-4703-8464-01ABDBC75428} URL = http://www.google.com/custom?client=pub-3794288947762788&forid=1&channel=5369970905&ie=UTF-8&oe=UTF-8&safe=active&cof=GALT%3A%23008000%3BGL%3A1%3BDIV%3A%23336699%3BVLC%3A663399%3BAH%3Acenter%3BBGC%3AFFFFFF%3BLBGC%3A336699%3BALC%3A0000FF%3BLC%3A0000FF%3BT%3A000000%3BGFNT%3A0000FF%3BGIMP%3A0000FF%3BFORID%3A1&hl=en&q={searchTerms}
SearchScopes: HKU\S-1-5-21-997025152-3087782429-1578093462-1001 -> {A87854B4-AD1C-4a1a-B3D6-580010D763EF} URL = http://search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=EGMB
SearchScopes: HKU\S-1-5-21-997025152-3087782429-1578093462-1001 -> {C60F1051-1C73-4447-BE4D-9A6706496455} URL = http://groovorio.com/results.php?f=4&q={searchTerms}&a=grv_dwnldius_14_18&cd=2XzuyEtN2Y1L1Qzu0FyEyC0DtDyE0A0D0E0DyD0FyC0D0EyEtN0D0Tzu0StCtDtDyEtN1L2XzutAtFtBtFtCtFtDtN1L1Czu1N1C2X1V1Q2W1G1I1Q1L2Y1B1VtCyE1VtCzztN1L1G1B1V1N2Y1L1Qzu2StD0A0DyBtBtAzy0EtGyC0BtD0AtGtDtDyEtDtG0EtCzyzztGtByC0B0ByC0AyEyE0ByDtAtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0DyC0BtBtA0E0FyCtG0C0EtByEtGyE0F0F0DtGzy0E0AyDtG0D0ByCtByCtCyC0Azy0BtByD2Q&cr=211907928&ir=
SearchScopes: HKU\S-1-5-21-997025152-3087782429-1578093462-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {C60F1051-1C73-4447-BE4D-9A6706496455} URL = http://groovorio.com/results.php?f=4&q={searchTerms}&a=grv_dwnldius_14_18&cd=2XzuyEtN2Y1L1Qzu0FyEyC0DtDyE0A0D0E0DyD0FyC0D0EyEtN0D0Tzu0StCtDtDyEtN1L2XzutAtFtBtFtCtFtDtN1L1Czu1N1C2X1V1Q2W1G1I1Q1L2Y1B1VtCyE1VtCzztN1L1G1B1V1N2Y1L1Qzu2StD0A0DyBtBtAzy0EtGyC0BtD0AtGtDtDyEtDtG0EtCzyzztGtByC0B0ByC0AyEyE0ByDtAtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0DyC0BtBtA0E0FyCtG0C0EtByEtGyE0F0F0DtGzy0E0AyDtG0D0ByCtByCtCyC0Azy0BtByD2Q&cr=211907928&ir=
SearchScopes: HKU\S-1-5-21-997025152-3087782429-1578093462-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {3E5DFA6D-3D8B-4703-8464-01ABDBC75428} URL = http://www.google.com/custom?client=pub-3794288947762788&forid=1&channel=5369970905&ie=UTF-8&oe=UTF-8&safe=active&cof=GALT%3A%23008000%3BGL%3A1%3BDIV%3A%23336699%3BVLC%3A663399%3BAH%3Acenter%3BBGC%3AFFFFFF%3BLBGC%3A336699%3BALC%3A0000FF%3BLC%3A0000FF%3BT%3A000000%3BGFNT%3A0000FF%3BGIMP%3A0000FF%3BFORID%3A1&hl=en&q={searchTerms}
SearchScopes: HKU\S-1-5-21-997025152-3087782429-1578093462-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {A87854B4-AD1C-4a1a-B3D6-580010D763EF} URL = http://search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=EGMB
SearchScopes: HKU\S-1-5-21-997025152-3087782429-1578093462-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {C60F1051-1C73-4447-BE4D-9A6706496455} URL = http://groovorio.com/results.php?f=4&q={searchTerms}&a=grv_dwnldius_14_18&cd=2XzuyEtN2Y1L1Qzu0FyEyC0DtDyE0A0D0E0DyD0FyC0D0EyEtN0D0Tzu0StCtDtDyEtN1L2XzutAtFtBtFtCtFtDtN1L1Czu1N1C2X1V1Q2W1G1I1Q1L2Y1B1VtCyE1VtCzztN1L1G1B1V1N2Y1L1Qzu2StD0A0DyBtBtAzy0EtGyC0BtD0AtGtDtDyEtDtG0EtCzyzztGtByC0B0ByC0AyEyE0ByDtAtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0DyC0BtBtA0E0FyCtG0C0EtByEtGyE0F0F0DtGzy0E0AyDtG0D0ByCtByCtCyC0Azy0BtByD2Q&cr=211907928&ir=
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKU\S-1-5-21-997025152-3087782429-1578093462-1001 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Toolbar: HKU\S-1-5-21-997025152-3087782429-1578093462-1001 -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} -  No File
Toolbar: HKU\S-1-5-21-997025152-3087782429-1578093462-1001 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Toolbar: HKU\S-1-5-21-997025152-3087782429-1578093462-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Toolbar: HKU\S-1-5-21-997025152-3087782429-1578093462-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} -  No File
Toolbar: HKU\S-1-5-21-997025152-3087782429-1578093462-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_296.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.31211.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.31211.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\user.js

Chrome:
=======
CHR Profile: C:\Users\Bo$$ Brenna\AppData\Local\Google\Chrome\User Data\Default

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [172344 2014-07-22] (SUPERAntiSpyware.com)
R2 ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [496232 2010-01-21] ()
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-03] (Macrovision Corporation) [File not signed]
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)
R2 nSvcIp; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [209000 2010-01-21] ()
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1721800 2014-08-08] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [18974152 2014-08-08] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-08-16] ()
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2009-08-03] ()
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [270912 2011-08-10] (DT Soft Ltd)
R3 LGSHidFilt; C:\Windows\System32\DRIVERS\LGSHidFilt.Sys [66360 2012-10-02] (Logitech Inc.)
R3 LGSUsbFilt; C:\Windows\System32\DRIVERS\LGSUsbFilt.Sys [43832 2012-10-02] (Logitech Inc.)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-26] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-15] ()
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [21448 2014-08-08] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-26 11:57 - 2015-01-26 11:57 - 00023631 _____ () C:\Users\Bo$$ Brenna\Downloads\FRST.txt
2015-01-26 11:57 - 2015-01-26 11:57 - 00000000 ____D () C:\FRST
2015-01-26 11:56 - 2015-01-26 11:56 - 02129920 _____ (Farbar) C:\Users\Bo$$ Brenna\Downloads\FRST64.exe
2015-01-25 20:49 - 2015-01-26 11:43 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
2015-01-25 20:49 - 2015-01-25 20:49 - 00001808 _____ () C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
2015-01-25 20:49 - 2015-01-25 20:49 - 00000000 ____D () C:\ProgramData\SUPERAntiSpyware.com
2015-01-25 20:49 - 2015-01-25 20:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
2015-01-25 20:00 - 2014-12-11 09:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-25 19:59 - 2014-12-18 19:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-25 19:59 - 2014-12-18 17:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-25 19:59 - 2014-12-05 20:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-25 19:59 - 2014-12-05 19:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-25 19:59 - 2014-12-05 19:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-25 19:58 - 2014-12-11 21:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-25 19:58 - 2014-12-11 21:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-01-25 19:58 - 2014-12-11 21:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-01-25 19:58 - 2014-12-11 21:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-01-25 19:58 - 2014-12-11 21:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-25 19:58 - 2014-12-11 21:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-25 19:58 - 2014-12-11 21:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-01-23 00:18 - 2015-01-23 12:57 - 00000000 ____D () C:\ProgramData\FowiRifi
2015-01-22 11:45 - 2015-01-22 11:45 - 00008516 _____ () C:\Users\Public\HELP_DECRYPT.HTML
2015-01-22 11:45 - 2015-01-22 11:45 - 00008516 _____ () C:\Users\Public\Downloads\HELP_DECRYPT.HTML
2015-01-22 11:45 - 2015-01-22 11:45 - 00008516 _____ () C:\Users\Bo$$ Brenna\HELP_DECRYPT.HTML
2015-01-22 11:45 - 2015-01-22 11:45 - 00004198 _____ () C:\Users\Public\HELP_DECRYPT.TXT
2015-01-22 11:45 - 2015-01-22 11:45 - 00004198 _____ () C:\Users\Public\Downloads\HELP_DECRYPT.TXT
2015-01-22 11:45 - 2015-01-22 11:45 - 00004198 _____ () C:\Users\Bo$$ Brenna\HELP_DECRYPT.TXT
2015-01-22 11:45 - 2015-01-22 11:45 - 00000268 _____ () C:\Users\Public\HELP_DECRYPT.URL
2015-01-22 11:45 - 2015-01-22 11:45 - 00000268 _____ () C:\Users\Public\Downloads\HELP_DECRYPT.URL
2015-01-22 11:45 - 2015-01-22 11:45 - 00000268 _____ () C:\Users\Bo$$ Brenna\HELP_DECRYPT.URL
2015-01-21 23:51 - 2015-01-21 23:51 - 00008516 _____ () C:\Users\Bo$$ Brenna\AppData\HELP_DECRYPT.HTML
2015-01-21 23:51 - 2015-01-21 23:51 - 00004198 _____ () C:\Users\Bo$$ Brenna\AppData\HELP_DECRYPT.TXT
2015-01-21 23:51 - 2015-01-21 23:51 - 00000268 _____ () C:\Users\Bo$$ Brenna\AppData\HELP_DECRYPT.URL
2015-01-21 23:50 - 2015-01-21 23:50 - 00008516 _____ () C:\ProgramData\HELP_DECRYPT.HTML
2015-01-21 23:50 - 2015-01-21 23:50 - 00004198 _____ () C:\ProgramData\HELP_DECRYPT.TXT
2015-01-21 23:50 - 2015-01-21 23:50 - 00000268 _____ () C:\ProgramData\HELP_DECRYPT.URL

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-26 11:51 - 2009-07-13 20:45 - 00028928 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-26 11:51 - 2009-07-13 20:45 - 00028928 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-26 11:48 - 2011-06-16 00:06 - 01906489 _____ () C:\Windows\WindowsUpdate.log
2015-01-26 11:47 - 2012-04-16 01:47 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-26 11:44 - 2014-09-02 10:12 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-26 11:43 - 2011-07-11 16:17 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-01-26 11:42 - 2014-12-23 16:40 - 00001726 _____ () C:\Windows\PFRO.log
2015-01-26 11:42 - 2014-12-09 23:03 - 00007392 _____ () C:\Windows\setupact.log
2015-01-26 11:42 - 2012-08-23 23:01 - 00000422 _____ () C:\Windows\Tasks\PC Optimizer Pro64 startups.job
2015-01-26 11:42 - 2011-06-16 00:26 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-01-26 11:42 - 2009-07-13 21:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-25 23:48 - 2012-04-16 01:47 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-01-25 23:48 - 2012-04-16 01:47 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-01-25 23:48 - 2011-07-11 16:10 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-25 21:11 - 2013-08-14 02:01 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-25 21:08 - 2011-07-15 11:42 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-25 19:48 - 2011-07-11 13:04 - 00000000 ____D () C:\Users\Bo$$ Brenna
2015-01-25 19:46 - 2014-12-09 13:24 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-25 19:46 - 2012-05-06 10:21 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-25 19:46 - 2012-03-09 09:36 - 00000000 ____D () C:\Users\Public\Downloads\Norton
2015-01-25 19:46 - 2012-02-24 15:45 - 00000000 ____D () C:\Windows\Minidump
2015-01-25 19:46 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\registration
2015-01-25 19:45 - 2013-08-29 18:22 - 00000000 ____D () C:\ProgramData\LogiShrd
2015-01-25 19:45 - 2011-07-11 17:41 - 00000000 ____D () C:\ProgramData\W3i
2015-01-25 19:45 - 2011-07-11 15:05 - 00000000 ____D () C:\ProgramData\DeviceVm
2015-01-22 11:45 - 2012-11-03 22:35 - 00000000 ____D () C:\Users\Bo$$ Brenna\Virtual Audio Cable 4.10
2015-01-21 23:50 - 2012-04-18 23:40 - 00000000 __SHD () C:\ProgramData\SecuROM
2015-01-21 23:50 - 2011-07-26 21:38 - 00000000 ____D () C:\ProgramData\WindSolutions
2015-01-07 19:29 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\rescache
2014-12-31 03:14 - 2010-11-20 19:27 - 00298120 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

==================== Files in the root of some directories =======

2015-01-21 23:51 - 2015-01-21 23:51 - 0008516 _____ () C:\Users\Bo$$ Brenna\AppData\Roaming\HELP_DECRYPT.HTML
2015-01-21 23:51 - 2015-01-21 23:51 - 0045357 _____ () C:\Users\Bo$$ Brenna\AppData\Roaming\HELP_DECRYPT.PNG
2015-01-21 23:51 - 2015-01-21 23:51 - 0004198 _____ () C:\Users\Bo$$ Brenna\AppData\Roaming\HELP_DECRYPT.TXT
2015-01-21 23:51 - 2015-01-21 23:51 - 0000268 _____ () C:\Users\Bo$$ Brenna\AppData\Roaming\HELP_DECRYPT.URL
2014-10-16 09:19 - 2014-10-16 09:19 - 0063996 _____ () C:\Users\Bo$$ Brenna\AppData\Roaming\icarus-dxdiag.xml
2011-07-26 21:55 - 2011-07-26 21:55 - 0003584 _____ () C:\Users\Bo$$ Brenna\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-01-21 23:51 - 2015-01-21 23:51 - 0008516 _____ () C:\Users\Bo$$ Brenna\AppData\Local\HELP_DECRYPT.HTML
2015-01-21 23:51 - 2015-01-21 23:51 - 0045357 _____ () C:\Users\Bo$$ Brenna\AppData\Local\HELP_DECRYPT.PNG
2015-01-21 23:51 - 2015-01-21 23:51 - 0004198 _____ () C:\Users\Bo$$ Brenna\AppData\Local\HELP_DECRYPT.TXT
2015-01-21 23:51 - 2015-01-21 23:51 - 0000268 _____ () C:\Users\Bo$$ Brenna\AppData\Local\HELP_DECRYPT.URL
2013-02-06 20:13 - 2014-09-16 14:35 - 0007605 _____ () C:\Users\Bo$$ Brenna\AppData\Local\Resmon.ResmonCfg
2012-09-13 00:12 - 2012-09-13 00:12 - 0000000 _____ () C:\ProgramData\0x0304A000.sfl
2015-01-21 23:50 - 2015-01-21 23:50 - 0008516 _____ () C:\ProgramData\HELP_DECRYPT.HTML
2015-01-21 23:50 - 2015-01-21 23:50 - 0045357 _____ () C:\ProgramData\HELP_DECRYPT.PNG
2015-01-21 23:50 - 2015-01-21 23:50 - 0004198 _____ () C:\ProgramData\HELP_DECRYPT.TXT
2015-01-21 23:50 - 2015-01-21 23:50 - 0000268 _____ () C:\ProgramData\HELP_DECRYPT.URL
2012-10-01 10:23 - 2012-10-01 10:23 - 0006400 _____ () C:\ProgramData\NanoRepository.bin
2012-10-01 10:23 - 2012-10-01 10:23 - 0006400 _____ () C:\ProgramData\NanoRepository.bin.bak

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-19 05:04

==================== End Of Log ============================


Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-01-2015 01
Ran by Bo$$ Brenna at 2015-01-26 11:57:52
Running from C:\Users\Bo$$ Brenna\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKU\S-1-5-21-997025152-3087782429-1578093462-1001\...\uTorrent) (Version: 3.4.2.35702 - BitTorrent Inc.)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Acrobat.com (HKLM-x32\...\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.1.377 - Adobe Systems Incorporated)
Acrobat.com (x32 Version: 0.0.0 - Adobe Systems Incorporated) Hidden
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.0.4990 - Adobe Systems Inc.)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.296 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.296 - Adobe Systems Incorporated)
Adobe Reader X (10.1.7) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.7 - Adobe Systems Incorporated)
Akamai NetSession Interface (HKU\S-1-5-21-997025152-3087782429-1578093462-1001\...\Akamai) (Version:  - Akamai Technologies, Inc)
APB Reloaded (HKLM-x32\...\Steam App 113400) (Version:  - Reloaded Productions)
Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{2EF5D87E-B7BD-458F-8428-E4D0B8B4E65C}) (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Audacity 2.0.2 (HKLM-x32\...\Audacity_is1) (Version: 2.0.2 - Audacity Team)
Avidemux 2.6 (32-bit) (HKLM-x32\...\Avidemux 2.6) (Version: 2.6.0.8179 - )
Belkin F7D1101 Basic Wireless USB Adapter (HKLM-x32\...\InstallShield_{AFD89880-C544-4777-B645-FBF6D3391B11}) (Version: 1.0.0.4 - Belkin)
Belkin F7D1101 Basic Wireless USB Adapter (x32 Version: 1.0.0.4 - Belkin) Hidden
BioShock (HKLM-x32\...\Steam App 7670) (Version:  - 2K Boston)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Browser Configuration Utility (HKLM-x32\...\{BA88EE67-8974-459D-A1DB-C8281D9AC6F6}) (Version: 1.0.12.1 - DeviceVM, Inc.) <==== ATTENTION
CCleaner (HKLM\...\CCleaner) (Version: 3.21 - Piriform)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.41.3.0173 - DT Soft Ltd)
Dead Island (HKLM-x32\...\Steam App 91310) (Version:  - Techland)
EA Download Manager (HKLM-x32\...\EADM) (Version: 5.0.0.255 - Electronic Arts, Inc.)
EphPod (HKLM-x32\...\EphPod) (Version:  - )
EPU-4 Engine (HKLM-x32\...\{8F66047B-1AF3-40D9-80D7-106E2EDC2C2A}) (Version: 1.02.01 - )
EVGA Precision 2.0.2 (HKLM-x32\...\Precision) (Version: 2.0.2 - EVGA Corporation)
Fallout 3 - Game of the Year Edition (HKLM-x32\...\Steam App 22370) (Version:  - Bethesda Softworks)
Fallout: New Vegas (HKLM-x32\...\Steam App 22380) (Version:  - Bethesda Softworks)
Gotham City Impostors: Free To Play (HKLM-x32\...\Steam App 206210) (Version:  - Monolith Productions, Inc.)
Infestation: Survivor Stories (HKLM-x32\...\Steam App 226700) (Version:  - Hammerpoint Interactive)
Itibiti RTC (x32 Version: 0.0.1 - Itibiti Inc) Hidden
iTunes (HKLM\...\{D601CEAD-2E4F-4BBB-85CC-C29A4CE6A3C0}) (Version: 11.1.3.8 - Apple Inc.)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Left 4 Dead (HKLM-x32\...\Steam App 500) (Version:  - Valve)
Left 4 Dead 2 (HKLM-x32\...\Steam App 550) (Version:  - Valve)
Loadout (HKLM-x32\...\Steam App 208090) (Version:  - Edge of Reality)
Logitech Gaming Software 8.40 (HKLM\...\Logitech Gaming Software) (Version: 8.40.83 - Logitech Inc.)
Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Messenger Companion (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}) (Version: 3.5.92.0 - Microsoft Corporation)
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Professional 2010 (HKLM\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Outlook Social Connector Provider for Windows Live Messenger 64-bit (HKLM\...\{95140000-007D-0409-1000-0000000FF1CE}) (Version: 14.0.5120.5000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.31211.0 - Microsoft Corporation)
Microsoft SkyDrive (HKU\S-1-5-21-997025152-3087782429-1578093462-1001\...\SkyDriveSetup.exe) (Version: 17.0.2015.0811 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\...\{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM-x32\...\{8e70e4e1-06d7-470b-9f74-a51bef21088e}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Word 2010 (HKLM\...\Office14.WORD) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
Mozilla Firefox 34.0.5 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 34.0.5 (x86 en-US)) (Version: 34.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
NVIDIA 3D Vision Controller Driver 340.50 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 340.50 - NVIDIA Corporation)
NVIDIA 3D Vision Driver 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 340.52 - NVIDIA Corporation)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10.57.35 - NVIDIA Corporation)
NVIDIA ForceWare Network Access Manager (HKLM-x32\...\{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}) (Version: 1.00.7325.0 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.1.1.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.1.1 - NVIDIA Corporation)
NVIDIA Graphics Driver 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 340.52 - NVIDIA Corporation)
NVIDIA HD Audio Driver 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
OAS (HKU\S-1-5-21-997025152-3087782429-1578093462-1001\...\Online Ad Scanner) (Version: 1.00 - OAS Corp)
Oregon Trail 5th Edition (HKU\S-1-5-21-997025152-3087782429-1578093462-1001\...\Oregon Trail 5th Edition) (Version:  - )
PeerBlock 1.1 (r518) (HKLM\...\{015C5B35-B678-451C-9AEE-821E8D69621C}_is1) (Version: 1.1.0.518 - PeerBlock, LLC)
Platform (x32 Version: 1.34 - VIA Technologies, Inc.) Hidden
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.)
QuickTime (HKLM-x32\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-001B-0000-1000-0000000FF1CE}_Office14.WORD_{A3364707-2F53-4C83-8F68-C9877A9080C7}) (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-003D-0000-1000-0000000FF1CE}_Office14.SingleImage_{A3364707-2F53-4C83-8F68-C9877A9080C7}) (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version:  - Microsoft) Hidden
Setup Screen Saver (HKLM-x32\...\Setup) (Version:  - )
SHIELD Streaming (Version: 3.1.100 - NVIDIA Corporation) Hidden
Sid Meier's Civilization V (HKLM-x32\...\Steam App 8930) (Version:  - 2K Games, Inc.)
Sid Meier's Civilization V: Brave New World Demo (HKLM-x32\...\Steam App 242180) (Version:  - Firaxis Games)
Sid Meier's Civilization V: Gods & Kings Demo (HKLM-x32\...\Steam App 213910) (Version:  - Firaxis Games)
SoulSeek 157 NS 13e (HKLM-x32\...\Soulseek2) (Version:  - )
Source Filmmaker (HKLM-x32\...\Steam App 1840) (Version:  - Valve)
State of Decay (HKLM-x32\...\Steam App 241540) (Version:  - Undead Labs)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 6.0.1168 - SUPERAntiSpyware.com)
System Requirements Lab Detection (HKLM-x32\...\{99F2020E-67D2-4704-812D-D8C584D8C80B}) (Version: 2.1.1.0 - Husdawg, LLC)
Team Fortress 2 (HKLM-x32\...\Steam App 440) (Version:  - Valve)
The Sims™ 3 (HKLM-x32\...\Steam App 47890) (Version:  - The Sims Studio)
The Walking Dead (HKLM-x32\...\Steam App 207610) (Version:  - )
The Walking Dead: Season Two (HKLM-x32\...\Steam App 261030) (Version:  - Telltale Games)
The Walking Dead™: Survival Instinct (HKLM-x32\...\Steam App 220050) (Version:  - )
Tropico 3: Absolute Power (HKLM-x32\...\Steam App 57600) (Version:  - )
Tropico 4 1.00 (HKU\S-1-5-21-997025152-3087782429-1578093462-1001\...\Tropico 4) (Version: 1.00 - Kalypso Media)
Tropico 5 (HKLM-x32\...\Tropico 5_is1) (Version:  - )
VIA Platform Device Manager (HKLM-x32\...\InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}) (Version: 1.34 - VIA Technologies, Inc.)
Visual C++ 8.0 Runtime Setup Package (x64) (HKLM-x32\...\{2FDBBCEA-62DB-45F4-B6E5-0E1FB2A1F29D}) (Version: 9.0.0.623 - AVG Technologies CZ, s.r.o.)
VLC media player 1.1.7 (HKLM-x32\...\VLC media player) (Version: 1.1.7 - VideoLAN)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Sync (HKLM-x32\...\{B10914FD-8812-47A4-85A1-50FCDE7F1F33}) (Version: 14.0.8117.416 - Microsoft Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-997025152-3087782429-1578093462-1001_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-997025152-3087782429-1578093462-1001_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-997025152-3087782429-1578093462-1001_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-997025152-3087782429-1578093462-1001_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-997025152-3087782429-1578093462-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points  =========================

12-01-2015 00:10:10 Windows Update
13-01-2015 15:17:04 Windows Update
14-01-2015 01:51:12 Windows Update
18-01-2015 23:54:09 Windows Update
23-01-2015 00:29:08 Windows Update
25-01-2015 20:01:44 Windows Update
25-01-2015 21:08:18 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 18:34 - 2009-06-10 13:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0118297F-6C52-401B-AB74-389C0EF9A735} - System32\Tasks\4721 => Wscript.exe C:\Users\BO$$BR~1\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION
Task: {01DECA93-0B1B-4377-BC4C-D549874D6D2E} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2012-07-24] (Piriform Ltd)
Task: {02572850-DD17-4EA3-ABF7-2E6CCBFBD52E} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {0B51FAD1-62D9-43F8-86D8-500E1610C2C4} - System32\Tasks\SMupdate1 => Rundll32.exe C:\PROGRA~1\COMMON~1\System\SysMenu.dll ,Command701 update1 <==== ATTENTION
Task: {0FA1DA12-D8DA-4395-902E-10274FACC1EA} - System32\Tasks\{A64A0548-0DA2-4B7E-B81F-74DDA6974EE6} => C:\Program Files (x86)\Steam\steamapps\common\The Walking Dead\WalkingDead101.exe [2014-04-28] (Telltale Games)
Task: {25CDFBBA-9003-464E-BD8A-D6E65B2447AA} - System32\Tasks\PCSpeedClean_Popup => C:\Program Files (x86)\PC Speed Clean\Splash.exe
Task: {3E94E228-4F20-4222-B0DA-3E6D6AF4E057} - System32\Tasks\PC Optimizer Pro64 startups => C:\Program Files\PC Optimizer Pro\StartApps.exe <==== ATTENTION
Task: {44EAA9B5-40DD-45BB-9C25-2A9979F2112B} - System32\Tasks\{C7550588-1A36-4C3A-BED3-9D1CB4845A65} => pcalua.exe -a "C:\Program Files (x86)\GoPCPro\gopcpro.exe" -c -u
Task: {451442D1-BBED-400A-B690-0AC5FBC69FD6} - System32\Tasks\0 => Iexplore.exe  <==== ATTENTION
Task: {57AB5C95-ED33-4CE7-82BA-F3312A89650D} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-25] (Adobe Systems Incorporated)
Task: {6C951BBD-7D94-45B9-8362-ECF782230E8B} - System32\Tasks\Microsoft\Windows\Multimedia\SMupdate3 => Rundll32.exe C:\PROGRA~1\COMMON~1\System\SysMenu.dll ,Command701 update3 <==== ATTENTION
Task: {762660E9-B267-48F2-94AB-452102F6CCEC} - System32\Tasks\{F61A1CD6-7A40-407E-ABB9-C7A4DD451337} => pcalua.exe -a D:\SetupAssistant.exe -d D:\
Task: {79E5A86E-8DD1-4324-8BE7-2D6BD7872BFE} - System32\Tasks\PCSpeedClean_Start => C:\Program Files (x86)\PC Speed Clean\PCSpeedClean.exe
Task: {87F4F3C9-4FFB-49B5-9967-89B5C73728E8} - System32\Tasks\Microsoft\Windows\Maintenance\SMupdate2 => Rundll32.exe C:\PROGRA~1\COMMON~1\System\SysMenu.dll ,Command701 update2 <==== ATTENTION
Task: {B883BBCF-4853-4C1C-97F1-DA9AA2CD5F38} - System32\Tasks\{CC5BCE07-CC3F-46FB-8562-7DA4F175636C} => pcalua.exe -a "C:\Program Files (x86)\Steam\steam.exe" -c steam://uninstall/113420
Task: {C7673732-E289-4E31-B494-3D973EC540FD} - System32\Tasks\YTDownloader => C:\Program Files (x86)\YTDownloader\YTDownloader.exe <==== ATTENTION
Task: {D1167DB8-9C96-44B2-98C1-A9EB9111CFE5} - System32\Tasks\{16694E65-4CFD-4783-94FE-489C8AE02193} => pcalua.exe -a E:\Sims3Setup.exe -d E:\
Task: {E0A85AE2-9AAF-4AD1-A7A9-30CF5BF24054} - System32\Tasks\{FB4B3B86-CAAD-4066-9817-5E8DE572A48D} => pcalua.exe -a E:\autorun.exe -d E:\
Task: {ECF8A19D-FAC6-4417-82ED-BB9841B799FB} - System32\Tasks\LaunchSignup => C:\Program Files (x86)\MyPC Backup\Signup Wizard.exe <==== ATTENTION
Task: {EE0EC228-4591-4824-864A-71EFC1E5B52A} - System32\Tasks\ASUS\ASUS SIX Engine => C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe [2010-02-03] (ASUSTeK Computer Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\PC Optimizer Pro64 startups.job => C:\Program Files\PC Optimizer Pro\StartApps.exe <==== ATTENTION

==================== Loaded Modules (whitelisted) =============

2011-03-20 16:33 - 2014-07-02 10:55 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2012-10-22 23:24 - 2013-08-16 22:49 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2011-06-16 00:09 - 2010-01-21 00:53 - 00496232 _____ () C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
2011-06-16 00:09 - 2010-01-21 00:52 - 00076392 _____ () C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nv_common.dll
2011-06-16 00:09 - 2010-01-21 00:53 - 00731752 _____ () C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\SpecialCase.dll
2011-06-16 00:09 - 2010-01-21 00:53 - 00209000 _____ () C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
2011-06-16 00:07 - 2010-05-24 01:10 - 00076192 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\QsApoApi64.dll
2011-06-16 00:07 - 2010-05-24 01:10 - 00383904 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Dts2ApoApi64.dll
2011-06-16 00:07 - 2010-05-24 01:10 - 00103328 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\VMicApi.dll
2011-06-16 00:07 - 2010-05-24 01:10 - 64641440 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Skin.dll
2014-09-22 03:36 - 2014-09-22 03:36 - 00177152 _____ () C:\Users\Bo$$ Brenna\AppData\Roaming\oas\oas.exe
2014-09-22 23:09 - 2014-09-22 23:09 - 00007168 _____ () C:\Users\Bo$$ Brenna\AppData\Roaming\oas\mcc.exe
2011-09-27 07:23 - 2011-09-27 07:23 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2011-09-27 07:22 - 2011-09-27 07:22 - 01242472 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2011-07-11 15:04 - 2009-03-19 21:35 - 00208896 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\AiNap.dll
2011-07-11 15:04 - 2009-03-19 21:35 - 00008704 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\vvc.dll
2011-07-11 15:04 - 2009-01-15 13:55 - 00565248 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\pngio.dll
2011-07-11 15:04 - 2009-03-25 15:53 - 00053248 _____ () C:\Program Files (x86)\ASUS\EPU-4 Engine\AsSpindownTimeout.dll
2015-01-19 00:59 - 2014-12-09 13:24 - 03758192 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2009-07-31 20:39 - 2009-07-31 20:39 - 00503202 _____ () C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\sqlite3.dll
2014-03-28 12:59 - 2014-03-28 12:59 - 01100784 _____ () C:\Users\Bo$$ Brenna\AppData\Roaming\oas\avcodec-53.dll
2014-03-28 12:59 - 2014-03-28 12:59 - 00124400 _____ () C:\Users\Bo$$ Brenna\AppData\Roaming\oas\avutil-51.dll
2014-03-28 12:59 - 2014-03-28 12:59 - 00191984 _____ () C:\Users\Bo$$ Brenna\AppData\Roaming\oas\avformat-53.dll
2014-07-08 08:31 - 2014-07-08 08:31 - 17029808 _____ () C:\Users\Bo$$ Brenna\AppData\Roaming\oas\plugins\NPSWF32_14_0_0_145.dll
2014-03-28 12:59 - 2014-03-28 12:59 - 00628704 _____ () C:\Users\Bo$$ Brenna\AppData\Roaming\oas\libglesv2.dll
2014-03-28 12:59 - 2014-03-28 12:59 - 00118240 _____ () C:\Users\Bo$$ Brenna\AppData\Roaming\oas\libegl.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:58D8F144

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: GoPCPro => C:\Program Files (x86)\GoPCPro\GoPcPro.exe
MSCONFIG\startupreg: MSC => "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey

========================= Accounts: ==========================

Administrator (S-1-5-21-997025152-3087782429-1578093462-500 - Administrator - Disabled)
Bo$$ Brenna (S-1-5-21-997025152-3087782429-1578093462-1001 - Administrator - Enabled) => C:\Users\Bo$$ Brenna
Guest (S-1-5-21-997025152-3087782429-1578093462-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-997025152-3087782429-1578093462-1003 - Limited - Enabled)

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft Teredo Tunneling Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (01/26/2015 11:43:02 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/26/2015 00:29:55 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: plugin-container.exe, version: 34.0.5.5443, time stamp: 0x5475dd5d
Faulting module name: mozalloc.dll, version: 34.0.5.5443, time stamp: 0x5475d664
Exception code: 0x80000003
Fault offset: 0x00001425
Faulting process id: 0xa70
Faulting application start time: 0xplugin-container.exe0
Faulting application path: plugin-container.exe1
Faulting module path: plugin-container.exe2
Report Id: plugin-container.exe3

Error: (01/25/2015 11:47:05 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/25/2015 07:48:50 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/25/2015 07:42:43 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/25/2015 07:38:04 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/23/2015 01:36:35 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/23/2015 01:25:29 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/23/2015 01:02:43 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/23/2015 00:59:03 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (01/25/2015 08:57:43 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Steam Client Service service failed to start due to the following error:
%%1053

Error: (01/25/2015 08:57:43 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Steam Client Service service to connect.

Error: (01/25/2015 07:47:57 PM) (Source: Microsoft Antimalware) (EventID: 2004) (User: )
Description: %60 has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures.

    Signatures Attempted: %24

    Error Code: 0x80070002

    Error description: The system cannot find the file specified.

    Signature version: 0.0.0.0;0.0.0.0

    Engine version: %600

Error: (01/25/2015 07:41:58 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1084wuauserv{E60687F7-01A1-40AA-86AC-DB1CBF673334}

Error: (01/25/2015 07:41:13 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error:
%%1068

Error: (01/25/2015 07:41:13 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1068netprofm{A47979D2-C419-11D9-A5B4-001185AD2B89}

Error: (01/25/2015 07:41:04 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
AFD
AsIO
DfsC
discache
MpFilter
NetBIOS
NetBT
nsiproxy
Psched
rdbss
spldr
tdx
vwififlt
Wanarpv6
WfpLwf

Error: (01/25/2015 07:41:03 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error:
%%1068

Error: (01/25/2015 07:41:03 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Microsoft Network Inspection System service depends on the Microsoft Malware Protection Driver service which failed to start because of the following error:
%%31

Error: (01/25/2015 07:41:03 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error:
%%1068


Microsoft Office Sessions:
=========================
Error: (01/26/2015 11:43:02 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/26/2015 00:29:55 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe34.0.5.54435475dd5dmozalloc.dll34.0.5.54435475d6648000000300001425a7001d0393cf2f3fe50C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll80f6e780-a535-11e4-9d40-ae8b5b246f64

Error: (01/25/2015 11:47:05 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/25/2015 07:48:50 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/25/2015 07:42:43 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/25/2015 07:38:04 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/23/2015 01:36:35 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/23/2015 01:25:29 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/23/2015 01:02:43 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/23/2015 00:59:03 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


==================== Memory info ===========================

Processor: AMD Phenom™ II X4 965 Processor
Percentage of memory in use: 26%
Total physical RAM: 8191.23 MB
Available physical RAM: 6008.77 MB
Total Pagefile: 16380.64 MB
Available Pagefile: 13681.2 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:931.41 GB) (Free:662.21 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 8357FF14)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS)

==================== End Of Log ============================



#3 cappatown

cappatown
  • Topic Starter

  • Members
  • 93 posts
  • OFFLINE
  •  
  • Local time:03:12 PM

Posted 28 January 2015 - 03:52 PM

Can anybody help me? Other users postings are later than mine and have been helped...

 

My anti-malwarebytes cannot find anything but my web brower and a picture file pops up with the cryptowall information telling me to pay.



#4 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,608 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:03:12 PM

Posted 28 January 2015 - 08:43 PM

Greetings cappatown and :welcome: to BleepingComputer's Virus/Trojan/Spyware/Malware Removal forum.

My name is Oh My! and I am here to help you! Now that we are "friends" please call me Gary.

If you would allow me to call you by your first name I would prefer to do that. :thumbup2:

===================================================

Ground Rules:
  • First, I would like to inform you that most of us here at Bleeping Computer offer our expert assistance out of the goodness of our hearts. Please try to match our commitment to you with your patience toward us. If this was easy we would never have met. :)
  • Please do not run any tools or take any steps other than those I will provide for you while we work on your computer together. I need to be certain about the state of your computer in order to provide appropriate and effective steps for you to take. Most often "well intentioned" (and usually panic driven!) independent efforts can make things much worse for both of us. If at any point you would prefer to take your own steps please let me know, I will not be offended. I would be happy to focus on the many others who are waiting in line for assistance.
  • Please perform all steps in the order they are listed in each set of instructions. Some steps may be a bit complicated. If things are not clear, be sure to stop and let me know. We need to work on this together with confidence.
  • Please copy and paste all logs into your post unless directed otherwise. Please do not re-run any programs I suggest. If you encounter problems simply stop and tell me.
  • When you post your reply, use the Replytopic.jpg button instead.
  • In the upper right hand corner of the topic you will see the Followtopic.jpg button. Click on this then choose Immediate E-Mail notification and then Proceed and you will be sent an email once I have posted a response.
  • If you do not reply to your topic after 5 days we assume it has been abandoned and I will close it.
  • When your computer is clean I will alert you of such. I will also provide for you detailed information about how you can combat future infections.
  • I would like to remind you to make no further changes to your computer unless I direct you to do so.
  • Now let's get started :thumbup2:
===================================================

Now that I am assisting you, you can expect that I will be very responsive to your situation. If you are able, I would request you check this thread at least once per day so that we can try to resolve your issues effectively and efficiently. If you are going to be delayed please be considerate and post that information so that I know you are still with me. Unfortunately, there are many people waiting to be assisted and not enough of us at BleepingComputer to go around. I appreciate your understanding and diligence.

Thank you for your patience thus far.

Can you tell me if you set this Proxy?

ProxyServer: [.DEFAULT] => http=127.0.0.1:50023;https=127.0.0.1:50023

Please consider and run the below for me.

===================================================

P2P Warning

--------------------

Going over your logs I noticed that you have µTorrent installed. It is pretty much certain that if you continue to use P2P programs, you will get infected again.
  • Avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs.
  • They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites.
  • Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users.
  • The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications.
I would recommend that you uninstall µTorrent, however that choice is up to you. If you choose to remove the program, you can do so via Start > Control Panel > Add/Remove Programs.

If you are still leaning toward using this program, please take a look at this information about Ransomware which can be delivered via P2P file transfers. The newest variation of Ransomware can make it impossible to recover the files this malicious software encrypts. In other words, you will probably lose most if not all of your valuable information, including pictures. In addition it has recently been reported that P2P downloads may be tracked resulting in your IP address being monitored by copyright authorities. .

If you wish to keep it, please do not use it until we are completely done and your machine is determined to be clean and updated.

===================================================

Farbar's Recovery Scan Tool - Run Fix in Normal or Safe Mode

--------------------
  • Press the Windows key Windows_Logo_key.gif + r on your keyboard at the same time. Type in notepad and press Enter
  • Please copy and paste the contents of the below code box into the open notepad and save it to your desktop (<<<Important) as fixlist.txt
HKLM-x32\...\Run: [YTDownloader] => "C:\Program Files (x86)\YTDownloader\YTDownloader.exe" /boot
HKLM-x32\...\RunOnce: [AvgUninstallURL] => cmd.exe /c start http://www.avg.com/ww.special-uninstallation-feedback-app?lic="&"inst=NwA3AC0AMQA0ADIANgA1ADIAMwAzADUANwAtAEQARABUACsAMAAtAFMAVAA5ADAAQQBQAFAAKwAxAC0AUABMACsAOQAtAE4AMQBEACsAMQAtAEYAT (the data entry has 60 more characters).
HKU\S-1-5-21-997025152-3087782429-1578093462-1001\...\Run: [YTDownloader] => "C:\Program Files (x86)\YTDownloader\YTDownloader.exe" /boot
HKU\S-1-5-21-997025152-3087782429-1578093462-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [YTDownloader] => "C:\Program Files (x86)\YTDownloader\YTDownloader.exe" /boot
AppInit_DLLs-x32: => "" File Not Found
Toolbar: HKU\S-1-5-21-997025152-3087782429-1578093462-1001 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Toolbar: HKU\S-1-5-21-997025152-3087782429-1578093462-1001 -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} -  No File
Toolbar: HKU\S-1-5-21-997025152-3087782429-1578093462-1001 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Toolbar: HKU\S-1-5-21-997025152-3087782429-1578093462-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Toolbar: HKU\S-1-5-21-997025152-3087782429-1578093462-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} -  No File
Toolbar: HKU\S-1-5-21-997025152-3087782429-1578093462-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
2015-01-23 00:18 - 2015-01-23 12:57 - 00000000 ____D () C:\ProgramData\FowiRifi
2015-01-22 11:45 - 2015-01-22 11:45 - 00008516 _____ () C:\Users\Public\HELP_DECRYPT.HTML
2015-01-22 11:45 - 2015-01-22 11:45 - 00008516 _____ () C:\Users\Public\Downloads\HELP_DECRYPT.HTML
2015-01-22 11:45 - 2015-01-22 11:45 - 00008516 _____ () C:\Users\Bo$$ Brenna\HELP_DECRYPT.HTML
2015-01-22 11:45 - 2015-01-22 11:45 - 00004198 _____ () C:\Users\Public\HELP_DECRYPT.TXT
2015-01-22 11:45 - 2015-01-22 11:45 - 00004198 _____ () C:\Users\Public\Downloads\HELP_DECRYPT.TXT
2015-01-22 11:45 - 2015-01-22 11:45 - 00004198 _____ () C:\Users\Bo$$ Brenna\HELP_DECRYPT.TXT
2015-01-22 11:45 - 2015-01-22 11:45 - 00000268 _____ () C:\Users\Public\HELP_DECRYPT.URL
2015-01-22 11:45 - 2015-01-22 11:45 - 00000268 _____ () C:\Users\Public\Downloads\HELP_DECRYPT.URL
2015-01-22 11:45 - 2015-01-22 11:45 - 00000268 _____ () C:\Users\Bo$$ Brenna\HELP_DECRYPT.URL
2015-01-21 23:51 - 2015-01-21 23:51 - 00008516 _____ () C:\Users\Bo$$ Brenna\AppData\HELP_DECRYPT.HTML
2015-01-21 23:51 - 2015-01-21 23:51 - 00004198 _____ () C:\Users\Bo$$ Brenna\AppData\HELP_DECRYPT.TXT
2015-01-21 23:51 - 2015-01-21 23:51 - 00000268 _____ () C:\Users\Bo$$ Brenna\AppData\HELP_DECRYPT.URL
2015-01-21 23:50 - 2015-01-21 23:50 - 00008516 _____ () C:\ProgramData\HELP_DECRYPT.HTML
2015-01-21 23:50 - 2015-01-21 23:50 - 00004198 _____ () C:\ProgramData\HELP_DECRYPT.TXT
2015-01-21 23:50 - 2015-01-21 23:50 - 00000268 _____ () C:\ProgramData\HELP_DECRYPT.URL
2015-01-21 23:51 - 2015-01-21 23:51 - 0008516 _____ () C:\Users\Bo$$ Brenna\AppData\Roaming\HELP_DECRYPT.HTML
2015-01-21 23:51 - 2015-01-21 23:51 - 0045357 _____ () C:\Users\Bo$$ Brenna\AppData\Roaming\HELP_DECRYPT.PNG
2015-01-21 23:51 - 2015-01-21 23:51 - 0004198 _____ () C:\Users\Bo$$ Brenna\AppData\Roaming\HELP_DECRYPT.TXT
2015-01-21 23:51 - 2015-01-21 23:51 - 0000268 _____ () C:\Users\Bo$$ Brenna\AppData\Roaming\HELP_DECRYPT.URL
2014-10-16 09:19 - 2014-10-16 09:19 - 0063996 _____ () C:\Users\Bo$$ Brenna\AppData\Roaming\icarus-dxdiag.xml
2011-07-26 21:55 - 2011-07-26 21:55 - 0003584 _____ () C:\Users\Bo$$ Brenna\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-01-21 23:51 - 2015-01-21 23:51 - 0008516 _____ () C:\Users\Bo$$ Brenna\AppData\Local\HELP_DECRYPT.HTML
2015-01-21 23:51 - 2015-01-21 23:51 - 0045357 _____ () C:\Users\Bo$$ Brenna\AppData\Local\HELP_DECRYPT.PNG
2015-01-21 23:51 - 2015-01-21 23:51 - 0004198 _____ () C:\Users\Bo$$ Brenna\AppData\Local\HELP_DECRYPT.TXT
2015-01-21 23:51 - 2015-01-21 23:51 - 0000268 _____ () C:\Users\Bo$$ Brenna\AppData\Local\HELP_DECRYPT.URL
2015-01-21 23:50 - 2015-01-21 23:50 - 0045357 _____ () C:\ProgramData\HELP_DECRYPT.PNG
Task: {0118297F-6C52-401B-AB74-389C0EF9A735} - System32\Tasks\4721 => Wscript.exe C:\Users\BO$$BR~1\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION
Task: {0B51FAD1-62D9-43F8-86D8-500E1610C2C4} - System32\Tasks\SMupdate1 => Rundll32.exe C:\PROGRA~1\COMMON~1\System\SysMenu.dll ,Command701 update1 <==== ATTENTION
Task: {3E94E228-4F20-4222-B0DA-3E6D6AF4E057} - System32\Tasks\PC Optimizer Pro64 startups => C:\Program Files\PC Optimizer Pro\StartApps.exe <==== ATTENTION
Task: {451442D1-BBED-400A-B690-0AC5FBC69FD6} - System32\Tasks\0 => Iexplore.exe  <==== ATTENTION
Task: {6C951BBD-7D94-45B9-8362-ECF782230E8B} - System32\Tasks\Microsoft\Windows\Multimedia\SMupdate3 => Rundll32.exe C:\PROGRA~1\COMMON~1\System\SysMenu.dll ,Command701 update3 <==== ATTENTION
Task: {87F4F3C9-4FFB-49B5-9967-89B5C73728E8} - System32\Tasks\Microsoft\Windows\Maintenance\SMupdate2 => Rundll32.exe C:\PROGRA~1\COMMON~1\System\SysMenu.dll ,Command701 update2 <==== ATTENTION
Task: {C7673732-E289-4E31-B494-3D973EC540FD} - System32\Tasks\YTDownloader => C:\Program Files (x86)\YTDownloader\YTDownloader.exe <==== ATTENTION
Task: {ECF8A19D-FAC6-4417-82ED-BB9841B799FB} - System32\Tasks\LaunchSignup => C:\Program Files (x86)\MyPC Backup\Signup Wizard.exe <==== ATTENTION
Task: C:\Windows\Tasks\PC Optimizer Pro64 startups.job => C:\Program Files\PC Optimizer Pro\StartApps.exe <==== ATTENTION
AlternateDataStreams: C:\ProgramData\TEMP:58D8F144
C:\Users\BO$$BR~1\AppData\Local\Temp\launchie.vbs
emptytemp:
  • Launch FRST and press the Fix button just once and wait, the program will automatically launch fixlist.txt.
  • The tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.
===================================================

AdwCleaner by Xplode - Delete Adware

-------------------
  • Please download AdwCleaner by Xplode onto your desktop.
  • Close all open programs and internet browser
  • Double click on AdwCleaner.exe, select OK, then Run
  • Click on Scan
  • Upon completion click Report
  • Review the entries and uncheck any items you would like to keep on your computer (leaving an item checked will cause its deletion)
  • Click Clean to remove the items still checked
  • Click OK twice to reboot your computer
  • Copy and paste the contents of the text file on your desktop upon reboot in your reply
  • You can also find the logfile at C:\AdwCleaner\AdwCleaner.txt
===================================================

Junkware Removal Tool by thisisu

-------------------
  • Please download Junkware Removal Tool and save it to your desktop.
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
  • Right-mouse click JRT.exe and select Run as administrator (Windows XP double click the icon)
  • Please allow the program time to run
  • Once completed a Notepad document will open on your desktop
  • Copy and paste the contents in your reply
===================================================

System Summary Information

--------------------
  • Press the windows key Windows_Logo_key.gif + r on your keyboard at the same time
  • Type msinfo32 and press Enter
  • Left click on System Summary
  • Click File, Save, and name the file Summary
  • Zip and attach the file to your reply
===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it. :thumbsup2:
  • Proxy?
  • Fixlog
  • AdwCleaner log
  • Junkware log
  • System Summary Information
  • Update on computer performance

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#5 cappatown

cappatown
  • Topic Starter

  • Members
  • 93 posts
  • OFFLINE
  •  
  • Local time:03:12 PM

Posted 28 January 2015 - 11:40 PM

Hello my name is Brenna.

 

I don't know what a proxy is or how to set one.

 

I uninstalled UTorrent.

Here is my fix log:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 28-01-2015
Ran by Bo$$ Brenna at 2015-01-28 20:17:10 Run:1
Running from C:\Users\Bo$$ Brenna\Desktop
Loaded Profiles: Bo$$ Brenna (Available profiles: Bo$$ Brenna)
Boot Mode: Safe Mode (with Networking)
==============================================

Content of fixlist:
*****************
HKLM-x32\...\Run: [YTDownloader] => "C:\Program Files (x86)\YTDownloader\YTDownloader.exe" /boot
HKLM-x32\...\RunOnce: [AvgUninstallURL] => cmd.exe /c start http://www.avg.com/ww.special-uninstallation-feedback-app?lic="&"inst=NwA3AC0AMQA0ADIANgA1ADIAMwAzADUANwAtAEQARABUACsAMAAtAFMAVAA5ADAAQQBQAFAAKwAxAC0AUABMACsAOQAtAE4AMQBEACsAMQAtAEYAT (the data entry has 60 more characters).
HKU\S-1-5-21-997025152-3087782429-1578093462-1001\...\Run: [YTDownloader] => "C:\Program Files (x86)\YTDownloader\YTDownloader.exe" /boot
HKU\S-1-5-21-997025152-3087782429-1578093462-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [YTDownloader] => "C:\Program Files (x86)\YTDownloader\YTDownloader.exe" /boot
AppInit_DLLs-x32: => "" File Not Found
Toolbar: HKU\S-1-5-21-997025152-3087782429-1578093462-1001 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Toolbar: HKU\S-1-5-21-997025152-3087782429-1578093462-1001 -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} -  No File
Toolbar: HKU\S-1-5-21-997025152-3087782429-1578093462-1001 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Toolbar: HKU\S-1-5-21-997025152-3087782429-1578093462-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Toolbar: HKU\S-1-5-21-997025152-3087782429-1578093462-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} -  No File
Toolbar: HKU\S-1-5-21-997025152-3087782429-1578093462-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
2015-01-23 00:18 - 2015-01-23 12:57 - 00000000 ____D () C:\ProgramData\FowiRifi
2015-01-22 11:45 - 2015-01-22 11:45 - 00008516 _____ () C:\Users\Public\HELP_DECRYPT.HTML
2015-01-22 11:45 - 2015-01-22 11:45 - 00008516 _____ () C:\Users\Public\Downloads\HELP_DECRYPT.HTML
2015-01-22 11:45 - 2015-01-22 11:45 - 00008516 _____ () C:\Users\Bo$$ Brenna\HELP_DECRYPT.HTML
2015-01-22 11:45 - 2015-01-22 11:45 - 00004198 _____ () C:\Users\Public\HELP_DECRYPT.TXT
2015-01-22 11:45 - 2015-01-22 11:45 - 00004198 _____ () C:\Users\Public\Downloads\HELP_DECRYPT.TXT
2015-01-22 11:45 - 2015-01-22 11:45 - 00004198 _____ () C:\Users\Bo$$ Brenna\HELP_DECRYPT.TXT
2015-01-22 11:45 - 2015-01-22 11:45 - 00000268 _____ () C:\Users\Public\HELP_DECRYPT.URL
2015-01-22 11:45 - 2015-01-22 11:45 - 00000268 _____ () C:\Users\Public\Downloads\HELP_DECRYPT.URL
2015-01-22 11:45 - 2015-01-22 11:45 - 00000268 _____ () C:\Users\Bo$$ Brenna\HELP_DECRYPT.URL
2015-01-21 23:51 - 2015-01-21 23:51 - 00008516 _____ () C:\Users\Bo$$ Brenna\AppData\HELP_DECRYPT.HTML
2015-01-21 23:51 - 2015-01-21 23:51 - 00004198 _____ () C:\Users\Bo$$ Brenna\AppData\HELP_DECRYPT.TXT
2015-01-21 23:51 - 2015-01-21 23:51 - 00000268 _____ () C:\Users\Bo$$ Brenna\AppData\HELP_DECRYPT.URL
2015-01-21 23:50 - 2015-01-21 23:50 - 00008516 _____ () C:\ProgramData\HELP_DECRYPT.HTML
2015-01-21 23:50 - 2015-01-21 23:50 - 00004198 _____ () C:\ProgramData\HELP_DECRYPT.TXT
2015-01-21 23:50 - 2015-01-21 23:50 - 00000268 _____ () C:\ProgramData\HELP_DECRYPT.URL
2015-01-21 23:51 - 2015-01-21 23:51 - 0008516 _____ () C:\Users\Bo$$ Brenna\AppData\Roaming\HELP_DECRYPT.HTML
2015-01-21 23:51 - 2015-01-21 23:51 - 0045357 _____ () C:\Users\Bo$$ Brenna\AppData\Roaming\HELP_DECRYPT.PNG
2015-01-21 23:51 - 2015-01-21 23:51 - 0004198 _____ () C:\Users\Bo$$ Brenna\AppData\Roaming\HELP_DECRYPT.TXT
2015-01-21 23:51 - 2015-01-21 23:51 - 0000268 _____ () C:\Users\Bo$$ Brenna\AppData\Roaming\HELP_DECRYPT.URL
2014-10-16 09:19 - 2014-10-16 09:19 - 0063996 _____ () C:\Users\Bo$$ Brenna\AppData\Roaming\icarus-dxdiag.xml
2011-07-26 21:55 - 2011-07-26 21:55 - 0003584 _____ () C:\Users\Bo$$ Brenna\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-01-21 23:51 - 2015-01-21 23:51 - 0008516 _____ () C:\Users\Bo$$ Brenna\AppData\Local\HELP_DECRYPT.HTML
2015-01-21 23:51 - 2015-01-21 23:51 - 0045357 _____ () C:\Users\Bo$$ Brenna\AppData\Local\HELP_DECRYPT.PNG
2015-01-21 23:51 - 2015-01-21 23:51 - 0004198 _____ () C:\Users\Bo$$ Brenna\AppData\Local\HELP_DECRYPT.TXT
2015-01-21 23:51 - 2015-01-21 23:51 - 0000268 _____ () C:\Users\Bo$$ Brenna\AppData\Local\HELP_DECRYPT.URL
2015-01-21 23:50 - 2015-01-21 23:50 - 0045357 _____ () C:\ProgramData\HELP_DECRYPT.PNG
Task: {0118297F-6C52-401B-AB74-389C0EF9A735} - System32\Tasks\4721 => Wscript.exe C:\Users\BO$$BR~1\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION
Task: {0B51FAD1-62D9-43F8-86D8-500E1610C2C4} - System32\Tasks\SMupdate1 => Rundll32.exe C:\PROGRA~1\COMMON~1\System\SysMenu.dll ,Command701 update1 <==== ATTENTION
Task: {3E94E228-4F20-4222-B0DA-3E6D6AF4E057} - System32\Tasks\PC Optimizer Pro64 startups => C:\Program Files\PC Optimizer Pro\StartApps.exe <==== ATTENTION
Task: {451442D1-BBED-400A-B690-0AC5FBC69FD6} - System32\Tasks\0 => Iexplore.exe  <==== ATTENTION
Task: {6C951BBD-7D94-45B9-8362-ECF782230E8B} - System32\Tasks\Microsoft\Windows\Multimedia\SMupdate3 => Rundll32.exe C:\PROGRA~1\COMMON~1\System\SysMenu.dll ,Command701 update3 <==== ATTENTION
Task: {87F4F3C9-4FFB-49B5-9967-89B5C73728E8} - System32\Tasks\Microsoft\Windows\Maintenance\SMupdate2 => Rundll32.exe C:\PROGRA~1\COMMON~1\System\SysMenu.dll ,Command701 update2 <==== ATTENTION
Task: {C7673732-E289-4E31-B494-3D973EC540FD} - System32\Tasks\YTDownloader => C:\Program Files (x86)\YTDownloader\YTDownloader.exe <==== ATTENTION
Task: {ECF8A19D-FAC6-4417-82ED-BB9841B799FB} - System32\Tasks\LaunchSignup => C:\Program Files (x86)\MyPC Backup\Signup Wizard.exe <==== ATTENTION
Task: C:\Windows\Tasks\PC Optimizer Pro64 startups.job => C:\Program Files\PC Optimizer Pro\StartApps.exe <==== ATTENTION
AlternateDataStreams: C:\ProgramData\TEMP:58D8F144
C:\Users\BO$$BR~1\AppData\Local\Temp\launchie.vbs
emptytemp:
*****************

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\YTDownloader => Value not found.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\\AvgUninstallURL => value deleted successfully.
HKU\S-1-5-21-997025152-3087782429-1578093462-1001\Software\Microsoft\Windows\CurrentVersion\Run\\YTDownloader => Value not found.
HKU\S-1-5-21-997025152-3087782429-1578093462-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\Run\\YTDownloader => Value not found.
"AppInit_DLLs-x32: => "" File Not Found" => Value Data not found.
HKU\S-1-5-21-997025152-3087782429-1578093462-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} => value deleted successfully.
HKCR\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068} => Key not found.
HKU\S-1-5-21-997025152-3087782429-1578093462-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} => Value not found.
HKCR\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} => Key not found.
HKU\S-1-5-21-997025152-3087782429-1578093462-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => value deleted successfully.
HKCR\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => Key not found.
HKU\S-1-5-21-997025152-3087782429-1578093462-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\Toolbar: HKU\S-1-5-21-997025152-3087782429-1578093462-1001-{{21FA44EF-376D-4D53-9B0F-8A89D3229068} => Value not found.
HKCR\CLSID\Toolbar: HKU\S-1-5-21-997025152-3087782429-1578093462-1001-{{21FA44EF-376D-4D53-9B0F-8A89D3229068} => Key not found.
HKU\S-1-5-21-997025152-3087782429-1578093462-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\Toolbar: HKU\S-1-5-21-997025152-3087782429-1578093462-1001-{{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} => Value not found.
HKCR\CLSID\Toolbar: HKU\S-1-5-21-997025152-3087782429-1578093462-1001-{{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} => Key not found.
HKU\S-1-5-21-997025152-3087782429-1578093462-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\Toolbar: HKU\S-1-5-21-997025152-3087782429-1578093462-1001-{{2318C2B1-4965-11D4-9B18-009027A5CD4F} => Value not found.
HKCR\CLSID\Toolbar: HKU\S-1-5-21-997025152-3087782429-1578093462-1001-{{2318C2B1-4965-11D4-9B18-009027A5CD4F} => Key not found.
C:\ProgramData\FowiRifi => Moved successfully.
C:\Users\Public\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\Public\Downloads\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\Bo$$ Brenna\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\Public\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\Public\Downloads\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\Bo$$ Brenna\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\Public\HELP_DECRYPT.URL => Moved successfully.
C:\Users\Public\Downloads\HELP_DECRYPT.URL => Moved successfully.
C:\Users\Bo$$ Brenna\HELP_DECRYPT.URL => Moved successfully.
C:\Users\Bo$$ Brenna\AppData\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\Bo$$ Brenna\AppData\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\Bo$$ Brenna\AppData\HELP_DECRYPT.URL => Moved successfully.
C:\ProgramData\HELP_DECRYPT.HTML => Moved successfully.
C:\ProgramData\HELP_DECRYPT.TXT => Moved successfully.
C:\ProgramData\HELP_DECRYPT.URL => Moved successfully.
C:\Users\Bo$$ Brenna\AppData\Roaming\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\Bo$$ Brenna\AppData\Roaming\HELP_DECRYPT.PNG => Moved successfully.
C:\Users\Bo$$ Brenna\AppData\Roaming\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\Bo$$ Brenna\AppData\Roaming\HELP_DECRYPT.URL => Moved successfully.
C:\Users\Bo$$ Brenna\AppData\Roaming\icarus-dxdiag.xml => Moved successfully.
C:\Users\Bo$$ Brenna\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini => Moved successfully.
C:\Users\Bo$$ Brenna\AppData\Local\HELP_DECRYPT.HTML => Moved successfully.
C:\Users\Bo$$ Brenna\AppData\Local\HELP_DECRYPT.PNG => Moved successfully.
C:\Users\Bo$$ Brenna\AppData\Local\HELP_DECRYPT.TXT => Moved successfully.
C:\Users\Bo$$ Brenna\AppData\Local\HELP_DECRYPT.URL => Moved successfully.
C:\ProgramData\HELP_DECRYPT.PNG => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{0118297F-6C52-401B-AB74-389C0EF9A735}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0118297F-6C52-401B-AB74-389C0EF9A735}" => Key deleted successfully.
C:\Windows\System32\Tasks\4721 => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\4721" => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0B51FAD1-62D9-43F8-86D8-500E1610C2C4} => Key not found.
C:\Windows\System32\Tasks\SMupdate1 not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SMupdate1 => Key not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{3E94E228-4F20-4222-B0DA-3E6D6AF4E057}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3E94E228-4F20-4222-B0DA-3E6D6AF4E057}" => Key deleted successfully.
C:\Windows\System32\Tasks\PC Optimizer Pro64 startups => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\PC Optimizer Pro64 startups" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{451442D1-BBED-400A-B690-0AC5FBC69FD6}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{451442D1-BBED-400A-B690-0AC5FBC69FD6}" => Key deleted successfully.
C:\Windows\System32\Tasks\0 => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\0" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{6C951BBD-7D94-45B9-8362-ECF782230E8B}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6C951BBD-7D94-45B9-8362-ECF782230E8B}" => Key deleted successfully.
C:\Windows\System32\Tasks\Microsoft\Windows\Multimedia\SMupdate3 => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Multimedia\SMupdate3" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{87F4F3C9-4FFB-49B5-9967-89B5C73728E8}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{87F4F3C9-4FFB-49B5-9967-89B5C73728E8}" => Key deleted successfully.
C:\Windows\System32\Tasks\Microsoft\Windows\Maintenance\SMupdate2 => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Maintenance\SMupdate2" => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C7673732-E289-4E31-B494-3D973EC540FD} => Key not found.
C:\Windows\System32\Tasks\YTDownloader not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\YTDownloader => Key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{ECF8A19D-FAC6-4417-82ED-BB9841B799FB} => Key not found.
C:\Windows\System32\Tasks\LaunchSignup not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\LaunchSignup => Key not found.
C:\Windows\Tasks\PC Optimizer Pro64 startups.job => Moved successfully.
C:\ProgramData\TEMP => ":58D8F144" ADS removed successfully.
"C:\Users\BO$$BR~1\AppData\Local\Temp\launchie.vbs" => File/Directory not found.
EmptyTemp: => Removed 535.7 MB temporary data.


The system needed a reboot.

==== End of Fixlog 20:17:24 ====
 

 

I am working on my reply with the logs but I am stuck at the adwcleaner step and need help with that part.

 

I ran a scan and clicked report like you said, but above the scan bar is says, "Pending. Please uncheck elements you don't want to remove." But there is nothing to check or uncheck. I didn't know if it was still loading or not so I left it like that for 10 minutes but nothing is showing up. What did I do wrong? Here is a screenshot attached.

Attached Files



#6 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,608 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:03:12 PM

Posted 29 January 2015 - 09:07 AM

Thank you for pausing and asking. Go ahead and click Clean.


Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#7 cappatown

cappatown
  • Topic Starter

  • Members
  • 93 posts
  • OFFLINE
  •  
  • Local time:03:12 PM

Posted 29 January 2015 - 03:11 PM

Adwcleaner report:

 

# AdwCleaner v4.109 - Report created 29/01/2015 at 11:58:56
# Updated 24/01/2015 by Xplode
# Database : 2015-01-26.1 [Live]
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Bo$$ Brenna - BOSSBRENNA-PC
# Running from : C:\Users\Bo$$ Brenna\Desktop\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****


***** [ Scheduled Tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Data Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - <local>

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17496


-\\ Mozilla Firefox v35.0.1 (x86 en-US)


-\\ Google Chrome v


-\\ Chromium v


*************************

AdwCleaner[R0].txt - [7275 octets] - [27/01/2015 12:22:32]
AdwCleaner[R1].txt - [1039 octets] - [28/01/2015 20:22:51]
AdwCleaner[R2].txt - [1100 octets] - [28/01/2015 20:25:01]
AdwCleaner[R3].txt - [1166 octets] - [28/01/2015 20:32:40]
AdwCleaner[R4].txt - [1221 octets] - [29/01/2015 11:57:40]
AdwCleaner[S0].txt - [7262 octets] - [27/01/2015 12:25:16]
AdwCleaner[S1].txt - [1144 octets] - [29/01/2015 11:58:56]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1204 octets] ##########
 

Junkware removal report:

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.1 (12.28.2014:1)
OS: Windows 7 Home Premium x64
Ran by Bo$$ Brenna on Thu 01/29/2015 at 12:03:31.30
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Users\Bo$$ Brenna\AppData\Roaming\w3i, llc"
Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"
Successfully deleted: [Empty Folder] C:\Users\Bo$$ Brenna\appdata\local\{0B467D69-806C-4D42-9CBC-273F579CBA93}
Successfully deleted: [Empty Folder] C:\Users\Bo$$ Brenna\appdata\local\{510444B9-876B-4F6D-917F-DA7F250F8069}



~~~ FireFox

Successfully deleted: [File] C:\user.js
Emptied folder: C:\Users\Bo$$ Brenna\AppData\Roaming\mozilla\firefox\profiles\xwbzbitc.default\minidumps [577 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Thu 01/29/2015 at 12:05:50.27
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

 

System summary attached

Attached Files



#8 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,608 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:03:12 PM

Posted 29 January 2015 - 03:42 PM

Very good. Can you update me on your computer performance?
Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#9 cappatown

cappatown
  • Topic Starter

  • Members
  • 93 posts
  • OFFLINE
  •  
  • Local time:03:12 PM

Posted 29 January 2015 - 04:00 PM

I am still getting the Cryptowall pop ups upon start up, a text file, and 2 web pages open up. I restarted my computer because I kept getting a pop up asking if I wanted the windows command to start and it wouldn't go away. I've never had that happen.



#10 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,608 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:03:12 PM

Posted 29 January 2015 - 04:11 PM

Thanks for the update, please do this.

===================================================

RogueKiller by Tigzy

--------------------
  • Download RogueKiller and save it to your desktop
  • Close all running programs
  • For Windows 8/7/Vista users right click on the icon and select Run as Administrator
  • For Windows XP simply double click on the icon
  • When prompted, Click Scan
  • A report should open and a copy of the report will be placed on your desktop
  • If RogueKiller has been blocked, do not hesitate to try a few times more. If it really won't run, rename it winlogon.exe (or winlogon.com) and try again
  • Copy and paste the contents of the report in your reply
===================================================

Run Combofix in Vista/7

--------------------

Combofix is a very powerful tool and special attention must be taken to allow it to work properly. Please pay careful attention to the following instructions.
  • Please download ComboFix from one of these locations:

BleepingComputer
ForoSpyware

  • Save Combofix.exe to your Desktop <-- Important!!!
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
  • Double click on Combofix.exe and follow the prompts. It is important you do not mouseclick while the program is running or it may stall.
Note #1: Often times it may appear as if ComboFix has stopped working. To verify it is still running please do one of the following below. If, based on the below, you have concluded ComboFix has stopped running please stop and advise me.
  • Check your computer clock. If it is still running then so is ComboFix
  • Open Task Manager and select the Applications Tab. If the status of AutoScan is Running, then ComboFix is running
  • Open Task Manager and select the Processes Tab. Under Image Name look for files ending in .3xe. If there are fluctuating numbers under CPU and Mem Usage then ComboFix is running
Note #2: If you receive the following error "Illegal operation attempted on a registery key that has been marked for deletion" please just restart your computer to resolve this issue

If Combofix fails to run properly using the above instructions please attempt the following:
  • Right click on the Combofix icon on your desktop and select Delete
  • Download a new copy but rename it to freshcopy.exe first, then save it to your desktop
  • Now download RKill.exe (or RKill renamed as iExplore.exe if the first one doesn't work properly) and save it to your desktop
  • Restart your computer in Safe Mode
  • Right click on RKill (or iExplore) and select Run as Administrator. If you are using Windows XP simply double click the icon
  • A black DOS screen should flash and disappear. If not, try to launch the program with the second file. If neither works please stop and let me know
  • When RKill is finished running you will be presented with a text file and a copy will be saved on your desktop. Copy and paste the contents of this report in your reply
  • Do not reboot your computer
  • Double click the freshcopy.exe icon (renamed Combofix file)
  • When finished, it will produce a log. Please copy and paste the C:\Combofix.txt log information in your next reply
  • If you disabled your antivirus please enable it again. If you uninstalled it please wait for instructions to reinstall it
===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it. :thumbsup2:
  • RogueKiller log
  • Combofix log

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#11 cappatown

cappatown
  • Topic Starter

  • Members
  • 93 posts
  • OFFLINE
  •  
  • Local time:03:12 PM

Posted 29 January 2015 - 05:34 PM

Rogue Killer log:

 

RogueKiller V10.2.0.0 [Jan 19 2015] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Bo$$ Brenna [Administrator]
Mode : Scan -- Date : 01/29/2015  13:21:14

¤¤¤ Processes : 14 ¤¤¤
[Suspicious.Path] mcc.exe(3836) -- C:\Users\Bo$$ Brenna\AppData\Roaming\OAS\mcc.exe[-] -> Killed [TermProc]
[Proc.Injected] svchost.exe(4780) -- C:\Windows\syswow64\svchost.exe[x] -> [NoKill]
[Proc.Svchost] svchost.exe(4780) -- C:\Windows\syswow64\svchost.exe[7] -> Killed [TermProc]
[Proc.Injected] svchost.exe(4896) -- C:\Windows\syswow64\svchost.exe[x] -> [NoKill]
[Proc.Svchost] svchost.exe(4896) -- C:\Windows\syswow64\svchost.exe[7] -> Killed [TermProc]
[Proc.Injected] svchost.exe(4904) -- C:\Windows\syswow64\svchost.exe[x] -> [NoKill]
[Proc.Svchost] svchost.exe(4904) -- C:\Windows\syswow64\svchost.exe[7] -> Killed [TermProc]
[Proc.Injected] svchost.exe(5044) -- C:\Windows\syswow64\svchost.exe[x] -> [NoKill]
[Proc.Svchost] svchost.exe(5044) -- C:\Windows\syswow64\svchost.exe[7] -> Killed [TermProc]
[Suspicious.Path] oas.exe(1200) -- C:\Users\Bo$$ Brenna\AppData\Roaming\oas\oas.exe[-] -> Killed [TermProc]
[Suspicious.Path] oas-module(756) -- C:\Users\Bo$$ Brenna\AppData\Roaming\oas\oas-module[7] -> Killed [TermProc]
[Suspicious.Path] oas-module(6096) -- C:\Users\Bo$$ Brenna\AppData\Roaming\oas\oas-module[7] -> Killed [TermThr]
[Suspicious.Path] oas-module(2940) -- C:\Users\Bo$$ Brenna\AppData\Roaming\oas\oas-module[7] -> Killed [TermThr]
[Suspicious.Path] oas-module(7748) -- C:\Users\Bo$$ Brenna\AppData\Roaming\oas\oas-module[7] -> Killed [TermThr]

¤¤¤ Registry : 16 ¤¤¤
[Suspicious.Path] (X64) HKEY_USERS\S-1-5-21-997025152-3087782429-1578093462-1001\Software\Microsoft\Windows\CurrentVersion\Run | Online Ad Scanner : C:\Users\Bo$$ Brenna\AppData\Roaming\OAS\oasupd.exe  -> Found
[Suspicious.Path] (X86) HKEY_USERS\S-1-5-21-997025152-3087782429-1578093462-1001\Software\Microsoft\Windows\CurrentVersion\Run | Online Ad Scanner : C:\Users\Bo$$ Brenna\AppData\Roaming\OAS\oasupd.exe  -> Found
[PUM.Proxy] (X64) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1  -> Found
[PUM.Proxy] (X86) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1  -> Found
[PUM.Proxy] (X64) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1  -> Found
[PUM.Proxy] (X86) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1  -> Found
[PUM.Proxy] (X64) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:50023;https=127.0.0.1:50023  -> Found
[PUM.Proxy] (X86) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:50023;https=127.0.0.1:50023  -> Found
[PUM.Proxy] (X64) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:50023;https=127.0.0.1:50023  -> Found
[PUM.Proxy] (X86) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:50023;https=127.0.0.1:50023  -> Found
[PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-997025152-3087782429-1578093462-1001\Software\Microsoft\Internet Explorer\Main | Start Page :
[PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-997025152-3087782429-1578093462-1001\Software\Microsoft\Internet Explorer\Main | Start Page :
[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> Found
[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1  -> Found
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> Found
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1  -> Found

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Not loaded [0xc000036b]) ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: Hitachi HDS721010CLA SCSI Disk Device +++++
--- User ---
[MBR] b7da66001024dac57d7b1024c9ead5fd
[BSP] 19e41d012e008c8b6441aa4fffe7a3da : Windows Vista/7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 953767 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
Error reading LL2 MBR! ([1] Incorrect function. )
 

~~~ After I ran the Rogue Killer you did not say whether to delete the infected files or not.. I deleted them~~~

 

Combofix log:

 

ComboFix 15-01-29.01 - Bo$$ Brenna 01/29/2015  14:21:04.1.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.8191.5863 [GMT -8:00]
Running from: c:\users\Bo$$ Brenna\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\msdownld.tmp
c:\windows\NCLAUNCH.EXe
c:\windows\security\logs\scecomp.log
.
.
(((((((((((((((((((((((((   Files Created from 2014-12-28 to 2015-01-29  )))))))))))))))))))))))))))))))
.
.
2015-01-29 22:28 . 2015-01-29 22:28    --------    d-----w-    c:\users\Default\AppData\Local\temp
2015-01-29 21:16 . 2015-01-29 21:16    35064    ----a-w-    c:\windows\system32\drivers\TrueSight.sys
2015-01-29 21:16 . 2015-01-29 21:16    --------    d-----w-    c:\programdata\RogueKiller
2015-01-29 20:03 . 2015-01-29 20:03    --------    d-----w-    c:\windows\ERUNT
2015-01-27 20:22 . 2015-01-29 19:58    --------    d-----w-    C:\AdwCleaner
2015-01-26 19:57 . 2015-01-29 04:17    --------    d-----w-    C:\FRST
2015-01-26 04:00 . 2014-12-11 17:47    52736    ----a-w-    c:\windows\system32\TSWbPrxy.exe
2015-01-26 03:59 . 2014-12-19 03:06    210432    ----a-w-    c:\windows\system32\profsvc.dll
2015-01-26 03:59 . 2014-12-06 04:17    303616    ----a-w-    c:\windows\system32\nlasvc.dll
2015-01-26 03:59 . 2014-12-06 03:50    52224    ----a-w-    c:\windows\SysWow64\nlaapi.dll
2015-01-26 03:59 . 2014-12-06 03:50    156672    ----a-w-    c:\windows\SysWow64\ncsi.dll
2015-01-26 03:59 . 2014-12-19 01:46    141312    ----a-w-    c:\windows\system32\drivers\mrxdav.sys
2015-01-26 03:58 . 2014-12-12 05:35    5553592    ----a-w-    c:\windows\system32\ntoskrnl.exe
2015-01-26 03:58 . 2014-12-12 05:31    503808    ----a-w-    c:\windows\system32\srcore.dll
2015-01-26 03:58 . 2014-12-12 05:31    296960    ----a-w-    c:\windows\system32\rstrui.exe
2015-01-26 03:58 . 2014-12-12 05:11    3971512    ----a-w-    c:\windows\SysWow64\ntkrnlpa.exe
2015-01-26 03:58 . 2014-12-12 05:11    3916728    ----a-w-    c:\windows\SysWow64\ntoskrnl.exe
2015-01-26 03:58 . 2014-12-12 05:31    50176    ----a-w-    c:\windows\system32\srclient.dll
2015-01-26 03:58 . 2014-12-12 05:07    43008    ----a-w-    c:\windows\SysWow64\srclient.dll
2015-01-22 07:52 . 2015-01-22 20:43    --------    d-----w-    c:\users\Bo$$ Brenna\AppData\Roaming\Yhpiky
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-01-28 22:39 . 2014-09-02 18:12    129752    ----a-w-    c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-01-26 07:48 . 2012-04-16 09:47    701616    ----a-w-    c:\windows\SysWow64\FlashPlayerApp.exe
2015-01-26 07:48 . 2011-07-12 00:10    71344    ----a-w-    c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-01-26 05:08 . 2011-07-15 19:42    113365784    ----a-w-    c:\windows\system32\MRT.exe
2014-12-31 11:14 . 2010-11-21 03:27    298120    ------w-    c:\windows\system32\MpSigStub.exe
2014-12-13 05:09 . 2014-12-17 22:59    144384    ----a-w-    c:\windows\system32\ieUnatt.exe
2014-12-13 03:33 . 2014-12-17 22:59    115712    ----a-w-    c:\windows\SysWow64\ieUnatt.exe
2014-12-04 02:50 . 2014-12-09 20:35    413184    ----a-w-    c:\windows\system32\generaltel.dll
2014-12-04 02:50 . 2014-12-09 20:35    741376    ----a-w-    c:\windows\system32\invagent.dll
2014-12-04 02:50 . 2014-12-09 20:35    396800    ----a-w-    c:\windows\system32\devinv.dll
2014-12-04 02:50 . 2014-12-09 20:35    830976    ----a-w-    c:\windows\system32\appraiser.dll
2014-12-04 02:50 . 2014-12-09 20:35    192000    ----a-w-    c:\windows\system32\aepic.dll
2014-12-04 02:50 . 2014-12-09 20:35    227328    ----a-w-    c:\windows\system32\aepdu.dll
2014-12-04 02:44 . 2014-12-09 20:35    1083392    ----a-w-    c:\windows\system32\aeinv.dll
2014-12-01 23:28 . 2014-12-09 20:35    1232040    ----a-w-    c:\windows\system32\aitstatic.exe
2014-11-27 01:43 . 2014-12-09 20:33    389296    ----a-w-    c:\windows\system32\iedkcs32.dll
2014-11-22 03:13 . 2014-12-09 20:33    25059840    ----a-w-    c:\windows\system32\mshtml.dll
2014-11-22 03:06 . 2014-12-09 20:34    2724864    ----a-w-    c:\windows\system32\mshtml.tlb
2014-11-22 03:06 . 2014-12-09 20:33    4096    ----a-w-    c:\windows\system32\ieetwcollectorres.dll
2014-11-22 02:50 . 2014-12-09 20:33    66560    ----a-w-    c:\windows\system32\iesetup.dll
2014-11-22 02:50 . 2014-12-09 20:33    580096    ----a-w-    c:\windows\system32\vbscript.dll
2014-11-22 02:49 . 2014-12-09 20:34    48640    ----a-w-    c:\windows\system32\ieetwproxystub.dll
2014-11-22 02:49 . 2014-12-09 20:33    2885120    ----a-w-    c:\windows\system32\iertutil.dll
2014-11-22 02:48 . 2014-12-09 20:33    88064    ----a-w-    c:\windows\system32\MshtmlDac.dll
2014-11-22 02:41 . 2014-12-09 20:33    54784    ----a-w-    c:\windows\system32\jsproxy.dll
2014-11-22 02:40 . 2014-12-09 20:34    34304    ----a-w-    c:\windows\system32\iernonce.dll
2014-11-22 02:37 . 2014-12-09 20:33    633856    ----a-w-    c:\windows\system32\ieui.dll
2014-11-22 02:35 . 2014-12-09 20:34    114688    ----a-w-    c:\windows\system32\ieetwcollector.exe
2014-11-22 02:34 . 2014-12-09 20:33    814080    ----a-w-    c:\windows\system32\jscript9diag.dll
2014-11-22 02:34 . 2014-12-09 20:33    6039552    ----a-w-    c:\windows\system32\jscript9.dll
2014-11-22 02:26 . 2014-12-09 20:33    968704    ----a-w-    c:\windows\system32\MsSpellCheckingFacility.exe
2014-11-22 02:22 . 2014-12-09 20:33    490496    ----a-w-    c:\windows\system32\dxtmsft.dll
2014-11-22 02:20 . 2014-12-09 20:33    2724864    ----a-w-    c:\windows\SysWow64\mshtml.tlb
2014-11-22 02:14 . 2014-12-09 20:34    77824    ----a-w-    c:\windows\system32\JavaScriptCollectionAgent.dll
2014-11-22 02:09 . 2014-12-09 20:33    199680    ----a-w-    c:\windows\system32\msrating.dll
2014-11-22 02:08 . 2014-12-09 20:33    92160    ----a-w-    c:\windows\system32\mshtmled.dll
2014-11-22 02:07 . 2014-12-09 20:33    501248    ----a-w-    c:\windows\SysWow64\vbscript.dll
2014-11-22 02:07 . 2014-12-09 20:33    62464    ----a-w-    c:\windows\SysWow64\iesetup.dll
2014-11-22 02:06 . 2014-12-09 20:34    47616    ----a-w-    c:\windows\SysWow64\ieetwproxystub.dll
2014-11-22 02:05 . 2014-12-09 20:33    64000    ----a-w-    c:\windows\SysWow64\MshtmlDac.dll
2014-11-22 02:05 . 2014-12-09 20:33    316928    ----a-w-    c:\windows\system32\dxtrans.dll
2014-11-22 01:54 . 2014-12-09 20:33    620032    ----a-w-    c:\windows\SysWow64\jscript9diag.dll
2014-11-22 01:49 . 2014-12-09 20:34    718848    ----a-w-    c:\windows\system32\ie4uinit.exe
2014-11-22 01:49 . 2014-12-09 20:33    800768    ----a-w-    c:\windows\system32\msfeeds.dll
2014-11-22 01:47 . 2014-12-09 20:33    1359360    ----a-w-    c:\windows\system32\mshtmlmedia.dll
2014-11-22 01:46 . 2014-12-09 20:33    2125312    ----a-w-    c:\windows\system32\inetcpl.cpl
2014-11-22 01:43 . 2014-12-09 20:33    14412800    ----a-w-    c:\windows\system32\ieframe.dll
2014-11-22 01:40 . 2014-12-09 20:34    60416    ----a-w-    c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2014-11-22 01:29 . 2014-12-09 20:33    4299264    ----a-w-    c:\windows\SysWow64\jscript9.dll
2014-11-22 01:28 . 2014-12-09 20:33    2358272    ----a-w-    c:\windows\system32\wininet.dll
2014-11-22 01:22 . 2014-12-09 20:33    2052096    ----a-w-    c:\windows\SysWow64\inetcpl.cpl
2014-11-22 01:21 . 2014-12-09 20:33    1155072    ----a-w-    c:\windows\SysWow64\mshtmlmedia.dll
2014-11-22 01:15 . 2014-12-09 20:33    1548288    ----a-w-    c:\windows\system32\urlmon.dll
2014-11-22 01:03 . 2014-12-09 20:33    800768    ----a-w-    c:\windows\system32\ieapfltr.dll
2014-11-22 01:00 . 2014-12-09 20:33    1888256    ----a-w-    c:\windows\SysWow64\wininet.dll
2014-11-21 14:14 . 2014-09-02 18:10    63704    ----a-w-    c:\windows\system32\drivers\mwac.sys
2014-11-21 14:14 . 2014-09-02 18:10    93400    ----a-w-    c:\windows\system32\drivers\mbamchameleon.sys
2014-11-21 14:14 . 2012-02-02 03:56    25816    ----a-w-    c:\windows\system32\drivers\mbam.sys
2014-11-19 12:26 . 2014-11-19 12:26    1614504    ----a-w-    c:\windows\system32\FM20.DLL
2014-11-11 03:09 . 2014-12-09 20:34    1424384    ----a-w-    c:\windows\system32\WindowsCodecs.dll
2014-11-11 03:08 . 2014-11-19 18:14    241152    ----a-w-    c:\windows\system32\pku2u.dll
2014-11-11 03:08 . 2014-11-19 18:14    728064    ----a-w-    c:\windows\system32\kerberos.dll
2014-11-11 02:44 . 2014-12-09 20:34    1230336    ----a-w-    c:\windows\SysWow64\WindowsCodecs.dll
2014-11-11 02:44 . 2014-11-19 18:14    186880    ----a-w-    c:\windows\SysWow64\pku2u.dll
2014-11-11 02:44 . 2014-11-19 18:14    550912    ----a-w-    c:\windows\SysWow64\kerberos.dll
2014-11-11 01:46 . 2014-12-09 20:34    119296    ----a-w-    c:\windows\system32\drivers\tdx.sys
2014-11-08 03:16 . 2014-12-09 20:31    2048    ----a-w-    c:\windows\system32\tzres.dll
2014-11-08 02:45 . 2014-12-09 20:31    2048    ----a-w-    c:\windows\SysWow64\tzres.dll
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2013-10-05 08:42    222832    ----a-w-    c:\users\Bo$$ Brenna\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2013-10-05 08:42    222832    ----a-w-    c:\users\Bo$$ Brenna\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2013-10-05 08:42    222832    ----a-w-    c:\users\Bo$$ Brenna\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\SkyDriveShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files (x86)\Steam\steam.exe" [2015-01-23 1942720]
"Akamai NetSession Interface"="c:\users\Bo$$ Brenna\AppData\Local\Akamai\netsession_win.exe" [2014-10-30 4673432]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HDAudDeck"="c:\program files (x86)\VIA\VIAudioi\VDeck\VDeck.exe" [2010-05-24 2439072]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-22 59720]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-11-02 152392]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2014-07-25 256896]
.
c:\users\Bo$$ Brenna\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
HELP_DECRYPT.HTML [2015-1-29 8528]
HELP_DECRYPT.PNG [2015-1-29 45458]
HELP_DECRYPT.TXT [2015-1-29 4204]
HELP_DECRYPT.URL [2015-1-29 272]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys;c:\windows\SYSNATIVE\drivers\LGBusEnum.sys [x]
S3 LGSHidFilt;Logitech Gaming KMDF HID Filter Driver;c:\windows\system32\DRIVERS\LGSHidFilt.Sys;c:\windows\SYSNATIVE\DRIVERS\LGSHidFilt.Sys [x]
S3 LGSUsbFilt;Logitech Gaming KMDF USB Filter Driver;c:\windows\system32\DRIVERS\LGSUsbFilt.Sys;c:\windows\SYSNATIVE\DRIVERS\LGSUsbFilt.Sys [x]
S3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys;c:\windows\SYSNATIVE\drivers\LGVirHid.sys [x]
S3 NvStreamKms;NvStreamKms;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 RTL8192su;%RTL8192su.DeviceDesc.DispName%;c:\windows\system32\DRIVERS\RTL8192su.sys;c:\windows\SYSNATIVE\DRIVERS\RTL8192su.sys [x]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys;c:\windows\SYSNATIVE\drivers\viahduaa.sys [x]
.
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - NisDrv
.
Contents of the 'Scheduled Tasks' folder
.
2015-01-29 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-16 07:48]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2013-10-05 08:42    261744    ----a-w-    c:\users\Bo$$ Brenna\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2013-10-05 08:42    261744    ----a-w-    c:\users\Bo$$ Brenna\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2013-10-05 08:42    261744    ----a-w-    c:\users\Bo$$ Brenna\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 108144]
"Launch LCore"="c:\program files\Logitech Gaming Software\LCore.exe" [2012-11-29 7406392]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2014-08-09 2404296]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2014-08-09 1283136]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://search.splashtop.com/asusexpressgate/mb/searchAPI.php?SE=yahoo&QS=http%3A%2F%2Fsearch.yahoo.com%2Fsearch%3Ffr%3Dfp-devicevm%26type%3DWEB01
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <local>
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath -
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKCU-Run-EA Core - c:\program files (x86)\Electronic Arts\EADM\Core.exe
Wow6432Node-HKCU-Run-Itibiti.exe - c:\program files (x86)\Itibiti Soft Phone\Itibiti.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
AddRemove-EADM - c:\program files (x86)\Electronic Arts\EADM\Uninstall.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-997025152-3087782429-1578093462-1001\Software\SecuROM\License information*]
"datasecu"=hex:c2,a3,23,5f,03,11,21,2a,30,2e,b5,50,e2,bc,79,c7,66,ea,b5,43,98,
   5e,f4,5b,f6,a8,f4,d5,d8,cd,5b,7b,7e,f5,87,4f,07,c2,43,9b,98,0e,39,f2,67,f2,\
"rkeysecu"=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_16_0_0_296_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_16_0_0_296_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_16_0_0_296_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_16_0_0_296_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_296.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.16"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_296.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_296.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_296.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2015-01-29  14:30:28
ComboFix-quarantined-files.txt  2015-01-29 22:30
.
Pre-Run: 716,675,014,656 bytes free
Post-Run: 716,283,809,792 bytes free
.
- - End Of File - - 5FE0A93ACC1F4C3AF641D0D959C55297
A36C5E4F47E84449FF07ED3517B43A31
 

 

 

I rebooted my computer and am still getting pop ups. A notepad file titled "help_decrypt" another file opening in windows picture viewer, and firefox opens and has 2 webpages with the Cryptowall text.


Edited by cappatown, 29 January 2015 - 05:42 PM.


#12 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,608 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:03:12 PM

Posted 29 January 2015 - 06:10 PM

Thank you for the information/update. Yes, there is still a bit left.

Please do this.

===================================================

SystemLook by jpshortstuff

--------------------
  • Please download SystemLook from one of the links below and save it to your Desktop.

Download Mirror #3 For 64-bit users

  • Double-click SystemLook.exe to run it.
  • Vista\Windows 7 users:: Right click on SystemLook.exe, click Run As Administrator
  • Copy the content of the following codebox into the main textfield:
:filefind
*decrypt*
:regfind
*decrypt*
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply or, if necessary zip and attach the file.
===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it. :thumbsup2:
  • SystemLook log

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#13 cappatown

cappatown
  • Topic Starter

  • Members
  • 93 posts
  • OFFLINE
  •  
  • Local time:03:12 PM

Posted 29 January 2015 - 06:15 PM

SystemLook 30.07.11 by jpshortstuff
Log created at 15:12 on 29/01/2015 by Bo$$ Brenna
Administrator - Elevation successful

========== filefind ==========

Searching for "*decrypt*"
C:\AdwCleaner\Quarantine\C\ProgramData\w3i\HELP_DECRYPT.HTML.vir    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\AdwCleaner\Quarantine\C\ProgramData\w3i\HELP_DECRYPT.PNG.vir    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\AdwCleaner\Quarantine\C\ProgramData\w3i\HELP_DECRYPT.TXT.vir    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\AdwCleaner\Quarantine\C\ProgramData\w3i\HELP_DECRYPT.URL.vir    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\AdwCleaner\Quarantine\C\ProgramData\w3i\InstallIQUpdater\HELP_DECRYPT.HTML.vir    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\AdwCleaner\Quarantine\C\ProgramData\w3i\InstallIQUpdater\HELP_DECRYPT.PNG.vir    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\AdwCleaner\Quarantine\C\ProgramData\w3i\InstallIQUpdater\HELP_DECRYPT.TXT.vir    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\AdwCleaner\Quarantine\C\ProgramData\w3i\InstallIQUpdater\HELP_DECRYPT.URL.vir    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\AdwCleaner\Quarantine\C\ProgramData\w3i\InstallIQUpdater\images\HELP_DECRYPT.HTML.vir    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\AdwCleaner\Quarantine\C\ProgramData\w3i\InstallIQUpdater\images\HELP_DECRYPT.PNG.vir    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\AdwCleaner\Quarantine\C\ProgramData\w3i\InstallIQUpdater\images\HELP_DECRYPT.TXT.vir    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\AdwCleaner\Quarantine\C\ProgramData\w3i\InstallIQUpdater\images\HELP_DECRYPT.URL.vir    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\HELP_DECRYPT.HTML.vir    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\HELP_DECRYPT.PNG.vir    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\HELP_DECRYPT.TXT.vir    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\HELP_DECRYPT.URL.vir    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\UnsentCrashReports\HELP_DECRYPT.HTML.vir    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\UnsentCrashReports\HELP_DECRYPT.PNG.vir    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\UnsentCrashReports\HELP_DECRYPT.TXT.vir    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\UnsentCrashReports\HELP_DECRYPT.URL.vir    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\HELP_DECRYPT.HTML.vir    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\HELP_DECRYPT.PNG.vir    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\HELP_DECRYPT.TXT.vir    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\HELP_DECRYPT.URL.vir    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\151d684c-4232-4fd4-83d4-0f5816c9fbf5\HELP_DECRYPT.HTML.vir    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\151d684c-4232-4fd4-83d4-0f5816c9fbf5\HELP_DECRYPT.PNG.vir    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\151d684c-4232-4fd4-83d4-0f5816c9fbf5\HELP_DECRYPT.TXT.vir    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\151d684c-4232-4fd4-83d4-0f5816c9fbf5\HELP_DECRYPT.URL.vir    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\523d371a-c7a9-4118-9299-ed128f8173bd\HELP_DECRYPT.HTML.vir    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\523d371a-c7a9-4118-9299-ed128f8173bd\HELP_DECRYPT.PNG.vir    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\523d371a-c7a9-4118-9299-ed128f8173bd\HELP_DECRYPT.TXT.vir    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\523d371a-c7a9-4118-9299-ed128f8173bd\HELP_DECRYPT.URL.vir    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\fcbc2232-0107-4059-9e35-5e6aee2c4d15\HELP_DECRYPT.HTML.vir    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\fcbc2232-0107-4059-9e35-5e6aee2c4d15\HELP_DECRYPT.PNG.vir    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\fcbc2232-0107-4059-9e35-5e6aee2c4d15\HELP_DECRYPT.TXT.vir    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\fcbc2232-0107-4059-9e35-5e6aee2c4d15\HELP_DECRYPT.URL.vir    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\FRST\Quarantine\C\ProgramData\HELP_DECRYPT.HTML.xBAD    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\FRST\Quarantine\C\ProgramData\HELP_DECRYPT.PNG.xBAD    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\FRST\Quarantine\C\ProgramData\HELP_DECRYPT.TXT.xBAD    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\FRST\Quarantine\C\ProgramData\HELP_DECRYPT.URL.xBAD    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\FRST\Quarantine\C\Users\Bo$$ Brenna\HELP_DECRYPT.HTML.xBAD    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\FRST\Quarantine\C\Users\Bo$$ Brenna\HELP_DECRYPT.TXT.xBAD    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\FRST\Quarantine\C\Users\Bo$$ Brenna\HELP_DECRYPT.URL.xBAD    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\FRST\Quarantine\C\Users\Bo$$ Brenna\AppData\HELP_DECRYPT.HTML.xBAD    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\FRST\Quarantine\C\Users\Bo$$ Brenna\AppData\HELP_DECRYPT.TXT.xBAD    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\FRST\Quarantine\C\Users\Bo$$ Brenna\AppData\HELP_DECRYPT.URL.xBAD    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\FRST\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\HELP_DECRYPT.HTML.xBAD    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\FRST\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\HELP_DECRYPT.PNG.xBAD    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\FRST\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\HELP_DECRYPT.TXT.xBAD    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\FRST\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\HELP_DECRYPT.URL.xBAD    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\FRST\Quarantine\C\Users\Bo$$ Brenna\AppData\Roaming\HELP_DECRYPT.HTML.xBAD    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\FRST\Quarantine\C\Users\Bo$$ Brenna\AppData\Roaming\HELP_DECRYPT.PNG.xBAD    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\FRST\Quarantine\C\Users\Bo$$ Brenna\AppData\Roaming\HELP_DECRYPT.TXT.xBAD    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\FRST\Quarantine\C\Users\Bo$$ Brenna\AppData\Roaming\HELP_DECRYPT.URL.xBAD    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\FRST\Quarantine\C\Users\Public\HELP_DECRYPT.HTML.xBAD    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\FRST\Quarantine\C\Users\Public\HELP_DECRYPT.TXT.xBAD    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\FRST\Quarantine\C\Users\Public\HELP_DECRYPT.URL.xBAD    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\FRST\Quarantine\C\Users\Public\Downloads\HELP_DECRYPT.HTML.xBAD    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\FRST\Quarantine\C\Users\Public\Downloads\HELP_DECRYPT.TXT.xBAD    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\FRST\Quarantine\C\Users\Public\Downloads\HELP_DECRYPT.URL.xBAD    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\ProgramData\HELP_DECRYPT.HTML    --a---- 8528 bytes    [20:55 29/01/2015]    [20:55 29/01/2015] F554319B9DFAA64EF408269F0333FAEA
C:\ProgramData\HELP_DECRYPT.PNG    --a---- 45454 bytes    [20:55 29/01/2015]    [20:55 29/01/2015] 21974389F5C52F88A406CC5306C4C9BE
C:\ProgramData\HELP_DECRYPT.TXT    --a---- 4204 bytes    [20:55 29/01/2015]    [20:55 29/01/2015] A1C40E8448B4EECF957D92818A05B167
C:\ProgramData\HELP_DECRYPT.URL    --a---- 272 bytes    [20:55 29/01/2015]    [20:55 29/01/2015] 4288505F8C6EBB2EEAF241AFBB90477D
C:\ProgramData\LogiShrd\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\ProgramData\LogiShrd\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\ProgramData\LogiShrd\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\ProgramData\LogiShrd\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\ProgramData\LogiShrd\Updater\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\ProgramData\LogiShrd\Updater\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\ProgramData\LogiShrd\Updater\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\ProgramData\LogiShrd\Updater\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\ProgramData\Microsoft\RAC\PublishedData\HELP_DECRYPT.HTML    --a---- 8528 bytes    [07:50 22/01/2015]    [20:55 29/01/2015] F554319B9DFAA64EF408269F0333FAEA
C:\ProgramData\Microsoft\RAC\PublishedData\HELP_DECRYPT.PNG    --a---- 45454 bytes    [07:50 22/01/2015]    [20:55 29/01/2015] 21974389F5C52F88A406CC5306C4C9BE
C:\ProgramData\Microsoft\RAC\PublishedData\HELP_DECRYPT.TXT    --a---- 4204 bytes    [07:50 22/01/2015]    [20:55 29/01/2015] A1C40E8448B4EECF957D92818A05B167
C:\ProgramData\Microsoft\RAC\PublishedData\HELP_DECRYPT.URL    --a---- 272 bytes    [07:50 22/01/2015]    [20:55 29/01/2015] 4288505F8C6EBB2EEAF241AFBB90477D
C:\ProgramData\Norton\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\ProgramData\Norton\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\ProgramData\Norton\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\ProgramData\Norton\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\ProgramData\SecuROM\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\ProgramData\SecuROM\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\ProgramData\SecuROM\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\ProgramData\SecuROM\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\ProgramData\SecuROM\DFA\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\ProgramData\SecuROM\DFA\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\ProgramData\SecuROM\DFA\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\ProgramData\SecuROM\DFA\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\ProgramData\WindSolutions\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\ProgramData\WindSolutions\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\ProgramData\WindSolutions\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\ProgramData\WindSolutions\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\ProgramData\WindSolutions\CopyTrans\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\ProgramData\WindSolutions\CopyTrans\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\ProgramData\WindSolutions\CopyTrans\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\ProgramData\WindSolutions\CopyTrans\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\ProgramData\WindSolutions\CopyTrans\Logs\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\ProgramData\WindSolutions\CopyTrans\Logs\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\ProgramData\WindSolutions\CopyTrans\Logs\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\ProgramData\WindSolutions\CopyTrans\Logs\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\ProgramData\WindSolutions\CopyTransManager\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\ProgramData\WindSolutions\CopyTransManager\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\ProgramData\WindSolutions\CopyTransManager\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\ProgramData\WindSolutions\CopyTransManager\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\ProgramData\WindSolutions\CopyTransManager\Logs\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\ProgramData\WindSolutions\CopyTransManager\Logs\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\ProgramData\WindSolutions\CopyTransManager\Logs\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\ProgramData\WindSolutions\CopyTransManager\Logs\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\All Users\HELP_DECRYPT.HTML    --a---- 8528 bytes    [20:55 29/01/2015]    [20:55 29/01/2015] F554319B9DFAA64EF408269F0333FAEA
C:\Users\All Users\HELP_DECRYPT.PNG    --a---- 45454 bytes    [20:55 29/01/2015]    [20:55 29/01/2015] 21974389F5C52F88A406CC5306C4C9BE
C:\Users\All Users\HELP_DECRYPT.TXT    --a---- 4204 bytes    [20:55 29/01/2015]    [20:55 29/01/2015] A1C40E8448B4EECF957D92818A05B167
C:\Users\All Users\HELP_DECRYPT.URL    --a---- 272 bytes    [20:55 29/01/2015]    [20:55 29/01/2015] 4288505F8C6EBB2EEAF241AFBB90477D
C:\Users\All Users\LogiShrd\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\All Users\LogiShrd\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\All Users\LogiShrd\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\All Users\LogiShrd\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\All Users\LogiShrd\Updater\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\All Users\LogiShrd\Updater\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\All Users\LogiShrd\Updater\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\All Users\LogiShrd\Updater\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\All Users\Microsoft\RAC\PublishedData\HELP_DECRYPT.HTML    --a---- 8528 bytes    [07:50 22/01/2015]    [20:55 29/01/2015] F554319B9DFAA64EF408269F0333FAEA
C:\Users\All Users\Microsoft\RAC\PublishedData\HELP_DECRYPT.PNG    --a---- 45454 bytes    [07:50 22/01/2015]    [20:55 29/01/2015] 21974389F5C52F88A406CC5306C4C9BE
C:\Users\All Users\Microsoft\RAC\PublishedData\HELP_DECRYPT.TXT    --a---- 4204 bytes    [07:50 22/01/2015]    [20:55 29/01/2015] A1C40E8448B4EECF957D92818A05B167
C:\Users\All Users\Microsoft\RAC\PublishedData\HELP_DECRYPT.URL    --a---- 272 bytes    [07:50 22/01/2015]    [20:55 29/01/2015] 4288505F8C6EBB2EEAF241AFBB90477D
C:\Users\All Users\Norton\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\All Users\Norton\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\All Users\Norton\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\All Users\Norton\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\All Users\SecuROM\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\All Users\SecuROM\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\All Users\SecuROM\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\All Users\SecuROM\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\All Users\SecuROM\DFA\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\All Users\SecuROM\DFA\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\All Users\SecuROM\DFA\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\All Users\SecuROM\DFA\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\All Users\WindSolutions\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\All Users\WindSolutions\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\All Users\WindSolutions\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\All Users\WindSolutions\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\All Users\WindSolutions\CopyTrans\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\All Users\WindSolutions\CopyTrans\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\All Users\WindSolutions\CopyTrans\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\All Users\WindSolutions\CopyTrans\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\All Users\WindSolutions\CopyTrans\Logs\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\All Users\WindSolutions\CopyTrans\Logs\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\All Users\WindSolutions\CopyTrans\Logs\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\All Users\WindSolutions\CopyTrans\Logs\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\All Users\WindSolutions\CopyTransManager\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\All Users\WindSolutions\CopyTransManager\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\All Users\WindSolutions\CopyTransManager\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\All Users\WindSolutions\CopyTransManager\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\All Users\WindSolutions\CopyTransManager\Logs\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\All Users\WindSolutions\CopyTransManager\Logs\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\All Users\WindSolutions\CopyTransManager\Logs\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\All Users\WindSolutions\CopyTransManager\Logs\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\HELP_DECRYPT.HTML    --a---- 8528 bytes    [20:59 29/01/2015]    [20:59 29/01/2015] F554319B9DFAA64EF408269F0333FAEA
C:\Users\Bo$$ Brenna\HELP_DECRYPT.PNG    --a---- 45458 bytes    [19:45 22/01/2015]    [20:59 29/01/2015] 02EFC26E52BBBA69EF983DF77D0452D2
C:\Users\Bo$$ Brenna\HELP_DECRYPT.TXT    --a---- 4204 bytes    [20:59 29/01/2015]    [20:59 29/01/2015] A1C40E8448B4EECF957D92818A05B167
C:\Users\Bo$$ Brenna\HELP_DECRYPT.URL    --a---- 272 bytes    [20:59 29/01/2015]    [20:59 29/01/2015] 4288505F8C6EBB2EEAF241AFBB90477D
C:\Users\Bo$$ Brenna\AppData\HELP_DECRYPT.HTML    --a---- 8528 bytes    [20:55 29/01/2015]    [20:55 29/01/2015] F554319B9DFAA64EF408269F0333FAEA
C:\Users\Bo$$ Brenna\AppData\HELP_DECRYPT.PNG    --a---- 45454 bytes    [07:51 22/01/2015]    [20:55 29/01/2015] 21974389F5C52F88A406CC5306C4C9BE
C:\Users\Bo$$ Brenna\AppData\HELP_DECRYPT.TXT    --a---- 4204 bytes    [20:55 29/01/2015]    [20:55 29/01/2015] A1C40E8448B4EECF957D92818A05B167
C:\Users\Bo$$ Brenna\AppData\HELP_DECRYPT.URL    --a---- 272 bytes    [20:55 29/01/2015]    [20:55 29/01/2015] 4288505F8C6EBB2EEAF241AFBB90477D
C:\Users\Bo$$ Brenna\AppData\Local\HELP_DECRYPT.HTML    --a---- 8528 bytes    [20:55 29/01/2015]    [20:55 29/01/2015] F554319B9DFAA64EF408269F0333FAEA
C:\Users\Bo$$ Brenna\AppData\Local\HELP_DECRYPT.PNG    --a---- 45454 bytes    [20:55 29/01/2015]    [20:55 29/01/2015] 21974389F5C52F88A406CC5306C4C9BE
C:\Users\Bo$$ Brenna\AppData\Local\HELP_DECRYPT.TXT    --a---- 4204 bytes    [20:55 29/01/2015]    [20:55 29/01/2015] A1C40E8448B4EECF957D92818A05B167
C:\Users\Bo$$ Brenna\AppData\Local\HELP_DECRYPT.URL    --a---- 272 bytes    [20:55 29/01/2015]    [20:55 29/01/2015] 4288505F8C6EBB2EEAF241AFBB90477D
C:\Users\Bo$$ Brenna\AppData\Local\Akamai\HELP_DECRYPT.HTML    --a---- 8528 bytes    [07:50 22/01/2015]    [20:55 29/01/2015] F554319B9DFAA64EF408269F0333FAEA
C:\Users\Bo$$ Brenna\AppData\Local\Akamai\HELP_DECRYPT.PNG    --a---- 45454 bytes    [07:50 22/01/2015]    [20:55 29/01/2015] 21974389F5C52F88A406CC5306C4C9BE
C:\Users\Bo$$ Brenna\AppData\Local\Akamai\HELP_DECRYPT.TXT    --a---- 4204 bytes    [07:50 22/01/2015]    [20:55 29/01/2015] A1C40E8448B4EECF957D92818A05B167
C:\Users\Bo$$ Brenna\AppData\Local\Akamai\HELP_DECRYPT.URL    --a---- 272 bytes    [07:50 22/01/2015]    [20:55 29/01/2015] 4288505F8C6EBB2EEAF241AFBB90477D
C:\Users\Bo$$ Brenna\AppData\Local\Apple Computer\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\Apple Computer\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\Apple Computer\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\Apple Computer\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\Apple Computer\iTunes\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\Apple Computer\iTunes\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\Apple Computer\iTunes\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\Apple Computer\iTunes\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\Arktos Entertainment\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\Arktos Entertainment\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\Arktos Entertainment\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\Arktos Entertainment\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\Arktos Entertainment\Infestation\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\Arktos Entertainment\Infestation\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\Arktos Entertainment\Infestation\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\Arktos Entertainment\Infestation\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\Arktos Entertainment\Infestation\Levels\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\Arktos Entertainment\Infestation\Levels\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\Arktos Entertainment\Infestation\Levels\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\Arktos Entertainment\Infestation\Levels\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\Arktos Entertainment\Infestation\Levels\California_V2\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\Arktos Entertainment\Infestation\Levels\California_V2\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\Arktos Entertainment\Infestation\Levels\California_V2\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\Arktos Entertainment\Infestation\Levels\California_V2\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\Arktos Entertainment\Infestation\Levels\Colorado_V2\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\Arktos Entertainment\Infestation\Levels\Colorado_V2\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\Arktos Entertainment\Infestation\Levels\Colorado_V2\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\Arktos Entertainment\Infestation\Levels\Colorado_V2\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\EdgeOfReality\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\EdgeOfReality\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\EdgeOfReality\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\EdgeOfReality\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\EdgeOfReality\Loadout\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\EdgeOfReality\Loadout\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\EdgeOfReality\Loadout\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\EdgeOfReality\Loadout\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\EdgeOfReality\Loadout\CrashReports\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\EdgeOfReality\Loadout\CrashReports\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\EdgeOfReality\Loadout\CrashReports\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\EdgeOfReality\Loadout\CrashReports\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\Fallout3\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\Fallout3\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\Fallout3\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\Fallout3\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\Google\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\Google\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\Google\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\Google\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\Google\Chrome\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\Google\Chrome\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\Google\Chrome\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\Google\Chrome\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\Google\Chrome\User Data\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\Google\Chrome\User Data\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\Google\Chrome\User Data\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\Google\Chrome\User Data\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\Google\Chrome\User Data\Default\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\Google\Chrome\User Data\Default\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\Google\Chrome\User Data\Default\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\Google\Chrome\User Data\Default\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\Google\Chrome\User Data\Default\databases\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\Google\Chrome\User Data\Default\databases\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\Google\Chrome\User Data\Default\databases\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\Google\Chrome\User Data\Default\databases\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Internet Explorer\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Internet Explorer\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Internet Explorer\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Internet Explorer\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Photo Acquisition\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Photo Acquisition\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Photo Acquisition\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Photo Acquisition\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Mail\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Mail\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Mail\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Mail\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Mail\Backup\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Mail\Backup\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Mail\Backup\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Mail\Backup\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Mail\Backup\new\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Mail\Backup\new\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Mail\Backup\new\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Mail\Backup\new\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Mail\Stationery\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Mail\Stationery\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Mail\Stationery\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Mail\Stationery\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Media\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Media\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Media\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Media\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Media\12.0\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Media\12.0\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Media\12.0\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Media\12.0\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Sidebar\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Sidebar\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Sidebar\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Sidebar\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Sidebar\Gadgets\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Sidebar\Gadgets\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Sidebar\Gadgets\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Sidebar\Gadgets\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft Games\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft Games\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft Games\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft Games\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft Games\Minesweeper\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft Games\Minesweeper\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft Games\Minesweeper\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft Games\Minesweeper\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft Games\Spider Solitaire\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft Games\Spider Solitaire\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft Games\Spider Solitaire\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\Microsoft Games\Spider Solitaire\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\Mozilla\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\Mozilla\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\Mozilla\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\Mozilla\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\Mozilla\Firefox\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\Mozilla\Firefox\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\Mozilla\Firefox\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\Mozilla\Firefox\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\AAV3\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\AAV3\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\AAV3\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\AAV3\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\AAV3\pb\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\AAV3\pb\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\AAV3\pb\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\AAV3\pb\HELP_DECRYPT.URL    --a---- 268 bytes    [07:50 22/01/2015]    [07:50 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\APB\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\APB\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\APB\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\APB\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\APB\pb\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\APB\pb\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\APB\pb\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\APB\pb\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\TWZ\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\TWZ\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\TWZ\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\TWZ\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\TWZ\pb\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\TWZ\pb\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\TWZ\pb\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\TWZ\pb\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\Rockstar Games\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\Rockstar Games\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\Rockstar Games\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\Rockstar Games\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\Rockstar Games\GTA IV\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\Rockstar Games\GTA IV\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\Rockstar Games\GTA IV\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\Rockstar Games\GTA IV\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\Rockstar Games\GTA IV\User Music\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\Rockstar Games\GTA IV\User Music\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\Rockstar Games\GTA IV\User Music\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\Rockstar Games\GTA IV\User Music\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Local\Symantec\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Local\Symantec\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Local\Symantec\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Local\Symantec\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\LocalLow\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\LocalLow\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\LocalLow\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\LocalLow\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\LocalLow\Adobe\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\LocalLow\Adobe\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\LocalLow\Adobe\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\LocalLow\Adobe\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\LocalLow\Adobe\Acrobat\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\LocalLow\Adobe\Acrobat\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\LocalLow\Adobe\Acrobat\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\LocalLow\Adobe\Acrobat\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\LocalLow\Adobe\Acrobat\10.0\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\LocalLow\Adobe\Acrobat\10.0\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\LocalLow\Adobe\Acrobat\10.0\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\LocalLow\Adobe\Acrobat\10.0\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\LocalLow\Microsoft\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\LocalLow\Microsoft\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\LocalLow\Microsoft\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\LocalLow\Microsoft\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\LocalLow\Microsoft\Silverlight\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\LocalLow\Microsoft\Silverlight\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\LocalLow\Microsoft\Silverlight\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\LocalLow\Microsoft\Silverlight\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\Java\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\Java\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\Java\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\Java\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\Java\Deployment\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\Java\Deployment\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\Java\Deployment\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\Java\Deployment\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\Java\Deployment\SystemCache\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\Java\Deployment\SystemCache\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\Java\Deployment\SystemCache\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\Java\Deployment\SystemCache\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\Java\Deployment\SystemCache\6.0\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\Java\Deployment\SystemCache\6.0\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\Java\Deployment\SystemCache\6.0\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\Java\Deployment\SystemCache\6.0\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\Java\Deployment\SystemCache\6.0\32\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\Java\Deployment\SystemCache\6.0\32\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\Java\Deployment\SystemCache\6.0\32\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\Java\Deployment\SystemCache\6.0\32\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Adobe\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Adobe\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Adobe\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Adobe\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Adobe\Flash Player\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Adobe\Flash Player\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Adobe\Flash Player\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Adobe\Flash Player\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Adobe\Flash Player\AssetCache\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Adobe\Flash Player\AssetCache\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Adobe\Flash Player\AssetCache\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Adobe\Flash Player\AssetCache\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Adobe\Flash Player\AssetCache\RFGM5ZUA\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Adobe\Flash Player\AssetCache\RFGM5ZUA\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Adobe\Flash Player\AssetCache\RFGM5ZUA\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Adobe\Flash Player\AssetCache\RFGM5ZUA\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\avidemux\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\avidemux\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\avidemux\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\avidemux\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Document Building Blocks\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Document Building Blocks\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Document Building Blocks\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Document Building Blocks\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Document Building Blocks\1033\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Document Building Blocks\1033\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Document Building Blocks\1033\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Document Building Blocks\1033\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Document Building Blocks\1033\14\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Document Building Blocks\1033\14\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Document Building Blocks\1033\14\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Document Building Blocks\1033\14\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Templates\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Templates\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Templates\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Templates\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Templates\LiveContent\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Templates\LiveContent\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Templates\LiveContent\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Templates\LiveContent\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\Word Document Building Blocks\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\Word Document Building Blocks\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\Word Document Building Blocks\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\Word Document Building Blocks\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\Word Document Building Blocks\1033\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\Word Document Building Blocks\1033\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\Word Document Building Blocks\1033\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\Word Document Building Blocks\1033\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Windows\Recent\HELP_DECRYPT.lnk    --a---- 1742 bytes    [04:18 29/01/2015]    [22:36 29/01/2015] C4456A5F54FA221306C336C2B2015A41
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HELP_DECRYPT.HTML    --a---- 8528 bytes    [19:45 22/01/2015]    [20:59 29/01/2015] F554319B9DFAA64EF408269F0333FAEA
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HELP_DECRYPT.PNG    --a---- 45458 bytes    [19:45 22/01/2015]    [20:59 29/01/2015] 02EFC26E52BBBA69EF983DF77D0452D2
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HELP_DECRYPT.TXT    --a---- 4204 bytes    [19:45 22/01/2015]    [20:59 29/01/2015] A1C40E8448B4EECF957D92818A05B167
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HELP_DECRYPT.URL    --a---- 272 bytes    [19:45 22/01/2015]    [20:59 29/01/2015] 4288505F8C6EBB2EEAF241AFBB90477D
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Windows Photo Viewer\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Windows Photo Viewer\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Windows Photo Viewer\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Windows Photo Viewer\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Crash Reports\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Crash Reports\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Crash Reports\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Crash Reports\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Crash Reports\submitted\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Crash Reports\submitted\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Crash Reports\submitted\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Crash Reports\submitted\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\sessionstore-backups\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\sessionstore-backups\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\sessionstore-backups\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\sessionstore-backups\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\chrome\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\chrome\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\chrome\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\chrome\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\chrome\idb\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\chrome\idb\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\chrome\idb\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\chrome\idb\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\http+++www.walmart.ca\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\http+++www.walmart.ca\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\http+++www.walmart.ca\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\http+++www.walmart.ca\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\http+++www.walmart.ca\idb\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\http+++www.walmart.ca\idb\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\http+++www.walmart.ca\idb\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\http+++www.walmart.ca\idb\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\moz-safe-about+home\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\moz-safe-about+home\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\moz-safe-about+home\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\moz-safe-about+home\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\moz-safe-about+home\idb\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\moz-safe-about+home\idb\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\moz-safe-about+home\idb\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\moz-safe-about+home\idb\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\OAS\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\OAS\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\OAS\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\OAS\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Prism\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Prism\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Prism\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Prism\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Prism\IG-Marauders\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Prism\IG-Marauders\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Prism\IG-Marauders\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Prism\IG-Marauders\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Prism\IG-Marauders\Profiles\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Prism\IG-Marauders\Profiles\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Prism\IG-Marauders\Profiles\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Prism\IG-Marauders\Profiles\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Prism\IG-Marauders\Profiles\ro3x7vhh.default\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Prism\IG-Marauders\Profiles\ro3x7vhh.default\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Prism\IG-Marauders\Profiles\ro3x7vhh.default\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Prism\IG-Marauders\Profiles\ro3x7vhh.default\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\SecuROM\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\SecuROM\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\SecuROM\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\SecuROM\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\SecuROM\UserData\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\SecuROM\UserData\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\SecuROM\UserData\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\SecuROM\UserData\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 3\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 3\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 3\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 3\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\user1\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\user1\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\user1\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\user1\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\user1\ExSaves\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\user1\ExSaves\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\user1\ExSaves\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\user1\ExSaves\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\user2\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\user2\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\user2\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\user2\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\user2\ExSaves\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\user2\ExSaves\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\user2\ExSaves\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\user2\ExSaves\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\user3\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\user3\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\user3\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\user3\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4 Demo\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4 Demo\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4 Demo\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4 Demo\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4 Demo\users\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4 Demo\users\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4 Demo\users\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4 Demo\users\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4 Demo\users\user1\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4 Demo\users\user1\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4 Demo\users\user1\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4 Demo\users\user1\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 5\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 5\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 5\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 5\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 5\Save\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 5\Save\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 5\Save\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 5\Save\HELP_DECRYPT.URL    --a---- 268 bytes    [07:51 22/01/2015]    [07:51 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Desktop\HELP_DECRYPT.HTML    --a---- 8528 bytes    [20:59 29/01/2015]    [20:59 29/01/2015] F554319B9DFAA64EF408269F0333FAEA
C:\Users\Bo$$ Brenna\Desktop\DLmusic\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:52 22/01/2015]    [07:52 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Desktop\DLmusic\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:52 22/01/2015]    [07:52 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\Desktop\DLmusic\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:52 22/01/2015]    [07:52 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Desktop\DLmusic\HELP_DECRYPT.URL    --a---- 268 bytes    [07:52 22/01/2015]    [07:52 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Documents\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Documents\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\Documents\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Documents\HELP_DECRYPT.URL    --a---- 268 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Documents\Arktos\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Documents\Arktos\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\Documents\Arktos\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Documents\Arktos\HELP_DECRYPT.URL    --a---- 268 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Documents\Arktos\WarZ\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Documents\Arktos\WarZ\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\Documents\Arktos\WarZ\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Documents\Arktos\WarZ\HELP_DECRYPT.URL    --a---- 268 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Documents\DeadIsland\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Documents\DeadIsland\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\Documents\DeadIsland\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Documents\DeadIsland\HELP_DECRYPT.URL    --a---- 268 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Documents\DeadIsland\out\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Documents\DeadIsland\out\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\Documents\DeadIsland\out\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Documents\DeadIsland\out\HELP_DECRYPT.URL    --a---- 268 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Documents\Electronic Arts\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Documents\Electronic Arts\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\Documents\Electronic Arts\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Documents\Electronic Arts\HELP_DECRYPT.URL    --a---- 268 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 3\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 3\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 3\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 3\HELP_DECRYPT.URL    --a---- 268 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 3\Custom Music\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 3\Custom Music\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 3\Custom Music\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 3\Custom Music\HELP_DECRYPT.URL    --a---- 268 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 3\DCCache\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 3\DCCache\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 3\DCCache\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 3\DCCache\HELP_DECRYPT.URL    --a---- 268 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 4\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 4\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 4\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 4\HELP_DECRYPT.URL    --a---- 268 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 4\saves\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 4\saves\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 4\saves\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 4\saves\HELP_DECRYPT.URL    --a---- 268 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 4\saves\scratch\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 4\saves\scratch\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 4\saves\scratch\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 4\saves\scratch\HELP_DECRYPT.URL    --a---- 268 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Documents\My Games\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Documents\My Games\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\Documents\My Games\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Documents\My Games\HELP_DECRYPT.URL    --a---- 268 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Documents\My Games\Fallout3\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Documents\My Games\Fallout3\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\Documents\My Games\Fallout3\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Documents\My Games\Fallout3\HELP_DECRYPT.URL    --a---- 268 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Documents\My Games\Fallout3\Saves\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Documents\My Games\Fallout3\Saves\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\Documents\My Games\Fallout3\Saves\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Documents\My Games\Fallout3\Saves\HELP_DECRYPT.URL    --a---- 268 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Documents\My Games\FalloutNV\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Documents\My Games\FalloutNV\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\Documents\My Games\FalloutNV\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Documents\My Games\FalloutNV\HELP_DECRYPT.URL    --a---- 268 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Documents\My Games\FalloutNV\Saves\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Documents\My Games\FalloutNV\Saves\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\Documents\My Games\FalloutNV\Saves\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Documents\My Games\FalloutNV\Saves\HELP_DECRYPT.URL    --a---- 268 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Documents\My Games\Sid Meier's Civilization 5\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Documents\My Games\Sid Meier's Civilization 5\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\Documents\My Games\Sid Meier's Civilization 5\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Documents\My Games\Sid Meier's Civilization 5\HELP_DECRYPT.URL    --a---- 268 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Documents\My Games\Sid Meier's Civilization 5\ModUserData\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Documents\My Games\Sid Meier's Civilization 5\ModUserData\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\Documents\My Games\Sid Meier's Civilization 5\ModUserData\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Documents\My Games\Sid Meier's Civilization 5\ModUserData\HELP_DECRYPT.URL    --a---- 268 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Documents\My Games\Sid Meier's Civilization 5\Replays\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Documents\My Games\Sid Meier's Civilization 5\Replays\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\Documents\My Games\Sid Meier's Civilization 5\Replays\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Documents\My Games\Sid Meier's Civilization 5\Replays\HELP_DECRYPT.URL    --a---- 268 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Documents\My Games\Sid Meier's Civilization 5 XP1 Demo\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Documents\My Games\Sid Meier's Civilization 5 XP1 Demo\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\Documents\My Games\Sid Meier's Civilization 5 XP1 Demo\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Documents\My Games\Sid Meier's Civilization 5 XP1 Demo\HELP_DECRYPT.URL    --a---- 268 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Documents\My Games\Sid Meier's Civilization 5 XP1 Demo\ModUserData\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Documents\My Games\Sid Meier's Civilization 5 XP1 Demo\ModUserData\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\Documents\My Games\Sid Meier's Civilization 5 XP1 Demo\ModUserData\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Documents\My Games\Sid Meier's Civilization 5 XP1 Demo\ModUserData\HELP_DECRYPT.URL    --a---- 268 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Documents\PCSpeedClean\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Documents\PCSpeedClean\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\Documents\PCSpeedClean\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Documents\PCSpeedClean\HELP_DECRYPT.URL    --a---- 268 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Documents\Riptide\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Documents\Riptide\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\Documents\Riptide\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Documents\Riptide\HELP_DECRYPT.URL    --a---- 268 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Documents\Riptide\out\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Documents\Riptide\out\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\Documents\Riptide\out\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Documents\Riptide\out\HELP_DECRYPT.URL    --a---- 268 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Documents\Symantec\HELP_DECRYPT.HTML    --a---- 8516 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Documents\Symantec\HELP_DECRYPT.PNG    --a---- 45357 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 58B66EF40A7BA4A69DF456806F69941F
C:\Users\Bo$$ Brenna\Documents\Symantec\HELP_DECRYPT.TXT    --a---- 4198 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Documents\Symantec\HELP_DECRYPT.URL    --a---- 268 bytes    [07:56 22/01/2015]    [07:56 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Downloads\HELP_DECRYPT.HTML    --a---- 8528 bytes    [20:59 29/01/2015]    [20:59 29/01/2015] F554319B9DFAA64EF408269F0333FAEA
C:\Users\Bo$$ Brenna\Downloads\HELP_DECRYPT.PNG    --a---- 45458 bytes    [20:59 29/01/2015]    [20:59 29/01/2015] 02EFC26E52BBBA69EF983DF77D0452D2
C:\Users\Bo$$ Brenna\Downloads\HELP_DECRYPT.TXT    --a---- 4204 bytes    [20:59 29/01/2015]    [20:59 29/01/2015] A1C40E8448B4EECF957D92818A05B167
C:\Users\Bo$$ Brenna\Downloads\HELP_DECRYPT.URL    --a---- 272 bytes    [20:59 29/01/2015]    [20:59 29/01/2015] 4288505F8C6EBB2EEAF241AFBB90477D
C:\Users\Bo$$ Brenna\Music\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Music\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\Music\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Music\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Music\iTunes\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Music\iTunes\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\Music\iTunes\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Music\iTunes\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\B-Side Players\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\B-Side Players\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\B-Side Players\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\B-Side Players\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\B-Side Players\Fire In The Youth\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\B-Side Players\Fire In The Youth\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\B-Side Players\Fire In The Youth\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\B-Side Players\Fire In The Youth\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Bob Dylan\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Bob Dylan\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Bob Dylan\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Bob Dylan\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Bob Dylan\The Essential Bob Dylan [Disc 2]\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Bob Dylan\The Essential Bob Dylan [Disc 2]\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Bob Dylan\The Essential Bob Dylan [Disc 2]\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Bob Dylan\The Essential Bob Dylan [Disc 2]\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Citizen Cope\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Citizen Cope\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Citizen Cope\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Citizen Cope\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Citizen Cope\The Clarence Greenwood Recordings\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Citizen Cope\The Clarence Greenwood Recordings\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Citizen Cope\The Clarence Greenwood Recordings\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Citizen Cope\The Clarence Greenwood Recordings\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Compilations\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Compilations\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Compilations\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Compilations\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Compilations\#1 Hits Of The 50's And 60's [Disc 2]\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Compilations\#1 Hits Of The 50's And 60's [Disc 2]\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Compilations\#1 Hits Of The 50's And 60's [Disc 2]\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Compilations\#1 Hits Of The 50's And 60's [Disc 2]\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Elvis Presley\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Elvis Presley\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Elvis Presley\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Elvis Presley\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Elvis Presley\Aloha From Hawaï Via Satellite_Moody Blu\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Elvis Presley\Aloha From Hawaï Via Satellite_Moody Blu\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Elvis Presley\Aloha From Hawaï Via Satellite_Moody Blu\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Elvis Presley\Aloha From Hawaï Via Satellite_Moody Blu\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Junior Brown\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Junior Brown\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Junior Brown\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Junior Brown\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Junior Brown\Unknown Album\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Junior Brown\Unknown Album\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Junior Brown\Unknown Album\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Junior Brown\Unknown Album\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Los Lobos\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Los Lobos\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Los Lobos\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Los Lobos\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Los Lobos\Unknown Album\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Los Lobos\Unknown Album\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Los Lobos\Unknown Album\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Los Lobos\Unknown Album\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Los Lonely Boys\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Los Lonely Boys\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Los Lonely Boys\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Los Lonely Boys\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Los Lonely Boys\Sacred\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Los Lonely Boys\Sacred\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Los Lonely Boys\Sacred\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Los Lonely Boys\Sacred\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Metallica\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Metallica\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Metallica\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Metallica\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Metallica\Master Of Puppets\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Metallica\Master Of Puppets\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Metallica\Master Of Puppets\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Metallica\Master Of Puppets\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Neville Brothers\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Neville Brothers\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Neville Brothers\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Neville Brothers\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Neville Brothers\Walkin' In The Shadow Of Life\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Neville Brothers\Walkin' In The Shadow Of Life\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Neville Brothers\Walkin' In The Shadow Of Life\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Neville Brothers\Walkin' In The Shadow Of Life\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Omar Kent Dykes & Jimmy Vaughn\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Omar Kent Dykes & Jimmy Vaughn\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Omar Kent Dykes & Jimmy Vaughn\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Omar Kent Dykes & Jimmy Vaughn\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Omar Kent Dykes & Jimmy Vaughn\On The Jimmy Reed Highway\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Omar Kent Dykes & Jimmy Vaughn\On The Jimmy Reed Highway\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Omar Kent Dykes & Jimmy Vaughn\On The Jimmy Reed Highway\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Omar Kent Dykes & Jimmy Vaughn\On The Jimmy Reed Highway\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Ray Charles\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Ray Charles\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Ray Charles\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Ray Charles\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Ray Charles\Unknown Album\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Ray Charles\Unknown Album\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Ray Charles\Unknown Album\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Ray Charles\Unknown Album\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Suicidal Tendencies\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Suicidal Tendencies\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Suicidal Tendencies\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Suicidal Tendencies\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Suicidal Tendencies\Suicidal Tendencies\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Suicidal Tendencies\Suicidal Tendencies\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Suicidal Tendencies\Suicidal Tendencies\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Suicidal Tendencies\Suicidal Tendencies\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\The Beach Boys\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\The Beach Boys\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\The Beach Boys\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\The Beach Boys\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\The Beach Boys\The Greatest Hits, Vol. 1\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\The Beach Boys\The Greatest Hits, Vol. 1\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\The Beach Boys\The Greatest Hits, Vol. 1\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\The Beach Boys\The Greatest Hits, Vol. 1\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\The Pogues\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\The Pogues\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\The Pogues\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\The Pogues\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\The Pogues\Red Roses For Me\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\The Pogues\Red Roses For Me\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\The Pogues\Red Roses For Me\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\The Pogues\Red Roses For Me\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Toots & The Maytals\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Toots & The Maytals\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Toots & The Maytals\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Toots & The Maytals\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Toots & The Maytals\20th Century Masters - The Millennium Co\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Toots & The Maytals\20th Century Masters - The Millennium Co\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Toots & The Maytals\20th Century Masters - The Millennium Co\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Toots & The Maytals\20th Century Masters - The Millennium Co\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Unknown Artist\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Unknown Artist\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Unknown Artist\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Unknown Artist\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Unknown Artist\Unknown Album\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Unknown Artist\Unknown Album\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Unknown Artist\Unknown Album\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Unknown Artist\Unknown Album\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Pictures\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Pictures\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\Pictures\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Pictures\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\SkyDrive\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\SkyDrive\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\SkyDrive\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\SkyDrive\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\SkyDrive\Pictures\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\SkyDrive\Pictures\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\SkyDrive\Pictures\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\SkyDrive\Pictures\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\SkyDrive\Pictures\Camera Roll\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\SkyDrive\Pictures\Camera Roll\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\SkyDrive\Pictures\Camera Roll\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\SkyDrive\Pictures\Camera Roll\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\SkyDrive\Pictures\Saved pictures\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\SkyDrive\Pictures\Saved pictures\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\SkyDrive\Pictures\Saved pictures\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\SkyDrive\Pictures\Saved pictures\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Bo$$ Brenna\Virtual Audio Cable 4.10\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Bo$$ Brenna\Virtual Audio Cable 4.10\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Bo$$ Brenna\Virtual Audio Cable 4.10\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Bo$$ Brenna\Virtual Audio Cable 4.10\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Public\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Public\Downloads\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Public\Downloads\Norton\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Public\Downloads\Norton\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Public\Downloads\Norton\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Public\Downloads\Norton\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E
C:\Users\Public\Downloads\Norton\{3A7FA539-8005-4603-87D2-SOS1-NSS-v5}\HELP_DECRYPT.HTML    --a---- 8516 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 2BDE5D3078CEFFF16D0234AFD3D21534
C:\Users\Public\Downloads\Norton\{3A7FA539-8005-4603-87D2-SOS1-NSS-v5}\HELP_DECRYPT.PNG    --a---- 45451 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] B136C424F34D9A33652A530DAFBB5400
C:\Users\Public\Downloads\Norton\{3A7FA539-8005-4603-87D2-SOS1-NSS-v5}\HELP_DECRYPT.TXT    --a---- 4198 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] A4F32273F8683FEBFB6F3703675793B7
C:\Users\Public\Downloads\Norton\{3A7FA539-8005-4603-87D2-SOS1-NSS-v5}\HELP_DECRYPT.URL    --a---- 268 bytes    [19:45 22/01/2015]    [19:45 22/01/2015] 368E62B9956AABA2055E53D295A4A20E

========== regfind ==========

Searching for "*decrypt*"
No data found.

-= EOF =-



#14 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,608 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:03:12 PM

Posted 29 January 2015 - 06:29 PM

Thanks,

We need to run another search to obtain a different format otherwise it will take me quite some time to make the last report workable. Please do this.

===================================================

Farbar's Recovery Scan Tool Search

--------------------
  • Launch FRST
  • Copy/paste the following in the Search Field
*decrypt*
  • Click Search File(s) button
  • When completed click OK and a Search.txt document will open on your desktop
  • Copy and paste the contents of that document your reply
===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it. :thumbsup2:
  • Search.txt

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#15 cappatown

cappatown
  • Topic Starter

  • Members
  • 93 posts
  • OFFLINE
  •  
  • Local time:03:12 PM

Posted 29 January 2015 - 06:38 PM

C:\Users\Public\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Public\Downloads\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Public\Downloads\Norton\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Public\Downloads\Norton\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Public\Downloads\Norton\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Public\Downloads\Norton\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Public\Downloads\Norton\{3A7FA539-8005-4603-87D2-SOS1-NSS-v5}\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Public\Downloads\Norton\{3A7FA539-8005-4603-87D2-SOS1-NSS-v5}\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Public\Downloads\Norton\{3A7FA539-8005-4603-87D2-SOS1-NSS-v5}\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Public\Downloads\Norton\{3A7FA539-8005-4603-87D2-SOS1-NSS-v5}\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\HELP_DECRYPT.HTML
[2015-01-29 12:59][2015-01-29 12:59] 0008528 ____A () F554319B9DFAA64EF408269F0333FAEA

C:\Users\Bo$$ Brenna\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-29 12:59] 0045458 ____A () 02EFC26E52BBBA69EF983DF77D0452D2

C:\Users\Bo$$ Brenna\HELP_DECRYPT.TXT
[2015-01-29 12:59][2015-01-29 12:59] 0004204 ____A () A1C40E8448B4EECF957D92818A05B167

C:\Users\Bo$$ Brenna\HELP_DECRYPT.URL
[2015-01-29 12:59][2015-01-29 12:59] 0000272 ____A () 4288505F8C6EBB2EEAF241AFBB90477D

C:\Users\Bo$$ Brenna\Virtual Audio Cable 4.10\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Virtual Audio Cable 4.10\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\Virtual Audio Cable 4.10\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Virtual Audio Cable 4.10\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\SkyDrive\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\SkyDrive\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\SkyDrive\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\SkyDrive\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\SkyDrive\Pictures\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\SkyDrive\Pictures\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\SkyDrive\Pictures\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\SkyDrive\Pictures\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\SkyDrive\Pictures\Saved pictures\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\SkyDrive\Pictures\Saved pictures\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\SkyDrive\Pictures\Saved pictures\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\SkyDrive\Pictures\Saved pictures\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\SkyDrive\Pictures\Camera Roll\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\SkyDrive\Pictures\Camera Roll\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\SkyDrive\Pictures\Camera Roll\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\SkyDrive\Pictures\Camera Roll\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Pictures\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Pictures\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\Pictures\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Pictures\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Music\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Music\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\Music\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Music\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Music\iTunes\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Music\iTunes\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\Music\iTunes\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Music\iTunes\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Unknown Artist\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Unknown Artist\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Unknown Artist\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Unknown Artist\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Unknown Artist\Unknown Album\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Unknown Artist\Unknown Album\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Unknown Artist\Unknown Album\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Unknown Artist\Unknown Album\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Toots & The Maytals\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Toots & The Maytals\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Toots & The Maytals\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Toots & The Maytals\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Toots & The Maytals\20th Century Masters - The Millennium Co\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Toots & The Maytals\20th Century Masters - The Millennium Co\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Toots & The Maytals\20th Century Masters - The Millennium Co\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Toots & The Maytals\20th Century Masters - The Millennium Co\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\The Pogues\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\The Pogues\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\The Pogues\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\The Pogues\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\The Pogues\Red Roses For Me\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\The Pogues\Red Roses For Me\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\The Pogues\Red Roses For Me\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\The Pogues\Red Roses For Me\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\The Beach Boys\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\The Beach Boys\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\The Beach Boys\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\The Beach Boys\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\The Beach Boys\The Greatest Hits, Vol. 1\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\The Beach Boys\The Greatest Hits, Vol. 1\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\The Beach Boys\The Greatest Hits, Vol. 1\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\The Beach Boys\The Greatest Hits, Vol. 1\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Suicidal Tendencies\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Suicidal Tendencies\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Suicidal Tendencies\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Suicidal Tendencies\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Suicidal Tendencies\Suicidal Tendencies\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Suicidal Tendencies\Suicidal Tendencies\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Suicidal Tendencies\Suicidal Tendencies\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Suicidal Tendencies\Suicidal Tendencies\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Ray Charles\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Ray Charles\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Ray Charles\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Ray Charles\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Ray Charles\Unknown Album\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Ray Charles\Unknown Album\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Ray Charles\Unknown Album\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Ray Charles\Unknown Album\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Omar Kent Dykes & Jimmy Vaughn\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Omar Kent Dykes & Jimmy Vaughn\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Omar Kent Dykes & Jimmy Vaughn\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Omar Kent Dykes & Jimmy Vaughn\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Omar Kent Dykes & Jimmy Vaughn\On The Jimmy Reed Highway\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Omar Kent Dykes & Jimmy Vaughn\On The Jimmy Reed Highway\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Omar Kent Dykes & Jimmy Vaughn\On The Jimmy Reed Highway\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Omar Kent Dykes & Jimmy Vaughn\On The Jimmy Reed Highway\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Neville Brothers\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Neville Brothers\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Neville Brothers\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Neville Brothers\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Neville Brothers\Walkin' In The Shadow Of Life\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Neville Brothers\Walkin' In The Shadow Of Life\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Neville Brothers\Walkin' In The Shadow Of Life\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Neville Brothers\Walkin' In The Shadow Of Life\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Metallica\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Metallica\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Metallica\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Metallica\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Metallica\Master Of Puppets\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Metallica\Master Of Puppets\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Metallica\Master Of Puppets\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Metallica\Master Of Puppets\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Los Lonely Boys\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Los Lonely Boys\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Los Lonely Boys\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Los Lonely Boys\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Los Lonely Boys\Sacred\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Los Lonely Boys\Sacred\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Los Lonely Boys\Sacred\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Los Lonely Boys\Sacred\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Los Lobos\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Los Lobos\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Los Lobos\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Los Lobos\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Los Lobos\Unknown Album\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Los Lobos\Unknown Album\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Los Lobos\Unknown Album\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Los Lobos\Unknown Album\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Junior Brown\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Junior Brown\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Junior Brown\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Junior Brown\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Junior Brown\Unknown Album\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Junior Brown\Unknown Album\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Junior Brown\Unknown Album\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Junior Brown\Unknown Album\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Elvis Presley\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Elvis Presley\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Elvis Presley\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Elvis Presley\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Elvis Presley\Aloha From Hawaï Via Satellite_Moody Blu\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Elvis Presley\Aloha From Hawaï Via Satellite_Moody Blu\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Elvis Presley\Aloha From Hawaï Via Satellite_Moody Blu\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Elvis Presley\Aloha From Hawaï Via Satellite_Moody Blu\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Compilations\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Compilations\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Compilations\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Compilations\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Compilations\#1 Hits Of The 50's And 60's [Disc 2]\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Compilations\#1 Hits Of The 50's And 60's [Disc 2]\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Compilations\#1 Hits Of The 50's And 60's [Disc 2]\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Compilations\#1 Hits Of The 50's And 60's [Disc 2]\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Citizen Cope\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Citizen Cope\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Citizen Cope\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Citizen Cope\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Citizen Cope\The Clarence Greenwood Recordings\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Citizen Cope\The Clarence Greenwood Recordings\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Citizen Cope\The Clarence Greenwood Recordings\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Citizen Cope\The Clarence Greenwood Recordings\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Bob Dylan\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Bob Dylan\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Bob Dylan\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Bob Dylan\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Bob Dylan\The Essential Bob Dylan [Disc 2]\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Bob Dylan\The Essential Bob Dylan [Disc 2]\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Bob Dylan\The Essential Bob Dylan [Disc 2]\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\Bob Dylan\The Essential Bob Dylan [Disc 2]\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\B-Side Players\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\B-Side Players\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\B-Side Players\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\B-Side Players\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\B-Side Players\Fire In The Youth\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\B-Side Players\Fire In The Youth\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-22 11:45] 0045451 ____A () B136C424F34D9A33652A530DAFBB5400

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\B-Side Players\Fire In The Youth\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Music\iTunes\iTunes Media\Music\B-Side Players\Fire In The Youth\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Downloads\HELP_DECRYPT.HTML
[2015-01-29 12:59][2015-01-29 12:59] 0008528 ____A () F554319B9DFAA64EF408269F0333FAEA

C:\Users\Bo$$ Brenna\Downloads\HELP_DECRYPT.PNG
[2015-01-29 12:59][2015-01-29 12:59] 0045458 ____A () 02EFC26E52BBBA69EF983DF77D0452D2

C:\Users\Bo$$ Brenna\Downloads\HELP_DECRYPT.TXT
[2015-01-29 12:59][2015-01-29 12:59] 0004204 ____A () A1C40E8448B4EECF957D92818A05B167

C:\Users\Bo$$ Brenna\Downloads\HELP_DECRYPT.URL
[2015-01-29 12:59][2015-01-29 12:59] 0000272 ____A () 4288505F8C6EBB2EEAF241AFBB90477D

C:\Users\Bo$$ Brenna\Documents\HELP_DECRYPT.HTML
[2015-01-21 23:56][2015-01-21 23:56] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Documents\HELP_DECRYPT.PNG
[2015-01-21 23:56][2015-01-21 23:56] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\Documents\HELP_DECRYPT.TXT
[2015-01-21 23:56][2015-01-21 23:56] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Documents\HELP_DECRYPT.URL
[2015-01-21 23:56][2015-01-21 23:56] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Documents\Symantec\HELP_DECRYPT.HTML
[2015-01-21 23:56][2015-01-21 23:56] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Documents\Symantec\HELP_DECRYPT.PNG
[2015-01-21 23:56][2015-01-21 23:56] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\Documents\Symantec\HELP_DECRYPT.TXT
[2015-01-21 23:56][2015-01-21 23:56] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Documents\Symantec\HELP_DECRYPT.URL
[2015-01-21 23:56][2015-01-21 23:56] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Documents\Riptide\HELP_DECRYPT.HTML
[2015-01-21 23:56][2015-01-21 23:56] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Documents\Riptide\HELP_DECRYPT.PNG
[2015-01-21 23:56][2015-01-21 23:56] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\Documents\Riptide\HELP_DECRYPT.TXT
[2015-01-21 23:56][2015-01-21 23:56] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Documents\Riptide\HELP_DECRYPT.URL
[2015-01-21 23:56][2015-01-21 23:56] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Documents\Riptide\out\HELP_DECRYPT.HTML
[2015-01-21 23:56][2015-01-21 23:56] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Documents\Riptide\out\HELP_DECRYPT.PNG
[2015-01-21 23:56][2015-01-21 23:56] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\Documents\Riptide\out\HELP_DECRYPT.TXT
[2015-01-21 23:56][2015-01-21 23:56] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Documents\Riptide\out\HELP_DECRYPT.URL
[2015-01-21 23:56][2015-01-21 23:56] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Documents\PCSpeedClean\HELP_DECRYPT.HTML
[2015-01-21 23:56][2015-01-21 23:56] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Documents\PCSpeedClean\HELP_DECRYPT.PNG
[2015-01-21 23:56][2015-01-21 23:56] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\Documents\PCSpeedClean\HELP_DECRYPT.TXT
[2015-01-21 23:56][2015-01-21 23:56] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Documents\PCSpeedClean\HELP_DECRYPT.URL
[2015-01-21 23:56][2015-01-21 23:56] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Documents\My Games\HELP_DECRYPT.HTML
[2015-01-21 23:56][2015-01-21 23:56] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Documents\My Games\HELP_DECRYPT.PNG
[2015-01-21 23:56][2015-01-21 23:56] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\Documents\My Games\HELP_DECRYPT.TXT
[2015-01-21 23:56][2015-01-21 23:56] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Documents\My Games\HELP_DECRYPT.URL
[2015-01-21 23:56][2015-01-21 23:56] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Documents\My Games\Sid Meier's Civilization 5 XP1 Demo\HELP_DECRYPT.HTML
[2015-01-21 23:56][2015-01-21 23:56] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Documents\My Games\Sid Meier's Civilization 5 XP1 Demo\HELP_DECRYPT.PNG
[2015-01-21 23:56][2015-01-21 23:56] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\Documents\My Games\Sid Meier's Civilization 5 XP1 Demo\HELP_DECRYPT.TXT
[2015-01-21 23:56][2015-01-21 23:56] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Documents\My Games\Sid Meier's Civilization 5 XP1 Demo\HELP_DECRYPT.URL
[2015-01-21 23:56][2015-01-21 23:56] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Documents\My Games\Sid Meier's Civilization 5 XP1 Demo\ModUserData\HELP_DECRYPT.HTML
[2015-01-21 23:56][2015-01-21 23:56] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Documents\My Games\Sid Meier's Civilization 5 XP1 Demo\ModUserData\HELP_DECRYPT.PNG
[2015-01-21 23:56][2015-01-21 23:56] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\Documents\My Games\Sid Meier's Civilization 5 XP1 Demo\ModUserData\HELP_DECRYPT.TXT
[2015-01-21 23:56][2015-01-21 23:56] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Documents\My Games\Sid Meier's Civilization 5 XP1 Demo\ModUserData\HELP_DECRYPT.URL
[2015-01-21 23:56][2015-01-21 23:56] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Documents\My Games\Sid Meier's Civilization 5\HELP_DECRYPT.HTML
[2015-01-21 23:56][2015-01-21 23:56] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Documents\My Games\Sid Meier's Civilization 5\HELP_DECRYPT.PNG
[2015-01-21 23:56][2015-01-21 23:56] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\Documents\My Games\Sid Meier's Civilization 5\HELP_DECRYPT.TXT
[2015-01-21 23:56][2015-01-21 23:56] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Documents\My Games\Sid Meier's Civilization 5\HELP_DECRYPT.URL
[2015-01-21 23:56][2015-01-21 23:56] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Documents\My Games\Sid Meier's Civilization 5\Replays\HELP_DECRYPT.HTML
[2015-01-21 23:56][2015-01-21 23:56] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Documents\My Games\Sid Meier's Civilization 5\Replays\HELP_DECRYPT.PNG
[2015-01-21 23:56][2015-01-21 23:56] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\Documents\My Games\Sid Meier's Civilization 5\Replays\HELP_DECRYPT.TXT
[2015-01-21 23:56][2015-01-21 23:56] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Documents\My Games\Sid Meier's Civilization 5\Replays\HELP_DECRYPT.URL
[2015-01-21 23:56][2015-01-21 23:56] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Documents\My Games\Sid Meier's Civilization 5\ModUserData\HELP_DECRYPT.HTML
[2015-01-21 23:56][2015-01-21 23:56] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Documents\My Games\Sid Meier's Civilization 5\ModUserData\HELP_DECRYPT.PNG
[2015-01-21 23:56][2015-01-21 23:56] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\Documents\My Games\Sid Meier's Civilization 5\ModUserData\HELP_DECRYPT.TXT
[2015-01-21 23:56][2015-01-21 23:56] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Documents\My Games\Sid Meier's Civilization 5\ModUserData\HELP_DECRYPT.URL
[2015-01-21 23:56][2015-01-21 23:56] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Documents\My Games\FalloutNV\HELP_DECRYPT.HTML
[2015-01-21 23:56][2015-01-21 23:56] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Documents\My Games\FalloutNV\HELP_DECRYPT.PNG
[2015-01-21 23:56][2015-01-21 23:56] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\Documents\My Games\FalloutNV\HELP_DECRYPT.TXT
[2015-01-21 23:56][2015-01-21 23:56] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Documents\My Games\FalloutNV\HELP_DECRYPT.URL
[2015-01-21 23:56][2015-01-21 23:56] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Documents\My Games\FalloutNV\Saves\HELP_DECRYPT.HTML
[2015-01-21 23:56][2015-01-21 23:56] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Documents\My Games\FalloutNV\Saves\HELP_DECRYPT.PNG
[2015-01-21 23:56][2015-01-21 23:56] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\Documents\My Games\FalloutNV\Saves\HELP_DECRYPT.TXT
[2015-01-21 23:56][2015-01-21 23:56] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Documents\My Games\FalloutNV\Saves\HELP_DECRYPT.URL
[2015-01-21 23:56][2015-01-21 23:56] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Documents\My Games\Fallout3\HELP_DECRYPT.HTML
[2015-01-21 23:56][2015-01-21 23:56] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Documents\My Games\Fallout3\HELP_DECRYPT.PNG
[2015-01-21 23:56][2015-01-21 23:56] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\Documents\My Games\Fallout3\HELP_DECRYPT.TXT
[2015-01-21 23:56][2015-01-21 23:56] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Documents\My Games\Fallout3\HELP_DECRYPT.URL
[2015-01-21 23:56][2015-01-21 23:56] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Documents\My Games\Fallout3\Saves\HELP_DECRYPT.HTML
[2015-01-21 23:56][2015-01-21 23:56] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Documents\My Games\Fallout3\Saves\HELP_DECRYPT.PNG
[2015-01-21 23:56][2015-01-21 23:56] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\Documents\My Games\Fallout3\Saves\HELP_DECRYPT.TXT
[2015-01-21 23:56][2015-01-21 23:56] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Documents\My Games\Fallout3\Saves\HELP_DECRYPT.URL
[2015-01-21 23:56][2015-01-21 23:56] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Documents\Electronic Arts\HELP_DECRYPT.HTML
[2015-01-21 23:56][2015-01-21 23:56] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Documents\Electronic Arts\HELP_DECRYPT.PNG
[2015-01-21 23:56][2015-01-21 23:56] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\Documents\Electronic Arts\HELP_DECRYPT.TXT
[2015-01-21 23:56][2015-01-21 23:56] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Documents\Electronic Arts\HELP_DECRYPT.URL
[2015-01-21 23:56][2015-01-21 23:56] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 4\HELP_DECRYPT.HTML
[2015-01-21 23:56][2015-01-21 23:56] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 4\HELP_DECRYPT.PNG
[2015-01-21 23:56][2015-01-21 23:56] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 4\HELP_DECRYPT.TXT
[2015-01-21 23:56][2015-01-21 23:56] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 4\HELP_DECRYPT.URL
[2015-01-21 23:56][2015-01-21 23:56] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 4\saves\HELP_DECRYPT.HTML
[2015-01-21 23:56][2015-01-21 23:56] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 4\saves\HELP_DECRYPT.PNG
[2015-01-21 23:56][2015-01-21 23:56] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 4\saves\HELP_DECRYPT.TXT
[2015-01-21 23:56][2015-01-21 23:56] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 4\saves\HELP_DECRYPT.URL
[2015-01-21 23:56][2015-01-21 23:56] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 4\saves\scratch\HELP_DECRYPT.HTML
[2015-01-21 23:56][2015-01-21 23:56] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 4\saves\scratch\HELP_DECRYPT.PNG
[2015-01-21 23:56][2015-01-21 23:56] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 4\saves\scratch\HELP_DECRYPT.TXT
[2015-01-21 23:56][2015-01-21 23:56] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 4\saves\scratch\HELP_DECRYPT.URL
[2015-01-21 23:56][2015-01-21 23:56] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 3\HELP_DECRYPT.HTML
[2015-01-21 23:56][2015-01-21 23:56] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 3\HELP_DECRYPT.PNG
[2015-01-21 23:56][2015-01-21 23:56] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 3\HELP_DECRYPT.TXT
[2015-01-21 23:56][2015-01-21 23:56] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 3\HELP_DECRYPT.URL
[2015-01-21 23:56][2015-01-21 23:56] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 3\DCCache\HELP_DECRYPT.HTML
[2015-01-21 23:56][2015-01-21 23:56] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 3\DCCache\HELP_DECRYPT.PNG
[2015-01-21 23:56][2015-01-21 23:56] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 3\DCCache\HELP_DECRYPT.TXT
[2015-01-21 23:56][2015-01-21 23:56] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 3\DCCache\HELP_DECRYPT.URL
[2015-01-21 23:56][2015-01-21 23:56] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 3\Custom Music\HELP_DECRYPT.HTML
[2015-01-21 23:56][2015-01-21 23:56] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 3\Custom Music\HELP_DECRYPT.PNG
[2015-01-21 23:56][2015-01-21 23:56] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 3\Custom Music\HELP_DECRYPT.TXT
[2015-01-21 23:56][2015-01-21 23:56] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Documents\Electronic Arts\The Sims 3\Custom Music\HELP_DECRYPT.URL
[2015-01-21 23:56][2015-01-21 23:56] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Documents\DeadIsland\HELP_DECRYPT.HTML
[2015-01-21 23:56][2015-01-21 23:56] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Documents\DeadIsland\HELP_DECRYPT.PNG
[2015-01-21 23:56][2015-01-21 23:56] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\Documents\DeadIsland\HELP_DECRYPT.TXT
[2015-01-21 23:56][2015-01-21 23:56] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Documents\DeadIsland\HELP_DECRYPT.URL
[2015-01-21 23:56][2015-01-21 23:56] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Documents\DeadIsland\out\HELP_DECRYPT.HTML
[2015-01-21 23:56][2015-01-21 23:56] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Documents\DeadIsland\out\HELP_DECRYPT.PNG
[2015-01-21 23:56][2015-01-21 23:56] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\Documents\DeadIsland\out\HELP_DECRYPT.TXT
[2015-01-21 23:56][2015-01-21 23:56] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Documents\DeadIsland\out\HELP_DECRYPT.URL
[2015-01-21 23:56][2015-01-21 23:56] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Documents\Arktos\HELP_DECRYPT.HTML
[2015-01-21 23:56][2015-01-21 23:56] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Documents\Arktos\HELP_DECRYPT.PNG
[2015-01-21 23:56][2015-01-21 23:56] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\Documents\Arktos\HELP_DECRYPT.TXT
[2015-01-21 23:56][2015-01-21 23:56] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Documents\Arktos\HELP_DECRYPT.URL
[2015-01-21 23:56][2015-01-21 23:56] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Documents\Arktos\WarZ\HELP_DECRYPT.HTML
[2015-01-21 23:56][2015-01-21 23:56] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Documents\Arktos\WarZ\HELP_DECRYPT.PNG
[2015-01-21 23:56][2015-01-21 23:56] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\Documents\Arktos\WarZ\HELP_DECRYPT.TXT
[2015-01-21 23:56][2015-01-21 23:56] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Documents\Arktos\WarZ\HELP_DECRYPT.URL
[2015-01-21 23:56][2015-01-21 23:56] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\Desktop\HELP_DECRYPT.HTML
[2015-01-21 23:56][2015-01-21 23:56] 0000000 _____ ()

C:\Users\Bo$$ Brenna\Desktop\DLmusic\HELP_DECRYPT.HTML
[2015-01-21 23:52][2015-01-21 23:52] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\Desktop\DLmusic\HELP_DECRYPT.PNG
[2015-01-21 23:52][2015-01-21 23:52] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\Desktop\DLmusic\HELP_DECRYPT.TXT
[2015-01-21 23:52][2015-01-21 23:52] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\Desktop\DLmusic\HELP_DECRYPT.URL
[2015-01-21 23:52][2015-01-21 23:52] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\HELP_DECRYPT.HTML
[2015-01-29 12:55][2015-01-29 12:55] 0008528 ____A () F554319B9DFAA64EF408269F0333FAEA

C:\Users\Bo$$ Brenna\AppData\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-29 12:55] 0045454 ____A () 21974389F5C52F88A406CC5306C4C9BE

C:\Users\Bo$$ Brenna\AppData\HELP_DECRYPT.TXT
[2015-01-29 12:55][2015-01-29 12:55] 0004204 ____A () A1C40E8448B4EECF957D92818A05B167

C:\Users\Bo$$ Brenna\AppData\HELP_DECRYPT.URL
[2015-01-29 12:55][2015-01-29 12:55] 0000272 ____A () 4288505F8C6EBB2EEAF241AFBB90477D

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 5\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 5\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 5\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 5\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 5\Save\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 5\Save\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 5\Save\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 5\Save\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4 Demo\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4 Demo\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4 Demo\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4 Demo\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4 Demo\users\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4 Demo\users\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4 Demo\users\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4 Demo\users\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4 Demo\users\user1\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4 Demo\users\user1\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4 Demo\users\user1\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4 Demo\users\user1\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\user3\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\user3\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\user3\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\user3\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\user2\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\user2\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\user2\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\user2\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\user2\ExSaves\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\user2\ExSaves\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\user2\ExSaves\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\user2\ExSaves\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\user1\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\user1\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\user1\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\user1\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\user1\ExSaves\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\user1\ExSaves\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\user1\ExSaves\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 4\users\user1\ExSaves\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 3\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 3\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 3\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Tropico 3\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\SecuROM\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\SecuROM\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\SecuROM\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\SecuROM\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\SecuROM\UserData\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\SecuROM\UserData\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\SecuROM\UserData\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\SecuROM\UserData\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Prism\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Prism\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Prism\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Prism\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Prism\IG-Marauders\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Prism\IG-Marauders\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Prism\IG-Marauders\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Prism\IG-Marauders\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Prism\IG-Marauders\Profiles\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Prism\IG-Marauders\Profiles\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Prism\IG-Marauders\Profiles\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Prism\IG-Marauders\Profiles\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Prism\IG-Marauders\Profiles\ro3x7vhh.default\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Prism\IG-Marauders\Profiles\ro3x7vhh.default\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Prism\IG-Marauders\Profiles\ro3x7vhh.default\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Prism\IG-Marauders\Profiles\ro3x7vhh.default\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\OAS\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\OAS\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\OAS\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\OAS\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\moz-safe-about+home\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\moz-safe-about+home\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\moz-safe-about+home\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\moz-safe-about+home\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\moz-safe-about+home\idb\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\moz-safe-about+home\idb\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\moz-safe-about+home\idb\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\moz-safe-about+home\idb\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\http+++www.walmart.ca\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\http+++www.walmart.ca\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\http+++www.walmart.ca\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\http+++www.walmart.ca\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\http+++www.walmart.ca\idb\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\http+++www.walmart.ca\idb\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\http+++www.walmart.ca\idb\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\http+++www.walmart.ca\idb\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\chrome\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\chrome\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\chrome\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\chrome\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\chrome\idb\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\chrome\idb\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\chrome\idb\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\storage\persistent\chrome\idb\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\sessionstore-backups\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\sessionstore-backups\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\sessionstore-backups\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Profiles\xwbzbitc.default\sessionstore-backups\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Crash Reports\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Crash Reports\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Crash Reports\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Crash Reports\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Crash Reports\submitted\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Crash Reports\submitted\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Crash Reports\submitted\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Mozilla\Firefox\Crash Reports\submitted\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Windows Photo Viewer\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Windows Photo Viewer\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Windows Photo Viewer\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Windows Photo Viewer\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HELP_DECRYPT.HTML
[2015-01-22 11:45][2015-01-29 12:59] 0008528 ____A () F554319B9DFAA64EF408269F0333FAEA

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HELP_DECRYPT.PNG
[2015-01-22 11:45][2015-01-29 12:59] 0045458 ____A () 02EFC26E52BBBA69EF983DF77D0452D2

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HELP_DECRYPT.TXT
[2015-01-22 11:45][2015-01-29 12:59] 0004204 ____A () A1C40E8448B4EECF957D92818A05B167

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HELP_DECRYPT.URL
[2015-01-22 11:45][2015-01-29 12:59] 0000272 ____A () 4288505F8C6EBB2EEAF241AFBB90477D

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Windows\Recent\HELP_DECRYPT.lnk
[2015-01-28 20:18][2015-01-29 15:28] 0001742 ____A () C4456A5F54FA221306C336C2B2015A41

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Templates\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Templates\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Templates\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Templates\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Templates\LiveContent\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Templates\LiveContent\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Templates\LiveContent\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Templates\LiveContent\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\Word Document Building Blocks\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\Word Document Building Blocks\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\Word Document Building Blocks\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\Word Document Building Blocks\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\Word Document Building Blocks\1033\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\Word Document Building Blocks\1033\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\Word Document Building Blocks\1033\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\Word Document Building Blocks\1033\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Document Building Blocks\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Document Building Blocks\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Document Building Blocks\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Document Building Blocks\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Document Building Blocks\1033\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Document Building Blocks\1033\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Document Building Blocks\1033\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Document Building Blocks\1033\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Document Building Blocks\1033\14\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Document Building Blocks\1033\14\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Document Building Blocks\1033\14\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Microsoft\Document Building Blocks\1033\14\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\avidemux\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\avidemux\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\avidemux\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\avidemux\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Adobe\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Adobe\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Adobe\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Adobe\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Adobe\Flash Player\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Adobe\Flash Player\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Adobe\Flash Player\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Adobe\Flash Player\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Adobe\Flash Player\AssetCache\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Adobe\Flash Player\AssetCache\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Adobe\Flash Player\AssetCache\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Adobe\Flash Player\AssetCache\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Roaming\Adobe\Flash Player\AssetCache\RFGM5ZUA\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Roaming\Adobe\Flash Player\AssetCache\RFGM5ZUA\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Roaming\Adobe\Flash Player\AssetCache\RFGM5ZUA\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Roaming\Adobe\Flash Player\AssetCache\RFGM5ZUA\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\LocalLow\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\LocalLow\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\LocalLow\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\LocalLow\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\Java\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\Java\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\Java\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\Java\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\Java\Deployment\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\Java\Deployment\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\Java\Deployment\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\Java\Deployment\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\Java\Deployment\SystemCache\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\Java\Deployment\SystemCache\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\Java\Deployment\SystemCache\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\Java\Deployment\SystemCache\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\Java\Deployment\SystemCache\6.0\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\Java\Deployment\SystemCache\6.0\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\Java\Deployment\SystemCache\6.0\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\Java\Deployment\SystemCache\6.0\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\Java\Deployment\SystemCache\6.0\32\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\Java\Deployment\SystemCache\6.0\32\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\Java\Deployment\SystemCache\6.0\32\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\LocalLow\Sun\Java\Deployment\SystemCache\6.0\32\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\LocalLow\Microsoft\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\LocalLow\Microsoft\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\LocalLow\Microsoft\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\LocalLow\Microsoft\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\LocalLow\Microsoft\Silverlight\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\LocalLow\Microsoft\Silverlight\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\LocalLow\Microsoft\Silverlight\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\LocalLow\Microsoft\Silverlight\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\LocalLow\Adobe\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\LocalLow\Adobe\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\LocalLow\Adobe\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\LocalLow\Adobe\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\LocalLow\Adobe\Acrobat\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\LocalLow\Adobe\Acrobat\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\LocalLow\Adobe\Acrobat\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\LocalLow\Adobe\Acrobat\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\LocalLow\Adobe\Acrobat\10.0\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\LocalLow\Adobe\Acrobat\10.0\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\LocalLow\Adobe\Acrobat\10.0\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\LocalLow\Adobe\Acrobat\10.0\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\HELP_DECRYPT.HTML
[2015-01-29 12:55][2015-01-29 12:55] 0008528 ____A () F554319B9DFAA64EF408269F0333FAEA

C:\Users\Bo$$ Brenna\AppData\Local\HELP_DECRYPT.PNG
[2015-01-29 12:55][2015-01-29 12:55] 0045454 ____A () 21974389F5C52F88A406CC5306C4C9BE

C:\Users\Bo$$ Brenna\AppData\Local\HELP_DECRYPT.TXT
[2015-01-29 12:55][2015-01-29 12:55] 0004204 ____A () A1C40E8448B4EECF957D92818A05B167

C:\Users\Bo$$ Brenna\AppData\Local\HELP_DECRYPT.URL
[2015-01-29 12:55][2015-01-29 12:55] 0000272 ____A () 4288505F8C6EBB2EEAF241AFBB90477D

C:\Users\Bo$$ Brenna\AppData\Local\Symantec\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\Symantec\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\Symantec\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\Symantec\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\Rockstar Games\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\Rockstar Games\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\Rockstar Games\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\Rockstar Games\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\Rockstar Games\GTA IV\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\Rockstar Games\GTA IV\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\Rockstar Games\GTA IV\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\Rockstar Games\GTA IV\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\Rockstar Games\GTA IV\User Music\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\Rockstar Games\GTA IV\User Music\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\Rockstar Games\GTA IV\User Music\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\Rockstar Games\GTA IV\User Music\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\TWZ\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\TWZ\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\TWZ\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\TWZ\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\TWZ\pb\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\TWZ\pb\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\TWZ\pb\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\TWZ\pb\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\APB\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\APB\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\APB\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\APB\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\APB\pb\HELP_DECRYPT.HTML
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\APB\pb\HELP_DECRYPT.PNG
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\APB\pb\HELP_DECRYPT.TXT
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\APB\pb\HELP_DECRYPT.URL
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\AAV3\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\AAV3\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\AAV3\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\AAV3\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\AAV3\pb\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\AAV3\pb\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\AAV3\pb\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\PunkBuster\AAV3\pb\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\Mozilla\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\Mozilla\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\Mozilla\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\Mozilla\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\Mozilla\Firefox\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\Mozilla\Firefox\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\Mozilla\Firefox\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\Mozilla\Firefox\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft Games\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft Games\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft Games\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft Games\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft Games\Spider Solitaire\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft Games\Spider Solitaire\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft Games\Spider Solitaire\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft Games\Spider Solitaire\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft Games\Minesweeper\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft Games\Minesweeper\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft Games\Minesweeper\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft Games\Minesweeper\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Sidebar\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Sidebar\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Sidebar\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Sidebar\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Sidebar\Gadgets\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Sidebar\Gadgets\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Sidebar\Gadgets\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Sidebar\Gadgets\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Media\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Media\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Media\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Media\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Media\12.0\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Media\12.0\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Media\12.0\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Media\12.0\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Mail\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Mail\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Mail\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Mail\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Mail\Stationery\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Mail\Stationery\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Mail\Stationery\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Mail\Stationery\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Mail\Backup\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Mail\Backup\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Mail\Backup\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Mail\Backup\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Mail\Backup\new\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Mail\Backup\new\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Mail\Backup\new\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Windows Mail\Backup\new\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Photo Acquisition\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Photo Acquisition\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Photo Acquisition\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Photo Acquisition\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Internet Explorer\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Internet Explorer\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Internet Explorer\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\Microsoft\Internet Explorer\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\Google\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\Google\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\Google\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\Google\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\Google\Chrome\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\Google\Chrome\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\Google\Chrome\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\Google\Chrome\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\Google\Chrome\User Data\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\Google\Chrome\User Data\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\Google\Chrome\User Data\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\Google\Chrome\User Data\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\Google\Chrome\User Data\Default\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\Google\Chrome\User Data\Default\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\Google\Chrome\User Data\Default\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\Google\Chrome\User Data\Default\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\Google\Chrome\User Data\Default\databases\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\Google\Chrome\User Data\Default\databases\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\Google\Chrome\User Data\Default\databases\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\Google\Chrome\User Data\Default\databases\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\Fallout3\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\Fallout3\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\Fallout3\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\Fallout3\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\EdgeOfReality\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\EdgeOfReality\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\EdgeOfReality\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\EdgeOfReality\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\EdgeOfReality\Loadout\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\EdgeOfReality\Loadout\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\EdgeOfReality\Loadout\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\EdgeOfReality\Loadout\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\EdgeOfReality\Loadout\CrashReports\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\EdgeOfReality\Loadout\CrashReports\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\EdgeOfReality\Loadout\CrashReports\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\EdgeOfReality\Loadout\CrashReports\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\Arktos Entertainment\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\Arktos Entertainment\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\Arktos Entertainment\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\Arktos Entertainment\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\Arktos Entertainment\Infestation\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\Arktos Entertainment\Infestation\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\Arktos Entertainment\Infestation\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\Arktos Entertainment\Infestation\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\Arktos Entertainment\Infestation\Levels\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\Arktos Entertainment\Infestation\Levels\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\Arktos Entertainment\Infestation\Levels\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\Arktos Entertainment\Infestation\Levels\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\Arktos Entertainment\Infestation\Levels\Colorado_V2\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\Arktos Entertainment\Infestation\Levels\Colorado_V2\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\Arktos Entertainment\Infestation\Levels\Colorado_V2\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\Arktos Entertainment\Infestation\Levels\Colorado_V2\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\Arktos Entertainment\Infestation\Levels\California_V2\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\Arktos Entertainment\Infestation\Levels\California_V2\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\Arktos Entertainment\Infestation\Levels\California_V2\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\Arktos Entertainment\Infestation\Levels\California_V2\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\Apple Computer\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\Apple Computer\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\Apple Computer\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\Apple Computer\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\Apple Computer\iTunes\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\Bo$$ Brenna\AppData\Local\Apple Computer\iTunes\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\Bo$$ Brenna\AppData\Local\Apple Computer\iTunes\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\Bo$$ Brenna\AppData\Local\Apple Computer\iTunes\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\Bo$$ Brenna\AppData\Local\Akamai\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-29 12:55] 0008528 ____A () F554319B9DFAA64EF408269F0333FAEA

C:\Users\Bo$$ Brenna\AppData\Local\Akamai\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-29 12:55] 0045454 ____A () 21974389F5C52F88A406CC5306C4C9BE

C:\Users\Bo$$ Brenna\AppData\Local\Akamai\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-29 12:55] 0004204 ____A () A1C40E8448B4EECF957D92818A05B167

C:\Users\Bo$$ Brenna\AppData\Local\Akamai\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-29 12:55] 0000272 ____A () 4288505F8C6EBB2EEAF241AFBB90477D

C:\Users\All Users\HELP_DECRYPT.HTML
[2015-01-29 12:55][2015-01-29 12:55] 0008528 ____A () F554319B9DFAA64EF408269F0333FAEA

C:\Users\All Users\HELP_DECRYPT.PNG
[2015-01-29 12:55][2015-01-29 12:55] 0045454 ____A () 21974389F5C52F88A406CC5306C4C9BE

C:\Users\All Users\HELP_DECRYPT.TXT
[2015-01-29 12:55][2015-01-29 12:55] 0004204 ____A () A1C40E8448B4EECF957D92818A05B167

C:\Users\All Users\HELP_DECRYPT.URL
[2015-01-29 12:55][2015-01-29 12:55] 0000272 ____A () 4288505F8C6EBB2EEAF241AFBB90477D

C:\Users\All Users\WindSolutions\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\All Users\WindSolutions\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\All Users\WindSolutions\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\All Users\WindSolutions\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\All Users\WindSolutions\CopyTransManager\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\All Users\WindSolutions\CopyTransManager\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\All Users\WindSolutions\CopyTransManager\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\All Users\WindSolutions\CopyTransManager\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\All Users\WindSolutions\CopyTransManager\Logs\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\All Users\WindSolutions\CopyTransManager\Logs\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\All Users\WindSolutions\CopyTransManager\Logs\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\All Users\WindSolutions\CopyTransManager\Logs\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\All Users\WindSolutions\CopyTrans\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\All Users\WindSolutions\CopyTrans\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\All Users\WindSolutions\CopyTrans\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\All Users\WindSolutions\CopyTrans\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\All Users\WindSolutions\CopyTrans\Logs\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\All Users\WindSolutions\CopyTrans\Logs\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\All Users\WindSolutions\CopyTrans\Logs\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\All Users\WindSolutions\CopyTrans\Logs\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\All Users\SecuROM\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\All Users\SecuROM\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\All Users\SecuROM\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\All Users\SecuROM\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\All Users\SecuROM\DFA\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\All Users\SecuROM\DFA\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\All Users\SecuROM\DFA\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\All Users\SecuROM\DFA\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\All Users\Norton\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\All Users\Norton\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\All Users\Norton\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\All Users\Norton\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\All Users\Microsoft\RAC\PublishedData\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-29 12:55] 0008528 ____A () F554319B9DFAA64EF408269F0333FAEA

C:\Users\All Users\Microsoft\RAC\PublishedData\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-29 12:55] 0045454 ____A () 21974389F5C52F88A406CC5306C4C9BE

C:\Users\All Users\Microsoft\RAC\PublishedData\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-29 12:55] 0004204 ____A () A1C40E8448B4EECF957D92818A05B167

C:\Users\All Users\Microsoft\RAC\PublishedData\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-29 12:55] 0000272 ____A () 4288505F8C6EBB2EEAF241AFBB90477D

C:\Users\All Users\LogiShrd\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\All Users\LogiShrd\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\All Users\LogiShrd\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\All Users\LogiShrd\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\Users\All Users\LogiShrd\Updater\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\Users\All Users\LogiShrd\Updater\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\Users\All Users\LogiShrd\Updater\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\Users\All Users\LogiShrd\Updater\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\ProgramData\HELP_DECRYPT.HTML
[2015-01-29 12:55][2015-01-29 12:55] 0008528 ____A () F554319B9DFAA64EF408269F0333FAEA

C:\ProgramData\HELP_DECRYPT.PNG
[2015-01-29 12:55][2015-01-29 12:55] 0045454 ____A () 21974389F5C52F88A406CC5306C4C9BE

C:\ProgramData\HELP_DECRYPT.TXT
[2015-01-29 12:55][2015-01-29 12:55] 0004204 ____A () A1C40E8448B4EECF957D92818A05B167

C:\ProgramData\HELP_DECRYPT.URL
[2015-01-29 12:55][2015-01-29 12:55] 0000272 ____A () 4288505F8C6EBB2EEAF241AFBB90477D

C:\ProgramData\WindSolutions\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\ProgramData\WindSolutions\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\ProgramData\WindSolutions\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\ProgramData\WindSolutions\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\ProgramData\WindSolutions\CopyTransManager\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\ProgramData\WindSolutions\CopyTransManager\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\ProgramData\WindSolutions\CopyTransManager\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\ProgramData\WindSolutions\CopyTransManager\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\ProgramData\WindSolutions\CopyTransManager\Logs\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\ProgramData\WindSolutions\CopyTransManager\Logs\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\ProgramData\WindSolutions\CopyTransManager\Logs\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\ProgramData\WindSolutions\CopyTransManager\Logs\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\ProgramData\WindSolutions\CopyTrans\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\ProgramData\WindSolutions\CopyTrans\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\ProgramData\WindSolutions\CopyTrans\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\ProgramData\WindSolutions\CopyTrans\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\ProgramData\WindSolutions\CopyTrans\Logs\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\ProgramData\WindSolutions\CopyTrans\Logs\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\ProgramData\WindSolutions\CopyTrans\Logs\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\ProgramData\WindSolutions\CopyTrans\Logs\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\ProgramData\SecuROM\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\ProgramData\SecuROM\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\ProgramData\SecuROM\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\ProgramData\SecuROM\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\ProgramData\SecuROM\DFA\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\ProgramData\SecuROM\DFA\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\ProgramData\SecuROM\DFA\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\ProgramData\SecuROM\DFA\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\ProgramData\Norton\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\ProgramData\Norton\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\ProgramData\Norton\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\ProgramData\Norton\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\ProgramData\Microsoft\RAC\PublishedData\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-29 12:55] 0008528 ____A () F554319B9DFAA64EF408269F0333FAEA

C:\ProgramData\Microsoft\RAC\PublishedData\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-29 12:55] 0045454 ____A () 21974389F5C52F88A406CC5306C4C9BE

C:\ProgramData\Microsoft\RAC\PublishedData\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-29 12:55] 0004204 ____A () A1C40E8448B4EECF957D92818A05B167

C:\ProgramData\Microsoft\RAC\PublishedData\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-29 12:55] 0000272 ____A () 4288505F8C6EBB2EEAF241AFBB90477D

C:\ProgramData\LogiShrd\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\ProgramData\LogiShrd\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\ProgramData\LogiShrd\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\ProgramData\LogiShrd\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\ProgramData\LogiShrd\Updater\HELP_DECRYPT.HTML
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\ProgramData\LogiShrd\Updater\HELP_DECRYPT.PNG
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\ProgramData\LogiShrd\Updater\HELP_DECRYPT.TXT
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\ProgramData\LogiShrd\Updater\HELP_DECRYPT.URL
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\FRST\Quarantine\C\Users\Public\HELP_DECRYPT.HTML.xBAD
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\FRST\Quarantine\C\Users\Public\HELP_DECRYPT.TXT.xBAD
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\FRST\Quarantine\C\Users\Public\HELP_DECRYPT.URL.xBAD
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\FRST\Quarantine\C\Users\Public\Downloads\HELP_DECRYPT.HTML.xBAD
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\FRST\Quarantine\C\Users\Public\Downloads\HELP_DECRYPT.TXT.xBAD
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\FRST\Quarantine\C\Users\Public\Downloads\HELP_DECRYPT.URL.xBAD
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\FRST\Quarantine\C\Users\Bo$$ Brenna\HELP_DECRYPT.HTML.xBAD
[2015-01-22 11:45][2015-01-22 11:45] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\FRST\Quarantine\C\Users\Bo$$ Brenna\HELP_DECRYPT.TXT.xBAD
[2015-01-22 11:45][2015-01-22 11:45] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\FRST\Quarantine\C\Users\Bo$$ Brenna\HELP_DECRYPT.URL.xBAD
[2015-01-22 11:45][2015-01-22 11:45] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\FRST\Quarantine\C\Users\Bo$$ Brenna\AppData\HELP_DECRYPT.HTML.xBAD
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\FRST\Quarantine\C\Users\Bo$$ Brenna\AppData\HELP_DECRYPT.TXT.xBAD
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\FRST\Quarantine\C\Users\Bo$$ Brenna\AppData\HELP_DECRYPT.URL.xBAD
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\FRST\Quarantine\C\Users\Bo$$ Brenna\AppData\Roaming\HELP_DECRYPT.HTML.xBAD
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\FRST\Quarantine\C\Users\Bo$$ Brenna\AppData\Roaming\HELP_DECRYPT.PNG.xBAD
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\FRST\Quarantine\C\Users\Bo$$ Brenna\AppData\Roaming\HELP_DECRYPT.TXT.xBAD
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\FRST\Quarantine\C\Users\Bo$$ Brenna\AppData\Roaming\HELP_DECRYPT.URL.xBAD
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\FRST\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\HELP_DECRYPT.HTML.xBAD
[2015-01-21 23:51][2015-01-21 23:51] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\FRST\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\HELP_DECRYPT.PNG.xBAD
[2015-01-21 23:51][2015-01-21 23:51] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\FRST\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\HELP_DECRYPT.TXT.xBAD
[2015-01-21 23:51][2015-01-21 23:51] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\FRST\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\HELP_DECRYPT.URL.xBAD
[2015-01-21 23:51][2015-01-21 23:51] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\FRST\Quarantine\C\ProgramData\HELP_DECRYPT.HTML.xBAD
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\FRST\Quarantine\C\ProgramData\HELP_DECRYPT.PNG.xBAD
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\FRST\Quarantine\C\ProgramData\HELP_DECRYPT.TXT.xBAD
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\FRST\Quarantine\C\ProgramData\HELP_DECRYPT.URL.xBAD
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\HELP_DECRYPT.HTML.vir
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\HELP_DECRYPT.PNG.vir
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\HELP_DECRYPT.TXT.vir
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\HELP_DECRYPT.URL.vir
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\UnsentCrashReports\HELP_DECRYPT.HTML.vir
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\UnsentCrashReports\HELP_DECRYPT.PNG.vir
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\UnsentCrashReports\HELP_DECRYPT.TXT.vir
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\UnsentCrashReports\HELP_DECRYPT.URL.vir
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\HELP_DECRYPT.HTML.vir
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\HELP_DECRYPT.PNG.vir
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\HELP_DECRYPT.TXT.vir
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\HELP_DECRYPT.URL.vir
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\fcbc2232-0107-4059-9e35-5e6aee2c4d15\HELP_DECRYPT.HTML.vir
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\fcbc2232-0107-4059-9e35-5e6aee2c4d15\HELP_DECRYPT.PNG.vir
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\fcbc2232-0107-4059-9e35-5e6aee2c4d15\HELP_DECRYPT.TXT.vir
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\fcbc2232-0107-4059-9e35-5e6aee2c4d15\HELP_DECRYPT.URL.vir
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\523d371a-c7a9-4118-9299-ed128f8173bd\HELP_DECRYPT.HTML.vir
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\523d371a-c7a9-4118-9299-ed128f8173bd\HELP_DECRYPT.PNG.vir
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\523d371a-c7a9-4118-9299-ed128f8173bd\HELP_DECRYPT.TXT.vir
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\523d371a-c7a9-4118-9299-ed128f8173bd\HELP_DECRYPT.URL.vir
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\151d684c-4232-4fd4-83d4-0f5816c9fbf5\HELP_DECRYPT.HTML.vir
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\151d684c-4232-4fd4-83d4-0f5816c9fbf5\HELP_DECRYPT.PNG.vir
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\151d684c-4232-4fd4-83d4-0f5816c9fbf5\HELP_DECRYPT.TXT.vir
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\AdwCleaner\Quarantine\C\Users\Bo$$ Brenna\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\151d684c-4232-4fd4-83d4-0f5816c9fbf5\HELP_DECRYPT.URL.vir
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\AdwCleaner\Quarantine\C\ProgramData\w3i\HELP_DECRYPT.HTML.vir
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\AdwCleaner\Quarantine\C\ProgramData\w3i\HELP_DECRYPT.PNG.vir
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\AdwCleaner\Quarantine\C\ProgramData\w3i\HELP_DECRYPT.TXT.vir
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\AdwCleaner\Quarantine\C\ProgramData\w3i\HELP_DECRYPT.URL.vir
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\AdwCleaner\Quarantine\C\ProgramData\w3i\InstallIQUpdater\HELP_DECRYPT.HTML.vir
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\AdwCleaner\Quarantine\C\ProgramData\w3i\InstallIQUpdater\HELP_DECRYPT.PNG.vir
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\AdwCleaner\Quarantine\C\ProgramData\w3i\InstallIQUpdater\HELP_DECRYPT.TXT.vir
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\AdwCleaner\Quarantine\C\ProgramData\w3i\InstallIQUpdater\HELP_DECRYPT.URL.vir
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

C:\AdwCleaner\Quarantine\C\ProgramData\w3i\InstallIQUpdater\images\HELP_DECRYPT.HTML.vir
[2015-01-21 23:50][2015-01-21 23:50] 0008516 ____A () 2BDE5D3078CEFFF16D0234AFD3D21534

C:\AdwCleaner\Quarantine\C\ProgramData\w3i\InstallIQUpdater\images\HELP_DECRYPT.PNG.vir
[2015-01-21 23:50][2015-01-21 23:50] 0045357 ____A () 58B66EF40A7BA4A69DF456806F69941F

C:\AdwCleaner\Quarantine\C\ProgramData\w3i\InstallIQUpdater\images\HELP_DECRYPT.TXT.vir
[2015-01-21 23:50][2015-01-21 23:50] 0004198 ____A () A4F32273F8683FEBFB6F3703675793B7

C:\AdwCleaner\Quarantine\C\ProgramData\w3i\InstallIQUpdater\images\HELP_DECRYPT.URL.vir
[2015-01-21 23:50][2015-01-21 23:50] 0000268 ____A () 368E62B9956AABA2055E53D295A4A20E

====== End Of Search ======






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users