Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Google Chrome redirect malware


  • This topic is locked This topic is locked
26 replies to this topic

#1 cloudsoda

cloudsoda

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:12:30 PM

Posted 23 April 2016 - 12:24 PM

Hello! I just got a new Dell XPS 15 laptop with Windows 10 on it about 3 days ago. I stupidly downloaded a "Skinpack", and while checking out its contents my mouse slipped and hit the "Skinpack Extras.exe" program, which unleashed what I can only describe as a $%&# slurry of malware and spamware.

 

Long story short, I've got about 5-6 anti-virus programs on here, from MBAM to FileAssassin to ESET to JRT, and McAfee. They seem to have gotten rid of mostly everything (I'm still paranoid though), except for one thing that keeps on redirecting my Google Chrome to "navigation.iwatchavi.com". I also spotted a BitCoinMiner trojan when I was scanning last night, but it was at 1 am and I had to stop the scan and go to bed. So I have no clue if the trojan got automatically quarantined and/or deleted, or if it's still there. Please help! Thank you!  :unsure:



BC AdBot (Login to Remove)

 


#2 polskamachina

polskamachina

  • Malware Response Team
  • 3,930 posts
  • ONLINE
  •  
  • Gender:Male
  • Local time:12:30 PM

Posted 23 April 2016 - 03:24 PM

Hi cloudsoda :)
 
My name is polskamachina and I would like to welcome you to the Malware Removal Forum. I will be helping you with your malware issues.

What follows below are some ground rules for this forum.

I will reply as soon as possible (typically within 24-48 hours). In turn, I ask that you please respond within 72 hours. If you know you will be away longer than that, please let me know. I am in California at GMT-7 hours (Pacific Standard Time). If I do not respond to you within 48 hours, feel free to send me a private message.

Some points for you to keep in mind:

  • Do NOT run any tools unless instructed to do so.
  • We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
  • Do not attach logs or use code boxes, just copy and paste the text.
  • I cannot see your computer. Periodically update me on the condition of your computer, and provide as much detail as you can in every post.
  • Once things seem to be working again, please do not abandon the thread. I will give an "all-clean" message at the very end.
  • NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planned. You can put them on a CD/DVD, external drive or a flash drive, anywhere except on the computer.
  • NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. Please remember to copy the entire post so you do not miss any instructions. 

Let's begin:

  • Please visit this link and start at step :step6:
  • In step :step7:, please do not create another new topic, just continue with this one.
  • Finally, copy and paste the FRST and Addition logs into your next reply to me.

Let me know if you have any questions.
 
polskamachina



#3 cloudsoda

cloudsoda
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:12:30 PM

Posted 23 April 2016 - 03:52 PM

Hey, thanks for the welcome. Currently trying to post the damn logs (posting this from my phone), every time I do on Chrome or Edge, the page freezes. I'll try from my old laptop, one sec.

#4 cloudsoda

cloudsoda
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:12:30 PM

Posted 23 April 2016 - 04:07 PM

Additional scan result of Farbar Recovery Scan Tool (x64) Version:18-04-2016
Ran by aroco (2016-04-23 13:31:30)
Running from C:\Users\aroco\Desktop
Windows 10 Home Version 1511 (X64) (2016-04-21 03:50:27)
Boot Mode: Normal
==========================================================
 
 
==================== Accounts: =============================
 
Administrator (S-1-5-21-735421175-1461169506-2791873875-500 - Administrator - Disabled)
aroco (S-1-5-21-735421175-1461169506-2791873875-1001 - Administrator - Enabled) => C:\Users\aroco
DefaultAccount (S-1-5-21-735421175-1461169506-2791873875-503 - Limited - Disabled)
Guest (S-1-5-21-735421175-1461169506-2791873875-501 - Limited - Disabled)
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: McAfee Anti-Virus and Anti-Spyware (Enabled - Up to date) {DA9F8ED0-D0DE-39CC-F55A-51AB4CC1B556}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: McAfee Anti-Virus and Anti-Spyware (Enabled - Up to date) {61FE6F34-F6E4-3642-CFEA-6AD93746FFEB}
FW: McAfee Firewall (Enabled) {E2A40FF5-9AB1-3894-DE05-F89EB212F22D}
 
==================== Installed Programs ======================
 
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
Adobe Acrobat X Pro - English, Français, Deutsch (HKLM-x32\...\{AC76BA86-1033-F400-7760-000000000005}) (Version: 10.1.1 - Adobe Systems)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.1.0.4880 - Adobe Systems Incorporated)
Adobe CS6 Design and Web Premium (HKLM-x32\...\{402F6F2E-5683-491C-977D-0CA599A07CAF}) (Version: 6 - Adobe Systems Incorporated)
Adobe Help Manager (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 4.0.244 - Adobe Systems Incorporated)
Apple Application Support (32-bit) (HKLM-x32\...\{FE5C2FAA-118D-4509-B51D-3F71CC9E1B3E}) (Version: 4.3 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{2937FD88-C9D6-4B82-B539-37CD0A572F42}) (Version: 4.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{2E4AF2A6-50EA-4260-9BA4-5E582D11879A}) (Version: 9.3.0.15 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{56EC47AA-5813-4FF6-8E75-544026FBEA83}) (Version: 2.2.0.150 - Apple Inc.)
Asmedia USB Host Controller Driver (HKLM-x32\...\{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}) (Version: 1.16.28.1 - Asmedia Technology)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
Dell Customer Connect (HKLM-x32\...\{99E581C6-471C-46CA-989E-3B17EB7E3F27}) (Version: 1.3.2.0 - Dell Inc.)
Dell Digital Delivery (HKLM-x32\...\{AB7F2792-2ED1-4C5C-9F28-680E5110BF72}) (Version: 3.1.1018.0 - Dell Products, LP)
Dell Foundation Services (HKLM\...\{AE5E3C86-2633-4DAF-A7F4-C43D1E738BAE}) (Version: 3.1.3300.0 - Dell Inc.)
Dell Help & Support (HKLM-x32\...\InstallShield_{7B3E057E-F356-4DB0-A664-4FF813C73F20}) (Version: 2.1.59.0 - Dell Inc.)
Dell Help & Support (Version: 2.1.59.0 - Dell Inc.) Hidden
Dell PremierColor (HKLM\...\{5CA2B02F-FC89-4F42-A3DA-7649B8EFF194}) (Version: 2.0.199 - Portrait Displays, Inc.)
Dell SupportAssist (HKLM\...\PC-Doctor for Windows) (Version: 1.2.6745.47 - Dell)
Dell Update (HKLM-x32\...\{2BE9948C-FD9C-40B0-AC04-EE2AAB4C19D4}) (Version: 1.8.1114.0 - Dell Inc.)
Dropbox 20 GB (HKLM-x32\...\{736A97C6-8766-3699-84A9-71736C5E0CE3}) (Version: 3.1.11.0 - Dropbox, Inc.)
DSC/AA Factory Installer (Version: 1.2.6745.47 - PC-Doctor, Inc.) Hidden
DW WLAN Card (HKLM\...\DW WLAN Card) (Version: 1.566.0.0 - Dell Inc.)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
FileASSASSIN (HKLM-x32\...\FileASSASSIN) (Version: 1.06 - Malwarebytes)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 50.0.2661.87 - Google Inc.)
Google Update Helper (x32 Version: 1.3.29.5 - Google Inc.) Hidden
Intel® Chipset Device Software (x32 Version: 10.1.1.13 - Intel® Corporation) Hidden
Intel® Dynamic Platform and Thermal Framework (HKLM-x32\...\{654EE65D-FAA4-4EA6-8C07-DC94E6A304D4}) (Version: 8.1.10605.221 - Intel Corporation)
Intel® HID Event Filter (HKLM-x32\...\3FB06EEC-013D-4366-9918-71B97DFB84EB) (Version: 1.1.0.311 - Intel Corporation)
Intel® Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 11.0.0.1167 - Intel Corporation)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 20.19.15.4390 - Intel Corporation)
Intel® Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 14.5.2.1088 - Intel Corporation)
Intel® Serial IO (HKLM\...\{9FD91C5C-44AE-4D9D-85BE-AE52816B0294}) (Version: 30.100.1519.7 - Intel Corporation)
Intel® Security Assist (HKLM-x32\...\{4B230374-6475-4A73-BA6E-41015E9C5013}) (Version: 1.0.0.532 - Intel Corporation)
Itibiti RTC (x32 Version: 0.0.1 - Itibiti Inc) Hidden
iTunes (HKLM\...\{A31C5565-90D9-4615-AE13-94D86C3836C7}) (Version: 12.3.3.17 - Apple Inc.)
Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Maxx Audio Installer (x64) (Version: 2.6.6570.2 - Waves Audio Ltd.) Hidden
McAfee LiveSafe (HKLM-x32\...\MSC) (Version: 14.0.8185 - McAfee, Inc.)
McAfee WebAdvisor (HKLM-x32\...\{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}) (Version: 4.0.189 - McAfee, Inc.)
Microsoft Office 365 - en-us (HKLM\...\O365HomePremRetail - en-us) (Version: 16.0.6769.2017 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Preview Redistributable (x64) - 12.0.20617 (HKLM-x32\...\{448652c1-f5f3-4230-98c6-68c10c88b1fb}) (Version: 12.0.20617.1 - Microsoft Corporation)
NVIDIA GeForce Experience 2.5.15.54 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.5.15.54 - NVIDIA Corporation)
NVIDIA Graphics Driver 358.94 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 358.94 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.15.0428 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.15.0428 - NVIDIA Corporation)
Office 16 Click-to-Run Extensibility Component (x32 Version: 16.0.6729.1014 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (Version: 16.0.6729.1014 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (x32 Version: 16.0.6729.1014 - Microsoft Corporation) Hidden
Paragon HFS+ for Windows™ 9.1 (HKLM-x32\...\{456534C0-51E7-11DF-B336-005056C00008}) (Version: 1.00 - Paragon Software)
PDF Settings CS6 (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden
Product Registration (HKLM-x32\...\InstallShield_{C1600AC7-74E3-4BB5-8B42-B13653792252}) (Version: 2.2.38.0 - Dell Inc.)
Product Registration (Version: 2.2.38.0 - Dell Inc.) Hidden
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7628 - Realtek Semiconductor Corp.)
Realtek USB Audio (HKLM-x32\...\{0A46A65D-89AC-464C-8026-3CD44960BD04}) (Version: 6.3.9600.41 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
SHIELD Streaming (Version: 4.1.500 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 2.5.15.54 - NVIDIA Corporation) Hidden
Skype™ 7.22 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.22.109 - Skype Technologies S.A.)
ST Microelectronics 3 Axis Digital Accelerometer Solution (HKLM-x32\...\{9C24F411-9CA7-4A8A-91F3-F08A4A38EB31}) (Version: 4.10.0067 - ST Microelectronics)
Thunderbolt™ Software (HKLM-x32\...\{B0E8A8CA-5A40-49C3-BE5E-9076664DB9AA}) (Version: 15.3.39.250 - Intel Corporation)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.2 - VideoLAN)
Wacom Tablet (HKLM\...\Wacom Tablet Driver) (Version: 6.3.11w3 - Wacom Technology Corp.)
WebTablet FB Plugin 32 bit (HKLM-x32\...\Wacom WebTabletPlugin for Internet Explorer and Netscape) (Version: 2.1.0.7 - Wacom Technology Corp.)
WebTablet FB Plugin 64 bit (HKLM\...\Wacom WebTabletPlugin for Internet Explorer and Netscape) (Version: 2.1.0.7 - Wacom Technology Corp.)
WIDCOMM Bluetooth Software (HKLM\...\{C6D9ED03-6FCF-4410-9CB7-45CA285F9E11}) (Version: 12.0.1.730 - Broadcom Corporation)
 
==================== Custom CLSID (Whitelisted): ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== Scheduled Tasks (Whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {39B1EAAA-51A3-4A3E-AA8F-7A68D71998DD} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-04-13] (Dropbox, Inc.)
Task: {4D87E43E-4306-4619-A1D0-A5F5625FEE5C} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-04-13] (Dropbox, Inc.)
Task: {5496365D-3A1A-4748-A906-ACB2CDE79C03} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-04-23] (Google Inc.)
Task: {54F3D4D1-C4BC-43BE-9989-A1F26BC64007} - System32\Tasks\McAfeeLogon => C:\Program Files\Common Files\McAfee\platform\McUICnt.exe [2016-03-10] (McAfee, Inc.)
Task: {556C9430-DE3B-404C-A98D-86CA6F739A21} - System32\Tasks\DropboxOEM => C:\Program Files (x86)\Dropbox\DropboxOEM\DropboxOEM.exe [2016-04-04] ()
Task: {59DDB85F-1F89-4457-8035-2E4A6F7A3067} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-04-23] (Google Inc.)
Task: {60567E80-C80C-4A44-A604-06925E57BD1D} - System32\Tasks\Microsoft\Office\Microsoft Office Touchless Attach Notification => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-04-03] (Microsoft Corporation)
Task: {67FA0649-0C95-4A2B-BD6F-DC1B395D0082} - System32\Tasks\McAfee\McAfee Auto Maintenance Task Agent
Task: {86D3A95B-0B26-45BD-8CF9-DA3B9EFC2ED6} - System32\Tasks\Intel\Thunderbolt\Start Thunderbolt service when hardware is detected => start ThunderboltService
Task: {8FA65603-3800-4B68-8893-919966771274} - System32\Tasks\Intel Security DAT Reputation (AMCore) periodic endpoint safety pulse => C:\Program Files\Common Files\McAfee\AMContent\scanners\x86_64\datrep\54.0\mcdatrep.exe [2016-04-21] (McAfee, Inc.)
Task: {8FB25977-3C65-434F-9082-B9DBE27AA407} - System32\Tasks\Intel\Thunderbolt\Start Thunderbolt application on login if service is up => Thunderbolt.exe
Task: {979C8ED9-4CF4-4B84-80F2-BE2EB6288865} - System32\Tasks\PCDDataUploadTask => uaclauncher.exe
Task: {97B51099-F415-48DD-A993-ABABFC2D647F} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe
Task: {99DD44AC-B5A7-422A-B717-5CC925E50149} - System32\Tasks\CreateExplorerShellUnelevatedTask => /NOUACCHECK
Task: {AEF1AC9E-0C90-4231-A3EC-0A44B1C6E809} - \SecurityApps2 -> No File <==== ATTENTION
Task: {CC151C18-9BDB-45CC-83A2-7D7A55B6F39B} - System32\Tasks\RtHDVBg_PushButton => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2015-10-06] (Realtek Semiconductor)
Task: {D2D21EBB-73AC-431D-AC82-088A2C2D4BDC} - System32\Tasks\AdobeAAMUpdater-1.0-MicrosoftAccount-arocoe@gmail.com => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-04-04] (Adobe Systems Incorporated)
Task: {D964280C-0BE2-410D-9D20-2FF778E315BA} - System32\Tasks\Intel\Thunderbolt\Start Thunderbolt application when hardware is detected => Thunderbolt.exe
Task: {E636799C-ACCB-4EB2-9434-9D1F56B8F756} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-04-03] (Microsoft Corporation)
Task: {EB82323C-5112-4838-84E2-ADC9B7B74DFE} - System32\Tasks\McAfee\McAfee Idle Detection Task
Task: {EECEA794-B2DA-4725-A2F8-281C24634C1B} - System32\Tasks\Intel\Thunderbolt\Start Thunderbolt service on boot if driver is up => tbtsvc.exe
Task: {F600B864-A7F6-4058-890D-8BFD900AD125} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-04-03] (Microsoft Corporation)
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
Task: C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 
==================== Shortcuts =============================
 
(The entries could be listed to be restored or removed.)
 
ShortcutWithArgument: C:\Users\aroco\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://navigation.iwatchavi.com/
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://navigation.iwatchavi.com/
ShortcutWithArgument: C:\Users\Public\Desktop\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://navigation.iwatchavi.com/
 
==================== Loaded Modules (Whitelisted) ==============
 
2015-10-30 00:17 - 2015-10-30 00:17 - 00028672 _____ () C:\Windows\SYSTEM32\efsext.dll
2015-10-30 00:18 - 2015-10-30 00:18 - 00185856 _____ () C:\Windows\SYSTEM32\ism32k.dll
2016-04-13 15:41 - 2015-11-09 01:08 - 00116344 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-08-20 17:47 - 2015-08-20 17:47 - 00049408 _____ () C:\Program Files\WIDCOMM\Bluetooth Software\btwleapi.dll
2016-03-18 22:56 - 2016-03-18 22:56 - 00092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2016-03-18 22:56 - 2016-03-18 22:56 - 01329936 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2014-11-14 19:21 - 2014-11-14 19:21 - 00066768 _____ () C:\Program Files (x86)\Paragon Software\HFS+ for Windows  9.1\apmwinsrv.exe
2016-04-13 15:45 - 2016-04-03 04:34 - 00172224 _____ () C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ApiClient.dll
2016-04-21 11:34 - 2016-03-29 03:20 - 02656952 _____ () C:\Windows\system32\CoreUIComponents.dll
2016-04-21 15:10 - 2016-04-21 15:10 - 00144384 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe
2016-04-21 11:34 - 2016-03-29 03:20 - 02656952 _____ () C:\Windows\System32\CoreUIComponents.dll
2016-04-13 15:45 - 2016-04-21 11:32 - 08919232 _____ () C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\1033\GrooveIntlResource.dll
2016-04-13 16:06 - 2016-03-07 17:26 - 00384120 _____ () C:\Windows\system32\igfxTray.exe
2016-04-13 16:26 - 2016-04-13 16:26 - 00093696 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Windows.UI.Shell.SharedUtilities.dll
2016-04-21 11:34 - 2016-04-01 20:25 - 00472064 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
2016-04-21 11:57 - 2014-12-22 13:42 - 01356568 _____ () C:\Program Files\Tablet\Wacom\libxml2.dll
2015-11-13 19:21 - 2015-11-13 19:21 - 00273136 _____ () C:\Program Files\Portrait Displays\Dell PremierColor\CTHelper.exe
2016-04-04 09:54 - 2016-04-04 09:54 - 00575432 _____ () C:\Program Files (x86)\Dropbox\DropboxOEM\DropboxOEM.exe
2016-01-11 11:25 - 2016-01-11 11:25 - 00036200 _____ () C:\Program Files\Dell\Dell Help & Support\MDLCSvc.exe
2016-04-21 15:07 - 2016-04-21 15:07 - 10244608 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsStore_2016.29.13.0_x64__8wekyb3d8bbwe\WinStore.Entertainment.Mobile.dll
2016-04-21 11:34 - 2016-04-01 20:03 - 07992832 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2016-04-21 11:33 - 2016-04-01 19:58 - 00591360 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2016-04-21 11:34 - 2016-04-01 19:59 - 02483200 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2016-04-21 11:34 - 2016-04-01 20:02 - 04089856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2016-03-18 22:55 - 2016-03-18 22:55 - 00306960 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxslt.dll
2016-04-21 15:10 - 2016-04-21 15:10 - 00141312 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeBackgroundTasks.dll
2016-04-21 15:10 - 2016-04-21 15:10 - 22284800 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkyWrap.dll
2016-04-13 15:41 - 2015-10-12 13:05 - 00013088 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll
2016-03-18 13:26 - 2016-03-18 13:26 - 00207872 _____ () C:\Program Files (x86)\Dropbox\DropboxOEM\Ledger.dll
2016-03-18 12:19 - 2016-03-18 12:19 - 00107520 _____ () C:\Program Files (x86)\Dropbox\DropboxOEM\zlib1.dll
2015-06-23 16:26 - 2015-06-23 16:26 - 00155888 _____ () c:\Program Files (x86)\Dell Digital Delivery\ServiceTagPlusPlus.dll
2015-09-04 20:34 - 2015-09-04 20:34 - 01243936 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\ACE.dll
2016-04-23 09:25 - 2016-04-20 14:08 - 01738904 _____ () C:\Program Files (x86)\Google\Chrome\Application\50.0.2661.87\libglesv2.dll
2016-04-23 09:25 - 2016-04-20 14:08 - 00086168 _____ () C:\Program Files (x86)\Google\Chrome\Application\50.0.2661.87\libegl.dll
2016-04-23 09:25 - 2016-04-20 14:08 - 17536664 _____ () C:\Program Files (x86)\Google\Chrome\Application\50.0.2661.87\PepperFlash\pepflashplayer.dll
2016-03-18 22:56 - 2016-03-18 22:56 - 00080184 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2016-03-18 22:56 - 2016-03-18 22:56 - 01040656 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
 
==================== Alternate Data Streams (Whitelisted) =========
 
(If an entry is included in the fixlist, only the ADS will be removed.)
 
 
==================== Safe Mode (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcapexe => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McNaiAnn => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeaack => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeaack.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeavfk => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeavfk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfemms => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfetdi2k => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfetdi2k.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Service"
 
==================== EXE Association (Whitelisted) ===============
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 
==================== Internet Explorer trusted/restricted ===============
 
(If an entry is included in the fixlist, it will be removed from the registry.)
 
 
==================== Hosts content: ===============================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2015-10-30 00:24 - 2016-04-22 15:05 - 00000844 ____N C:\Windows\system32\Drivers\etc\hosts
 
 
==================== Other Areas ============================
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-735421175-1461169506-2791873875-1001\Control Panel\Desktop\\Wallpaper -> c:\users\aroco\documents\documents\toshiro mifune\awesomesanjurobg.png
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-735421175-1461169506-2791873875-1001\...\StartupApproved\Run: => "RocketDock"
 
==================== FirewallRules (Whitelisted) ===============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{2849D8DE-968D-41F7-8E8D-B6BDBF6DEA2B}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{5B35871E-56FB-4969-A1F9-6FDA0EC5204A}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{AA3CEEDA-2C34-412B-9C0A-3D5F260591A0}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{0D2A815A-1469-48D9-84AB-2E64B9FDB257}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{3A3DBAAE-C907-4632-93CF-AC0E6B54CC6E}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
FirewallRules: [{E0326EAB-A8F9-42F9-A9D5-F1AEB8B9DFEF}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{C78618EE-9E76-4D11-BC3B-85E20EAEA42D}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{F780CD45-1CFE-4F8B-AE69-D177C7C5AE19}] => (Allow) C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe
FirewallRules: [{DEBE5149-0FA2-4788-9B81-713C73197EFF}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\outlook.exe
FirewallRules: [{75A75D33-36A2-4CE7-9298-2B56E53C24AE}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{899BCBDF-0C91-4C70-96C5-657551B56A84}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{2083C760-3E57-4138-80FA-94C54E4DEF7E}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{6C570CC7-4C47-4626-BABF-3BD950677DC0}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{C6D6F420-FBA8-4915-82B8-1FB5A71799CA}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{C356A70D-E91D-4359-90EC-9912E675500F}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{F50F3DE8-66F0-4F1C-93E6-6AC78490C785}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
 
==================== Restore Points =========================
 
20-04-2016 20:50:12 Windows Modules Installer
22-04-2016 12:02:47 Dell Update: eDellRoot Removal
22-04-2016 12:03:12 Dell Update: DSD Cert Removal
23-04-2016 08:53:31 JRT Pre-Junkware Removal
23-04-2016 09:01:15 JRT Pre-Junkware Removal
23-04-2016 10:31:42 JRT Pre-Junkware Removal
 
==================== Faulty Device Manager Devices =============
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (04/23/2016 10:31:43 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
 
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.
 
System Error:
Access is denied.
.
 
Error: (04/23/2016 09:45:35 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: OnlineScannerApp.exe, version: 1.0.0.1, time stamp: 0x55546904
Faulting module name: ONLINE~1.OCX, version: 1.0.0.7777, time stamp: 0x55546935
Exception code: 0xc000041d
Fault offset: 0x0002d516
Faulting process id: 0x964
Faulting application start time: 0xOnlineScannerApp.exe0
Faulting application path: OnlineScannerApp.exe1
Faulting module path: OnlineScannerApp.exe2
Report Id: OnlineScannerApp.exe3
Faulting package full name: OnlineScannerApp.exe4
Faulting package-relative application ID: OnlineScannerApp.exe5
 
Error: (04/23/2016 09:45:33 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: OnlineScannerApp.exe, version: 1.0.0.1, time stamp: 0x55546904
Faulting module name: ONLINE~1.OCX, version: 1.0.0.7777, time stamp: 0x55546935
Exception code: 0xc0000005
Fault offset: 0x0002d516
Faulting process id: 0x964
Faulting application start time: 0xOnlineScannerApp.exe0
Faulting application path: OnlineScannerApp.exe1
Faulting module path: OnlineScannerApp.exe2
Report Id: OnlineScannerApp.exe3
Faulting package full name: OnlineScannerApp.exe4
Faulting package-relative application ID: OnlineScannerApp.exe5
 
Error: (04/23/2016 09:11:38 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528.manifest.
 
Error: (04/23/2016 09:01:16 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
 
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.
 
System Error:
Access is denied.
.
 
Error: (04/23/2016 08:53:32 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.
 
Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.
 
System Error:
Access is denied.
.
 
Error: (04/23/2016 08:49:58 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: OnlineScannerApp.exe, version: 1.0.0.1, time stamp: 0x55546904
Faulting module name: ONLINE~1.OCX, version: 1.0.0.7777, time stamp: 0x55546935
Exception code: 0xc000041d
Fault offset: 0x0002d516
Faulting process id: 0x2078
Faulting application start time: 0xOnlineScannerApp.exe0
Faulting application path: OnlineScannerApp.exe1
Faulting module path: OnlineScannerApp.exe2
Report Id: OnlineScannerApp.exe3
Faulting package full name: OnlineScannerApp.exe4
Faulting package-relative application ID: OnlineScannerApp.exe5
 
Error: (04/23/2016 08:49:56 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: OnlineScannerApp.exe, version: 1.0.0.1, time stamp: 0x55546904
Faulting module name: ONLINE~1.OCX, version: 1.0.0.7777, time stamp: 0x55546935
Exception code: 0xc0000005
Fault offset: 0x0002d516
Faulting process id: 0x2078
Faulting application start time: 0xOnlineScannerApp.exe0
Faulting application path: OnlineScannerApp.exe1
Faulting module path: OnlineScannerApp.exe2
Report Id: OnlineScannerApp.exe3
Faulting package full name: OnlineScannerApp.exe4
Faulting package-relative application ID: OnlineScannerApp.exe5
 
Error: (04/23/2016 08:38:15 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528.manifest.
 
Error: (04/23/2016 12:55:12 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528.manifest.
 
 
System errors:
=============
Error: (04/23/2016 12:16:52 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)UnavailableUnavailable
 
Error: (04/23/2016 11:19:34 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The Interactive Services Detection service terminated with the following error: 
%%1
 
Error: (04/23/2016 11:05:12 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)UnavailableUnavailable
 
Error: (04/23/2016 09:47:15 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)UnavailableUnavailable
 
Error: (04/23/2016 09:37:32 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)UnavailableUnavailable
 
Error: (04/23/2016 09:11:57 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The eapihdrv service failed to start due to the following error: 
%%1275
 
Error: (04/23/2016 09:11:57 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\aroco\AppData\Local\Temp\ehdrv.sys
 
Error: (04/23/2016 09:11:57 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The eapihdrv service failed to start due to the following error: 
%%1275
 
Error: (04/23/2016 09:11:57 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\Users\aroco\AppData\Local\Temp\ehdrv.sys
 
Error: (04/23/2016 09:11:57 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The eapihdrv service failed to start due to the following error: 
%%1275
 
 
CodeIntegrity:
===================================
  Date: 2016-04-22 12:06:01.773
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\dnsapi.dll that did not meet the Store signing level requirements.
 
  Date: 2016-04-22 12:06:01.747
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\dnsapi.dll that did not meet the Store signing level requirements.
 
  Date: 2016-04-22 12:06:01.708
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\dnsapi.dll that did not meet the Store signing level requirements.
 
  Date: 2016-04-22 12:06:01.647
  Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\dnsapi.dll that did not meet the Store signing level requirements.
 
  Date: 2016-04-22 12:04:23.301
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-04-21 23:33:13.302
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-04-21 15:44:26.742
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-04-21 12:04:34.655
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-04-21 11:38:12.276
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2016-04-21 11:35:40.310
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
 
==================== Memory info =========================== 
 
Processor: Intel® Core™ i7-6700HQ CPU @ 2.60GHz
Percentage of memory in use: 30%
Total physical RAM: 16233.91 MB
Available physical RAM: 11315.33 MB
Total Virtual: 19177.91 MB
Available Virtual: 14043.25 MB
 
==================== Drives ================================
 
Drive c: (OS) (Fixed) (Total:464.97 GB) (Free:391.27 GB) NTFS
Drive d: (Annabel Coe) (Fixed) (Total:931.19 GB) (Free:610.87 GB) NTFS
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (Size: 476.9 GB) (Disk ID: EE8ACBB0)
 
Partition: GPT.
 
========================================================
Disk: 1 (Size: 931.5 GB) (Disk ID: 02496340)
 
Partition: GPT.
 
==================== End of Addition.txt ============================


#5 cloudsoda

cloudsoda
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:12:30 PM

Posted 23 April 2016 - 04:13 PM

Seems like the FRST.txt file is pretty big, and that might be what's causing my browsers to stop responding. Can I post it in like 2 parts, or omit anything? :S



#6 polskamachina

polskamachina

  • Malware Response Team
  • 3,930 posts
  • ONLINE
  •  
  • Gender:Male
  • Local time:12:30 PM

Posted 23 April 2016 - 10:00 PM

Hi cloudsoda :)

 

Yes, you can break up the FRST.txt log into smaller parts and make multiple posts. However, do not omit anything.

 

Let me know if you have any questions.

 

polskamachina



#7 cloudsoda

cloudsoda
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:12:30 PM

Posted 23 April 2016 - 10:58 PM

Alright, cool. :D

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:18-04-2016
Ran by aroco (administrator) on DESKTOP-97NB5PD (23-04-2016 13:30:54)
Running from C:\Users\aroco\Desktop
Loaded Profiles: aroco (Available Profiles: aroco)
Platform: Windows 10 Home Version 1511 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Edge)
Boot Mode: Normal
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\WTabletServicePro.exe
(Intel Corporation) C:\Windows\SysWOW64\IntelCpHeciSvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Broadcom Corporation.) C:\Windows\System32\BtwRSupportService.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
() C:\Program Files (x86)\Paragon Software\HFS+ for Windows  9.1\apmwinsrv.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Portrait Displays, Inc.) C:\Program Files\Portrait Displays\Dell PremierColor\PremierColorService.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(Intel Corporation) C:\Windows\SysWOW64\esif_uf.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfemms.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
(Intel Security, Inc.) C:\Program Files\Common Files\Intel Security\PEF\CORE\PEFService.exe
(Waves Audio Ltd.) C:\Program Files\Waves\MaxxAudio\WavesSysSvc64.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(McAfee, Inc.) C:\Program Files\mcafee\msc\McAPExe.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe
(Intel Corporation) C:\Windows\Temp\DPTF\esif_assist_64.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
() C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
() C:\Windows\System32\igfxTray.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe
(Wacom Technology) C:\Program Files\Tablet\Wacom\WacomHost.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Waves Audio Ltd.) C:\Program Files\Waves\MaxxAudio\WavesSvc64.exe
(Portrait Displays, Inc.) C:\Program Files\Portrait Displays\Dell PremierColor\PremierColor.exe
() C:\Program Files\Portrait Displays\Dell PremierColor\CTHelper.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
() C:\Program Files (x86)\Dropbox\DropboxOEM\DropboxOEM.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\platform\McUICnt.exe
(Intel Corporation) C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Dell Inc.) C:\Program Files (x86)\Dell Customer Connect\DCCService.exe
(Dell) C:\Program Files\Dell\Dell Foundation Services\DFSSvc.exe
() C:\Program Files\Dell\Dell Help & Support\MDLCSvc.exe
(Dell) C:\Program Files\Dell\Product Registration\PRSvc.exe
(Dell Products, LP.) C:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe
(Dell Inc.) C:\Program Files (x86)\Dell Update\DellUpService.exe
(Dell Inc.) C:\Program Files (x86)\Dell Update\DellUpTray.exe
(Dell) C:\Program Files\Dell\Dell Foundation Services\DFS.Common.Agent.exe
(Intel Corporation) C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\CSP\1.9.656.0\McCSPServiceHost.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\ModuleCore\ModuleCoreService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Security Assist\isa.exe
(McAfee, Inc.) C:\Program Files\mcafee\virusscan\McVsShld.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsStore_2016.29.13.0_x64__8wekyb3d8bbwe\WinStore.Mobile.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Apple Inc.) C:\Program Files\iTunes\iTunes.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\distnoted.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BtITunesPlugIn.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Farbar) C:\Users\aroco\Desktop\FRST64 (2).exe
 
 
==================== Registry (Whitelisted) ===========================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8712960 2015-10-06] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_MAXX6] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1407744 2015-10-06] (Realtek Semiconductor)
HKLM\...\Run: [WavesSvc] => C:\Program Files\Waves\MaxxAudio\WavesSvc64.exe [717744 2015-11-02] (Waves Audio Ltd.)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [322472 2015-07-22] (Intel Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2655520 2015-10-12] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [PremierColor] => C:\Program Files\Portrait Displays\Dell PremierColor\PremierColor.exe [3889904 2015-11-13] (Portrait Displays, Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [176952 2016-03-19] (Apple Inc.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-09-05] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [36760 2011-09-05] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [2904984 2011-09-05] (Adobe Systems Inc.)
HKU\S-1-5-21-735421175-1461169506-2791873875-1001\...\Run: [RocketDock] => "C:\SkinPack\RocketDock\RocketDock.exe"
HKU\S-1-5-21-735421175-1461169506-2791873875-1001\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-735421175-1461169506-2791873875-1001\...\RunOnce: [Application Restart #1] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [881304 2016-04-20] (Google Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2016-04-13]
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{7b41cf52-554f-4fdd-b340-07ccd84004d6}: [DhcpNameServer] 192.168.1.1
 
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-735421175-1461169506-2791873875-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-735421175-1461169506-2791873875-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://dell15.msn.com/?pc=DCTE
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2016-04-21] (Microsoft Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL [2016-04-21] (Microsoft Corporation)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-09-05] (Adobe Systems Incorporated)
BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2011-09-05] (Adobe Systems Incorporated)
BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2011-09-05] (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2011-09-05] (Adobe Systems Incorporated)
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\mcieplg.dll [2016-04-20] (McAfee, Inc.)
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\mcieplg.dll [2016-04-20] (McAfee, Inc.)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-04-21] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-04-21] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-04-21] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-04-21] (Microsoft Corporation)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\mcieplg.dll [2016-04-20] (McAfee, Inc.)
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\mcieplg.dll [2016-04-20] (McAfee, Inc.)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\mcafee\msc\McSnIePl64.dll [2016-03-31] (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\msc\McSnIePl.dll [2016-03-31] (McAfee, Inc.)
 
FireFox:
========
FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL [2016-03-31] ()
FF Plugin: @wacom.com/wtPlugin,version=2.1.0.7 -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin: wacom.com/WacomTabletPlugin -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2016-03-08] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.68 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2015-08-24] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2015-08-24] (Intel Corporation)
FF Plugin-x32: @mcafee.com/MSC,version=10 -> c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL [2016-03-31] ()
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2016-04-21] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-04-23] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-04-23] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-01-20] (VideoLAN)
FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.7 -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll [2011-09-05] (Adobe Systems Inc.)
FF Plugin-x32: wacom.com/WacomTabletPlugin -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi
FF Extension: McAfee WebAdvisor - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi [2016-04-21]
FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2016-04-21] [not signed]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK [2016-04-22] [not signed]
 
Chrome: 
=======
CHR StartupUrls: Default -> "hxxps://www.google.com/"
CHR Profile: C:\Users\aroco\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\aroco\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-04-23]
CHR Extension: (Google Drive) - C:\Users\aroco\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-04-23]
CHR Extension: (YouTube) - C:\Users\aroco\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-04-23]
CHR Extension: (SiteAdvisor) - C:\Users\aroco\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho [2016-04-23]
CHR Extension: (Google Docs Offline) - C:\Users\aroco\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-04-23]
CHR Extension: (Chrome Web Store Payments) - C:\Users\aroco\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-23]
CHR Extension: (Gmail) - C:\Users\aroco\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-04-23]
CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2016-04-21]
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2016-04-21]
 
==================== Services (Whitelisted) ========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 apmwinsrv; C:\Program Files (x86)\Paragon Software\HFS+ for Windows  9.1\apmwinsrv.exe [66768 2014-11-14] ()
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-03-02] (Apple Inc.)
R2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2288384 2016-04-13] (Broadcom Corporation.)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [2838768 2016-04-03] (Microsoft Corporation)
S3 cplspcon; C:\Windows\system32\IntelCpHDCPSvc.exe [603256 2016-03-07] (Intel Corporation)
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [139504 2016-04-13] (Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [139504 2016-04-13] (Dropbox, Inc.)
R2 Dell Customer Connect; C:\Program Files (x86)\Dell Customer Connect\DCCService.exe [153328 2015-06-15] (Dell Inc.)
R2 Dell Foundation Services; C:\Program Files\Dell\Dell Foundation Services\DFSSvc.exe [119656 2016-01-15] (Dell)
R2 Dell Help & Support; C:\Program Files\Dell\Dell Help & Support\MDLCSvc.exe [36200 2016-01-11] ()
R2 Dell Product Registration; C:\Program Files\Dell\Product Registration\PRSvc.exe [32104 2016-01-25] (Dell)
R2 DellPremierColorService; C:\Program Files\Portrait Displays\Dell PremierColor\PremierColorService.exe [175344 2015-11-13] (Portrait Displays, Inc.)
R2 DellUpdate; C:\Program Files (x86)\Dell Update\DellUpService.exe [228216 2016-01-21] (Dell Inc.)
R2 esifsvc; C:\Windows\SysWOW64\esif_uf.exe [1392792 2015-10-30] (Intel Corporation)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1156384 2015-10-12] (NVIDIA Corporation)
R2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [453520 2016-03-10] (McAfee, Inc.)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [18856 2015-07-22] (Intel Corporation)
R2 igfxCUIService2.0.0.0; C:\Windows\system32\igfxCUIService.exe [354936 2016-03-07] (Intel Corporation)
S3 Intel® Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [881152 2015-05-22] (Intel® Corporation)
R3 Intel® Security Assist; C:\Program Files (x86)\Intel\Intel® Security Assist\isa.exe [335872 2015-05-19] (Intel Corporation) [File not signed]
S2 isaHelperSvc; C:\Program Files (x86)\Intel\Intel® Security Assist\isaHelperService.exe [7680 2015-05-19] () [File not signed]
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [207648 2015-09-04] (Intel Corporation)
R2 McAfee SiteAdvisor Service; C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe [163592 2016-04-20] (McAfee, Inc.)
R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [889704 2016-03-31] (McAfee, Inc.)
S3 McAWFwk; c:\Program Files\Common Files\McAfee\ActWiz\McAWFwk.exe [352104 2015-09-29] (McAfee, Inc.)
R2 McBootDelayStartSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [453520 2016-03-10] (McAfee, Inc.)
R2 mccspsvc; C:\Program Files\Common Files\McAfee\CSP\1.9.656.0\McCSPServiceHost.exe [1709096 2016-03-14] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [453520 2016-03-10] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [453520 2016-03-10] (McAfee, Inc.)
S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [718248 2016-03-07] (McAfee, Inc.)
S4 McOobeSv2; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [453520 2016-03-10] (McAfee, Inc.)
R2 mcpltsvc; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [453520 2016-03-10] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [453520 2016-03-10] (McAfee, Inc.)
R3 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [234192 2016-01-25] (McAfee, Inc.)
R2 mfemms; C:\Program Files\Common Files\McAfee\SystemCore\\mfemms.exe [382456 2016-02-19] (McAfee, Inc.)
R3 mfevtp; C:\Windows\system32\mfevtps.exe [279488 2016-01-25] (McAfee, Inc.)
R2 ModuleCoreService; C:\Program Files\Common Files\McAfee\ModuleCore\ModuleCoreService.exe [1037048 2016-03-15] (McAfee, Inc.)
R2 MSK80Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [453520 2016-03-10] (McAfee, Inc.)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1873696 2015-10-12] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [5568288 2015-10-12] (NVIDIA Corporation)
R2 PEFService; C:\Program Files\Common Files\Intel Security\PEF\CORE\PEFService.exe [896456 2016-03-02] (Intel Security, Inc.)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [307456 2015-10-06] (Realtek Semiconductor)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
S3 ThunderboltService; c:\Program Files (x86)\Intel\Thunderbolt Software\tbtsvc.exe [1831064 2015-11-04] (Intel Corporation)
R2 WavesSysSvc; C:\Program Files\Waves\MaxxAudio\WavesSysSvc64.exe [578480 2015-09-25] (Waves Audio Ltd.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [364464 2015-10-30] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-10-30] (Microsoft Corporation)
R2 WTabletServicePro; C:\Program Files\Tablet\Wacom\WTabletServicePro.exe [671512 2014-12-22] (Wacom Technology, Corp.)
S2 Eruvwee; "C:\Users\aroco\AppData\Roaming\LaexuGegobog\Reloace.exe" -cms [X]
 
===================== Drivers (Whitelisted) ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R0 apmwin; C:\Windows\System32\DRIVERS\apmwin.sys [50896 2014-11-14] (Paragon Software Group)
R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [208192 2016-04-13] (Broadcom Corporation.)
R3 BCMPCIEDHD63; C:\Windows\system32\DRIVERS\bcmpciedhd63.sys [1063736 2016-03-03] (Broadcom Corp)
R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [79248 2016-01-29] (McAfee, Inc.)
R3 dptf_acpi; C:\Windows\System32\drivers\dptf_acpi.sys [55784 2015-10-30] (Intel Corporation)
R3 dptf_cpu; C:\Windows\System32\drivers\dptf_cpu.sys [52200 2015-10-30] (Intel Corporation)
R3 esif_lf; C:\Windows\system32\DRIVERS\esif_lf.sys [260072 2015-10-30] (Intel Corporation)
R0 gpt_loader; C:\Windows\System32\DRIVERS\gpt_loader.sys [61136 2014-11-14] (Paragon Software Group)
R3 Hfsplus; C:\Windows\System32\DRIVERS\hfsplus.sys [204496 2014-11-14] (Paragon Software Group)
R2 HfsplusRec; C:\Windows\System32\DRIVERS\hfsplusrec.sys [15568 2014-11-14] (Paragon Software Group)
R3 HidEventFilter; C:\Windows\System32\drivers\HidEventFilter.sys [54272 2015-09-21] (Intel Corporation)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [207208 2015-05-19] (McAfee, Inc.)
R3 iaLPSS2_I2C; C:\Windows\System32\drivers\iaLPSS2_I2C.sys [185128 2015-06-16] (Intel Corporation)
R3 MEIx64; C:\Windows\System32\drivers\TeeDriverW8x64.sys [185088 2015-08-31] (Intel Corporation)
R3 mfeaack; C:\Windows\System32\drivers\mfeaack.sys [422184 2016-01-29] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [351656 2016-01-29] (McAfee, Inc.)
S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [83608 2016-01-29] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [496368 2016-01-29] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [847608 2016-01-29] (McAfee, Inc.)
R3 mfencbdc; C:\Windows\System32\DRIVERS\mfencbdc.sys [543488 2016-02-10] (McAfee, Inc.)
S3 mfencrk; C:\Windows\System32\DRIVERS\mfencrk.sys [109480 2016-02-10] (McAfee, Inc.)
R3 mfesapsn; C:\Program Files (x86)\McAfee\SiteAdvisor\x64\mfesapsn.sys [45728 2016-03-15] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [245096 2016-01-29] (McAfee, Inc.)
R0 mounthlp; C:\Windows\System32\DRIVERS\mounthlp.sys [45776 2014-11-14] (Paragon Software Group)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20768 2015-10-12] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [50472 2015-08-11] (NVIDIA Corporation)
S3 RTSPER; C:\Windows\system32\DRIVERS\RtsPer.sys [752856 2015-06-24] (Realsil Semiconductor Corporation)
S3 RTSUER; C:\Windows\system32\Drivers\RtsUer.sys [402136 2015-06-24] (Realsil Semiconductor Corporation)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44568 2015-10-30] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [293216 2015-10-30] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [118112 2015-10-30] (Microsoft Corporation)
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2016-04-23 13:30 - 2016-04-23 13:31 - 00028208 _____ C:\Users\aroco\Desktop\FRST.txt
2016-04-23 13:29 - 2016-04-23 13:30 - 02375680 _____ (Farbar) C:\Users\aroco\Desktop\FRST64 (2).exe
2016-04-23 11:18 - 2016-04-23 11:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2016-04-23 10:34 - 2016-04-23 12:53 - 00000000 ____D C:\EEK
2016-04-23 10:32 - 2016-04-23 10:34 - 229419792 _____ C:\Users\aroco\Downloads\EmsisoftEmergencyKit.exe
2016-04-23 10:26 - 2016-04-23 10:27 - 00037678 _____ C:\Users\aroco\Downloads\Addition.txt
2016-04-23 10:25 - 2016-04-23 13:30 - 00000000 ____D C:\FRST
2016-04-23 10:25 - 2016-04-23 10:52 - 01075214 _____ C:\Users\aroco\Downloads\FRST.txt
2016-04-23 10:09 - 2016-04-23 10:09 - 00004118 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{8700821C-4994-4473-BC01-EC1713ECD995}
2016-04-23 10:04 - 2016-04-23 10:07 - 00000000 ___HD C:\$SysReset
2016-04-23 09:33 - 2016-04-23 09:33 - 22851472 _____ (Malwarebytes ) C:\Users\aroco\Downloads\mbam-setup-2.2.1.1043.exe
2016-04-23 09:26 - 2016-04-23 09:26 - 00398752 _____ (Bleeping Computer, LLC) C:\Users\aroco\Downloads\unhide.exe
2016-04-23 09:25 - 2016-04-23 13:10 - 00002412 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-04-23 09:25 - 2016-04-23 13:10 - 00002400 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-04-23 09:24 - 2016-04-23 13:29 - 00000928 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-04-23 09:24 - 2016-04-23 09:29 - 00000924 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-04-23 09:24 - 2016-04-23 09:29 - 00000000 ____D C:\AdwCleaner
2016-04-23 09:24 - 2016-04-23 09:24 - 00003986 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2016-04-23 09:24 - 2016-04-23 09:24 - 00003754 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2016-04-23 09:13 - 2016-04-23 09:18 - 00987728 _____ (Google Inc.) C:\Users\aroco\Downloads\ChromeSetup.exe
2016-04-23 09:10 - 2016-04-23 09:10 - 00000000 ____D C:\Program Files\HitmanPro
2016-04-23 09:09 - 2016-04-23 09:09 - 00001514 _____ C:\Windows\system32\.crusader
2016-04-23 09:06 - 2016-04-23 09:07 - 00294254 _____ C:\TDSSKiller.3.1.0.9_23.04.2016_09.06.09_log.txt
2016-04-23 08:55 - 2016-04-23 08:55 - 00001139 _____ C:\Users\aroco\Desktop\JRT.txt
2016-04-23 08:52 - 2016-04-23 08:53 - 01610008 _____ (Malwarebytes) C:\Users\aroco\Downloads\JRT.exe
2016-04-23 08:50 - 2016-04-23 08:50 - 00170280 _____ (ESET) C:\Windows\system32\Drivers\ESETCleanersDriver.sys
2016-04-22 23:40 - 2016-04-22 23:40 - 00000000 ____D C:\Program Files (x86)\ESET
2016-04-22 23:39 - 2016-04-22 23:40 - 02870984 _____ (ESET) C:\Users\aroco\Downloads\esetsmartinstaller_enu.exe
2016-04-22 23:34 - 2016-04-23 09:09 - 00000000 ____D C:\ProgramData\HitmanPro
2016-04-22 23:27 - 2016-04-22 23:27 - 00001339 _____ C:\Users\aroco\Desktop\Revo Uninstaller.lnk
2016-04-22 23:27 - 2016-04-22 23:27 - 00000000 ____D C:\Users\aroco\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller
2016-04-22 23:27 - 2016-04-22 23:27 - 00000000 ____D C:\Program Files (x86)\VS Revo Group
2016-04-22 23:26 - 2016-04-22 23:34 - 11441744 _____ (SurfRight B.V.) C:\Users\aroco\Downloads\HitmanPro_x64.exe
2016-04-22 23:24 - 2016-04-22 23:27 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\aroco\Downloads\revosetup.exe
2016-04-22 23:04 - 2016-04-22 23:07 - 00577910 _____ C:\TDSSKiller.3.1.0.9_22.04.2016_23.04.28_log.txt
2016-04-22 15:05 - 2016-04-22 15:14 - 00294362 _____ C:\TDSSKiller.3.1.0.9_22.04.2016_15.05.53_log.txt
2016-04-22 15:04 - 2016-04-22 15:05 - 04727984 _____ (Kaspersky Lab ZAO) C:\Users\aroco\Downloads\tdsskiller.exe
2016-04-22 12:50 - 2016-04-22 12:50 - 03683904 _____ C:\Users\aroco\Downloads\adwcleaner_5.112.exe
2016-04-22 12:20 - 2016-04-22 12:20 - 00000000 ____D C:\Windows\system32\SleepStudy
2016-04-22 12:11 - 2016-04-22 12:11 - 00000000 ____D C:\Users\aroco\AppData\Local\ElevatedDiagnostics
2016-04-22 12:10 - 2016-04-22 12:10 - 00000064 _____ C:\Users\aroco\Documents\regularcolorcalibration
2016-04-22 11:17 - 2016-04-22 11:17 - 00000000 ____D C:\ProgramData\Intel Security
2016-04-22 11:17 - 2016-04-22 11:17 - 00000000 ____D C:\Program Files\Common Files\Intel Security
2016-04-22 09:33 - 2016-04-22 09:33 - 00000000 ____D C:\Users\aroco\Desktop\Art Stuff
2016-04-22 00:08 - 2016-04-22 00:08 - 00597685 _____ C:\Users\aroco\Downloads\BushRat.psd
2016-04-21 23:46 - 2016-04-21 23:46 - 00000000 ____D C:\Users\aroco\AppData\Roaming\MCorp
2016-04-21 23:42 - 2016-04-23 11:46 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-04-21 23:42 - 2016-04-21 23:42 - 00001173 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-04-21 23:42 - 2016-04-21 23:42 - 00000000 ____D C:\ProgramData\Malwarebytes
2016-04-21 23:42 - 2016-04-21 23:42 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-04-21 23:42 - 2016-03-10 14:09 - 00065408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2016-04-21 23:42 - 2016-03-10 14:08 - 00140672 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-04-21 23:42 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2016-04-21 23:28 - 2016-04-21 23:28 - 00000000 ____D C:\Windows\system32\ebi
2016-04-21 22:50 - 2016-04-21 22:51 - 04318702 _____ C:\Users\aroco\Desktop\star fox melo.psd
2016-04-21 21:28 - 2016-04-21 21:28 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileASSASSIN
2016-04-21 21:28 - 2016-04-21 21:28 - 00000000 ____D C:\Program Files (x86)\FileASSASSIN
2016-04-21 21:27 - 2016-04-21 21:28 - 00167034 _____ C:\Users\aroco\Downloads\fileassassin-setup-1.06.exe
2016-04-21 21:27 - 2016-04-21 21:27 - 00167034 _____ C:\Users\aroco\Downloads\fileassassin-setup-1.06 (1).exe
2016-04-21 21:23 - 2016-04-22 13:08 - 00000000 ____D C:\Users\aroco\AppData\Roaming\Rikfootov
2016-04-21 21:23 - 2016-04-21 21:23 - 00000000 ____D C:\Users\aroco\AppData\Local\Tempfolder
2016-04-21 21:22 - 2016-04-21 21:22 - 00000000 _____ C:\Windows\SysWOW64\Number of results
2016-04-21 16:33 - 2016-04-21 16:33 - 00000000 ____D C:\Users\aroco\AppData\LocalLow\Adobe
2016-04-21 16:11 - 2016-04-21 16:11 - 00000000 ____D C:\Users\aroco\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
2016-04-21 16:00 - 2016-04-21 16:00 - 00003658 _____ C:\Windows\System32\Tasks\AdobeAAMUpdater-1.0-MicrosoftAccount-arocoe@gmail.com
2016-04-21 15:39 - 2016-04-21 16:00 - 00000000 ____D C:\ProgramData\regid.1986-12.com.adobe
2016-04-21 15:36 - 2016-04-21 15:36 - 00000000 ____D C:\ProgramData\ALM
2016-04-21 15:35 - 2016-04-21 15:35 - 00002481 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat Distiller X.lnk
2016-04-21 15:35 - 2016-04-21 15:35 - 00002469 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat X Pro.lnk
2016-04-21 15:35 - 2016-04-21 15:35 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe LiveCycle ES2
2016-04-21 15:33 - 2016-04-21 15:37 - 00000000 ____D C:\Program Files\Adobe
2016-04-21 15:32 - 2016-04-21 15:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Design and Web Premium CS6
2016-04-21 15:32 - 2016-04-21 15:32 - 00001072 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Help.lnk
2016-04-21 15:32 - 2016-04-21 15:32 - 00000000 ____D C:\Users\Default\AppData\Roaming\Macromedia
2016-04-21 15:32 - 2016-04-21 15:32 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Macromedia
2016-04-21 15:29 - 2016-04-21 15:37 - 00000000 ____D C:\Program Files (x86)\Adobe
2016-04-21 15:28 - 2016-04-21 15:38 - 00000000 ____D C:\Program Files\Common Files\Adobe
2016-04-21 15:18 - 2016-04-21 16:14 - 00000000 ____D C:\ProgramData\Adobe
2016-04-21 15:17 - 2016-04-23 08:17 - 00000000 ____D C:\Users\aroco\AppData\Local\Adobe
2016-04-21 15:10 - 2016-04-21 15:17 - 00000000 ____D C:\Users\aroco\Documents\Adobe CS6 Design and Web Premium
2016-04-21 15:01 - 2016-04-21 15:01 - 00000000 ____D C:\W7P_Backups
2016-04-21 14:25 - 2016-04-21 14:30 - 00000000 ___RD C:\Users\aroco\Desktop\Swashbucklers
2016-04-21 14:25 - 2016-04-21 14:26 - 00000000 ___RD C:\Users\aroco\Desktop\LANDSCAPE CLASS SUMMER 2014
2016-04-21 14:16 - 2016-04-21 14:16 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wacom Tablet
2016-04-21 14:16 - 2016-04-21 14:16 - 00000000 ____D C:\Users\aroco\AppData\Local\Wacom Help
2016-04-21 14:15 - 2016-04-21 14:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2016-04-21 14:15 - 2016-04-21 14:15 - 00000000 ____D C:\Program Files (x86)\VideoLAN
2016-04-21 13:09 - 2016-04-21 13:09 - 00000200 _____ C:\Windows\system32\{EC94D02F-D200-4428-9531-05AF7F9799CB}.bat
2016-04-21 13:09 - 2016-04-21 13:09 - 00000000 _____ C:\Windows\system32\GfxValDisplayLog.bin
2016-04-21 13:06 - 2015-10-30 15:09 - 00208600 _____ (Realtek Semiconductor Corp.) C:\Windows\RUAudExD.DLL
2016-04-21 12:58 - 2016-04-21 22:21 - 00003656 _____ C:\Windows\System32\Tasks\CreateExplorerShellUnelevatedTask
2016-04-21 12:58 - 2016-04-21 12:58 - 00000000 ____D C:\Users\aroco\AppData\Roaming\MetroSidebar
2016-04-21 12:25 - 2016-04-21 12:41 - 00000000 ___RD C:\Users\aroco\Desktop\Thesis Concept Art
2016-04-21 12:15 - 2016-04-23 00:49 - 00000000 ____D C:\Users\aroco\AppData\Roaming\Skype
2016-04-21 12:15 - 2016-04-21 12:15 - 00000000 ___RD C:\Program Files (x86)\Skype
2016-04-21 12:15 - 2016-04-21 12:15 - 00000000 ____D C:\Users\aroco\Tracing
2016-04-21 12:15 - 2016-04-21 12:15 - 00000000 ____D C:\ProgramData\Skype
2016-04-21 12:15 - 2016-04-21 12:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2016-04-21 12:08 - 2016-04-21 12:09 - 00000000 ____D C:\Users\aroco\Documents\4 C's
2016-04-21 12:05 - 2016-04-21 12:05 - 00000000 ____D C:\Users\aroco\AppData\Roaming\WTablet
2016-04-21 11:57 - 2016-04-21 14:15 - 00000000 ____D C:\Program Files\Tablet
2016-04-21 11:57 - 2016-04-21 11:57 - 00000000 ____D C:\Program Files\TabletPlugins
2016-04-21 11:57 - 2016-04-21 11:57 - 00000000 ____D C:\Program Files (x86)\TabletPlugins
2016-04-21 11:57 - 2014-12-22 13:42 - 02029336 _____ (Wacom Technology, Corp.) C:\Windows\system32\WacomMT.dll
2016-04-21 11:57 - 2014-12-22 13:42 - 01997592 _____ (Wacom Technology, Corp.) C:\Windows\system32\Wacom_Tablet.dll
2016-04-21 11:57 - 2014-12-22 13:42 - 01990936 _____ (Wacom Technology, Corp.) C:\Windows\system32\Wacom_Touch_Tablet.dll
2016-04-21 11:57 - 2014-12-22 13:42 - 01863960 _____ (Wacom Technology, Corp.) C:\Windows\system32\Wintab32.dll
2016-04-21 11:57 - 2014-12-22 13:42 - 01626392 _____ (Wacom Technology, Corp.) C:\Windows\SysWOW64\WacomMT.dll
2016-04-21 11:57 - 2014-12-22 13:42 - 01618712 _____ (Wacom Technology, Corp.) C:\Windows\SysWOW64\Wacom_Tablet.dll
2016-04-21 11:57 - 2014-12-22 13:42 - 01612056 _____ (Wacom Technology, Corp.) C:\Windows\SysWOW64\Wacom_Touch_Tablet.dll
2016-04-21 11:57 - 2014-12-22 13:42 - 01497368 _____ (Wacom Technology, Corp.) C:\Windows\SysWOW64\Wintab32.dll
2016-04-21 11:57 - 2014-10-25 13:52 - 00100664 _____ (Wacom Technology) C:\Windows\system32\Drivers\wachidrouter.sys
2016-04-21 11:57 - 2014-10-25 13:52 - 00015160 _____ (Wacom Technology) C:\Windows\system32\Drivers\wacomrouterfilter.sys
2016-04-21 11:57 - 2014-10-25 13:52 - 00014136 _____ (Windows ® Win 7 DDK provider) C:\Windows\system32\Drivers\hidkmdf.sys
2016-04-21 11:57 - 2012-12-11 15:12 - 01721576 _____ (Microsoft Corporation) C:\Windows\system32\wdfcoinstaller01009.dll
2016-04-21 11:57 - 2012-12-11 15:12 - 01721576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wdfcoinstaller01009.dll
2016-04-21 11:39 - 2016-04-21 11:39 - 08320264 _____ (McAfee, Inc.) C:\Users\aroco\Downloads\Setup_serial_Y63XUO8q3u3Taz91eaPLzQ2_key.exe
2016-04-21 11:35 - 2016-04-21 11:36 - 00000000 ____D C:\Windows\system32\MRT
2016-04-21 11:35 - 2016-04-21 11:35 - 135176864 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2016-04-21 11:35 - 2016-03-28 22:51 - 22378496 _____ (Microsoft Corporation) C:\Windows\system32\edgehtml.dll
2016-04-21 11:35 - 2016-03-28 22:41 - 24602112 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-04-21 11:35 - 2016-02-24 02:28 - 03449168 _____ (Microsoft Corporation) C:\Windows\system32\WSService.dll
2016-04-21 11:35 - 2016-02-24 01:46 - 06607080 _____ (Microsoft Corporation) C:\Windows\system32\windows.storage.dll
2016-04-21 11:35 - 2016-02-23 22:09 - 06972416 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Data.Pdf.dll
2016-04-21 11:35 - 2016-02-23 22:03 - 14252544 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2016-04-21 11:35 - 2016-02-23 03:32 - 08705672 _____ (Microsoft Corp.) C:\Windows\system32\Windows.Media.Protection.PlayReady.dll
2016-04-21 11:35 - 2016-02-23 03:21 - 22564328 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2016-04-21 11:35 - 2016-02-23 02:38 - 06952088 _____ (Microsoft Corp.) C:\Windows\SysWOW64\Windows.Media.Protection.PlayReady.dll
2016-04-21 11:35 - 2016-02-23 02:27 - 21124344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2016-04-21 11:34 - 2016-04-01 20:26 - 00630272 _____ (Microsoft Corporation) C:\Windows\system32\PhoneProviders.dll
2016-04-21 11:34 - 2016-04-01 20:21 - 00498688 _____ (Microsoft Corporation) C:\Windows\system32\tileobjserver.dll
2016-04-21 11:34 - 2016-04-01 20:19 - 01054208 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2016-04-21 11:34 - 2016-04-01 20:15 - 01090048 _____ (Microsoft Corporation) C:\Windows\system32\RDXService.dll
2016-04-21 11:34 - 2016-04-01 20:14 - 03994624 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers_nt.dll
2016-04-21 11:34 - 2016-04-01 20:09 - 01832448 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentExtensions.dll
2016-04-21 11:34 - 2016-04-01 20:07 - 03575296 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettingsThresholdAdminFlowUI.dll
2016-04-21 11:34 - 2016-04-01 20:07 - 02158592 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentServer.dll
2016-04-21 11:34 - 2016-04-01 20:00 - 01390080 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Shell.dll
2016-04-21 11:34 - 2016-03-29 03:20 - 07474016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2016-04-21 11:34 - 2016-03-29 03:20 - 02656952 _____ C:\Windows\system32\CoreUIComponents.dll
2016-04-21 11:34 - 2016-03-29 03:18 - 02152280 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2016-04-21 11:34 - 2016-03-29 02:56 - 01297752 _____ (Microsoft Corporation) C:\Windows\system32\LicenseManager.dll
2016-04-21 11:34 - 2016-03-29 02:37 - 01862008 _____ C:\Windows\SysWOW64\CoreUIComponents.dll
2016-04-21 11:34 - 2016-03-29 02:28 - 00696664 _____ (Microsoft Corporation) C:\Windows\system32\NetSetupEngine.dll
2016-04-21 11:34 - 2016-03-29 02:17 - 00300104 _____ (Microsoft Corporation) C:\Windows\system32\LockAppHost.exe
2016-04-21 11:34 - 2016-03-29 02:13 - 00986976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\LicenseManager.dll
2016-04-21 11:34 - 2016-03-29 02:08 - 00358752 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2016-04-21 11:34 - 2016-03-29 01:32 - 00253088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\LockAppHost.exe
2016-04-21 11:34 - 2016-03-29 00:34 - 00641536 _____ (Microsoft Corporation) C:\Windows\system32\enterprisecsps.dll
2016-04-21 11:34 - 2016-03-29 00:28 - 00460288 _____ (Microsoft Corporation) C:\Windows\system32\MapConfiguration.dll
2016-04-21 11:34 - 2016-03-29 00:27 - 00339968 _____ (Microsoft Corporation) C:\Windows\system32\SensorService.dll
2016-04-21 11:34 - 2016-03-29 00:23 - 00324608 _____ (Microsoft Corporation) C:\Windows\system32\RDXTaskFactory.dll
2016-04-21 11:34 - 2016-03-29 00:22 - 00438784 _____ (Microsoft Corporation) C:\Windows\system32\AccountsRt.dll
2016-04-21 11:34 - 2016-03-29 00:20 - 00948736 _____ (Microsoft Corporation) C:\Windows\system32\XblAuthManager.dll
2016-04-21 11:34 - 2016-03-29 00:16 - 00852480 _____ (Microsoft Corporation) C:\Windows\system32\MapsStore.dll
2016-04-21 11:34 - 2016-03-29 00:15 - 01714688 _____ (Microsoft Corporation) C:\Windows\system32\SRHInproc.dll
2016-04-21 11:34 - 2016-03-29 00:14 - 00965632 _____ (Microsoft Corporation) C:\Windows\system32\SRH.dll
2016-04-21 11:34 - 2016-03-29 00:14 - 00859136 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.dll
2016-04-21 11:34 - 2016-03-29 00:12 - 00471552 _____ (Microsoft Corporation) C:\Windows\system32\NetSetupShim.dll
2016-04-21 11:34 - 2016-03-29 00:11 - 00988160 _____ (Microsoft Corporation) C:\Windows\system32\NMAA.dll
2016-04-21 11:34 - 2016-03-29 00:10 - 01388544 _____ (Microsoft Corporation) C:\Windows\system32\win32kbase.sys
2016-04-21 11:34 - 2016-03-29 00:10 - 00938496 _____ (Microsoft Corporation) C:\Windows\system32\MapControlCore.dll
2016-04-21 11:34 - 2016-03-29 00:07 - 01902592 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2016-04-21 11:34 - 2016-03-29 00:07 - 01213440 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2016-04-21 11:34 - 2016-03-29 00:06 - 01575936 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Media.Speech.dll
2016-04-21 11:34 - 2016-03-29 00:02 - 02624512 _____ (Microsoft Corporation) C:\Windows\system32\InputService.dll
2016-04-21 11:34 - 2016-03-29 00:02 - 01211904 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Cred.dll
2016-04-21 11:34 - 2016-03-28 23:56 - 00821760 _____ (Microsoft Corporation) C:\Windows\system32\TokenBroker.dll
2016-04-21 11:34 - 2016-03-28 23:55 - 01052160 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.dll
2016-04-21 11:34 - 2016-03-28 23:43 - 00358400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AccountsRt.dll
2016-04-21 11:34 - 2016-03-28 23:42 - 03592704 _____ (Microsoft Corporation) C:\Windows\system32\win32kfull.sys
2016-04-21 11:34 - 2016-03-28 23:42 - 01410560 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Web.Http.dll
2016-04-21 11:34 - 2016-03-28 23:36 - 00649728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.dll
2016-04-21 11:34 - 2016-03-28 23:35 - 00354304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\NetSetupShim.dll
2016-04-21 11:34 - 2016-03-28 23:32 - 01731584 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-04-21 11:34 - 2016-03-28 23:32 - 01098240 _____ (Microsoft Corporation) C:\Windows\system32\dosvc.dll
2016-04-21 11:34 - 2016-03-28 23:31 - 02275328 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2016-04-21 11:34 - 2016-03-28 23:31 - 01946112 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2016-04-21 11:34 - 2016-03-28 23:27 - 07979008 _____ (Microsoft Corporation) C:\Windows\system32\mos.dll
2016-04-21 11:34 - 2016-03-28 23:26 - 02755584 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-04-21 11:34 - 2016-03-28 23:19 - 02635776 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Logon.dll
2016-04-21 11:34 - 2016-03-28 23:14 - 01072128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Web.Http.dll
2016-04-21 11:34 - 2016-03-28 23:05 - 07199232 _____ (Microsoft Corporation) C:\Windows\system32\BingMaps.dll
2016-04-21 11:34 - 2016-03-28 23:05 - 01500672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2016-04-21 11:34 - 2016-03-28 23:05 - 01388032 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2016-04-21 11:34 - 2016-03-28 23:02 - 02229760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2016-04-21 11:34 - 2016-03-28 23:01 - 13018624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Xaml.dll
2016-04-21 11:34 - 2016-03-28 23:00 - 06297088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mos.dll
2016-04-21 11:34 - 2016-03-28 22:58 - 01799680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Logon.dll
2016-04-21 11:34 - 2016-03-28 22:56 - 16985600 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Xaml.dll
2016-04-21 11:34 - 2016-03-28 22:52 - 11545600 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
2016-04-21 11:34 - 2016-03-28 22:51 - 09918976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2016-04-21 11:34 - 2016-03-28 22:49 - 05202944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\BingMaps.dll
2016-04-21 11:34 - 2016-03-28 22:45 - 03078144 _____ (Microsoft Corporation) C:\Windows\system32\esent.dll
2016-04-21 11:34 - 2016-03-28 22:43 - 03428864 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Media.dll
2016-04-21 11:34 - 2016-03-28 22:41 - 12125184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2016-04-21 11:34 - 2016-03-28 22:39 - 13382656 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-04-21 11:34 - 2016-03-28 22:38 - 18673664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\edgehtml.dll
2016-04-21 11:34 - 2016-03-28 22:38 - 02798080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Media.dll
2016-04-21 11:34 - 2016-03-28 22:37 - 19340800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2016-04-21 11:34 - 2016-03-28 22:36 - 02722816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\esent.dll
2016-04-21 11:34 - 2016-03-28 22:27 - 07836160 _____ (Microsoft Corporation) C:\Windows\system32\Chakra.dll
2016-04-21 11:34 - 2016-03-28 22:27 - 05662208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Chakra.dll
2016-04-21 11:34 - 2016-03-28 22:26 - 00958976 _____ (Microsoft Corporation) C:\Windows\system32\RemoteNaturalLanguage.dll
2016-04-21 11:34 - 2016-03-28 22:25 - 00712704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RemoteNaturalLanguage.dll
2016-04-21 11:34 - 2016-02-24 02:52 - 01997328 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2016-04-21 11:34 - 2016-02-24 02:48 - 00713568 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2016-04-21 11:34 - 2016-02-24 02:47 - 01173344 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2016-04-21 11:34 - 2016-02-24 02:34 - 01613664 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2016-04-21 11:34 - 2016-02-24 02:15 - 01557768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2016-04-21 11:34 - 2016-02-24 01:58 - 00794888 _____ (Microsoft Corporation) C:\Windows\system32\mfds.dll
2016-04-21 11:34 - 2016-02-24 01:51 - 01322248 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2016-04-21 11:34 - 2016-02-24 01:50 - 00808800 _____ (Microsoft Corporation) C:\Windows\system32\WWAHost.exe
2016-04-21 11:34 - 2016-02-24 01:43 - 00625000 _____ (Microsoft Corporation) C:\Windows\system32\ClipSVC.dll
2016-04-21 11:34 - 2016-02-24 01:19 - 00670928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfds.dll
2016-04-21 11:34 - 2016-02-24 01:11 - 01997152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2016-04-21 11:34 - 2016-02-24 01:11 - 00957608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2016-04-21 11:34 - 2016-02-24 01:11 - 00703840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WWAHost.exe
2016-04-21 11:34 - 2016-02-24 01:11 - 00652392 _____ (Microsoft Corporation) C:\Windows\system32\dxgi.dll
2016-04-21 11:34 - 2016-02-24 01:10 - 00576864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms2.sys
2016-04-21 11:34 - 2016-02-24 01:09 - 00640472 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2016-04-21 11:34 - 2016-02-24 01:06 - 05242496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\windows.storage.dll
2016-04-21 11:34 - 2016-02-24 00:35 - 00523752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxgi.dll
2016-04-21 11:34 - 2016-02-24 00:33 - 00538736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2016-04-21 11:34 - 2016-02-23 23:59 - 00450560 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Internal.Bluetooth.dll
2016-04-21 11:34 - 2016-02-23 23:59 - 00360448 _____ (Microsoft Corporation) C:\Windows\system32\vaultsvc.dll
2016-04-21 11:34 - 2016-02-23 23:44 - 00700416 _____ (Microsoft Corporation) C:\Windows\system32\AppointmentApis.dll
2016-04-21 11:34 - 2016-02-23 23:43 - 00286720 _____ (Microsoft Corporation) C:\Windows\system32\deviceaccess.dll
2016-04-21 11:34 - 2016-02-23 23:41 - 00982016 _____ (Microsoft Corporation) C:\Windows\system32\AppxPackaging.dll
2016-04-21 11:34 - 2016-02-23 23:41 - 00436736 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentClient.dll
2016-04-21 11:34 - 2016-02-23 23:40 - 01224704 _____ (Microsoft Corporation) C:\Windows\system32\Unistore.dll
2016-04-21 11:34 - 2016-02-23 23:34 - 00938496 _____ (Microsoft Corporation) C:\Windows\system32\ContactApis.dll
2016-04-21 11:34 - 2016-02-23 23:21 - 00315904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Internal.Bluetooth.dll
2016-04-21 11:34 - 2016-02-23 23:18 - 01490432 _____ (Microsoft Corporation) C:\Windows\system32\UserDataService.dll
2016-04-21 11:34 - 2016-02-23 23:09 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AppointmentApis.dll
2016-04-21 11:34 - 2016-02-23 23:09 - 00228352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\deviceaccess.dll
2016-04-21 11:34 - 2016-02-23 23:07 - 00949248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Unistore.dll
2016-04-21 11:34 - 2016-02-23 23:07 - 00890368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AppxPackaging.dll
2016-04-21 11:34 - 2016-02-23 23:07 - 00342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AppXDeploymentClient.dll
2016-04-21 11:34 - 2016-02-23 23:04 - 01497088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPDMC.exe
2016-04-21 11:34 - 2016-02-23 23:03 - 00769536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ContactApis.dll
2016-04-21 11:34 - 2016-02-23 22:55 - 01996288 _____ (Microsoft Corporation) C:\Windows\system32\ActiveSyncProvider.dll
2016-04-21 11:34 - 2016-02-23 22:34 - 01707520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ActiveSyncProvider.dll
2016-04-21 11:34 - 2016-02-23 22:12 - 05321728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Data.Pdf.dll
2016-04-21 11:34 - 2016-02-23 22:05 - 12586496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2016-04-21 11:34 - 2016-02-23 04:25 - 01818696 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2016-04-21 11:34 - 2016-02-23 03:34 - 01542816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2016-04-21 11:34 - 2016-02-23 03:32 - 02544264 _____ (Microsoft Corporation) C:\Windows\system32\mfcore.dll
2016-04-21 11:34 - 2016-02-23 03:32 - 01152328 _____ (Microsoft Corporation) C:\Windows\system32\mfasfsrcsnk.dll
2016-04-21 11:34 - 2016-02-23 03:32 - 01062480 _____ (Microsoft Corporation) C:\Windows\system32\mfmp4srcsnk.dll
2016-04-21 11:34 - 2016-02-23 03:32 - 00498448 _____ (Microsoft Corporation) C:\Windows\system32\MFCaptureEngine.dll
2016-04-21 11:34 - 2016-02-23 03:31 - 01017032 _____ (Microsoft Corporation) C:\Windows\system32\mfsrcsnk.dll
2016-04-21 11:34 - 2016-02-23 03:31 - 00819648 _____ (Microsoft Corporation) C:\Windows\system32\mfmpeg2srcsnk.dll
2016-04-21 11:34 - 2016-02-23 03:31 - 00536256 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2016-04-21 11:34 - 2016-02-23 03:25 - 03671888 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2016-04-21 11:34 - 2016-02-23 03:22 - 00572272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\taskschd.dll
2016-04-21 11:34 - 2016-02-23 02:45 - 02773096 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll
2016-04-21 11:34 - 2016-02-23 02:38 - 02180136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfcore.dll
2016-04-21 11:34 - 2016-02-23 02:38 - 00980352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfasfsrcsnk.dll
2016-04-21 11:34 - 2016-02-23 02:38 - 00895080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfsrcsnk.dll
2016-04-21 11:34 - 2016-02-23 02:38 - 00882720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmp4srcsnk.dll
2016-04-21 11:34 - 2016-02-23 02:38 - 00450912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MFCaptureEngine.dll
2016-04-21 11:34 - 2016-02-23 02:38 - 00420928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvproc.dll
2016-04-21 11:34 - 2016-02-23 02:37 - 00713824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmpeg2srcsnk.dll
2016-04-21 11:34 - 2016-02-23 02:32 - 00791744 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2016-04-21 11:34 - 2016-02-23 02:30 - 02919320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2016-04-21 11:34 - 2016-02-23 02:27 - 00376536 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Media.MediaControl.dll
2016-04-21 11:34 - 2016-02-23 02:20 - 01139712 _____ (Microsoft Corporation) C:\Windows\system32\XblGameSave.dll
2016-04-21 11:34 - 2016-02-23 02:17 - 00649216 _____ (Microsoft Corporation) C:\Windows\system32\ngcsvc.dll
2016-04-21 11:34 - 2016-02-23 01:56 - 02186864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2016-04-21 11:34 - 2016-02-23 01:38 - 00287712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Media.MediaControl.dll
2016-04-21 11:34 - 2016-02-23 01:36 - 00216576 _____ (Microsoft Corporation) C:\Windows\system32\QuickActionsDataModel.dll
2016-04-21 11:34 - 2016-02-23 01:34 - 00305664 _____ (Microsoft Corporation) C:\Windows\system32\wifiprofilessettinghandler.dll
2016-04-21 11:34 - 2016-02-23 01:31 - 00463360 _____ (Microsoft Corporation) C:\Windows\system32\wlansec.dll
2016-04-21 11:34 - 2016-02-23 01:29 - 00591872 _____ (Microsoft Corporation) C:\Windows\system32\SmsRouterSvc.dll
2016-04-21 11:34 - 2016-02-23 01:27 - 00307712 _____ (Microsoft Corporation) C:\Windows\system32\usbmon.dll
2016-04-21 11:34 - 2016-02-23 01:26 - 00372224 _____ (Microsoft Corporation) C:\Windows\system32\MDEServer.exe
2016-04-21 11:34 - 2016-02-23 01:22 - 00567808 _____ (Microsoft Corporation) C:\Windows\system32\MCRecvSrc.dll
2016-04-21 11:34 - 2016-02-23 01:20 - 00847360 _____ (Microsoft Corporation) C:\Windows\system32\netlogon.dll
2016-04-21 11:34 - 2016-02-23 01:20 - 00606720 _____ (Microsoft Corporation) C:\Windows\system32\wcmsvc.dll
2016-04-21 11:34 - 2016-02-23 01:20 - 00493568 _____ (Microsoft Corporation) C:\Windows\system32\mfmkvsrcsnk.dll
2016-04-21 11:34 - 2016-02-23 01:19 - 00517632 _____ (Microsoft Corporation) C:\Windows\system32\winspool.drv
2016-04-21 11:34 - 2016-02-23 01:14 - 00828928 _____ (Microsoft Corporation) C:\Windows\system32\Windows.AccountsControl.dll
2016-04-21 11:34 - 2016-02-23 01:10 - 00997376 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll
2016-04-21 11:34 - 2016-02-23 01:09 - 00870400 _____ (Microsoft Corporation) C:\Windows\system32\modernexecserver.dll
2016-04-21 11:34 - 2016-02-23 01:04 - 01131520 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Media.Audio.dll
2016-04-21 11:34 - 2016-02-23 01:04 - 00673792 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.dll
2016-04-21 11:34 - 2016-02-23 01:04 - 00382464 _____ (Microsoft Corporation) C:\Windows\system32\wuuhext.dll
2016-04-21 11:34 - 2016-02-23 01:02 - 01318912 _____ (Microsoft Corporation) C:\Windows\system32\wifinetworkmanager.dll
2016-04-21 11:34 - 2016-02-23 01:02 - 00755712 _____ (Microsoft Corporation) C:\Windows\system32\spoolsv.exe
2016-04-21 11:34 - 2016-02-23 00:58 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\TimeBrokerServer.dll
2016-04-21 11:34 - 2016-02-23 00:52 - 00456704 _____ (Microsoft Corporation) C:\Windows\system32\ipnathlp.dll
2016-04-21 11:34 - 2016-02-23 00:48 - 00838144 _____ (Microsoft Corporation) C:\Windows\system32\uDWM.dll
2016-04-21 11:34 - 2016-02-23 00:38 - 00480256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MCRecvSrc.dll
2016-04-21 11:34 - 2016-02-23 00:37 - 01118208 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2016-04-21 11:34 - 2016-02-23 00:37 - 00613376 _____ (Microsoft Corporation) C:\Windows\system32\SettingSync.dll
2016-04-21 11:34 - 2016-02-23 00:36 - 00713728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netlogon.dll
2016-04-21 11:34 - 2016-02-23 00:36 - 00379392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmkvsrcsnk.dll
2016-04-21 11:34 - 2016-02-23 00:31 - 00585216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.AccountsControl.dll
2016-04-21 11:34 - 2016-02-23 00:24 - 04827136 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2016-04-21 11:34 - 2016-02-23 00:24 - 01105920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Media.Audio.dll
2016-04-21 11:34 - 2016-02-23 00:24 - 00489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.dll
2016-04-21 11:34 - 2016-02-23 00:14 - 00990720 _____ (Microsoft Corporation) C:\Windows\system32\SettingSyncCore.dll
2016-04-21 11:34 - 2016-02-23 00:05 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SettingSync.dll
2016-04-21 11:34 - 2016-02-23 00:01 - 02295808 _____ (Microsoft Corporation) C:\Windows\system32\wlansvc.dll
2016-04-21 11:34 - 2016-02-22 23:56 - 04412928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2016-04-21 11:34 - 2016-02-22 23:55 - 04894208 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-04-21 11:34 - 2016-02-22 23:51 - 00754176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SettingSyncCore.dll
2016-04-21 11:34 - 2016-02-22 23:41 - 02912256 _____ (Microsoft Corporation) C:\Windows\system32\CertEnroll.dll
2016-04-21 11:34 - 2016-02-22 23:39 - 02581504 _____ (Microsoft Corporation) C:\Windows\system32\MFMediaEngine.dll
2016-04-21 11:34 - 2016-02-22 23:36 - 03666432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2016-04-21 11:34 - 2016-02-22 23:35 - 07533568 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2016-04-21 11:34 - 2016-02-22 23:33 - 02604032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CertEnroll.dll
2016-04-21 11:34 - 2016-02-22 23:30 - 02061312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MFMediaEngine.dll
2016-04-21 11:34 - 2016-02-22 23:28 - 06740992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2016-04-21 11:34 - 2016-01-28 23:57 - 04502352 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2016-04-21 11:34 - 2016-01-28 23:33 - 04064320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
2016-04-21 11:34 - 2016-01-26 22:57 - 01824264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\combase.dll
2016-04-21 11:34 - 2016-01-26 22:57 - 00820704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinTypes.dll
2016-04-21 11:34 - 2016-01-26 22:46 - 02606824 _____ (Microsoft Corporation) C:\Windows\system32\combase.dll
2016-04-21 11:34 - 2016-01-26 22:46 - 01270072 _____ (Microsoft Corporation) C:\Windows\system32\WinTypes.dll
2016-04-21 11:34 - 2016-01-15 23:24 - 00538632 _____ (Microsoft Corporation) C:\Windows\system32\WWanAPI.dll
2016-04-21 11:34 - 2016-01-15 23:21 - 01750440 _____ (Microsoft Corporation) C:\Windows\system32\WpcMon.exe
2016-04-21 11:34 - 2016-01-15 23:20 - 00652312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll
2016-04-21 11:34 - 2016-01-15 23:19 - 00405568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2016-04-21 11:34 - 2016-01-15 23:12 - 01415200 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2016-04-21 11:34 - 2016-01-15 23:08 - 01174008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2016-04-21 11:34 - 2016-01-15 22:37 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\wscsvc.dll
2016-04-21 11:34 - 2016-01-15 22:32 - 00621568 _____ (Microsoft Corporation) C:\Windows\system32\wbiosrvc.dll
2016-04-21 11:34 - 2016-01-15 22:31 - 00794112 _____ (Microsoft Corporation) C:\Windows\system32\winhttp.dll
2016-04-21 11:34 - 2016-01-15 22:31 - 00343552 _____ (Microsoft Corporation) C:\Windows\system32\SensorsApi.dll
2016-04-21 11:34 - 2016-01-15 22:30 - 00784384 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-04-21 11:34 - 2016-01-15 22:29 - 01500672 _____ (Microsoft Corporation) C:\Windows\system32\RecoveryDrive.exe
2016-04-21 11:34 - 2016-01-15 22:27 - 00335872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2016-04-21 11:34 - 2016-01-15 22:26 - 00260608 _____ C:\Windows\system32\MTFServer.dll
2016-04-21 11:34 - 2016-01-15 22:24 - 02057216 _____ (Microsoft Corporation) C:\Windows\system32\wlidsvc.dll
2016-04-21 11:34 - 2016-01-15 22:24 - 00613888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winhttp.dll
2016-04-21 11:34 - 2016-01-15 22:24 - 00273408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SensorsApi.dll
2016-04-21 11:34 - 2016-01-15 22:23 - 02050048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2016-04-21 11:34 - 2016-01-15 22:23 - 00687616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2016-04-21 11:34 - 2016-01-15 22:20 - 02597888 _____ (Microsoft Corporation) C:\Windows\system32\NetworkMobileSettings.dll
2016-04-21 11:34 - 2016-01-15 22:18 - 01674240 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2016-04-21 11:34 - 2016-01-15 22:17 - 05503488 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2016-04-21 11:34 - 2016-01-15 22:16 - 01542656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2016-04-21 11:34 - 2016-01-15 22:15 - 04759040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2016-04-21 11:33 - 2016-04-01 21:13 - 00369912 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2016-04-21 11:33 - 2016-04-01 21:10 - 00770640 _____ (Microsoft Corporation) C:\Windows\system32\iuilp.dll
2016-04-21 11:33 - 2016-04-01 21:10 - 00730344 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Internal.Shell.Broker.dll
2016-04-21 11:33 - 2016-04-01 21:10 - 00374008 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettingsAdminFlows.exe
2016-04-21 11:33 - 2016-04-01 20:29 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\VEDataLayerHelpers.dll
2016-04-21 11:33 - 2016-04-01 20:29 - 00083968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VEDataLayerHelpers.dll
2016-04-21 11:33 - 2016-04-01 20:23 - 00219648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VEEventDispatcher.dll
2016-04-21 11:33 - 2016-04-01 20:18 - 00988160 _____ (Microsoft Corporation) C:\Windows\system32\SharedStartModel.dll
2016-04-21 11:33 - 2016-03-29 03:23 - 00277856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sdbus.sys
2016-04-21 11:33 - 2016-03-29 03:22 - 01030416 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2016-04-21 11:33 - 2016-03-29 03:22 - 00874968 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2016-04-21 11:33 - 2016-03-29 03:20 - 01317640 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2016-04-21 11:33 - 2016-03-29 03:20 - 01141504 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2016-04-21 11:33 - 2016-03-29 03:15 - 00100232 _____ (Microsoft Corporation) C:\Windows\system32\omadmapi.dll
2016-04-21 11:33 - 2016-03-29 03:11 - 00686976 _____ (Microsoft Corporation) C:\Windows\system32\dnsapi.dll
2016-04-21 11:33 - 2016-03-29 03:05 - 01152864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2016-04-21 11:33 - 2016-03-29 03:02 - 00989536 _____ (Microsoft Corporation) C:\Windows\system32\SecConfig.efi
2016-04-21 11:33 - 2016-03-29 03:02 - 00334736 _____ (Microsoft Corporation) C:\Windows\system32\policymanager.dll
2016-04-21 11:33 - 2016-03-29 02:28 - 00535080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dnsapi.dll
2016-04-21 11:33 - 2016-03-29 02:28 - 00115040 _____ (Microsoft Corporation) C:\Windows\system32\NetSetupApi.dll
2016-04-21 11:33 - 2016-03-29 02:25 - 00258912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ufx01000.sys
2016-04-21 11:33 - 2016-03-29 02:25 - 00058400 _____ (Microsoft Corporation) C:\Windows\system32\SensorsNativeApi.dll
2016-04-21 11:33 - 2016-03-29 02:19 - 00296488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\policymanager.dll
2016-04-21 11:33 - 2016-03-29 02:18 - 00185184 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dumpsd.sys
2016-04-21 11:33 - 2016-03-29 02:11 - 00605440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2016-04-21 11:33 - 2016-03-29 02:11 - 00074424 _____ (Microsoft Corporation) C:\Windows\system32\easinvoker.exe
2016-04-21 11:33 - 2016-03-29 02:10 - 00110584 _____ (Microsoft Corporation) C:\Windows\system32\srvcli.dll
2016-04-21 11:33 - 2016-03-29 02:09 - 00078040 _____ (Microsoft Corporation) C:\Windows\system32\wkscli.dll
2016-04-21 11:33 - 2016-03-29 02:08 - 00261376 _____ (Microsoft Corporation) C:\Windows\system32\LsaIso.exe
2016-04-21 11:33 - 2016-03-29 02:07 - 00081144 _____ (Microsoft Corporation) C:\Windows\system32\netapi32.dll
2016-04-21 11:33 - 2016-03-29 01:44 - 00502104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\NetSetupEngine.dll
2016-04-21 11:33 - 2016-03-29 01:44 - 00084832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\NetSetupApi.dll
2016-04-21 11:33 - 2016-03-29 01:41 - 00630632 _____ (Microsoft Corporation) C:\Windows\system32\fontdrvhost.exe
2016-04-21 11:33 - 2016-03-29 01:41 - 00051128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SensorsNativeApi.dll
2016-04-21 11:33 - 2016-03-29 01:26 - 02403680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2016-04-21 11:33 - 2016-03-29 01:26 - 01089888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2016-04-21 11:33 - 2016-03-29 01:26 - 00073872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srvcli.dll
2016-04-21 11:33 - 2016-03-29 01:25 - 00056320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wkscli.dll
2016-04-21 11:33 - 2016-03-29 01:24 - 00294752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2016-04-21 11:33 - 2016-03-29 01:23 - 00069744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netapi32.dll
2016-04-21 11:33 - 2016-03-29 01:21 - 00378208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBXHCI.SYS
2016-04-21 11:33 - 2016-03-29 01:07 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\wsdchngr.dll
2016-04-21 11:33 - 2016-03-29 01:01 - 00541304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontdrvhost.exe
2016-04-21 11:33 - 2016-03-29 00:57 - 00199168 _____ (Microsoft Corporation) C:\Windows\system32\InstallAgent.exe
2016-04-21 11:33 - 2016-03-29 00:57 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\MosStorage.dll
2016-04-21 11:33 - 2016-03-29 00:55 - 00120320 _____ (Microsoft Corporation) C:\Windows\system32\MapsBtSvc.dll
2016-04-21 11:33 - 2016-03-29 00:54 - 00147456 _____ (Microsoft Corporation) C:\Windows\system32\mtxoci.dll
2016-04-21 11:33 - 2016-03-29 00:54 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bthenum.sys
2016-04-21 11:33 - 2016-03-29 00:51 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rfcomm.sys
2016-04-21 11:33 - 2016-03-29 00:51 - 00167936 _____ (Microsoft Corporation) C:\Windows\system32\dafBth.dll
2016-04-21 11:33 - 2016-03-29 00:50 - 00088576 _____ (Microsoft Corporation) C:\Windows\system32\AppxSysprep.dll
2016-04-21 11:33 - 2016-03-29 00:48 - 00144896 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Media.Devices.dll
2016-04-21 11:33 - 2016-03-29 00:46 - 00365568 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2016-04-21 11:33 - 2016-03-29 00:44 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\DAFWSD.dll
2016-04-21 11:33 - 2016-03-29 00:42 - 00269824 _____ (Microsoft Corporation) C:\Windows\system32\moshostcore.dll
2016-04-21 11:33 - 2016-03-29 00:39 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\StoreAgent.dll
2016-04-21 11:33 - 2016-03-29 00:38 - 00207360 _____ (Microsoft Corporation) C:\Windows\system32\NetSetupSvc.dll
2016-04-21 11:33 - 2016-03-29 00:37 - 00617984 _____ (Microsoft Corporation) C:\Windows\system32\StorSvc.dll
2016-04-21 11:33 - 2016-03-29 00:36 - 00530432 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\nwifi.sys
2016-04-21 11:33 - 2016-03-29 00:36 - 00209408 _____ (Microsoft Corporation) C:\Windows\system32\storewuauth.dll
2016-04-21 11:33 - 2016-03-29 00:35 - 00411648 _____ (Microsoft Corporation) C:\Windows\system32\oleacc.dll
2016-04-21 11:33 - 2016-03-29 00:35 - 00239616 _____ (Microsoft Corporation) C:\Windows\system32\credprovhost.dll
2016-04-21 11:33 - 2016-03-29 00:34 - 00686592 _____ (Microsoft Corporation) C:\Windows\system32\ieproxy.dll
2016-04-21 11:33 - 2016-03-29 00:34 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\dnsrslvr.dll
2016-04-21 11:33 - 2016-03-29 00:33 - 00174592 _____ (Microsoft Corporation) C:\Windows\system32\easwrt.dll
2016-04-21 11:33 - 2016-03-29 00:30 - 00328192 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2016-04-21 11:33 - 2016-03-29 00:26 - 00169472 _____ (Microsoft Corporation) C:\Windows\system32\mdmmigrator.dll
2016-04-21 11:33 - 2016-03-29 00:23 - 00694784 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdiWiFi.sys
2016-04-21 11:33 - 2016-03-29 00:23 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\MessagingDataModel2.dll
2016-04-21 11:33 - 2016-03-29 00:20 - 00166400 _____ (Microsoft Corporation) C:\Windows\system32\AboveLockAppHost.dll
2016-04-21 11:33 - 2016-03-29 00:19 - 00556032 _____ (Microsoft Corporation) C:\Windows\system32\PsmServiceExtHost.dll
2016-04-21 11:33 - 2016-03-29 00:17 - 01056256 _____ (Microsoft Corporation) C:\Windows\system32\JpMapControl.dll
2016-04-21 11:33 - 2016-03-29 00:17 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Security.Authentication.Web.Core.dll
2016-04-21 11:33 - 2016-03-29 00:17 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\CredProvDataModel.dll
2016-04-21 11:33 - 2016-03-29 00:15 - 00970752 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2016-04-21 11:33 - 2016-03-29 00:14 - 00954368 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bthport.sys
2016-04-21 11:33 - 2016-03-29 00:13 - 00587776 _____ (Microsoft Corporation) C:\Windows\system32\bisrv.dll
2016-04-21 11:33 - 2016-03-29 00:11 - 00881664 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Input.Inking.dll
2016-04-21 11:33 - 2016-03-29 00:11 - 00161280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InstallAgent.exe
2016-04-21 11:33 - 2016-03-29 00:11 - 00059904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MosStorage.dll
2016-04-21 11:33 - 2016-03-29 00:09 - 01239552 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Devices.Bluetooth.dll
2016-04-21 11:33 - 2016-03-29 00:08 - 00888320 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Networking.dll
2016-04-21 11:33 - 2016-03-29 00:08 - 00841216 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2016-04-21 11:33 - 2016-03-29 00:06 - 00848896 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2016-04-21 11:33 - 2016-03-29 00:05 - 01395712 _____ (Microsoft Corporation) C:\Windows\system32\UIAutomationCore.dll
2016-04-21 11:33 - 2016-03-29 00:04 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Media.Devices.dll
2016-04-21 11:33 - 2016-03-29 00:03 - 00148480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dfsc.sys
2016-04-21 11:33 - 2016-03-29 00:02 - 00303104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2016-04-21 11:33 - 2016-03-29 00:00 - 00345600 _____ (Microsoft Corporation) C:\Windows\system32\TextInputFramework.dll
2016-04-21 11:33 - 2016-03-29 00:00 - 00235008 _____ C:\Windows\system32\MTF.dll
2016-04-21 11:33 - 2016-03-28 23:59 - 00119808 _____ (Microsoft Corporation) C:\Windows\system32\BitLockerDeviceEncryption.exe
2016-04-21 11:33 - 2016-03-28 23:56 - 00415232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\StoreAgent.dll
2016-04-21 11:33 - 2016-03-28 23:53 - 00323072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleacc.dll
2016-04-21 11:33 - 2016-03-28 23:49 - 00288256 _____ (Microsoft Corporation) C:\Windows\system32\fveui.dll
2016-04-21 11:33 - 2016-03-28 23:48 - 00346624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MapConfiguration.dll
2016-04-21 11:33 - 2016-03-28 23:44 - 00498176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MessagingDataModel2.dll
2016-04-21 11:33 - 2016-03-28 23:41 - 00129024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AboveLockAppHost.dll
2016-04-21 11:33 - 2016-03-28 23:40 - 00787456 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Web.dll
2016-04-21 11:33 - 2016-03-28 23:39 - 00564224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSDApi.dll
2016-04-21 11:33 - 2016-03-28 23:39 - 00350720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CredProvDataModel.dll
2016-04-21 11:33 - 2016-03-28 23:38 - 00800768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JpMapControl.dll
2016-04-21 11:33 - 2016-03-28 23:37 - 01444352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SRHInproc.dll
2016-04-21 11:33 - 2016-03-28 23:37 - 00799744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SRH.dll
2016-04-21 11:33 - 2016-03-28 23:37 - 00792064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2016-04-21 11:33 - 2016-03-28 23:36 - 03351040 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2016-04-21 11:33 - 2016-03-28 23:34 - 00711680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MapControlCore.dll
2016-04-21 11:33 - 2016-03-28 23:34 - 00682496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Input.Inking.dll
2016-04-21 11:33 - 2016-03-28 23:34 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dmenrollengine.dll
2016-04-21 11:33 - 2016-03-28 23:32 - 01588224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2016-04-21 11:33 - 2016-03-28 23:32 - 00854528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Devices.Bluetooth.dll
2016-04-21 11:33 - 2016-03-28 23:32 - 00638464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Networking.dll
2016-04-21 11:33 - 2016-03-28 23:32 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\mdmregistration.dll
2016-04-21 11:33 - 2016-03-28 23:32 - 00162816 _____ (Microsoft Corporation) C:\Windows\system32\enrollmentapi.dll
2016-04-21 11:33 - 2016-03-28 23:31 - 01117184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Media.Speech.dll
2016-04-21 11:33 - 2016-03-28 23:31 - 00705536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2016-04-21 11:33 - 2016-03-28 23:30 - 01139712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAutomationCore.dll
2016-04-21 11:33 - 2016-03-28 23:29 - 00555520 _____ (Microsoft Corporation) C:\Windows\system32\SyncController.dll
2016-04-21 11:33 - 2016-03-28 23:29 - 00256000 _____ (Microsoft Corporation) C:\Windows\system32\accountaccessor.dll
2016-04-21 11:33 - 2016-03-28 23:28 - 01944576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InputService.dll
2016-04-21 11:33 - 2016-03-28 23:28 - 00764928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Cred.dll
2016-04-21 11:33 - 2016-03-28 23:27 - 00245760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TextInputFramework.dll
2016-04-21 11:33 - 2016-03-28 23:27 - 00162816 _____ C:\Windows\SysWOW64\MTF.dll
2016-04-21 11:33 - 2016-03-28 23:23 - 00777728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsSpellCheckingFacility.dll
2016-04-21 11:33 - 2016-03-28 23:22 - 00638464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TokenBroker.dll
2016-04-21 11:33 - 2016-03-28 23:17 - 00765952 _____ (Microsoft Corporation) C:\Windows\system32\fveapi.dll
2016-04-21 11:33 - 2016-03-28 23:13 - 00592384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Web.dll
2016-04-21 11:33 - 2016-03-28 23:10 - 03671040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2016-04-21 11:33 - 2016-03-28 23:06 - 00151040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mdmregistration.dll
2016-04-21 11:33 - 2016-03-28 23:05 - 01626624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2016-04-21 11:33 - 2016-03-28 23:05 - 00450560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SyncController.dll
2016-04-21 11:33 - 2016-03-28 23:05 - 00361472 _____ (Microsoft Corporation) C:\Windows\system32\bdesvc.dll
2016-04-21 11:33 - 2016-03-28 23:04 - 00848896 _____ (Microsoft Corporation) C:\Windows\system32\samsrv.dll
2016-04-21 11:33 - 2016-03-28 23:04 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Networking.Connectivity.dll
2016-04-21 11:33 - 2016-03-28 23:01 - 00957952 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2016-04-21 11:33 - 2016-03-28 22:45 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\ncbservice.dll
2016-04-21 11:33 - 2016-03-28 22:43 - 00521728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Networking.Connectivity.dll
2016-04-21 11:33 - 2016-02-29 22:31 - 00848168 _____ (Microsoft Corporation) C:\Windows\system32\mfsvr.dll
2016-04-21 11:33 - 2016-02-29 22:22 - 00709688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfsvr.dll
2016-04-21 11:33 - 2016-02-24 02:40 - 00513888 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2016-04-21 11:33 - 2016-02-24 01:54 - 00127840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBSTOR.SYS
2016-04-21 11:33 - 2016-02-24 01:39 - 00141560 _____ (Microsoft Corporation) C:\Windows\system32\AuthHost.exe
2016-04-21 11:33 - 2016-02-24 01:14 - 00216416 _____ (Microsoft Corporation) C:\Windows\system32\AppxAllUserStore.dll
2016-04-21 11:33 - 2016-02-24 01:11 - 00394080 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2016-04-21 11:33 - 2016-02-24 01:11 - 00258280 _____ (Microsoft Corporation) C:\Windows\system32\sqmapi.dll
2016-04-21 11:33 - 2016-02-24 01:09 - 00147808 _____ (Microsoft Corporation) C:\Windows\system32\wermgr.exe
2016-04-21 11:33 - 2016-02-24 00:38 - 00187744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AppxAllUserStore.dll
2016-04-21 11:33 - 2016-02-24 00:35 - 00220064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sqmapi.dll
2016-04-21 11:33 - 2016-02-24 00:33 - 00141664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wermgr.exe
2016-04-21 11:33 - 2016-02-24 00:23 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\asycfilt.dll
2016-04-21 11:33 - 2016-02-24 00:23 - 00068096 _____ (Microsoft Corporation) C:\Windows\system32\UserDataPlatformHelperUtil.dll
2016-04-21 11:33 - 2016-02-24 00:20 - 00195072 _____ (Microsoft Corporation) C:\Windows\system32\VCardParser.dll
2016-04-21 11:33 - 2016-02-24 00:13 - 00121856 _____ (Microsoft Corporation) C:\Windows\system32\AppointmentActivation.dll
2016-04-21 11:33 - 2016-02-24 00:12 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\cemapi.dll
2016-04-21 11:33 - 2016-02-24 00:12 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\PhoneCallHistoryApis.dll
2016-04-21 11:33 - 2016-02-24 00:09 - 00258560 _____ (Microsoft Corporation) C:\Windows\system32\UserDataAccountApis.dll
2016-04-21 11:33 - 2016-02-24 00:09 - 00161792 _____ (Microsoft Corporation) C:\Windows\system32\AppxSip.dll
2016-04-21 11:33 - 2016-02-24 00:07 - 00252928 _____ (Microsoft Corporation) C:\Windows\system32\PimIndexMaintenance.dll
2016-04-21 11:33 - 2016-02-24 00:03 - 00088576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\olepro32.dll
2016-04-21 11:33 - 2016-02-24 00:02 - 00161280 _____ (Microsoft Corporation) C:\Windows\system32\CallHistoryClient.dll
2016-04-21 11:33 - 2016-02-24 00:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\AuthBroker.dll
2016-04-21 11:33 - 2016-02-23 23:59 - 00318976 _____ (Microsoft Corporation) C:\Windows\system32\domgmt.dll
2016-04-21 11:33 - 2016-02-23 23:55 - 00790528 _____ (Microsoft Corporation) C:\Windows\system32\EmailApis.dll
2016-04-21 11:33 - 2016-02-23 23:55 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\PackageStateRoaming.dll
2016-04-21 11:33 - 2016-02-23 23:54 - 00288768 _____ (Microsoft Corporation) C:\Windows\system32\vaultcli.dll
2016-04-21 11:33 - 2016-02-23 23:54 - 00228352 _____ (Microsoft Corporation) C:\Windows\system32\wsqmcons.exe
2016-04-21 11:33 - 2016-02-23 23:52 - 00451584 _____ (Microsoft Corporation) C:\Windows\system32\werui.dll
2016-04-21 11:33 - 2016-02-23 23:49 - 00726528 _____ (Microsoft Corporation) C:\Windows\system32\ChatApis.dll
2016-04-21 11:33 - 2016-02-23 23:44 - 00915456 _____ (Microsoft Corporation) C:\Windows\system32\configurationclient.dll
2016-04-21 11:33 - 2016-02-23 23:44 - 00056320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\POSyncServices.dll
2016-04-21 11:33 - 2016-02-23 23:40 - 00078848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\asycfilt.dll
2016-04-21 11:33 - 2016-02-23 23:38 - 00150528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VCardParser.dll
2016-04-21 11:33 - 2016-02-23 23:36 - 01847808 _____ (Microsoft Corporation) C:\Windows\system32\WMPDMC.exe
2016-04-21 11:33 - 2016-02-23 23:32 - 00223744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExSMime.dll
2016-04-21 11:33 - 2016-02-23 23:32 - 00098304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AppointmentActivation.dll
2016-04-21 11:33 - 2016-02-23 23:31 - 00200704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cemapi.dll
2016-04-21 11:33 - 2016-02-23 23:31 - 00169984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PhoneCallHistoryApis.dll
2016-04-21 11:33 - 2016-02-23 23:28 - 00870912 _____ (Microsoft Corporation) C:\Windows\system32\MPSSVC.dll
2016-04-21 11:33 - 2016-02-23 23:28 - 00135168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AppxSip.dll
2016-04-21 11:33 - 2016-02-23 23:25 - 00401408 _____ (Microsoft Corporation) C:\Windows\system32\sharemediacpl.dll
2016-04-21 11:33 - 2016-02-23 23:21 - 00168448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Devices.Scanners.dll
2016-04-21 11:33 - 2016-02-23 23:18 - 00575488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\EmailApis.dll
2016-04-21 11:33 - 2016-02-23 23:18 - 00184832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PackageStateRoaming.dll
2016-04-21 11:33 - 2016-02-23 23:17 - 00369664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FirewallAPI.dll
2016-04-21 11:33 - 2016-02-23 23:13 - 00540160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ChatApis.dll
2016-04-21 11:33 - 2016-02-23 22:22 - 00163328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fwbase.dll
2016-04-21 11:33 - 2016-02-23 04:25 - 00563552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\acpi.sys
2016-04-21 11:33 - 2016-02-23 04:15 - 00779384 _____ (Microsoft Corporation) C:\Windows\system32\taskschd.dll
2016-04-21 11:33 - 2016-02-23 03:33 - 00389992 _____ (Microsoft Corporation) C:\Windows\system32\wlanapi.dll
2016-04-21 11:33 - 2016-02-23 03:31 - 00476728 _____ (Microsoft Corporation) C:\Windows\system32\msvproc.dll
2016-04-21 11:33 - 2016-02-23 03:31 - 00408120 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2016-04-21 11:33 - 2016-02-23 03:17 - 00146272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2016-04-21 11:33 - 2016-02-23 02:40 - 00430944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2016-04-21 11:33 - 2016-02-23 02:25 - 00534368 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBHUB3.SYS
2016-04-21 11:33 - 2016-02-23 02:20 - 00238592 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\xboxgip.sys
2016-04-21 11:33 - 2016-02-23 02:12 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\provpackageapidll.dll
2016-04-21 11:33 - 2016-02-23 02:10 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\WiFiConfigSP.dll
2016-04-21 11:33 - 2016-02-23 02:06 - 00129536 _____ (Microsoft Corporation) C:\Windows\system32\flvprophandler.dll
2016-04-21 11:33 - 2016-02-23 02:00 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\EnterpriseDesktopAppMgmtCSP.dll
2016-04-21 11:33 - 2016-02-23 01:55 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bridge.sys
2016-04-21 11:33 - 2016-02-23 01:53 - 00099328 _____ (Microsoft Corporation) C:\Windows\system32\ngckeyenum.dll
2016-04-21 11:33 - 2016-02-23 01:52 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\MDMAppInstaller.exe
2016-04-21 11:33 - 2016-02-23 01:50 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\DeviceCensus.exe
2016-04-21 11:33 - 2016-02-23 01:40 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\SMSRouter.dll
2016-04-21 11:33 - 2016-02-23 01:39 - 00178176 _____ (Microsoft Corporation) C:\Windows\system32\psmsrv.dll
2016-04-21 11:33 - 2016-02-23 01:38 - 00320000 _____ (Microsoft Corporation) C:\Windows\system32\MSFlacDecoder.dll
2016-04-21 11:33 - 2016-02-23 01:37 - 00274944 _____ (Microsoft Corporation) C:\Windows\system32\DisplayManager.dll
2016-04-21 11:33 - 2016-02-23 01:34 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\WiFiDisplay.dll
2016-04-21 11:33 - 2016-02-23 01:28 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll
2016-04-21 11:33 - 2016-02-23 01:23 - 00412672 _____ (Microsoft Corporation) C:\Windows\system32\wlanmsm.dll
2016-04-21 11:33 - 2016-02-23 01:02 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2016-04-21 11:33 - 2016-02-23 00:50 - 00266752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSFlacDecoder.dll
2016-04-21 11:33 - 2016-02-23 00:49 - 00200704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DisplayManager.dll
2016-04-21 11:33 - 2016-02-23 00:47 - 00157184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WiFiDisplay.dll
2016-04-21 11:33 - 2016-02-23 00:35 - 00400896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winspool.drv
2016-04-21 11:33 - 2016-02-08 20:18 - 00297472 _____ (Microsoft Corporation) C:\Windows\system32\thumbcache.dll
2016-04-21 11:33 - 2016-02-08 20:18 - 00237056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\thumbcache.dll
2016-04-21 11:33 - 2016-02-08 20:07 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\DeviceEnroller.exe
2016-04-21 11:33 - 2016-01-26 22:59 - 00304752 _____ (Microsoft Corporation) C:\Windows\system32\systemreset.exe
2016-04-21 11:33 - 2016-01-26 22:55 - 00081112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\OpenWith.exe
2016-04-21 11:33 - 2016-01-26 22:44 - 00085320 _____ (Microsoft Corporation) C:\Windows\system32\OpenWith.exe
2016-04-21 11:33 - 2016-01-26 22:15 - 00031232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ztrace_maps.dll
2016-04-21 11:33 - 2016-01-26 22:08 - 00299008 _____ (Microsoft Corporation) C:\Windows\system32\microsoft-windows-system-events.dll
2016-04-21 11:33 - 2016-01-26 22:08 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\ztrace_maps.dll
2016-04-21 11:33 - 2016-01-26 22:07 - 00203264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iassam.dll
2016-04-21 11:33 - 2016-01-26 22:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\hlink.dll
2016-04-21 11:33 - 2016-01-26 21:59 - 00258048 _____ (Microsoft Corporation) C:\Windows\system32\iassam.dll
2016-04-21 11:33 - 2016-01-26 21:50 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2016-04-21 11:33 - 2016-01-15 23:37 - 00202472 _____ (Microsoft Corporation) C:\Windows\system32\wscapi.dll
2016-04-21 11:33 - 2016-01-15 23:23 - 00785088 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2016-04-21 11:33 - 2016-01-15 23:20 - 00431240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WWanAPI.dll
2016-04-21 11:33 - 2016-01-15 23:20 - 00366224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2016-04-21 11:33 - 2016-01-15 23:08 - 00440152 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2016-04-21 11:33 - 2016-01-15 22:44 - 00166400 _____ (Microsoft Corporation) C:\Windows\system32\MusNotification.exe
2016-04-21 11:33 - 2016-01-15 22:41 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\MusNotificationUx.exe
2016-04-21 11:33 - 2016-01-15 22:39 - 00149504 _____ (Microsoft Corporation) C:\Windows\system32\FilterDS.dll
2016-04-21 11:33 - 2016-01-15 22:38 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\MusUpdateHandlers.dll
2016-04-21 11:33 - 2016-01-15 22:38 - 00193024 _____ (Microsoft Corporation) C:\Windows\system32\SimCfg.dll
2016-04-21 11:33 - 2016-01-15 22:36 - 00475648 _____ (Microsoft Corporation) C:\Windows\system32\DDDS.dll
2016-04-21 11:33 - 2016-01-15 22:36 - 00221696 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2016-04-21 11:33 - 2016-01-15 22:36 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\SimAuth.dll
2016-04-21 11:33 - 2016-01-15 22:35 - 00383488 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2016-04-21 11:33 - 2016-01-15 22:34 - 00610816 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2016-04-21 11:33 - 2016-01-15 22:34 - 00477696 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2016-04-21 11:33 - 2016-01-15 22:33 - 00726528 _____ (Microsoft Corporation) C:\Windows\system32\wlidcli.dll
2016-04-21 11:33 - 2016-01-15 22:33 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Networking.UX.EapRequestHandler.dll
2016-04-21 11:33 - 2016-01-15 22:30 - 02127360 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2016-04-21 11:33 - 2016-01-15 22:30 - 00157696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SimCfg.dll
2016-04-21 11:33 - 2016-01-15 22:28 - 00884736 _____ (Microsoft Corporation) C:\Windows\system32\rasdlg.dll
2016-04-21 11:33 - 2016-01-15 22:28 - 00129024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SimAuth.dll
2016-04-21 11:33 - 2016-01-15 22:26 - 00535040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2016-04-21 11:33 - 2016-01-15 22:25 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlidcli.dll
2016-04-21 11:33 - 2016-01-15 22:20 - 00799744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasdlg.dll
2016-04-21 11:33 - 2016-01-15 22:19 - 00733184 _____ (Microsoft Corporation) C:\Windows\system32\rasapi32.dll
2016-04-21 11:33 - 2016-01-15 22:11 - 00653312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasapi32.dll
2016-04-21 11:32 - 2016-04-01 20:30 - 00151040 _____ (Microsoft Corporation) C:\Windows\system32\VEStoreEventHandlers.dll
2016-04-21 11:32 - 2016-04-01 20:25 - 00278528 _____ (Microsoft Corporation) C:\Windows\system32\NotificationObjFactory.dll
2016-04-21 11:32 - 2016-04-01 20:25 - 00239104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\NotificationObjFactory.dll
2016-04-21 11:32 - 2016-04-01 20:23 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\VEEventDispatcher.dll
2016-04-21 11:32 - 2016-04-01 20:08 - 02193408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll
2016-04-21 11:32 - 2016-04-01 20:03 - 04774912 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2016-04-21 11:32 - 2016-03-29 01:17 - 00089088 _____ (Microsoft Corporation) C:\Windows\system32\MapsCSP.dll
2016-04-21 11:32 - 2016-03-29 01:16 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\xinputhid.sys
2016-04-21 11:32 - 2016-03-29 01:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\SensorsNativeApi.V2.dll
2016-04-21 11:32 - 2016-03-29 01:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\policymanagerprecheck.dll
2016-04-21 11:32 - 2016-03-29 01:07 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2016-04-21 11:32 - 2016-03-29 01:07 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\dmenterprisediagnostics.dll
2016-04-21 11:32 - 2016-03-29 01:06 - 00045568 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2016-04-21 11:32 - 2016-03-29 01:06 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\oleacchooks.dll
2016-04-21 11:32 - 2016-03-29 01:02 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2016-04-21 11:32 - 2016-03-29 01:00 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\NetCfgNotifyObjectHost.exe
2016-04-21 11:32 - 2016-03-29 01:00 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\fveskybackup.dll
2016-04-21 11:32 - 2016-03-29 01:00 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\mapsupdatetask.dll
2016-04-21 11:32 - 2016-03-29 00:59 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\LicenseManagerShellext.exe
2016-04-21 11:32 - 2016-03-29 00:58 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\wininetlui.dll
2016-04-21 11:32 - 2016-03-29 00:58 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2016-04-21 11:32 - 2016-03-29 00:57 - 00095744 _____ (Microsoft Corporation) C:\Windows\system32\samlib.dll
2016-04-21 11:32 - 2016-03-29 00:57 - 00058368 _____ (Microsoft Corporation) C:\Windows\system32\browcli.dll
2016-04-21 11:32 - 2016-03-29 00:55 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\serial.sys
2016-04-21 11:32 - 2016-03-29 00:55 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\tbauth.dll
2016-04-21 11:32 - 2016-03-29 00:53 - 00116224 _____ (Microsoft Corporation) C:\Windows\system32\FontProvider.dll
2016-04-21 11:32 - 2016-03-29 00:52 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\TokenBrokerCookies.exe
2016-04-21 11:32 - 2016-03-29 00:51 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\tzautoupdate.dll
2016-04-21 11:32 - 2016-03-29 00:50 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\BdeHdCfgLib.dll
2016-04-21 11:32 - 2016-03-29 00:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\moshost.dll
2016-04-21 11:32 - 2016-03-29 00:50 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\OnDemandConnRouteHelper.dll
2016-04-21 11:32 - 2016-03-29 00:50 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\wuautoappupdate.dll
2016-04-21 11:32 - 2016-03-29 00:49 - 00245760 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\BthLEEnum.sys
2016-04-21 11:32 - 2016-03-29 00:49 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\browserbroker.dll
2016-04-21 11:32 - 2016-03-29 00:48 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\AppCapture.dll
2016-04-21 11:32 - 2016-03-29 00:46 - 00134656 _____ (Microsoft Corporation) C:\Windows\system32\browser.dll
2016-04-21 11:32 - 2016-03-29 00:34 - 00333824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2016-04-21 11:32 - 2016-03-29 00:32 - 00764928 _____ (Microsoft Corporation) C:\Windows\system32\Chakradiag.dll
2016-04-21 11:32 - 2016-03-29 00:32 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\bcastdvr.exe
2016-04-21 11:32 - 2016-03-29 00:30 - 00161792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msorcl32.dll
2016-04-21 11:32 - 2016-03-29 00:21 - 00330240 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2016-04-21 11:32 - 2016-03-29 00:20 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SensorsNativeApi.V2.dll
2016-04-21 11:32 - 2016-03-29 00:20 - 00026112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wsdchngr.dll
2016-04-21 11:32 - 2016-03-29 00:19 - 00037376 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2016-04-21 11:32 - 2016-03-29 00:19 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleacchooks.dll
2016-04-21 11:32 - 2016-03-29 00:18 - 00676352 _____ (Microsoft Corporation) C:\Windows\system32\WSDApi.dll
2016-04-21 11:32 - 2016-03-29 00:16 - 00093696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2016-04-21 11:32 - 2016-03-29 00:14 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\BTHUSB.SYS
2016-04-21 11:32 - 2016-03-29 00:12 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininetlui.dll
2016-04-21 11:32 - 2016-03-29 00:12 - 00045568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2016-04-21 11:32 - 2016-03-29 00:11 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\samlib.dll
2016-04-21 11:32 - 2016-03-29 00:11 - 00043520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\browcli.dll
2016-04-21 11:32 - 2016-03-29 00:09 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MapsBtSvc.dll
2016-04-21 11:32 - 2016-03-29 00:09 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tbauth.dll
2016-04-21 11:32 - 2016-03-29 00:08 - 00118272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mtxoci.dll
2016-04-21 11:32 - 2016-03-29 00:06 - 00022528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TokenBrokerCookies.exe
2016-04-21 11:32 - 2016-03-29 00:05 - 00052736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\OnDemandConnRouteHelper.dll
2016-04-21 11:32 - 2016-03-29 00:00 - 00176128 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettings.DeviceEncryptionHandlers.dll
2016-04-21 11:32 - 2016-03-29 00:00 - 00175616 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Core.TextInput.dll
2016-04-21 11:32 - 2016-03-28 23:59 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\fveapibase.dll
2016-04-21 11:32 - 2016-03-28 23:59 - 00108544 _____ (Microsoft Corporation) C:\Windows\system32\InputLocaleManager.dll
2016-04-21 11:32 - 2016-03-28 23:53 - 00193024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credprovhost.dll
2016-04-21 11:32 - 2016-03-28 23:52 - 00306176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieproxy.dll
2016-04-21 11:32 - 2016-03-28 23:52 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\easwrt.dll
2016-04-21 11:32 - 2016-03-28 23:42 - 00250880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2016-04-21 11:32 - 2016-03-28 23:39 - 00496128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Security.Authentication.Web.Core.dll
2016-04-21 11:32 - 2016-03-28 23:34 - 00784896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\NMAA.dll
2016-04-21 11:32 - 2016-03-28 23:32 - 00128512 _____ (Microsoft Corporation) C:\Windows\system32\dmcsps.dll
2016-04-21 11:32 - 2016-03-28 23:27 - 00133632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Core.TextInput.dll
2016-04-21 11:32 - 2016-03-28 23:27 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InputLocaleManager.dll
2016-04-21 11:32 - 2016-03-28 22:35 - 00821248 _____ (Microsoft Corporation) C:\Windows\system32\fvewiz.dll
2016-04-21 11:32 - 2016-03-28 22:28 - 00324608 _____ (Microsoft Corporation) C:\Windows\system32\fvecpl.dll
2016-04-21 11:32 - 2016-03-28 22:27 - 00794112 _____ (Microsoft Corporation) C:\Windows\system32\BFE.DLL
2016-04-21 11:32 - 2016-03-28 22:26 - 00402432 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2016-04-21 11:32 - 2016-03-28 22:25 - 00269824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2016-04-21 11:32 - 2016-03-28 22:21 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\basesrv.dll
2016-04-21 11:32 - 2016-02-24 00:39 - 00045568 _____ (Microsoft Corporation) C:\Windows\system32\UserDataTypeHelperUtil.dll
2016-04-21 11:32 - 2016-02-24 00:39 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\ExtrasXmlParser.dll
2016-04-21 11:32 - 2016-02-24 00:38 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\UserDataTimeUtil.dll
2016-04-21 11:32 - 2016-02-24 00:37 - 00045056 _____ (Microsoft Corporation) C:\Windows\system32\UserDataLanguageUtil.dll
2016-04-21 11:32 - 2016-02-24 00:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\PimIndexMaintenanceClient.dll
2016-04-21 11:32 - 2016-02-24 00:30 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\wfapigp.dll
2016-04-21 11:32 - 2016-02-24 00:28 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\POSyncServices.dll
2016-04-21 11:32 - 2016-02-24 00:22 - 00196608 _____ (Microsoft Corporation) C:\Windows\system32\fwpolicyiomgr.dll
2016-04-21 11:32 - 2016-02-24 00:19 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\dssvc.dll
2016-04-21 11:32 - 2016-02-24 00:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\seclogon.dll
2016-04-21 11:32 - 2016-02-24 00:14 - 00274944 _____ (Microsoft Corporation) C:\Windows\system32\ExSMime.dll
2016-04-21 11:32 - 2016-02-24 00:10 - 00093184 _____ (Microsoft Corporation) C:\Windows\system32\wpninprc.dll
2016-04-21 11:32 - 2016-02-24 00:01 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\profext.dll
2016-04-21 11:32 - 2016-02-24 00:00 - 00214528 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Devices.Scanners.dll
2016-04-21 11:32 - 2016-02-23 23:58 - 00685568 _____ (Microsoft Corporation) C:\Windows\system32\scapi.dll
2016-04-21 11:32 - 2016-02-23 23:55 - 00018944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExtrasXmlParser.dll
2016-04-21 11:32 - 2016-02-23 23:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\FirewallAPI.dll
2016-04-21 11:32 - 2016-02-23 23:54 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UserDataTypeHelperUtil.dll
2016-04-21 11:32 - 2016-02-23 23:53 - 00089088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UserDataTimeUtil.dll
2016-04-21 11:32 - 2016-02-23 23:53 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UserDataLanguageUtil.dll
2016-04-21 11:32 - 2016-02-23 23:52 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PimIndexMaintenanceClient.dll
2016-04-21 11:32 - 2016-02-23 23:46 - 00020480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wfapigp.dll
2016-04-21 11:32 - 2016-02-23 23:40 - 00056320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UserDataPlatformHelperUtil.dll
2016-04-21 11:32 - 2016-02-23 23:39 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fwpolicyiomgr.dll
2016-04-21 11:32 - 2016-02-23 23:28 - 00196608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UserDataAccountApis.dll
2016-04-21 11:32 - 2016-02-23 23:23 - 00129024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CallHistoryClient.dll
2016-04-21 11:32 - 2016-02-23 23:22 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\profext.dll
2016-04-21 11:32 - 2016-02-23 23:16 - 00394752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\werui.dll
2016-04-21 11:32 - 2016-02-23 22:43 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\fwbase.dll
2016-04-21 11:32 - 2016-02-23 02:07 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\LaunchWinApp.exe
2016-04-21 11:32 - 2016-02-23 02:07 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\wlansvcpal.dll
2016-04-21 11:32 - 2016-02-23 02:01 - 00104960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rasl2tp.sys
2016-04-21 11:32 - 2016-02-23 02:00 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\wfdprov.dll
2016-04-21 11:32 - 2016-02-23 01:58 - 00025088 _____ (Microsoft Corporation) C:\Windows\system32\irmon.dll
2016-04-21 11:32 - 2016-02-23 01:53 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\srpapi.dll
2016-04-21 11:32 - 2016-02-23 01:48 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\TimeBrokerClient.dll
2016-04-21 11:32 - 2016-02-23 01:33 - 00558080 _____ (Microsoft Corporation) C:\Windows\system32\MBMediaManager.dll
2016-04-21 11:32 - 2016-02-23 01:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\LaunchWinApp.exe
2016-04-21 11:32 - 2016-02-23 00:57 - 00031744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TimeBrokerClient.dll
2016-04-21 11:32 - 2016-01-26 22:10 - 00099840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\hlink.dll
2016-04-21 11:32 - 2016-01-26 21:44 - 00063488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cfgbkend.dll
2016-04-21 11:32 - 2016-01-26 21:32 - 01087488 _____ (Microsoft Corporation) C:\Windows\system32\reseteng.dll
2016-04-21 11:32 - 2016-01-26 21:31 - 00079360 _____ (Microsoft Corporation) C:\Windows\system32\cfgbkend.dll
2016-04-21 11:32 - 2016-01-15 22:46 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbser.sys
2016-04-21 11:32 - 2016-01-15 22:44 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\rasadhlp.dll
2016-04-21 11:32 - 2016-01-15 22:44 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\rastlsext.dll
2016-04-21 11:32 - 2016-01-15 22:43 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\winhttpcom.dll
2016-04-21 11:32 - 2016-01-15 22:42 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\sscoreext.dll
2016-04-21 11:32 - 2016-01-15 22:40 - 00106496 _____ (Microsoft Corporation) C:\Windows\system32\rasauto.dll
2016-04-21 11:32 - 2016-01-15 22:40 - 00049152 _____ (Microsoft Corporation) C:\Windows\system32\pcaui.exe
2016-04-21 11:32 - 2016-01-15 22:40 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\rasautou.exe
2016-04-21 11:32 - 2016-01-15 22:38 - 00130560 _____ (Microsoft Corporation) C:\Windows\system32\winbio.dll
2016-04-21 11:32 - 2016-01-15 22:36 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastlsext.dll
2016-04-21 11:32 - 2016-01-15 22:35 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasadhlp.dll
2016-04-21 11:32 - 2016-01-15 22:34 - 00079360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winhttpcom.dll
2016-04-21 11:32 - 2016-01-15 22:32 - 00041984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pcaui.exe
2016-04-21 11:32 - 2016-01-15 22:31 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasautou.exe
2016-04-21 11:32 - 2016-01-15 22:30 - 00093696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winbio.dll
2016-04-21 11:14 - 2016-04-21 11:14 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
2016-04-21 11:13 - 2016-04-21 11:13 - 13445408 _____ (Paragon Software ) C:\Users\aroco\Downloads\HFS4WIN.exe
2016-04-21 11:13 - 2016-04-21 11:13 - 00000000 ____D C:\Program Files (x86)\Paragon Software
2016-04-21 11:13 - 2014-11-14 19:21 - 00204496 _____ (Paragon Software Group) C:\Windows\system32\Drivers\hfsplus.sys
2016-04-21 11:13 - 2014-11-14 19:21 - 00061136 _____ (Paragon Software Group) C:\Windows\system32\Drivers\gpt_loader.sys
2016-04-21 11:13 - 2014-11-14 19:21 - 00050896 _____ (Paragon Software Group) C:\Windows\system32\Drivers\apmwin.sys
2016-04-21 11:13 - 2014-11-14 19:21 - 00045776 _____ (Paragon Software Group) C:\Windows\system32\Drivers\mounthlp.sys
2016-04-21 11:13 - 2014-11-14 19:21 - 00015568 _____ (Paragon Software Group) C:\Windows\system32\Drivers\hfsplusrec.sys
2016-04-21 11:01 - 2016-04-21 15:41 - 00000000 ____D C:\Users\aroco\AppData\Roaming\Apple Computer
2016-04-21 11:01 - 2016-04-21 11:01 - 00001824 _____ C:\Users\Public\Desktop\iTunes.lnk
2016-04-21 11:01 - 2016-04-21 11:01 - 00000000 ____D C:\Users\aroco\AppData\Local\Apple Computer
2016-04-21 11:01 - 2016-04-21 11:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2016-04-21 11:00 - 2016-04-23 12:58 - 00004020 _____ C:\Windows\System32\Tasks\Intel Security DAT Reputation (AMCore) periodic endpoint safety pulse
2016-04-21 11:00 - 2016-04-21 11:01 - 00000000 ____D C:\Program Files\iTunes
2016-04-21 11:00 - 2016-04-21 11:00 - 00002535 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2016-04-21 11:00 - 2016-04-21 11:00 - 00000000 ____D C:\Users\aroco\AppData\Local\Apple
2016-04-21 11:00 - 2016-04-21 11:00 - 00000000 ____D C:\ProgramData\Apple Computer
2016-04-21 11:00 - 2016-04-21 11:00 - 00000000 ____D C:\ProgramData\Apple
2016-04-21 11:00 - 2016-04-21 11:00 - 00000000 ____D C:\Program Files\iPod
2016-04-21 11:00 - 2016-04-21 11:00 - 00000000 ____D C:\Program Files\Common Files\Apple
2016-04-21 11:00 - 2016-04-21 11:00 - 00000000 ____D C:\Program Files\Bonjour
2016-04-21 11:00 - 2016-04-21 11:00 - 00000000 ____D C:\Program Files (x86)\iTunes
2016-04-21 11:00 - 2016-04-21 11:00 - 00000000 ____D C:\Program Files (x86)\Bonjour
2016-04-21 11:00 - 2016-04-21 11:00 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
2016-04-21 11:00 - 2015-05-19 13:59 - 00207208 _____ (McAfee, Inc.) C:\Windows\system32\Drivers\HipShieldK.sys
2016-04-20 22:48 - 2016-04-20 22:48 - 00000000 _SHDL C:\Users\Public\Documents\My Videos
2016-04-20 22:48 - 2016-04-20 22:48 - 00000000 _SHDL C:\Users\Public\Documents\My Pictures
2016-04-20 22:48 - 2016-04-20 22:48 - 00000000 _SHDL C:\Users\Public\Documents\My Music
2016-04-20 22:48 - 2016-04-20 22:48 - 00000000 _SHDL C:\Users\Default\My Documents
2016-04-20 22:48 - 2016-04-20 22:48 - 00000000 _SHDL C:\Users\Default\Documents\My Videos
2016-04-20 22:48 - 2016-04-20 22:48 - 00000000 _SHDL C:\Users\Default\Documents\My Pictures
2016-04-20 22:48 - 2016-04-20 22:48 - 00000000 _SHDL C:\Users\Default\Documents\My Music
2016-04-20 22:48 - 2016-04-20 22:48 - 00000000 _SHDL C:\Users\Default User\Documents\My Videos
2016-04-20 22:48 - 2016-04-20 22:48 - 00000000 _SHDL C:\Users\Default User\Documents\My Pictures
2016-04-20 22:48 - 2016-04-20 22:48 - 00000000 _SHDL C:\Users\Default User\Documents\My Music
2016-04-20 22:48 - 2016-04-20 22:48 - 00000000 _SHDL C:\Documents and Settings
2016-04-20 21:10 - 2016-04-20 21:10 - 00000000 ____D C:\Users\aroco\AppData\Local\NetworkTiles
2016-04-20 20:58 - 2016-04-20 20:58 - 00000000 ____D C:\Users\aroco\AppData\Roaming\Macromedia
2016-04-20 20:57 - 2016-04-23 09:25 - 00000000 ____D C:\Users\aroco\AppData\Local\Google
2016-04-20 20:57 - 2016-04-23 09:25 - 00000000 ____D C:\Program Files (x86)\Google
2016-04-20 20:57 - 2016-04-20 20:57 - 00000000 ____D C:\Users\aroco\AppData\Local\MicrosoftEdge
2016-04-20 20:56 - 2016-04-20 20:56 - 00002336 _____ C:\Users\aroco\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2016-04-20 20:56 - 2016-04-20 20:56 - 00000000 ___RD C:\Users\aroco\OneDrive
2016-04-20 20:56 - 2016-04-20 20:56 - 00000000 ____D C:\Users\aroco\AppData\Roaming\Intel Corporation
2016-04-20 20:55 - 2016-04-21 13:01 - 00000000 ____D C:\Users\aroco\AppData\Local\Comms
2016-04-20 20:55 - 2016-04-20 20:55 - 00000000 ____D C:\Users\aroco\Documents\Bluetooth Exchange Folder
2016-04-20 20:55 - 2016-04-20 20:55 - 00000000 ____D C:\Users\aroco\AppData\Roaming\Portrait Displays
2016-04-20 20:55 - 2016-04-20 20:55 - 00000000 ____D C:\Users\aroco\AppData\Local\Portrait Displays
2016-04-20 20:55 - 2016-04-20 20:55 - 00000000 ____D C:\Users\aroco\AppData\Local\ChromaTune_Dell
2016-04-20 20:55 - 2016-04-20 20:55 - 00000000 ____D C:\Users\aroco\AppData\Local\Broadcom
2016-04-20 20:55 - 2016-04-20 20:55 - 00000000 ____D C:\Users\aroco\AppData\Local\ActiveSync
2016-04-20 20:54 - 2016-04-20 20:54 - 00000000 ____D C:\Users\aroco\AppData\Roaming\DropboxOEM
2016-04-20 20:54 - 2016-04-20 20:54 - 00000000 ____D C:\Users\aroco\AppData\Local\Publishers
2016-04-20 20:54 - 2016-04-20 20:54 - 00000000 ____D C:\Users\aroco\AppData\Local\DropboxOEM
2016-04-20 20:53 - 2016-04-23 09:10 - 00000000 __SHD C:\Users\aroco\IntelGraphicsProfiles
2016-04-20 20:53 - 2016-04-21 17:05 - 00000000 ____D C:\Users\aroco\AppData\Local\Packages
2016-04-20 20:53 - 2016-04-21 16:33 - 00000000 ____D C:\Users\aroco\AppData\Roaming\Adobe
2016-04-20 20:53 - 2016-04-20 20:53 - 00000000 ____D C:\Users\aroco\AppData\Local\VirtualStore
2016-04-20 20:53 - 2016-04-20 20:53 - 00000000 ____D C:\Users\aroco\AppData\Local\TileDataLayer
2016-04-20 20:53 - 2016-04-20 20:53 - 00000000 ____D C:\Users\aroco\AppData\Local\NVIDIA Corporation
2016-04-20 20:53 - 2016-04-20 20:53 - 00000000 ____D C:\Users\aroco\AppData\Local\NVIDIA
2016-04-20 20:52 - 2016-04-22 12:42 - 00000000 ____D C:\Users\aroco
2016-04-20 20:52 - 2016-04-20 20:52 - 00003436 _____ C:\Windows\System32\Tasks\PCDDataUploadTask
2016-04-20 20:52 - 2016-04-20 20:52 - 00003322 _____ C:\Windows\System32\Tasks\SystemToolsDailyTest
2016-04-20 20:52 - 2016-04-20 20:52 - 00000020 ___SH C:\Users\aroco\ntuser.ini
2016-04-20 20:52 - 2016-04-20 20:52 - 00000000 _SHDL C:\Users\aroco\My Documents
2016-04-20 20:52 - 2016-04-20 20:52 - 00000000 _SHDL C:\Users\aroco\Documents\My Videos
2016-04-20 20:52 - 2016-04-20 20:52 - 00000000 _SHDL C:\Users\aroco\Documents\My Pictures
2016-04-20 20:52 - 2016-04-20 20:52 - 00000000 _SHDL C:\Users\aroco\Documents\My Music
2016-04-20 20:51 - 2016-04-20 20:51 - 00002138 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox 20 GB.lnk
2016-04-20 20:50 - 2016-04-23 09:10 - 00000180 _____ C:\Windows\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2016-04-13 16:30 - 2016-04-13 16:30 - 00026649 ____R C:\dell.sdr
2016-04-13 16:26 - 2016-04-13 16:26 - 06572032 _____ (Microsoft Corporation) C:\Windows\system32\wwanmm.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 03355136 _____ (Microsoft Corporation) C:\Windows\system32\msftedit.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 02843136 _____ (Microsoft Corporation) C:\Windows\system32\cdp.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 02756096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2016-04-13 16:26 - 2016-04-13 16:26 - 02756096 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2016-04-13 16:26 - 2016-04-13 16:26 - 02680320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msftedit.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 02587696 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 02444288 _____ (Microsoft Corporation) C:\Windows\system32\twinui.appcore.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 02352128 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 02155008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 02026736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 02001408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.appcore.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 01860096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cdp.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 01814528 _____ (Microsoft Corporation) C:\Windows\system32\pnidui.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 01804664 _____ (Microsoft Corporation) C:\Windows\system32\WMALFXGFXDSP.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 01717248 _____ (Microsoft Corporation) C:\Windows\system32\GdiPlus.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 01648640 _____ (Microsoft Corporation) C:\Windows\system32\comsvcs.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 01594408 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 01582080 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2016-04-13 16:26 - 2016-04-13 16:26 - 01467392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\GdiPlus.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 01399224 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 01371792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 01337240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 01328128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comsvcs.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 01309376 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 01299504 _____ (Microsoft Corporation) C:\Windows\system32\mfnetsrc.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 01268736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Xaml.Resources.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 01268736 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Xaml.Resources.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 01255936 _____ (Microsoft Corporation) C:\Windows\system32\WMSPDMOE.DLL
2016-04-13 16:26 - 2016-04-13 16:26 - 01118208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfnetsrc.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 01092456 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 01070080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMSPDMOE.DLL
2016-04-13 16:26 - 2016-04-13 16:26 - 01042432 _____ (Microsoft Corporation) C:\Windows\system32\BingOnlineServices.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 01035776 _____ (Microsoft Corporation) C:\Windows\system32\XboxNetApiSvc.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 01009152 _____ (Microsoft Corporation) C:\Windows\system32\WMSPDMOD.DLL
2016-04-13 16:26 - 2016-04-13 16:26 - 00931328 _____ (Microsoft Corporation) C:\Windows\system32\MSMPEG2ENC.DLL
2016-04-13 16:26 - 2016-04-13 16:26 - 00925064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00912384 _____ (Microsoft Corporation) C:\Windows\system32\usermgr.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00911648 _____ (Microsoft Corporation) C:\Windows\system32\dcomp.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00900608 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Networking.BackgroundTransfer.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00890880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMSPDMOD.DLL
2016-04-13 16:26 - 2016-04-13 16:26 - 00871936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSMPEG2ENC.DLL
2016-04-13 16:26 - 2016-04-13 16:26 - 00870400 _____ (Microsoft Corporation) C:\Windows\system32\wpncore.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00858952 _____ (Microsoft Corporation) C:\Windows\system32\mfnetcore.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00824320 _____ (Microsoft Corporation) C:\Windows\system32\WpcWebFilter.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00803840 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00786696 _____ (Microsoft Corporation) C:\Windows\system32\WMADMOD.DLL
2016-04-13 16:26 - 2016-04-13 16:26 - 00749056 _____ (Microsoft Corporation) C:\Windows\system32\PhoneService.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00709120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\BingOnlineServices.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00704000 _____ (Microsoft Corporation) C:\Windows\system32\CellularAPI.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00701384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfnetcore.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00698208 _____ (Microsoft Corporation) C:\Windows\system32\wimgapi.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00697856 _____ (Microsoft Corporation) C:\Windows\system32\PlayToManager.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00695752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMADMOD.DLL
2016-04-13 16:26 - 2016-04-13 16:26 - 00683008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Networking.BackgroundTransfer.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00678912 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00675064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dcomp.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00671472 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00647168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00644096 _____ (Microsoft Corporation) C:\Windows\system32\uReFS.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00604672 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00589312 _____ (Microsoft Corporation) C:\Windows\system32\MbaeApi.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00586208 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00586080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wimgapi.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00584704 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2016-04-13 16:26 - 2016-04-13 16:26 - 00578912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2016-04-13 16:26 - 2016-04-13 16:26 - 00573440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00572928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WpcWebFilter.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00569856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00558592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uReFS.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00526856 _____ (Microsoft Corporation) C:\Windows\system32\mfreadwrite.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00523776 _____ (Microsoft Corporation) C:\Windows\system32\catsrvut.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00523616 _____ (Microsoft Corporation) C:\Windows\system32\wimserv.exe
2016-04-13 16:26 - 2016-04-13 16:26 - 00517632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PlayToManager.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00516544 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00515584 _____ (Microsoft Corporation) C:\Windows\system32\LogonController.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00511320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00499432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00479232 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00472576 _____ (Microsoft Corporation) C:\Windows\system32\DscCore.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00470528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MbaeApi.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\wwanconn.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00462760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfreadwrite.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00458752 _____ (Microsoft Corporation) C:\Windows\system32\PlayToDevice.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00454056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00421888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\LogonController.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00415744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\catsrvut.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00412512 _____ (Microsoft Corporation) C:\Windows\system32\wifitask.exe
2016-04-13 16:26 - 2016-04-13 16:26 - 00389120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00387072 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00340480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PlayToDevice.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00337840 _____ (Microsoft Corporation) C:\Windows\system32\MFPlay.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00334336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcastdvr.exe
2016-04-13 16:26 - 2016-04-13 16:26 - 00320000 _____ (Microsoft Corporation) C:\Windows\system32\cryptngc.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00305664 _____ (Microsoft Corporation) C:\Windows\system32\ksproxy.ax
2016-04-13 16:26 - 2016-04-13 16:26 - 00292352 _____ (Microsoft Corporation) C:\Windows\system32\provengine.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00289248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MFPlay.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00286208 _____ (Microsoft Corporation) C:\Windows\system32\provhandlers.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\facecredentialprovider.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00264544 _____ (Microsoft Corporation) C:\Windows\system32\ContentDeliveryManager.Utilities.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00264192 _____ (Nokia) C:\Windows\system32\NmaDirect.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\UserMgrProxy.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00245840 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00241664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptngc.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00235008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ksproxy.ax
2016-04-13 16:26 - 2016-04-13 16:26 - 00234504 _____ (Microsoft Corporation) C:\Windows\system32\mftranscode.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\KnobsCore.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\wcmcsp.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00208176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mftranscode.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00205824 _____ (Nokia) C:\Windows\SysWOW64\NmaDirect.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00204800 _____ (Microsoft Corporation) C:\Windows\system32\Microsoft-Windows-AppModelExecEvents.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\provisioningcsp.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00182784 _____ (Microsoft Corporation) C:\Windows\system32\shutdownux.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00167936 _____ (Microsoft Corporation) C:\Windows\system32\ProximityCommon.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00166912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UserMgrProxy.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00165376 _____ (Microsoft Corporation) C:\Windows\system32\provdatastore.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00163328 _____ (Microsoft Corporation) C:\Windows\system32\provops.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00162304 _____ (Microsoft Corporation) C:\Windows\system32\tetheringservice.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00161632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2016-04-13 16:26 - 2016-04-13 16:26 - 00157184 _____ (Microsoft Corporation) C:\Windows\system32\dmcertinst.exe
2016-04-13 16:26 - 2016-04-13 16:26 - 00148992 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2016-04-13 16:26 - 2016-04-13 16:26 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rmcast.sys
2016-04-13 16:26 - 2016-04-13 16:26 - 00145920 _____ (Microsoft Corporation) C:\Windows\system32\omadmclient.exe
2016-04-13 16:26 - 2016-04-13 16:26 - 00138240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ETWCoreUIComponentsResources.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00138240 _____ (Microsoft Corporation) C:\Windows\system32\ETWCoreUIComponentsResources.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00134656 _____ (Microsoft Corporation) C:\Windows\system32\wificonnapi.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\dialserver.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00125440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx
2016-04-13 16:26 - 2016-04-13 16:26 - 00123392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ProximityCommon.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00122368 _____ (Microsoft Corporation) C:\Windows\system32\KnobsCsp.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00119320 _____ (Microsoft Corporation) C:\Windows\system32\MP3DMOD.DLL
2016-04-13 16:26 - 2016-04-13 16:26 - 00118624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2016-04-13 16:26 - 2016-04-13 16:26 - 00117248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\capimg.sys
2016-04-13 16:26 - 2016-04-13 16:26 - 00116728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00115200 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2016-04-13 16:26 - 2016-04-13 16:26 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\offlinelsa.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00110592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Microsoft-Windows-MapControls.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00110592 _____ (Microsoft Corporation) C:\Windows\system32\Microsoft-Windows-MapControls.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00110032 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00100864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\offlinelsa.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00100160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MP3DMOD.DLL
2016-04-13 16:26 - 2016-04-13 16:26 - 00095072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sdstor.sys
2016-04-13 16:26 - 2016-04-13 16:26 - 00092352 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\NFCProvisioningPlugin.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00088392 _____ (Microsoft Corporation) C:\Windows\system32\remoteaudioendpoint.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00080600 _____ (Microsoft Corporation) C:\Windows\system32\wwapi.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00078336 _____ (Microsoft Corporation) C:\Windows\system32\BarcodeProvisioningPlugin.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\ProvPluginEng.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\RMSRoamingSecurity.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Networking.XboxLive.ProxyStub.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00075264 _____ (Microsoft Corporation) C:\Windows\system32\wwanprotdim.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00075264 _____ (Microsoft Corporation) C:\Windows\system32\EditBufferTestHook.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\mssign32.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00073728 _____ (Microsoft Corporation) C:\Windows\system32\wwancfg.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00073360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\remoteaudioendpoint.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AppCapture.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\XblAuthManagerProxy.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MosHostClient.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\ihvrilproxy.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00063528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wwapi.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00060928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssign32.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00060928 _____ (Microsoft Corporation) C:\Windows\system32\XblAuthTokenBrokerExt.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00059904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\EditBufferTestHook.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00058368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MosResource.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00058368 _____ (Microsoft Corporation) C:\Windows\system32\MosResource.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00056320 _____ (Microsoft Corporation) C:\Windows\system32\provtool.exe
2016-04-13 16:26 - 2016-04-13 16:26 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rilproxy.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\tetheringclient.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\RemovableMediaProvisioningPlugin.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\Wwanpref.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00051680 _____ (Microsoft Corporation) C:\Windows\system32\SensorsUtilsV2.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00049152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XblAuthTokenBrokerExt.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MosHostClient.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\wsplib.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\usermgrcli.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\bcastdvr.proxy.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\mapstoasttask.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00041984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XblAuthManagerProxy.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\BackgroundTransferHost.exe
2016-04-13 16:26 - 2016-04-13 16:26 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAutomationCoreRes.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\UIAutomationCoreRes.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00035680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wimmount.sys
2016-04-13 16:26 - 2016-04-13 16:26 - 00035656 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2016-04-13 16:26 - 2016-04-13 16:26 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usermgrcli.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00034304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\BackgroundTransferHost.exe
2016-04-13 16:26 - 2016-04-13 16:26 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00032040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2016-04-13 16:26 - 2016-04-13 16:26 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\tetheringconfigsp.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\StorageUsage.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\WordBreakers.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Management.Provisioning.ProxyStub.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\nativemap.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00027136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcastdvr.proxy.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00026408 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2016-04-13 16:26 - 2016-04-13 16:26 - 00024064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WordBreakers.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wshrm.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\IcsEntitlementHost.exe
2016-04-13 16:26 - 2016-04-13 16:26 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\MapsBtSvcProxy.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Microsoft-Windows-MosTrace.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\Microsoft-Windows-MosTrace.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00009728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Microsoft-Windows-MosHost.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\Microsoft-Windows-MosHost.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\readingviewresources.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00003072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MapControlStringsRes.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00003072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\MapControlStringsRes.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2016-04-13 16:26 - 2016-04-13 16:26 - 00000000 ____D C:\Windows\SysWOW64\sda
2016-04-13 16:06 - 2016-03-07 17:26 - 38186736 _____ (Intel Corporation) C:\Windows\SysWOW64\igdumdim32.dll
2016-04-13 16:06 - 2016-03-07 17:26 - 32843120 _____ (Intel Corporation) C:\Windows\system32\igd11dxva64.dll
2016-04-13 16:06 - 2016-03-07 17:26 - 15188408 _____ (Intel Corporation) C:\Windows\system32\igc64.dll
2016-04-13 16:06 - 2016-03-07 17:26 - 14292832 _____ (Intel Corporation) C:\Windows\system32\igd10iumd64.dll
2016-04-13 16:06 - 2016-03-07 17:26 - 13221632 _____ (Intel Corporation) C:\Windows\SysWOW64\igc32.dll
2016-04-13 16:06 - 2016-03-07 17:26 - 11621512 _____ (Intel Corporation) C:\Windows\SysWOW64\igd10iumd32.dll
2016-04-13 16:06 - 2016-03-07 17:26 - 07895504 _____ (Intel Corporation) C:\Windows\system32\Drivers\igdkmd64.sys
2016-04-13 16:06 - 2016-03-07 17:26 - 02053120 _____ (Intel Corporation) C:\Windows\system32\igfxLHM.dll
2016-04-13 16:06 - 2016-03-07 17:26 - 00736256 _____ (Intel Corporation) C:\Windows\system32\igfxDH.dll
2016-04-13 16:06 - 2016-03-07 17:26 - 00384120 _____ C:\Windows\system32\igfxTray.exe
2016-04-13 16:06 - 2016-03-07 17:26 - 00370688 _____ (Intel Corporation) C:\Windows\system32\igfxDI.dll
2016-04-13 16:06 - 2016-03-07 17:26 - 00354936 _____ (Intel Corporation) C:\Windows\system32\igfxCUIService.exe
2016-04-13 16:06 - 2016-03-07 17:26 - 00335992 _____ (Intel Corporation) C:\Windows\system32\igfxEM.exe
2016-04-13 16:06 - 2016-03-07 17:26 - 00282744 _____ (Intel Corporation) C:\Windows\SysWOW64\IntelCpHeciSvc.exe
2016-04-13 16:06 - 2016-03-07 17:26 - 00250488 _____ (Intel Corporation) C:\Windows\system32\igfxHK.exe
2016-04-13 16:06 - 2016-03-07 17:26 - 00238080 _____ (Intel Corporation) C:\Windows\system32\igfxDTCM.dll
2016-04-13 16:06 - 2016-03-07 17:26 - 00218232 _____ (Intel Corporation) C:\Windows\system32\igfxext.exe
2016-04-13 16:06 - 2016-03-07 17:26 - 00036616 _____ (Intel Corporation) C:\Windows\system32\igfxexps.dll
2016-04-13 16:06 - 2015-12-03 09:12 - 02813952 _____ C:\Windows\system32\iglhxa64.cpa
2016-04-13 16:06 - 2015-12-03 09:12 - 01559552 _____ (Intel Corporation) C:\Windows\system32\igfxcmjit64.dll
2016-04-13 16:06 - 2015-12-03 09:12 - 01150464 _____ (Intel Corporation) C:\Windows\SysWOW64\igfxcmjit32.dll
2016-04-13 16:06 - 2015-12-03 09:12 - 00641530 _____ C:\Windows\system32\FilmModeDetection.wmv
2016-04-13 16:06 - 2015-12-03 09:12 - 00511260 _____ C:\Windows\system32\cp_resources.bin
2016-04-13 16:06 - 2015-12-03 09:12 - 00403671 _____ C:\Windows\system32\ImageStabilization.wmv
2016-04-13 16:06 - 2015-12-03 09:12 - 00188928 _____ (Intel Corporation) C:\Windows\system32\igfxCoIn_v4331.dll
2016-04-13 16:06 - 2015-12-03 09:12 - 00086528 _____ (Khronos Group) C:\Windows\SysWOW64\Intel_OpenCL_ICD32.dll
2016-04-13 16:06 - 2015-12-03 09:12 - 00082432 _____ (Khronos Group) C:\Windows\system32\Intel_OpenCL_ICD64.dll
2016-04-13 16:06 - 2015-12-03 09:12 - 00041296 _____ C:\Windows\system32\iglhxc64_dev.vp
2016-04-13 16:06 - 2015-12-03 09:12 - 00040931 _____ C:\Windows\system32\iglhxo64_dev.vp
2016-04-13 16:06 - 2015-12-03 09:12 - 00040343 _____ C:\Windows\system32\iglhxo64.vp
2016-04-13 16:06 - 2015-12-03 09:12 - 00040316 _____ C:\Windows\system32\iglhxc64.vp
2016-04-13 16:06 - 2015-12-03 09:12 - 00039798 _____ C:\Windows\system32\iglhxg64_dev.vp
2016-04-13 16:06 - 2015-12-03 09:12 - 00039658 _____ C:\Windows\system32\iglhxg64.vp
2016-04-13 16:06 - 2015-12-03 09:12 - 00001125 _____ C:\Windows\system32\iglhxa64.vp
2016-04-13 16:06 - 2015-12-03 09:12 - 00000935 _____ C:\Windows\system32\Gfxv4_0.exe.config
2016-04-13 16:06 - 2015-12-03 09:12 - 00000935 _____ C:\Windows\system32\DPTopologyApp.exe.config
2016-04-13 16:06 - 2015-12-03 09:12 - 00000895 _____ C:\Windows\system32\Gfxv2_0.exe.config
2016-04-13 16:06 - 2015-12-03 09:12 - 00000895 _____ C:\Windows\system32\DPTopologyAppv2_0.exe.config
2016-04-13 16:05 - 2015-12-03 09:11 - 29084160 _____ (Intel Corporation) C:\Windows\system32\common_clang64.dll
2016-04-13 16:05 - 2015-12-03 09:11 - 19844096 _____ (Intel Corporation) C:\Windows\SysWOW64\common_clang32.dll
2016-04-13 16:05 - 2015-12-03 09:11 - 00375173 _____ C:\Windows\system32\ColorImageEnhancement.wmv
2016-04-13 16:05 - 2015-09-21 12:55 - 00054272 _____ (Intel Corporation) C:\Windows\system32\Drivers\HidEventFilter.sys
2016-04-13 16:04 - 2015-07-24 17:30 - 01455552 _____ (Intel Corporation) C:\Windows\system32\Drivers\iaStorA.sys
2016-04-13 16:03 - 2015-06-24 14:07 - 09890008 _____ (Realtek Semiconductor Corp.) C:\Windows\SysWOW64\RsCRIcon.dll
2016-04-13 16:03 - 2015-06-24 14:07 - 00752856 _____ (Realsil Semiconductor Corporation) C:\Windows\system32\Drivers\RtsPer.sys
2016-04-13 16:03 - 2015-06-24 14:07 - 00402136 _____ (Realsil Semiconductor Corporation) C:\Windows\system32\Drivers\RtsUer.sys
2016-04-13 16:03 - 2015-06-24 14:07 - 00083160 _____ (Realtek Semiconductor.) C:\Windows\system32\RtCRX64.dll
2016-04-13 15:59 - 2016-04-21 13:06 - 00000000 ____D C:\ProgramData\Dell
2016-04-13 15:59 - 2016-04-13 15:59 - 00003589 _____ C:\Windows\SysWOW64\Drivers\1028_Dell_XPS_9550.mrk
2016-04-13 15:59 - 2016-04-13 15:59 - 00003589 _____ C:\Windows\system32\Drivers\1028_Dell_XPS_9550.mrk
2016-04-13 15:57 - 2016-04-13 16:02 - 00015243 _____ C:\Windows\diagwrn.xml
2016-04-13 15:57 - 2016-04-13 16:02 - 00015243 _____ C:\Windows\diagerr.xml
2016-04-13 15:52 - 2016-04-13 15:52 - 00000000 ____D C:\ProgramData\Microsoft OneDrive
2016-04-13 15:50 - 2016-04-13 15:50 - 00000012 _____ C:\Windows\csup.txt
2016-04-13 15:48 - 2016-04-13 17:07 - 00000000 ____D C:\Windows\Panther
2016-04-13 15:48 - 2016-04-13 15:48 - 00003589 _____ C:\Windows\system32\oemDELL.sdr
2016-04-13 15:48 - 2015-10-30 00:19 - 00031816 _____ C:\Windows\Core.xml
2016-04-13 15:45 - 2016-04-21 11:34 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2016-04-13 15:45 - 2016-04-13 15:45 - 00002495 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Word 2016.lnk
2016-04-13 15:45 - 2016-04-13 15:45 - 00002494 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerPoint 2016.lnk
2016-04-13 15:45 - 2016-04-13 15:45 - 00002458 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access 2016.lnk
2016-04-13 15:45 - 2016-04-13 15:45 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel 2016.lnk
2016-04-13 15:45 - 2016-04-13 15:45 - 00002451 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook 2016.lnk
2016-04-13 15:45 - 2016-04-13 15:45 - 00002445 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Publisher 2016.lnk
2016-04-13 15:45 - 2016-04-13 15:45 - 00002437 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneNote 2016.lnk
2016-04-13 15:45 - 2016-04-13 15:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2016 Tools
2016-04-13 15:45 - 2016-04-13 15:45 - 00000000 ____D C:\Program Files\Microsoft Office 15
2016-04-13 15:43 - 2016-04-21 22:21 - 00000000 ___RD C:\Users\Public\AccountPictures
2016-04-13 15:43 - 2016-04-21 13:44 - 00019710 _____ C:\Windows\system32\results.xml
2016-04-13 15:42 - 2016-04-22 11:17 - 00003122 _____ C:\Windows\System32\Tasks\McAfeeLogon
2016-04-13 15:42 - 2016-04-22 11:17 - 00000000 ____D C:\Windows\System32\Tasks\McAfee
2016-04-13 15:42 - 2016-01-29 07:01 - 00847608 _____ (McAfee, Inc.) C:\Windows\system32\Drivers\mfehidk.sys
2016-04-13 15:42 - 2016-01-29 07:01 - 00496368 _____ (McAfee, Inc.) C:\Windows\system32\Drivers\mfefirek.sys
2016-04-13 15:42 - 2016-01-29 07:01 - 00422184 _____ (McAfee, Inc.) C:\Windows\system32\Drivers\mfeaack.sys
2016-04-13 15:42 - 2016-01-29 07:01 - 00351656 _____ (McAfee, Inc.) C:\Windows\system32\Drivers\mfeavfk.sys
2016-04-13 15:42 - 2016-01-29 07:01 - 00245096 _____ (McAfee, Inc.) C:\Windows\system32\Drivers\mfewfpk.sys
2016-04-13 15:42 - 2016-01-29 07:01 - 00083608 _____ (McAfee, Inc.) C:\Windows\system32\Drivers\mfeelamk.sys
2016-04-13 15:42 - 2016-01-29 07:01 - 00079248 _____ (McAfee, Inc.) C:\Windows\system32\Drivers\cfwids.sys
2016-04-13 15:42 - 2016-01-25 16:29 - 00279488 _____ (McAfee, Inc.) C:\Windows\system32\mfevtps.exe
2016-04-13 15:41 - 2016-04-23 12:46 - 00000934 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job
2016-04-13 15:41 - 2016-04-23 09:10 - 00000930 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job
2016-04-13 15:41 - 2016-04-22 12:00 - 00000000 ____D C:\Program Files (x86)\McAfee
2016-04-13 15:41 - 2016-04-22 11:19 - 00000000 ____D C:\ProgramData\McAfee
2016-04-13 15:41 - 2016-04-22 11:18 - 00000000 ____D C:\Program Files\Common Files\McAfee
2016-04-13 15:41 - 2016-04-21 11:01 - 00000000 ____D C:\Program Files\mcafee
2016-04-13 15:41 - 2016-04-20 22:49 - 00003448 _____ C:\Windows\System32\Tasks\DropboxUpdateTaskMachineUA
2016-04-13 15:41 - 2016-04-20 22:48 - 00003224 _____ C:\Windows\System32\Tasks\DropboxUpdateTaskMachineCore
2016-04-13 15:41 - 2016-04-20 20:51 - 00003186 _____ C:\Windows\System32\Tasks\DropboxOEM
2016-04-13 15:41 - 2016-04-20 20:51 - 00000000 ____D C:\Program Files (x86)\Dropbox
2016-04-13 15:41 - 2016-04-13 15:41 - 00000000 ____D C:\ProgramData\NVIDIA
2016-04-13 15:41 - 2016-04-13 15:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2016-04-13 15:41 - 2016-04-13 15:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell PremierColor
2016-04-13 15:41 - 2016-04-13 15:41 - 00000000 ____D C:\ProgramData\Dropbox
2016-04-13 15:41 - 2016-04-13 15:41 - 00000000 ____D C:\Program Files\Portrait Displays
2016-04-13 15:41 - 2016-04-13 15:41 - 00000000 ____D C:\Program Files\mcafee.com
2016-04-13 15:41 - 2016-04-13 15:41 - 00000000 ____D C:\Program Files\Common Files\AV
2016-04-13 15:41 - 2016-04-13 15:41 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2016-04-13 15:41 - 2016-04-13 15:41 - 00000000 ____D C:\Program Files (x86)\mcafee.com
2016-04-13 15:41 - 2016-04-13 15:41 - 00000000 ____D C:\Program Files (x86)\Dell Update
2016-04-13 15:41 - 2016-04-13 15:41 - 00000000 ____D C:\Program Files (x86)\Dell Digital Delivery
2016-04-13 15:41 - 2016-04-13 15:41 - 00000000 ____D C:\Program Files (x86)\Dell Customer Connect
2016-04-13 15:41 - 2015-11-09 01:08 - 06358832 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2016-04-13 15:41 - 2015-11-09 01:08 - 02983032 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2016-04-13 15:41 - 2015-11-09 01:08 - 02554488 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2016-04-13 15:41 - 2015-11-09 01:08 - 00938800 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2016-04-13 15:41 - 2015-11-09 01:08 - 00523384 _____ (NVIDIA Corporation) C:\Windows\system32\nv3dappshext.dll
2016-04-13 15:41 - 2015-11-09 01:08 - 00385328 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2016-04-13 15:41 - 2015-11-09 01:08 - 00075056 _____ (NVIDIA Corporation) C:\Windows\system32\nv3dappshextr.dll
2016-04-13 15:41 - 2015-11-09 01:08 - 00062768 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2016-04-13 15:41 - 2015-10-28 00:39 - 06027430 _____ C:\Windows\system32\nvcoproc.bin
2016-04-13 15:41 - 2015-10-12 13:05 - 01423304 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2016-04-13 15:41 - 2015-10-12 13:05 - 01316000 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2016-04-13 15:41 - 2015-10-12 13:04 - 01756424 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2016-04-13 15:41 - 2015-10-12 13:04 - 01710752 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2016-04-13 15:41 - 2010-05-26 11:41 - 02401112 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_43.dll
2016-04-13 15:41 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_43.dll
2016-04-13 15:41 - 2010-05-26 11:41 - 00511328 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_43.dll
2016-04-13 15:41 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_43.dll
2016-04-13 15:41 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll
2016-04-13 15:41 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll
2016-04-13 15:40 - 2016-04-13 15:41 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2016-04-13 15:40 - 2016-04-13 15:41 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2016-04-13 15:40 - 2016-03-03 11:11 - 04158512 _____ (Broadcom Corporation) C:\Windows\system32\bcmihvsrv64.dll
2016-04-13 15:40 - 2016-03-03 11:11 - 03786800 _____ (Broadcom Corporation) C:\Windows\system32\bcmihvui64.dll
2016-04-13 15:40 - 2016-03-03 11:11 - 01063736 _____ (Broadcom Corp) C:\Windows\system32\Drivers\bcmpciedhd63.sys
2016-04-13 15:40 - 2016-03-03 11:11 - 00641596 _____ C:\Windows\system32\Drivers\43602r1rtecdc.bin
2016-04-13 15:40 - 2015-11-14 04:24 - 11226256 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2016-04-13 15:40 - 2015-11-09 21:37 - 42913912 _____ C:\Windows\system32\nvcompiler.dll
2016-04-13 15:40 - 2015-11-09 21:37 - 37881976 _____ C:\Windows\SysWOW64\nvcompiler.dll
2016-04-13 15:40 - 2015-11-09 21:37 - 22344496 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2016-04-13 15:40 - 2015-11-09 21:37 - 18487360 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2016-04-13 15:40 - 2015-11-09 21:37 - 18388784 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2016-04-13 15:40 - 2015-11-09 21:37 - 16561320 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2016-04-13 15:40 - 2015-11-09 21:37 - 15933912 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2016-04-13 15:40 - 2015-11-09 21:37 - 15839200 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2016-04-13 15:40 - 2015-11-09 21:37 - 14844112 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2016-04-13 15:40 - 2015-11-09 21:37 - 13533416 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2016-04-13 15:40 - 2015-11-09 21:37 - 12870192 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2016-04-13 15:40 - 2015-11-09 21:37 - 12040952 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2016-04-13 15:40 - 2015-11-09 21:37 - 03540360 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2016-04-13 15:40 - 2015-11-09 21:37 - 03126984 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2016-04-13 15:40 - 2015-11-09 21:37 - 02876720 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2016-04-13 15:40 - 2015-11-09 21:37 - 02496632 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2016-04-13 15:40 - 2015-11-09 21:37 - 01905272 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6435894.dll
2016-04-13 15:40 - 2015-11-09 21:37 - 01564976 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6435894.dll
2016-04-13 15:40 - 2015-11-09 21:37 - 01016360 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncMFTH264.dll
2016-04-13 15:40 - 2015-11-09 21:37 - 00877872 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2016-04-13 15:40 - 2015-11-09 21:37 - 00861816 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2016-04-13 15:40 - 2015-11-09 21:37 - 00823416 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncMFTH264.dll
2016-04-13 15:40 - 2015-11-09 21:37 - 00689784 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2016-04-13 15:40 - 2015-11-09 21:37 - 00674096 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2016-04-13 15:40 - 2015-11-09 21:37 - 00501056 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
2016-04-13 15:40 - 2015-11-09 21:37 - 00422568 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
2016-04-13 15:40 - 2015-11-09 21:37 - 00414000 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll
2016-04-13 15:40 - 2015-11-09 21:37 - 00369272 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll
2016-04-13 15:40 - 2015-11-09 21:37 - 00177416 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2016-04-13 15:40 - 2015-11-09 21:37 - 00155792 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2016-04-13 15:40 - 2015-11-09 21:37 - 00034493 _____ C:\Windows\system32\nvinfo.pb
2016-04-13 15:40 - 2015-08-11 14:52 - 00072504 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll
2016-04-13 15:40 - 2015-08-11 14:52 - 00069416 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2016-04-13 15:40 - 2015-08-11 14:52 - 00050472 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2016-04-13 15:39 - 2016-04-21 13:09 - 00000652 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel® HD Graphics Control Panel.lnk
2016-04-13 15:39 - 2016-04-20 20:52 - 00000000 ____D C:\ProgramData\PCDr
2016-04-13 15:39 - 2016-04-13 15:44 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell
2016-04-13 15:39 - 2016-04-13 15:44 - 00000000 ____D C:\Program Files\Dell
2016-04-13 15:39 - 2016-04-13 15:39 - 02288384 _____ (Broadcom Corporation.) C:\Windows\system32\BtwRSupportService.exe
2016-04-13 15:39 - 2016-04-13 15:39 - 00239392 _____ (Broadcom Corporation.) C:\Windows\system32\Drivers\btwavdt.sys
2016-04-13 15:39 - 2016-04-13 15:39 - 00226080 _____ (Broadcom Corporation.) C:\Windows\system32\Drivers\btwampfl.sys
2016-04-13 15:39 - 2016-04-13 15:39 - 00220448 _____ (Broadcom Corporation.) C:\Windows\system32\Drivers\btwaudio.sys
2016-04-13 15:39 - 2016-04-13 15:39 - 00208192 _____ (Broadcom Corporation.) C:\Windows\system32\Drivers\bcbtums.sys
2016-04-13 15:39 - 2016-04-13 15:39 - 00109080 _____ C:\Windows\system32\Drivers\BCM20703A1_001.001.005.0214.0422.hex
2016-04-13 15:39 - 2016-04-13 15:39 - 00104184 _____ (Broadcom Corporation.) C:\Windows\system32\btwdi.dll
2016-04-13 15:39 - 2016-04-13 15:39 - 00048984 _____ (Broadcom Corporation.) C:\Windows\system32\Drivers\btwl2cap.sys
2016-04-13 15:39 - 2016-04-13 15:39 - 00047392 _____ (Broadcom Corporation.) C:\Windows\system32\Drivers\btwrchid.sys
2016-04-13 15:39 - 2016-04-13 15:39 - 00000000 ____D C:\ProgramData\PC-Doctor for Windows
2016-04-13 15:39 - 2016-04-13 15:39 - 00000000 ____D C:\Program Files\WIDCOMM
2016-04-13 15:39 - 2016-04-13 15:39 - 00000000 ____D C:\Program Files\Dell Support Center
2016-04-13 15:39 - 2015-12-03 09:12 - 00086528 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.DLL
2016-04-13 15:39 - 2015-12-03 09:12 - 00082432 _____ (Khronos Group) C:\Windows\system32\OpenCL.DLL
2016-04-13 15:38 - 2016-04-13 15:38 - 00000000 ____D C:\Windows\System32\Tasks\Intel
2016-04-13 15:38 - 2016-04-13 15:38 - 00000000 ____D C:\Program Files (x86)\ST Microelectronics
2016-04-13 15:37 - 2016-04-23 09:17 - 00881036 _____ C:\Windows\system32\PerfStringBackup.INI
2016-04-13 15:37 - 2016-04-22 13:14 - 00000000 ____D C:\ProgramData\Package Cache
2016-04-13 15:37 - 2016-04-21 13:06 - 00000000 ____D C:\Program Files (x86)\InstallShield Installation Information
2016-04-13 15:37 - 2016-04-20 22:48 - 00002304 _____ C:\Windows\System32\Tasks\RtHDVBg_PushButton
2016-04-13 15:37 - 2016-04-13 15:39 - 00000000 ____D C:\ProgramData\Intel
2016-04-13 15:37 - 2016-04-13 15:39 - 00000000 ____D C:\Program Files\Intel
2016-04-13 15:37 - 2016-04-13 15:39 - 00000000 ____D C:\Program Files (x86)\Intel
2016-04-13 15:37 - 2016-04-13 15:39 - 00000000 ____D C:\Intel
2016-04-13 15:37 - 2016-04-13 15:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Thunderbolt™ Software
2016-04-13 15:37 - 2016-04-13 15:37 - 00879220 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2016-04-13 15:37 - 2016-04-13 15:37 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel
2016-04-13 15:37 - 2016-04-13 15:37 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_esif_umdf2_02_00_00.Wdf
2016-04-13 15:37 - 2016-04-13 15:37 - 00000000 ____D C:\Windows\SysWOW64\RTCOM
2016-04-13 15:37 - 2016-04-13 15:37 - 00000000 ____D C:\Windows\system32\SRSLabs
2016-04-13 15:37 - 2016-04-13 15:37 - 00000000 ____D C:\ProgramData\USOShared
2016-04-13 15:37 - 2016-04-13 15:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell Audio
2016-04-13 15:37 - 2016-04-13 15:37 - 00000000 ____D C:\Program Files\Waves
2016-04-13 15:37 - 2016-04-13 15:37 - 00000000 ____D C:\Program Files\Realtek
2016-04-13 15:37 - 2016-04-13 15:37 - 00000000 ____D C:\Program Files (x86)\Realtek
2016-04-13 15:37 - 2016-04-13 15:37 - 00000000 _____ C:\ProgramData\DP45977C.lfl
2016-04-13 15:37 - 2015-10-30 04:32 - 01804688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdfCoInstaller01011.dll
2016-04-13 15:37 - 2015-10-30 04:32 - 01392792 _____ (Intel Corporation) C:\Windows\SysWOW64\esif_uf.exe
2016-04-13 15:37 - 2015-10-30 04:32 - 00971944 _____ (Microsoft Corporation) C:\Windows\system32\msvcr120.dll
2016-04-13 15:37 - 2015-10-30 04:32 - 00668840 _____ (Microsoft Corporation) C:\Windows\system32\msvcp120.dll
2016-04-13 15:37 - 2015-10-30 04:32 - 00260072 _____ (Intel Corporation) C:\Windows\system32\Drivers\esif_lf.sys
2016-04-13 15:37 - 2015-10-30 04:31 - 00055784 _____ (Intel Corporation) C:\Windows\system32\Drivers\dptf_acpi.sys
2016-04-13 15:37 - 2015-10-30 04:31 - 00052200 _____ (Intel Corporation) C:\Windows\system32\Drivers\dptf_cpu.sys
2016-04-13 15:37 - 2015-10-30 00:17 - 02718208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PrintConfig.dll
2016-04-13 15:37 - 2015-10-06 15:52 - 00532384 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSX64.dll
2016-04-13 15:37 - 2015-10-06 15:52 - 00221976 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSH64.dll
2016-04-13 15:37 - 2015-10-06 15:52 - 00209544 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSHP64.dll
2016-04-13 15:37 - 2015-10-06 15:52 - 00166208 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSWOW64.dll
2016-04-13 15:37 - 2015-10-06 15:51 - 03271912 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkApi64.dll
2016-04-13 15:37 - 2015-10-06 15:51 - 00343712 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtlCPAPI64.dll
2016-04-13 15:37 - 2015-10-06 15:51 - 00195192 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCfg64.dll
2016-04-13 15:37 - 2015-10-06 15:51 - 00164432 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkXInterface64.dll
2016-04-13 15:37 - 2015-10-06 15:50 - 02958904 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RltkAPO64.dll
2016-04-13 15:37 - 2015-10-06 15:50 - 01352000 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTCOM64.dll
2016-04-13 15:37 - 2015-10-06 15:50 - 00689888 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtDataProc64.dll
2016-04-13 15:37 - 2015-10-06 15:50 - 00447720 _____ (Dolby Laboratories) C:\Windows\system32\R4EED64A.dll
2016-04-13 15:37 - 2015-10-06 15:50 - 00410032 _____ (Creative Technology Ltd.) C:\Windows\system32\MBWrp64.dll
2016-04-13 15:37 - 2015-10-06 15:50 - 00387320 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEP64A.dll
2016-04-13 15:37 - 2015-10-06 15:50 - 00321720 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DHT64.dll
2016-04-13 15:37 - 2015-10-06 15:50 - 00321720 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DAA64.dll
2016-04-13 15:37 - 2015-10-06 15:50 - 00214840 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEED64A.dll
2016-04-13 15:37 - 2015-10-06 15:50 - 00151792 _____ (Dolby Laboratories) C:\Windows\system32\R4EEL64A.dll
2016-04-13 15:37 - 2015-10-06 15:50 - 00134200 _____ (Dolby Laboratories) C:\Windows\system32\R4EEA64A.dll
2016-04-13 15:37 - 2015-10-06 15:50 - 00110992 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEL64A.dll
2016-04-13 15:37 - 2015-10-06 15:50 - 00088352 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEG64A.dll
2016-04-13 15:37 - 2015-10-06 15:50 - 00084624 _____ (Dolby Laboratories) C:\Windows\system32\R4EEG64A.dll
2016-04-13 15:37 - 2015-10-06 15:49 - 13120760 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVoiceAPO3064.dll
2016-04-13 15:37 - 2015-10-06 15:49 - 12986528 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVoiceAPO4064.dll
2016-04-13 15:37 - 2015-10-06 15:49 - 12014440 _____ (Waves Audio Ltd.) C:\Windows\SysWOW64\MaxxVoiceAPO30.dll
2016-04-13 15:37 - 2015-10-06 15:49 - 01976560 _____ (Creative Technology Ltd.) C:\Windows\system32\MBAPO264.dll
2016-04-13 15:37 - 2015-10-06 15:49 - 01743080 _____ (Creative Technology Ltd.) C:\Windows\SysWOW64\MBAPO232.dll
2016-04-13 15:37 - 2015-10-06 15:49 - 00914024 _____ (Creative Technology Ltd.) C:\Windows\system32\MBAPO64.dll
2016-04-13 15:37 - 2015-10-06 15:49 - 00768824 _____ (Creative Technology Ltd.) C:\Windows\SysWOW64\MBAPO32.dll
2016-04-13 15:37 - 2015-10-06 15:49 - 00677680 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVolumeSDAPO.dll
2016-04-13 15:37 - 2015-10-06 15:49 - 00642928 _____ (Creative Technology Ltd.) C:\Windows\system32\MBTHX64.dll
2016-04-13 15:37 - 2015-10-06 15:49 - 00577840 _____ (Creative Technology Ltd.) C:\Windows\SysWOW64\MBTHX32.dll
2016-04-13 15:37 - 2015-10-06 15:49 - 00074608 _____ (Creative Technology Ltd.) C:\Windows\system32\MBppld64.dll
2016-04-13 15:37 - 2015-10-06 15:49 - 00069928 _____ (Creative Technology Ltd.) C:\Windows\system32\MBPPCn64.dll
2016-04-13 15:37 - 2015-10-06 15:48 - 03278416 _____ (Fortemedia Corporation) C:\Windows\system32\FMAPO64.dll
2016-04-13 15:37 - 2015-10-06 15:48 - 02823280 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO7064.dll
2016-04-13 15:37 - 2015-10-06 15:48 - 01395768 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO6064.dll
2016-04-13 15:37 - 2015-10-06 15:48 - 01211840 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO5064.dll
2016-04-13 15:37 - 2015-10-06 15:48 - 01164336 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO4064.dll
2016-04-13 15:37 - 2015-10-06 15:48 - 00998032 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVoiceAPO2064.dll
2016-04-13 15:37 - 2015-10-06 15:48 - 00678192 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO30.dll
2016-04-13 15:37 - 2015-10-06 15:48 - 00330568 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO20.dll
2016-04-13 15:37 - 2015-10-06 15:47 - 01780624 _____ (DTS) C:\Windows\system32\DTSS2SpeakerDLL64.dll
2016-04-13 15:37 - 2015-10-06 15:47 - 01591064 _____ (DTS) C:\Windows\system32\DTSS2HeadphoneDLL64.dll
2016-04-13 15:37 - 2015-10-06 15:47 - 01508936 _____ (DTS) C:\Windows\system32\DTSBoostDLL64.dll
2016-04-13 15:37 - 2015-10-06 15:47 - 00743968 _____ (DTS) C:\Windows\system32\DTSBassEnhancementDLL64.dll
2016-04-13 15:37 - 2015-10-06 15:47 - 00727440 _____ (DTS) C:\Windows\system32\DTSSymmetryDLL64.dll
2016-04-13 15:37 - 2015-10-06 15:47 - 00708320 _____ (DTS) C:\Windows\system32\DTSVoiceClarityDLL64.dll
2016-04-13 15:37 - 2015-10-06 15:47 - 00504312 _____ (DTS) C:\Windows\system32\DTSNeoPCDLL64.dll
2016-04-13 15:37 - 2015-10-06 15:47 - 00445408 _____ (DTS) C:\Windows\system32\DTSLimiterDLL64.dll
2016-04-13 15:37 - 2015-10-06 15:47 - 00441272 _____ (DTS) C:\Windows\system32\DTSGainCompensatorDLL64.dll
2016-04-13 15:37 - 2015-10-06 15:47 - 00327456 _____ (Dolby Laboratories) C:\Windows\system32\DDPO64A.dll
2016-04-13 15:37 - 2015-10-06 15:47 - 00253904 _____ (DTS) C:\Windows\system32\DTSGFXAPO64.dll
2016-04-13 15:37 - 2015-10-06 15:47 - 00253872 _____ (DTS) C:\Windows\system32\DTSLFXAPO64.dll
2016-04-13 15:37 - 2015-10-06 15:47 - 00252880 _____ (DTS) C:\Windows\system32\DTSGFXAPONS64.dll
2016-04-13 15:37 - 2015-10-06 15:46 - 01965816 _____ (Dolby Laboratories) C:\Windows\system32\DDPD64A.dll
2016-04-13 15:37 - 2015-10-06 15:46 - 00574760 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAC64.dll
2016-04-13 15:37 - 2015-10-06 15:46 - 00272720 _____ (Dolby Laboratories) C:\Windows\system32\DDPA64.dll
2016-04-13 15:37 - 2015-10-06 15:46 - 00118600 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAR64.dll
2016-04-13 15:37 - 2015-10-06 15:41 - 72203792 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCORES64.dat
2016-04-13 15:37 - 2015-10-06 15:41 - 04613888 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RTKVHD64.sys
2016-04-13 15:37 - 2015-10-06 15:41 - 02893568 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTSnMg64.cpl
2016-04-13 15:37 - 2015-10-06 15:41 - 00023704 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCoLDR64.dll
2016-04-13 15:37 - 2015-10-06 15:40 - 07172920 _____ (Dolby Laboratories) C:\Windows\system32\R4EEP64A.dll
2016-04-13 15:37 - 2015-10-06 15:40 - 02028672 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoInstII64.dll
2016-04-13 15:37 - 2015-10-06 15:39 - 03700360 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioMeters64.exe
2016-04-13 15:37 - 2015-10-06 15:39 - 02050184 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioEQ64.dll
2016-04-13 15:37 - 2015-10-06 15:39 - 00203560 _____ (Waves Audio) C:\Windows\system32\MaxxAudioVienna264.dll
2016-04-13 15:37 - 2015-10-06 15:38 - 07096192 _____ (Dolby Laboratories) C:\Windows\system32\DDPP64A.dll
2016-04-13 15:37 - 2015-10-06 15:38 - 00122328 _____ (Real Sound Lab SIA) C:\Windows\system32\CONEQMSAPOGUILibrary.dll
2016-04-13 15:37 - 2015-10-06 15:31 - 02997504 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtPgEx64.dll
2016-04-13 15:37 - 2015-10-06 13:24 - 05804772 _____ C:\Windows\system32\Drivers\rtvienna.dat
2016-04-13 15:37 - 2015-10-06 13:24 - 03951402 _____ C:\Windows\system32\Drivers\RTAIODAT.DAT
2016-04-13 15:36 - 2016-04-21 13:06 - 00001536 _____ C:\Windows\SysWOW64\RtkMsgs.dll
2016-04-13 15:36 - 2016-04-13 15:37 - 00000000 ____D C:\Program Files (x86)\Temp
2016-04-13 15:36 - 2016-04-13 15:36 - 00000000 ____D C:\Program Files (x86)\ASM104xUSB3
2016-04-13 15:36 - 2015-06-08 02:13 - 02825944 _____ (Realtek Semiconductor Corp.) C:\Windows\RtlExUpd.dll
2016-04-13 15:35 - 2016-04-23 09:09 - 00000006 _____ C:\Windows\Tasks\SA.DAT
2016-04-13 15:32 - 2016-04-21 16:32 - 04957528 _____ C:\Windows\system32\FNTCACHE.DAT
 

 



#8 cloudsoda

cloudsoda
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:12:30 PM

Posted 23 April 2016 - 11:35 PM

==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2016-04-23 09:21 - 2015-10-30 00:24 - 00000000 ____D C:\Windows\AppReadiness
2016-04-23 09:17 - 2015-10-30 00:21 - 00000000 ____D C:\Windows\INF
2016-04-23 09:09 - 2015-10-29 23:28 - 00262144 ___SH C:\Windows\system32\config\BBI
2016-04-22 12:10 - 2015-10-30 00:24 - 00000000 ___HD C:\Program Files\WindowsApps
2016-04-22 11:18 - 2015-10-30 00:24 - 00000000 ____D C:\Windows\ELAMBKUP
2016-04-21 15:28 - 2015-10-30 00:24 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2016-04-21 15:01 - 2015-10-30 00:18 - 63591424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imageres.dll
2016-04-21 15:01 - 2015-10-30 00:18 - 63591424 _____ (Microsoft Corporation) C:\Windows\system32\imageres.dll
2016-04-21 14:58 - 2015-10-30 00:24 - 00000000 ____D C:\Windows\Cursors
2016-04-21 12:01 - 2015-10-30 00:24 - 00000000 ___SD C:\Windows\system32\F12
2016-04-21 12:01 - 2015-10-30 00:24 - 00000000 ___RD C:\Windows\PurchaseDialog
2016-04-21 12:01 - 2015-10-30 00:24 - 00000000 ____D C:\Windows\system32\WinBioPlugIns
2016-04-21 12:01 - 2015-10-30 00:24 - 00000000 ____D C:\Windows\system32\SystemResetPlatform
2016-04-21 12:01 - 2015-10-30 00:24 - 00000000 ____D C:\Windows\system32\oobe
2016-04-21 12:01 - 2015-10-30 00:24 - 00000000 ____D C:\Windows\system32\appraiser
2016-04-21 12:01 - 2015-10-30 00:24 - 00000000 ____D C:\Windows\PolicyDefinitions
2016-04-21 12:01 - 2015-10-29 23:28 - 00000000 ____D C:\Windows\SysWOW64\Dism
2016-04-21 12:01 - 2015-10-29 23:28 - 00000000 ____D C:\Windows\system32\Dism
2016-04-21 12:00 - 2015-10-30 02:05 - 00000000 ____D C:\Program Files\Windows Journal
2016-04-21 12:00 - 2015-10-30 00:24 - 00000000 __RSD C:\Windows\Media
2016-04-21 12:00 - 2015-10-30 00:24 - 00000000 ___RD C:\Windows\ImmersiveControlPanel
2016-04-21 12:00 - 2015-10-30 00:24 - 00000000 ____D C:\Windows\bcastdvr
2016-04-21 12:00 - 2015-10-30 00:24 - 00000000 ____D C:\Program Files\Windows Portable Devices
2016-04-21 12:00 - 2015-10-30 00:24 - 00000000 ____D C:\Program Files\Windows Multimedia Platform
2016-04-21 12:00 - 2015-10-30 00:24 - 00000000 ____D C:\Program Files (x86)\Windows Portable Devices
2016-04-21 12:00 - 2015-10-30 00:24 - 00000000 ____D C:\Program Files (x86)\Windows Multimedia Platform
2016-04-21 11:37 - 2015-10-30 00:11 - 00000000 ____D C:\Windows\CbsTemp
2016-04-21 11:35 - 2015-10-30 00:24 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2016-04-20 21:10 - 2015-10-30 00:24 - 00000000 ___RD C:\Windows\DevicesFlow
2016-04-20 20:58 - 2015-10-29 23:28 - 00032768 ___SH C:\Windows\system32\config\ELAM
2016-04-20 20:53 - 2015-10-30 00:24 - 00000000 ___RD C:\Windows\PrintDialog
2016-04-20 20:53 - 2015-10-30 00:24 - 00000000 ___RD C:\Windows\MiracastView
2016-04-20 20:52 - 2015-10-30 00:24 - 00000000 ____D C:\Windows\system32\WinBioDatabase
2016-04-13 17:20 - 2015-11-03 12:03 - 00000000 ____D C:\Dell
2016-04-13 16:26 - 2015-10-30 00:24 - 00000000 ____D C:\Windows\Provisioning
2016-04-13 16:04 - 2015-10-29 23:28 - 00000000 ____D C:\Windows\system32\Sysprep
2016-04-13 15:57 - 2015-10-30 00:24 - 00000000 ____D C:\Windows\Registration
2016-04-13 15:48 - 2015-10-30 00:26 - 00000000 ____D C:\Windows\Setup
2016-04-13 15:48 - 2015-10-30 00:24 - 00028672 _____ C:\Windows\system32\config\BCD-Template
2016-04-13 15:41 - 2015-10-30 00:24 - 00000000 ____D C:\Windows\Help
2016-04-13 15:37 - 2015-10-30 00:24 - 00000000 ____D C:\Windows\system32\spool
2016-04-13 15:37 - 2015-10-30 00:24 - 00000000 ____D C:\Windows\system32\FxsTmp
2016-04-13 15:37 - 2015-10-30 00:24 - 00000000 ____D C:\ProgramData\USOPrivate
2016-04-13 15:32 - 2015-10-30 02:11 - 00000000 ____D C:\Windows\ServiceProfiles
2016-04-06 11:32 - 2015-10-30 00:26 - 00829944 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-04-06 11:32 - 2015-10-30 00:26 - 00176632 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
 
==================== Files in the root of some directories =======
 
2016-04-13 15:37 - 2016-04-13 15:37 - 0000000 _____ () C:\ProgramData\DP45977C.lfl
 
Some files in TEMP:
====================
C:\Users\aroco\AppData\Local\Temp\100.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1003.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1004.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1005.tmp.exe
C:\Users\aroco\AppData\Local\Temp\100F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1010.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1015.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1016.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1017.tmp.exe
C:\Users\aroco\AppData\Local\Temp\102.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1020.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1025.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1026.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1027.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1028.tmp.exe
C:\Users\aroco\AppData\Local\Temp\103.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1031.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1032.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1033.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1034.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1037.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1039.tmp.exe
C:\Users\aroco\AppData\Local\Temp\103A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1047.tmp.exe
C:\Users\aroco\AppData\Local\Temp\104B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\104C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1054.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1058.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1059.tmp.exe
C:\Users\aroco\AppData\Local\Temp\105C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\105D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1065.tmp.exe
C:\Users\aroco\AppData\Local\Temp\106E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\106F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1075.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1076.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1079.tmp.exe
C:\Users\aroco\AppData\Local\Temp\107A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\107F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\108.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1087.tmp.exe
C:\Users\aroco\AppData\Local\Temp\108B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\109.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1090.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1098.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1099.tmp.exe
C:\Users\aroco\AppData\Local\Temp\109C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\109D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10A1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10A2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10A9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10AA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10AD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10B2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10B3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10BB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10BE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10C4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10CC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10CD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10CE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10CF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10D5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10D6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10DD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10DE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10E0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10E6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10E7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10EF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10F0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10F1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10F2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10F8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10F9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1100.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1101.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1102.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1109.tmp.exe
C:\Users\aroco\AppData\Local\Temp\110A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\111.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1112.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1113.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1114.tmp.exe
C:\Users\aroco\AppData\Local\Temp\111B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\111C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\112.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1123.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1124.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1125.tmp.exe
C:\Users\aroco\AppData\Local\Temp\112D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1134.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1135.tmp.exe
C:\Users\aroco\AppData\Local\Temp\113D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\113E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\114.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1146.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1147.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1148.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1149.tmp.exe
C:\Users\aroco\AppData\Local\Temp\114A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\114F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\115.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1157.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1158.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1160.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1161.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1169.tmp.exe
C:\Users\aroco\AppData\Local\Temp\116A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\116B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1171.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1172.tmp.exe
C:\Users\aroco\AppData\Local\Temp\117A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\117B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\117C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\117D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1183.tmp.exe
C:\Users\aroco\AppData\Local\Temp\118B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\118D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\119.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1193.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1194.tmp.exe
C:\Users\aroco\AppData\Local\Temp\119C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\119E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\119F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11A5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11AD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11B0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11B1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11B6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11B7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11BD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11C1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11C2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11C7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11C8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11CE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11D3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11D4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11DE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11E5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11E6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11E9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11EA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11EF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11F0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11F6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11F7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11FA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1201.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1208.tmp.exe
C:\Users\aroco\AppData\Local\Temp\120B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1211.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1218.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1219.tmp.exe
C:\Users\aroco\AppData\Local\Temp\121B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\121C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\122.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1222.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1223.tmp.exe
C:\Users\aroco\AppData\Local\Temp\122A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\122B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\122D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1234.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1235.tmp.exe
C:\Users\aroco\AppData\Local\Temp\123C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\123D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\123E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\123F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1245.tmp.exe
C:\Users\aroco\AppData\Local\Temp\124E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\124F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\125.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1250.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1256.tmp.exe
C:\Users\aroco\AppData\Local\Temp\125F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1261.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1262.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1266.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1267.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1270.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1271.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1273.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1278.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1281.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1282.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1283.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1284.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1289.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1293.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1294.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1295.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1296.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1299.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12A4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12A5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12A6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12AA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12B6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12B7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12BB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12BC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12C8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12C9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12CA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12CC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12D9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12DA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12DB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12DD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12DE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12EB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12EC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12ED.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12EE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12FD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12FE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12FF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1300.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1301.tmp.exe
C:\Users\aroco\AppData\Local\Temp\130E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1311.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1312.tmp.exe
C:\Users\aroco\AppData\Local\Temp\131F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1320.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1321.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1323.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1324.tmp.exe
C:\Users\aroco\AppData\Local\Temp\133.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1330.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1331.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1332.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1333.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1334.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1335.tmp.exe
C:\Users\aroco\AppData\Local\Temp\134.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1342.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1343.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1344.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1346.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1347.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1354.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1355.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1358.tmp.exe
C:\Users\aroco\AppData\Local\Temp\136.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1365.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1366.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1367.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1368.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1369.tmp.exe
C:\Users\aroco\AppData\Local\Temp\137.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1376.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1378.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1379.tmp.exe
C:\Users\aroco\AppData\Local\Temp\137A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\137B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1387.tmp.exe
C:\Users\aroco\AppData\Local\Temp\138A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\138B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\138C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1398.tmp.exe
C:\Users\aroco\AppData\Local\Temp\139B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\139C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\139D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\139E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13A8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13A9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13AD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13AF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13B0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13BA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13BD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13BE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13C0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13CF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13D1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13D2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13DA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13DB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13E0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13E1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13E3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13E4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13EC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13F1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13F4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13FC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13FD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1402.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1403.tmp.exe
C:\Users\aroco\AppData\Local\Temp\140E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1414.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1415.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1416.tmp.exe
C:\Users\aroco\AppData\Local\Temp\141F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1424.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1425.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1426.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1427.tmp.exe
C:\Users\aroco\AppData\Local\Temp\142F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1436.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1437.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1438.tmp.exe
C:\Users\aroco\AppData\Local\Temp\144.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1440.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1441.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1447.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1448.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1449.tmp.exe
C:\Users\aroco\AppData\Local\Temp\145.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1452.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1453.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1458.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1459.tmp.exe
C:\Users\aroco\AppData\Local\Temp\145A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\145B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1463.tmp.exe
C:\Users\aroco\AppData\Local\Temp\146B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\146C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\146D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1474.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1475.tmp.exe
C:\Users\aroco\AppData\Local\Temp\147B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\147D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\147E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1485.tmp.exe
C:\Users\aroco\AppData\Local\Temp\148C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\148D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\148F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1490.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1496.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1497.tmp.exe
C:\Users\aroco\AppData\Local\Temp\149E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14A1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14A2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14AE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14AF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14B2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14B7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14C0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14C1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14C3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14C4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14C8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14C9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14D1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14D2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14D4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14D5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14DA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14E3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14E6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14EA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14EB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14F4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14F5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14F7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14FC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1505.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1507.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1508.tmp.exe
C:\Users\aroco\AppData\Local\Temp\150C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\150D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1516.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1517.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1519.tmp.exe
C:\Users\aroco\AppData\Local\Temp\151A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\151E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\151F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1528.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1529.tmp.exe
C:\Users\aroco\AppData\Local\Temp\152B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\152C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1530.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1539.tmp.exe
C:\Users\aroco\AppData\Local\Temp\153A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\153C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\153D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1540.tmp.exe
C:\Users\aroco\AppData\Local\Temp\154B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\154E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1551.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1552.tmp.exe
C:\Users\aroco\AppData\Local\Temp\155B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\155C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\155E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\155F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\156.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1560.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1563.tmp.exe
C:\Users\aroco\AppData\Local\Temp\156D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\156E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\157.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1571.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1573.tmp.exe
C:\Users\aroco\AppData\Local\Temp\157F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\158.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1582.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1583.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1584.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1585.tmp.exe
C:\Users\aroco\AppData\Local\Temp\158F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\159.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1590.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1593.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1594.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1595.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1596.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15A1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15A2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15A5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15A7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15B3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15B4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15B6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15B7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15B8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15C4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15C5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15C7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15C8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15C9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15D6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15D7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15D8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15DA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15DB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15EB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15EC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15F8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15F9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15FA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15FB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15FD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15FE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16.tmp.exe
C:\Users\aroco\AppData\Local\Temp\160.tmp.exe
C:\Users\aroco\AppData\Local\Temp\160A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\160B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\160C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\160D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\160F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\161.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1610.tmp.exe
C:\Users\aroco\AppData\Local\Temp\161B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\161C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\161D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1620.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1621.tmp.exe
C:\Users\aroco\AppData\Local\Temp\162D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\162E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\163F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1640.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1641.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1650.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1651.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1652.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1653.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1661.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1662.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1663.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1664.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1665.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1673.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1674.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1675.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1676.tmp.exe
C:\Users\aroco\AppData\Local\Temp\168.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1683.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1684.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1686.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1687.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1688.tmp.exe
C:\Users\aroco\AppData\Local\Temp\169.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1695.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1696.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1697.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1698.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1699.tmp.exe
C:\Users\aroco\AppData\Local\Temp\169A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16A6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16A7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16A8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16A9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16AA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16AB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16B8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16B9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16BA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16BB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16BC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16BD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16CC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16CD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16CE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16CF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16D9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16DA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16DD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16DF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16EB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16EC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16EE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16EF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16F0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16F1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16FD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16FE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16FF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1700.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1701.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1702.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1703.tmp.exe
C:\Users\aroco\AppData\Local\Temp\170E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\170F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1712.tmp.exe
C:\Users\aroco\AppData\Local\Temp\172.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1720.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1721.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1723.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1724.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1725.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1726.tmp.exe
C:\Users\aroco\AppData\Local\Temp\173.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1731.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1734.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1736.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1737.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1742.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1743.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1745.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1746.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1748.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1754.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1757.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1759.tmp.exe
C:\Users\aroco\AppData\Local\Temp\175A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1764.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1767.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1768.tmp.exe
C:\Users\aroco\AppData\Local\Temp\176A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\176B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1775.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1776.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1779.tmp.exe
C:\Users\aroco\AppData\Local\Temp\177C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\177D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1787.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1788.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1789.tmp.exe
C:\Users\aroco\AppData\Local\Temp\178A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\178D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\178E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\179.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1798.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1799.tmp.exe
C:\Users\aroco\AppData\Local\Temp\179B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\179C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\179F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17A0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17AA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17AB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17AD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17AE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17B1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17BB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17BC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17BE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17C1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17C2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17CD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17CF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17D0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17D3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17D4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17DE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17DF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17E1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17E2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17E5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17E6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17EF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17F0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17F2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17F3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17F6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17F7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1801.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1802.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1804.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1805.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1808.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1809.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1815.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1816.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1819.tmp.exe
C:\Users\aroco\AppData\Local\Temp\181A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1822.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1823.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1827.tmp.exe
C:\Users\aroco\AppData\Local\Temp\182B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\182C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\183.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1834.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1835.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1838.tmp.exe
C:\Users\aroco\AppData\Local\Temp\183D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1845.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1848.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1849.tmp.exe
C:\Users\aroco\AppData\Local\Temp\184D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\184E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1856.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1857.tmp.exe
C:\Users\aroco\AppData\Local\Temp\185A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\185B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1868.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1869.tmp.exe
C:\Users\aroco\AppData\Local\Temp\186C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\186D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\186F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1870.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1871.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1879.tmp.exe
C:\Users\aroco\AppData\Local\Temp\187D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\187E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1881.tmp.exe
C:\Users\aroco\AppData\Local\Temp\188A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\188B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\188C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\188F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1892.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1893.tmp.exe
C:\Users\aroco\AppData\Local\Temp\189D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\189F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18A0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18A1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18A2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18A3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18A4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18AD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18AE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18B5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18B6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18BF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18C3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18C4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18C7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18C8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18CF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18D0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18D4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18D5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18D8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18D9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18DA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18E1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18E2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18E6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18EB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18F7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18F8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18FC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18FD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1902.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1903.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1908.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1909.tmp.exe
C:\Users\aroco\AppData\Local\Temp\190D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\190E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1914.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1915.tmp.exe
C:\Users\aroco\AppData\Local\Temp\191A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\191B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\191F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1920.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1926.tmp.exe
C:\Users\aroco\AppData\Local\Temp\192B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1930.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1931.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1936.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1937.tmp.exe
C:\Users\aroco\AppData\Local\Temp\193C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\193D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\194.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1948.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1949.tmp.exe
C:\Users\aroco\AppData\Local\Temp\194E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\195.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1952.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1953.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1959.tmp.exe
C:\Users\aroco\AppData\Local\Temp\195A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\195E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\195F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1963.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1964.tmp.exe
C:\Users\aroco\AppData\Local\Temp\196B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\196C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1970.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1971.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1975.tmp.exe
C:\Users\aroco\AppData\Local\Temp\197D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\197E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1982.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1983.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1986.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1987.tmp.exe
C:\Users\aroco\AppData\Local\Temp\198E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\198F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1993.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1994.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1995.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1997.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1998.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19A0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19A9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19B1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19B2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19B5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19B6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19B9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19BA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19BB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19C2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19C3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19C7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19CC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19D4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19D5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19D8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19D9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19DD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19DE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19E5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19E6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19E9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19EA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19EE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19EF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19F7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19F8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19FB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19FC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A00.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A09.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A0D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A0E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A11.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A12.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A19.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A1A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A1E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A1F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A20.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A22.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A2B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A2C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A33.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A40.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A41.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A43.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A44.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A4C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A4D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A4E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A52.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A53.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A55.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A56.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A5F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A64.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A65.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A67.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A68.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A6F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A70.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A75.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A76.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A78.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A81.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A82.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A87.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A88.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A89.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A8A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A93.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A94.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A99.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A9B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A9C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A9D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AA4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AA9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AAA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AAD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AB5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AB6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AB7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1ABB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1ABC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1ABD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1ABE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1ABF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AC8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1ACF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AD0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AD8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AD9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1ADD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1ADE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AE1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AE2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AEA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AEF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AF0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AF3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AF4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AFA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AFB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B00.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B01.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B04.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B05.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B0C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B0D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B12.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B13.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B14.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B16.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B17.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B1E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B25.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B26.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B28.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B29.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B2E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B2F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B36.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B37.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B39.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B3A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B40.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B48.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B49.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B4B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B4C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B51.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B52.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B59.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B5A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B5C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B62.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B63.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B6B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B6C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B6D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B74.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B75.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B7E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B7F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B85.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B8C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B8D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B8F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B90.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B96.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B97.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B98.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B9E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B9F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BA1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BA9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BAA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BB0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BB1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BB2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BB3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BBA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BC1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BC2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BC3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BC4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BCB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BCC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BD3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BD4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BD5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BD6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BDD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BDE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BE4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BE5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BE6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BE7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BEE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BEF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BF6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BF7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BF8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BF9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C00.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C01.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C08.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C09.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C0A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C0B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C11.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C12.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C19.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C1A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C1B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C1C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C23.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C2B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C2C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C2D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C2E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C34.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C35.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C3D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C3F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C45.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C4D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C4E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C4F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C56.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C57.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C5F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C60.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C61.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C6F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C70.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C71.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C72.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C77.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C78.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C79.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C81.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C83.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C8A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C92.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C93.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C94.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C95.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C9A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C9B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CA3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CA4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CA5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CA6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CAC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CAD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CB5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CB7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CB8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CBE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CBF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CC6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CC7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CC9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CCA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CCB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CCF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CD0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CD7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CD8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CD9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CDB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CDC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CE1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CE2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CEA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CEB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CED.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CEE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CF3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CF4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CFB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CFE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D04.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D05.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D0C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D0D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D0F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D10.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D16.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D1E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D1F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D21.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D22.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D26.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D27.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D2F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D30.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D32.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D33.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D38.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D39.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D41.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D42.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D43.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D44.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D45.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D4A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D54.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D56.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D5A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D5B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D64.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D65.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D66.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D67.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D6C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D6D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D76.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D77.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D78.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D79.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D7E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D87.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D89.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D8A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D8E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D8F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D98.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D99.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DA0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DA1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DAA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DAB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DAC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DB1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DB2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DBA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DBB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DBC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DBD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DC3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DC4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DCC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DCD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DCE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DCF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DD5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DD6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DDE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DE0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DE6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DEE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DEF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DF0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DF1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DF7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DF8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E00.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E01.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E02.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E03.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E09.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E0A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E11.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E13.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E14.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E1A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E22.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E23.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E24.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E25.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E26.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E2B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E35.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E36.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E37.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E38.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E3B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E3C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E46.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E48.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E4D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E4E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E57.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E58.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E59.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E5A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E5F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E69.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E6A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E6B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E6F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E70.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E7A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E7B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E81.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E82.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E8B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E8C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E8D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E93.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E94.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E9B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E9C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E9D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EA4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EA5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EAD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EAE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EAF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EB0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EB6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EB7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EBF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EC1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EC7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EC8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1ECF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1ED0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1ED1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1ED2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1ED9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EDA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EE1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EE3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EEB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EEC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EF2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EF4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EF5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EFC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F02.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F03.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F05.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F06.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F0D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F0E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F0F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F14.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F15.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F17.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F18.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F20.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F21.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F25.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F26.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F28.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F31.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F32.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F37.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F38.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F39.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F3A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F43.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F44.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F49.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F4A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F4B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F4C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F54.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F5A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F5C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F5D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F65.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F66.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F6B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F6C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F6E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F6F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F77.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F7E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F7F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F80.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F81.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F87.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F88.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F8F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F90.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F91.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F92.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F99.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F9A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FA1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FA3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FA4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FAB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FAC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FB1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FB2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FB4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FB5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FBC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FC3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FC4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FCD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FCE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FD6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FD7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FDE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FDF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FE4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FE5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FE7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FE8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FF0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FF1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FF2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FF6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FF7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FF9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FFA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2003.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2004.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2008.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2009.tmp.exe
C:\Users\aroco\AppData\Local\Temp\200B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\200C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2014.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2019.tmp.exe
C:\Users\aroco\AppData\Local\Temp\201A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\201C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\201D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2025.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2026.tmp.exe
C:\Users\aroco\AppData\Local\Temp\202B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\202C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\202E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2037.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2038.tmp.exe
C:\Users\aroco\AppData\Local\Temp\203C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\203E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\203F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\204.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2040.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2048.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2049.tmp.exe
C:\Users\aroco\AppData\Local\Temp\204D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\204E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\204F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\205.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2051.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2052.tmp.exe
C:\Users\aroco\AppData\Local\Temp\205A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\206.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2060.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2061.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2063.tmp.exe
C:\Users\aroco\AppData\Local\Temp\206A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\206B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2071.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2072.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2073.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2074.tmp.exe
C:\Users\aroco\AppData\Local\Temp\207C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\207D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2083.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2085.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2086.tmp.exe
C:\Users\aroco\AppData\Local\Temp\208E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2094.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2095.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2097.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2098.tmp.exe
C:\Users\aroco\AppData\Local\Temp\209E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\209F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20A5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20A6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20B0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20B1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20B7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20B8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20B9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20BA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20C2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20C3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20C7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20C8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20CA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20D3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20D4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20D5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20D9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20DA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20DB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20DC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20E6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20E7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20EB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20ED.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20EE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20F7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20FB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20FC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20FE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20FF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2108.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2109.tmp.exe
C:\Users\aroco\AppData\Local\Temp\210D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\210E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2110.tmp.exe
C:\Users\aroco\AppData\Local\Temp\211A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\211B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\211F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\212.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2120.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2121.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2122.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2123.tmp.exe
C:\Users\aroco\AppData\Local\Temp\212B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2130.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2131.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2133.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2134.tmp.exe
C:\Users\aroco\AppData\Local\Temp\213C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\213D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\213E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2142.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2143.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2145.tmp.exe
C:\Users\aroco\AppData\Local\Temp\214F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\215.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2150.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2153.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2154.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2155.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2156.tmp.exe
C:\Users\aroco\AppData\Local\Temp\216.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2160.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2165.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2167.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2168.tmp.exe
C:\Users\aroco\AppData\Local\Temp\217.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2171.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2172.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2176.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2177.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2179.tmp.exe
C:\Users\aroco\AppData\Local\Temp\217A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\218.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2182.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2183.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2187.tmp.exe
C:\Users\aroco\AppData\Local\Temp\218A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\218B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2194.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2195.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2198.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2199.tmp.exe
C:\Users\aroco\AppData\Local\Temp\219C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\219D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21AA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21AB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21AE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21B5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21B6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21BB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21BE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21BF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21C7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21C8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21CC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21CD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21D0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21D1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21D9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21DA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21DD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21E1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21EA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21EB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21EE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21EF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21FC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\220.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2202.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2203.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2204.tmp.exe
C:\Users\aroco\AppData\Local\Temp\220C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\220D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\220F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2210.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2214.tmp.exe
C:\Users\aroco\AppData\Local\Temp\221E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\221F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2220.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2221.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2225.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2226.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2231.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2232.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2233.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2237.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2238.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2242.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2243.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2244.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2248.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2254.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2255.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2256.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2259.tmp.exe
C:\Users\aroco\AppData\Local\Temp\225A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2265.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2266.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2267.tmp.exe
C:\Users\aroco\AppData\Local\Temp\226A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\226B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\226C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\227.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2276.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2277.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2278.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2279.tmp.exe
C:\Users\aroco\AppData\Local\Temp\227A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\227D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\227E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\228.tmp.exe
C:\Users\aroco\AppData\Local\Temp\228B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\228C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\228F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\229.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2297.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2298.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2299.tmp.exe
C:\Users\aroco\AppData\Local\Temp\229C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\229D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\229F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22A0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22AA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22AE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22B1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22B2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22BB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22BC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22BF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22C0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22C3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22C4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22CC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22D0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22D1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22DD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22DE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22E4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22E5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22EF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22F0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22F1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22F2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22F5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22F6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\230.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2300.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2301.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2303.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2304.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2307.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2308.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2312.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2313.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2315.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2316.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2319.tmp.exe
C:\Users\aroco\AppData\Local\Temp\231A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2323.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2326.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2327.tmp.exe
C:\Users\aroco\AppData\Local\Temp\232A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2334.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2335.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2338.tmp.exe
C:\Users\aroco\AppData\Local\Temp\233B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\233C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2346.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2347.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2349.tmp.exe
C:\Users\aroco\AppData\Local\Temp\234A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\234D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\234E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\234F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2357.tmp.exe
C:\Users\aroco\AppData\Local\Temp\235A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\235B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\235F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2368.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2369.tmp.exe
C:\Users\aroco\AppData\Local\Temp\236A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\236C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\236D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2370.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2371.tmp.exe
C:\Users\aroco\AppData\Local\Temp\237B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\237D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\237E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\238.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2381.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2382.tmp.exe
C:\Users\aroco\AppData\Local\Temp\238B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\238C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\238F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\239.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2393.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2394.tmp.exe
C:\Users\aroco\AppData\Local\Temp\239D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\239E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23A0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23A1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23A5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23AE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23AF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23B1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23B2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23B5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23B6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23B7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23C0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23C3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23C4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23C8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23D1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23D5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23D6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23D9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23DA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23E1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23E2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23E6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23EA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23EB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23F3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23F4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23F7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23F8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23FC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2405.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2406.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2408.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2409.tmp.exe
C:\Users\aroco\AppData\Local\Temp\240C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\240D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\241.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2416.tmp.exe
C:\Users\aroco\AppData\Local\Temp\241A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\241B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\242.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2427.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2428.tmp.exe
C:\Users\aroco\AppData\Local\Temp\242E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\242F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2438.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2439.tmp.exe
C:\Users\aroco\AppData\Local\Temp\243B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\243C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\243F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2440.tmp.exe
C:\Users\aroco\AppData\Local\Temp\244A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\244B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\244C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\244D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\244E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2451.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2452.tmp.exe
C:\Users\aroco\AppData\Local\Temp\245D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\245F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2460.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2463.tmp.exe
C:\Users\aroco\AppData\Local\Temp\246D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\246E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2470.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2473.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2474.tmp.exe
C:\Users\aroco\AppData\Local\Temp\247F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2480.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2481.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2482.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2485.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2486.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2491.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2492.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2493.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2496.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2497.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24A2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24A4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24A5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24A8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24A9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24B3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24B6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24B7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24BA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24BB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24C3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24C4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24C7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24C8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24CB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24CC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24D5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24D6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24D9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24DA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24DD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24E7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24E8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24EB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24EE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24F8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24FB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24FC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24FE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2509.tmp.exe
C:\Users\aroco\AppData\Local\Temp\250A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\250D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\250F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\251B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\251C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\251D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\251F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\252C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\252D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\252E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\252F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\253.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2530.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2531.tmp.exe
C:\Users\aroco\AppData\Local\Temp\253F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\254.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2541.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2542.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2543.tmp.exe
C:\Users\aroco\AppData\Local\Temp\254F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2550.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2552.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2553.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2561.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2562.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2563.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2564.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2565.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2573.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2574.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2575.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2576.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2577.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2578.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2584.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2585.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2586.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2587.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2588.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2596.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2597.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2598.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2599.tmp.exe
C:\Users\aroco\AppData\Local\Temp\259A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\259B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25A9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25AA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25AB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25AC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25B9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25BA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25BB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25BC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25BD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25CB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25CC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25CD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25CE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25CF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25D0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25DC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25DD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25DE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25DF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25E0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25E1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25EE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25F0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25F1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2602.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2603.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2604.tmp.exe
C:\Users\aroco\AppData\Local\Temp\260E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\260F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2610.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2613.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2614.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2615.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2616.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2621.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2622.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2625.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2626.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2627.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2633.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2636.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2637.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2638.tmp.exe
C:\Users\aroco\AppData\Local\Temp\264.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2643.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2644.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2647.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2648.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2649.tmp.exe
C:\Users\aroco\AppData\Local\Temp\264A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\265.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2655.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2656.tmp.exe
C:\Users\aroco\AppData\Local\Temp\265B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\265C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2666.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2667.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2668.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2669.tmp.exe
C:\Users\aroco\AppData\Local\Temp\266A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\266C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\266D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2678.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2679.tmp.exe
C:\Users\aroco\AppData\Local\Temp\267B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\267E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\267F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\268A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\268B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\268C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\268D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2690.tmp.exe
C:\Users\aroco\AppData\Local\Temp\269B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\269D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\269E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26A0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26A1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26AC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26AD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26AF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26B0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26B2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26B3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26BE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26BF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26C0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26C1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26C3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26C4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26C5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26CF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26D2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26D3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26D6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26E0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26E4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26E5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26E7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26E8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26F0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26F1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26F5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26F6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26F8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26F9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2702.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2703.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2707.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2708.tmp.exe
C:\Users\aroco\AppData\Local\Temp\270A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2714.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2715.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2719.tmp.exe
C:\Users\aroco\AppData\Local\Temp\271A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\271B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\271C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2725.tmp.exe
C:\Users\aroco\AppData\Local\Temp\272A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\272B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\272C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2736.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2737.tmp.exe
C:\Users\aroco\AppData\Local\Temp\273D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\273E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2748.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2749.tmp.exe
C:\Users\aroco\AppData\Local\Temp\274B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\274C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\274E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\274F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2759.tmp.exe
C:\Users\aroco\AppData\Local\Temp\275A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\275D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\275E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\276.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2760.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2761.tmp.exe
C:\Users\aroco\AppData\Local\Temp\276B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\276C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\276F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2770.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2772.tmp.exe
C:\Users\aroco\AppData\Local\Temp\277C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\277D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2780.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2781.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2782.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2783.tmp.exe
C:\Users\aroco\AppData\Local\Temp\278E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2792.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2794.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2795.tmp.exe
C:\Users\aroco\AppData\Local\Temp\279F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27A0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27A3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27A4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27A6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27A7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27A8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27B0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27B1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27B4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27B5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27B6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27B8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27C2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27C7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27C9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27CA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27D3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27D7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27D8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27DA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27DB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27E3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27E4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27E9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27EA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27EC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27F5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27F6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27FB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27FC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27FD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27FE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28.tmp.exe
C:\Users\aroco\AppData\Local\Temp\280.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2806.tmp.exe
C:\Users\aroco\AppData\Local\Temp\280C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\280D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\280E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\281.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2817.tmp.exe
C:\Users\aroco\AppData\Local\Temp\281F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2820.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2828.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2829.tmp.exe
C:\Users\aroco\AppData\Local\Temp\282E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\282F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2831.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2832.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2839.tmp.exe
C:\Users\aroco\AppData\Local\Temp\283A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\283F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2840.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2842.tmp.exe
C:\Users\aroco\AppData\Local\Temp\284B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\284C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2851.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2853.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2854.tmp.exe
C:\Users\aroco\AppData\Local\Temp\285D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2861.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2862.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2864.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2865.tmp.exe
C:\Users\aroco\AppData\Local\Temp\286D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\287.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2873.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2874.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2876.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2877.tmp.exe
C:\Users\aroco\AppData\Local\Temp\287E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\287F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2885.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2886.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2888.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2889.tmp.exe
C:\Users\aroco\AppData\Local\Temp\288F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2896.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2897.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2899.tmp.exe
C:\Users\aroco\AppData\Local\Temp\289A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28A0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28A1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28A8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28A9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28AB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28AC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28B2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28BA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28BD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28C2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28C3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28CA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28CB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28CD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28CE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28D4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28DC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28DD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28DF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28E5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28E6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28ED.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28EE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28F6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28F7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28FF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2900.tmp.exe
C:\Users\aroco\AppData\Local\Temp\291.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2910.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2911.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2912.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2917.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2918.tmp.exe
C:\Users\aroco\AppData\Local\Temp\292.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2921.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2922.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2923.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2929.tmp.exe
C:\Users\aroco\AppData\Local\Temp\292A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2933.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2934.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2935.tmp.exe
C:\Users\aroco\AppData\Local\Temp\293B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\293C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2946.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2947.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2948.tmp.exe
C:\Users\aroco\AppData\Local\Temp\294C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2957.tmp.exe
C:\Users\aroco\AppData\Local\Temp\295D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\295E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2968.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2969.tmp.exe
C:\Users\aroco\AppData\Local\Temp\296A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\296F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2970.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2978.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2979.tmp.exe
C:\Users\aroco\AppData\Local\Temp\297A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\297B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\298.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2980.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2981.tmp.exe
C:\Users\aroco\AppData\Local\Temp\298A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\298B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\298C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2992.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2993.tmp.exe
C:\Users\aroco\AppData\Local\Temp\299C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\299D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\299E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29A3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29A4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29AC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29AE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29AF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29B5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29BD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29C0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29C1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29C6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29C7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29CE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29CF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29D2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29D3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29D7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29D8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29DF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29E0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29E3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29E4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29E9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29F1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29F2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29F5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29FA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29FB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A02.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A05.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A06.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A0B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A0C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A13.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A14.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A17.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A18.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A1D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A25.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A29.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A2A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A2D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A2E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A35.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A36.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A3F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A40.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A4A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A4B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A51.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A52.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A57.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A58.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A5C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A5D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A62.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A63.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A68.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A69.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A6D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A6E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A74.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A75.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A7A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A7F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A86.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A87.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A8A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A8B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A8F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A90.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A97.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A98.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A9C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AA1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AA9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AAA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AAD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AAE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AB2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AB3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AB4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2ABA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2ABE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2ABF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AC4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AC5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2ACB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2ACC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2ACD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AD0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AD1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AD6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AD7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2ADE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2ADF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AE2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AE8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AE9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AEF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AF2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AF3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AF9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AFA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B00.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B01.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B04.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B0B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B12.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B13.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B14.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B15.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B1B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B1C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B1D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B23.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B26.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B27.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B2E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B2F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B34.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B38.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B40.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B44.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B45.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B48.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B49.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B50.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B51.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B56.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B57.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B5A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B62.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B63.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B68.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B69.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B6B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B6C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B74.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B75.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B79.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B7C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B8A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B8B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B8D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B95.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B96.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B9C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B9D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B9E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BA6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BA7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BAD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BAE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BAF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BB8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BB9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BBF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BC0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BC1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BCA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BCB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BD0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BD1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BD2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BDB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BDC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BE2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BE3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BE4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BED.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BF4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BF5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BF6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BFE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BFF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C04.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C05.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C06.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C07.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C0F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C10.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C16.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C18.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C19.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C21.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C22.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C27.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C29.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C2A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C32.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C37.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C38.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C3B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C3C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C43.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C44.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C49.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C4A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C4D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C55.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C56.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C5A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C5B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C5D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C5E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C6C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C76.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C77.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C7D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C7E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C7F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C80.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C88.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C89.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C8E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C8F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C90.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C91.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C99.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C9A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CA0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CA1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CA2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CA3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CAB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CAC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CB2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CB3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CB4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CBC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CBD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CC2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CC3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CC5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CCE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CD4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CD5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CD6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CD7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CDF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CE0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CE1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CE5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CE7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CE8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CE9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CF1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CF2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CF6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CF7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CFA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D03.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D08.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D09.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D0B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D0C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D14.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D15.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D19.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D1C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D1D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D25.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D26.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D2A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D2B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D2E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D37.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D38.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D3C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D3D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D3E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D3F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D48.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D49.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D4A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D4D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D50.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D51.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D5B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D5C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D62.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D63.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D6D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D6E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D6F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D73.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D7F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D80.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D81.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D84.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D85.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D91.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D92.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D93.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D96.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DA2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DA4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DA5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DA6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DA7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DB3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DB4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DC5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DC6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DC7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DC8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DD5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DD6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DD7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DD8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DD9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DDA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DE8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DE9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DEA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DEB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DF9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DFB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DFC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DFD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E0A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E0B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E0D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E0E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E0F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E1C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E1D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E1F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E20.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E21.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E2D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E2E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E2F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E30.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E31.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E32.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E33.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E42.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E43.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E44.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E4F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E50.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E53.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E54.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E55.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E56.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E60.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E61.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E65.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E66.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E67.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E72.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E73.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E76.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E77.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E78.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E83.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E87.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E88.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E89.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E8A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E94.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E95.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EA6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EA7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EA9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EAA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EAB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EAC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EB7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EB8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EBA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EBB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EBD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EC9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2ECA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2ECC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2ECD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2ECE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2ECF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EDB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EDC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EDD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EDE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EE0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EEC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EED.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EEF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EF0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EF1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EFE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EFF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F00.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F01.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F02.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F03.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F0F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F11.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F12.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F14.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F15.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F20.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F21.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F22.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F23.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F24.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F25.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F26.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F33.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F34.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F35.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F36.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F37.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F38.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F44.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F46.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F47.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F49.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F4A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F55.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F56.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F58.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F59.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F5A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F67.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F69.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F6B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F6C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F77.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F78.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F7A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F7B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F7C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F8C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F8D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F8E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F98.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F99.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F9A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F9D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F9E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F9F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FA0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FAB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FAC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FAF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FB0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FB1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FBD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FC1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FC2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FC3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FCD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FCE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FD1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FD2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FD4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FD5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FDF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FE0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FE5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FE6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FF1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FF2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FF3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FF4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FF7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FF8.tmp.exe


#9 cloudsoda

cloudsoda
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:12:30 PM

Posted 23 April 2016 - 11:36 PM

==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2016-04-23 09:21 - 2015-10-30 00:24 - 00000000 ____D C:\Windows\AppReadiness
2016-04-23 09:17 - 2015-10-30 00:21 - 00000000 ____D C:\Windows\INF
2016-04-23 09:09 - 2015-10-29 23:28 - 00262144 ___SH C:\Windows\system32\config\BBI
2016-04-22 12:10 - 2015-10-30 00:24 - 00000000 ___HD C:\Program Files\WindowsApps
2016-04-22 11:18 - 2015-10-30 00:24 - 00000000 ____D C:\Windows\ELAMBKUP
2016-04-21 15:28 - 2015-10-30 00:24 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2016-04-21 15:01 - 2015-10-30 00:18 - 63591424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imageres.dll
2016-04-21 15:01 - 2015-10-30 00:18 - 63591424 _____ (Microsoft Corporation) C:\Windows\system32\imageres.dll
2016-04-21 14:58 - 2015-10-30 00:24 - 00000000 ____D C:\Windows\Cursors
2016-04-21 12:01 - 2015-10-30 00:24 - 00000000 ___SD C:\Windows\system32\F12
2016-04-21 12:01 - 2015-10-30 00:24 - 00000000 ___RD C:\Windows\PurchaseDialog
2016-04-21 12:01 - 2015-10-30 00:24 - 00000000 ____D C:\Windows\system32\WinBioPlugIns
2016-04-21 12:01 - 2015-10-30 00:24 - 00000000 ____D C:\Windows\system32\SystemResetPlatform
2016-04-21 12:01 - 2015-10-30 00:24 - 00000000 ____D C:\Windows\system32\oobe
2016-04-21 12:01 - 2015-10-30 00:24 - 00000000 ____D C:\Windows\system32\appraiser
2016-04-21 12:01 - 2015-10-30 00:24 - 00000000 ____D C:\Windows\PolicyDefinitions
2016-04-21 12:01 - 2015-10-29 23:28 - 00000000 ____D C:\Windows\SysWOW64\Dism
2016-04-21 12:01 - 2015-10-29 23:28 - 00000000 ____D C:\Windows\system32\Dism
2016-04-21 12:00 - 2015-10-30 02:05 - 00000000 ____D C:\Program Files\Windows Journal
2016-04-21 12:00 - 2015-10-30 00:24 - 00000000 __RSD C:\Windows\Media
2016-04-21 12:00 - 2015-10-30 00:24 - 00000000 ___RD C:\Windows\ImmersiveControlPanel
2016-04-21 12:00 - 2015-10-30 00:24 - 00000000 ____D C:\Windows\bcastdvr
2016-04-21 12:00 - 2015-10-30 00:24 - 00000000 ____D C:\Program Files\Windows Portable Devices
2016-04-21 12:00 - 2015-10-30 00:24 - 00000000 ____D C:\Program Files\Windows Multimedia Platform
2016-04-21 12:00 - 2015-10-30 00:24 - 00000000 ____D C:\Program Files (x86)\Windows Portable Devices
2016-04-21 12:00 - 2015-10-30 00:24 - 00000000 ____D C:\Program Files (x86)\Windows Multimedia Platform
2016-04-21 11:37 - 2015-10-30 00:11 - 00000000 ____D C:\Windows\CbsTemp
2016-04-21 11:35 - 2015-10-30 00:24 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2016-04-20 21:10 - 2015-10-30 00:24 - 00000000 ___RD C:\Windows\DevicesFlow
2016-04-20 20:58 - 2015-10-29 23:28 - 00032768 ___SH C:\Windows\system32\config\ELAM
2016-04-20 20:53 - 2015-10-30 00:24 - 00000000 ___RD C:\Windows\PrintDialog
2016-04-20 20:53 - 2015-10-30 00:24 - 00000000 ___RD C:\Windows\MiracastView
2016-04-20 20:52 - 2015-10-30 00:24 - 00000000 ____D C:\Windows\system32\WinBioDatabase
2016-04-13 17:20 - 2015-11-03 12:03 - 00000000 ____D C:\Dell
2016-04-13 16:26 - 2015-10-30 00:24 - 00000000 ____D C:\Windows\Provisioning
2016-04-13 16:04 - 2015-10-29 23:28 - 00000000 ____D C:\Windows\system32\Sysprep
2016-04-13 15:57 - 2015-10-30 00:24 - 00000000 ____D C:\Windows\Registration
2016-04-13 15:48 - 2015-10-30 00:26 - 00000000 ____D C:\Windows\Setup
2016-04-13 15:48 - 2015-10-30 00:24 - 00028672 _____ C:\Windows\system32\config\BCD-Template
2016-04-13 15:41 - 2015-10-30 00:24 - 00000000 ____D C:\Windows\Help
2016-04-13 15:37 - 2015-10-30 00:24 - 00000000 ____D C:\Windows\system32\spool
2016-04-13 15:37 - 2015-10-30 00:24 - 00000000 ____D C:\Windows\system32\FxsTmp
2016-04-13 15:37 - 2015-10-30 00:24 - 00000000 ____D C:\ProgramData\USOPrivate
2016-04-13 15:32 - 2015-10-30 02:11 - 00000000 ____D C:\Windows\ServiceProfiles
2016-04-06 11:32 - 2015-10-30 00:26 - 00829944 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-04-06 11:32 - 2015-10-30 00:26 - 00176632 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
 
==================== Files in the root of some directories =======
 
2016-04-13 15:37 - 2016-04-13 15:37 - 0000000 _____ () C:\ProgramData\DP45977C.lfl
 
Some files in TEMP:
====================
C:\Users\aroco\AppData\Local\Temp\100.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1003.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1004.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1005.tmp.exe
C:\Users\aroco\AppData\Local\Temp\100F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1010.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1015.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1016.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1017.tmp.exe
C:\Users\aroco\AppData\Local\Temp\102.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1020.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1025.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1026.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1027.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1028.tmp.exe
C:\Users\aroco\AppData\Local\Temp\103.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1031.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1032.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1033.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1034.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1037.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1039.tmp.exe
C:\Users\aroco\AppData\Local\Temp\103A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1047.tmp.exe
C:\Users\aroco\AppData\Local\Temp\104B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\104C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1054.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1058.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1059.tmp.exe
C:\Users\aroco\AppData\Local\Temp\105C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\105D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1065.tmp.exe
C:\Users\aroco\AppData\Local\Temp\106E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\106F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1075.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1076.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1079.tmp.exe
C:\Users\aroco\AppData\Local\Temp\107A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\107F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\108.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1087.tmp.exe
C:\Users\aroco\AppData\Local\Temp\108B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\109.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1090.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1098.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1099.tmp.exe
C:\Users\aroco\AppData\Local\Temp\109C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\109D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10A1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10A2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10A9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10AA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10AD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10B2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10B3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10BB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10BE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10C4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10CC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10CD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10CE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10CF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10D5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10D6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10DD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10DE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10E0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10E6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10E7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10EF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10F0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10F1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10F2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10F8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\10F9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1100.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1101.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1102.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1109.tmp.exe
C:\Users\aroco\AppData\Local\Temp\110A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\111.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1112.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1113.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1114.tmp.exe
C:\Users\aroco\AppData\Local\Temp\111B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\111C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\112.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1123.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1124.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1125.tmp.exe
C:\Users\aroco\AppData\Local\Temp\112D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1134.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1135.tmp.exe
C:\Users\aroco\AppData\Local\Temp\113D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\113E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\114.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1146.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1147.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1148.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1149.tmp.exe
C:\Users\aroco\AppData\Local\Temp\114A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\114F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\115.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1157.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1158.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1160.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1161.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1169.tmp.exe
C:\Users\aroco\AppData\Local\Temp\116A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\116B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1171.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1172.tmp.exe
C:\Users\aroco\AppData\Local\Temp\117A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\117B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\117C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\117D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1183.tmp.exe
C:\Users\aroco\AppData\Local\Temp\118B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\118D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\119.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1193.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1194.tmp.exe
C:\Users\aroco\AppData\Local\Temp\119C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\119E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\119F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11A5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11AD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11B0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11B1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11B6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11B7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11BD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11C1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11C2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11C7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11C8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11CE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11D3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11D4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11DE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11E5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11E6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11E9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11EA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11EF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11F0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11F6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11F7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\11FA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1201.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1208.tmp.exe
C:\Users\aroco\AppData\Local\Temp\120B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1211.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1218.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1219.tmp.exe
C:\Users\aroco\AppData\Local\Temp\121B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\121C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\122.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1222.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1223.tmp.exe
C:\Users\aroco\AppData\Local\Temp\122A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\122B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\122D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1234.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1235.tmp.exe
C:\Users\aroco\AppData\Local\Temp\123C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\123D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\123E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\123F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1245.tmp.exe
C:\Users\aroco\AppData\Local\Temp\124E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\124F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\125.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1250.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1256.tmp.exe
C:\Users\aroco\AppData\Local\Temp\125F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1261.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1262.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1266.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1267.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1270.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1271.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1273.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1278.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1281.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1282.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1283.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1284.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1289.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1293.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1294.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1295.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1296.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1299.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12A4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12A5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12A6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12AA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12B6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12B7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12BB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12BC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12C8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12C9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12CA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12CC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12D9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12DA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12DB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12DD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12DE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12EB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12EC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12ED.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12EE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12FD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12FE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\12FF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1300.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1301.tmp.exe
C:\Users\aroco\AppData\Local\Temp\130E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1311.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1312.tmp.exe
C:\Users\aroco\AppData\Local\Temp\131F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1320.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1321.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1323.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1324.tmp.exe
C:\Users\aroco\AppData\Local\Temp\133.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1330.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1331.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1332.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1333.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1334.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1335.tmp.exe
C:\Users\aroco\AppData\Local\Temp\134.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1342.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1343.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1344.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1346.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1347.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1354.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1355.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1358.tmp.exe
C:\Users\aroco\AppData\Local\Temp\136.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1365.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1366.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1367.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1368.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1369.tmp.exe
C:\Users\aroco\AppData\Local\Temp\137.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1376.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1378.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1379.tmp.exe
C:\Users\aroco\AppData\Local\Temp\137A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\137B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1387.tmp.exe
C:\Users\aroco\AppData\Local\Temp\138A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\138B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\138C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1398.tmp.exe
C:\Users\aroco\AppData\Local\Temp\139B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\139C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\139D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\139E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13A8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13A9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13AD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13AF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13B0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13BA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13BD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13BE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13C0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13CF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13D1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13D2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13DA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13DB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13E0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13E1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13E3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13E4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13EC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13F1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13F4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13FC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\13FD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1402.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1403.tmp.exe
C:\Users\aroco\AppData\Local\Temp\140E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1414.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1415.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1416.tmp.exe
C:\Users\aroco\AppData\Local\Temp\141F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1424.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1425.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1426.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1427.tmp.exe
C:\Users\aroco\AppData\Local\Temp\142F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1436.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1437.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1438.tmp.exe
C:\Users\aroco\AppData\Local\Temp\144.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1440.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1441.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1447.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1448.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1449.tmp.exe
C:\Users\aroco\AppData\Local\Temp\145.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1452.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1453.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1458.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1459.tmp.exe
C:\Users\aroco\AppData\Local\Temp\145A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\145B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1463.tmp.exe
C:\Users\aroco\AppData\Local\Temp\146B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\146C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\146D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1474.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1475.tmp.exe
C:\Users\aroco\AppData\Local\Temp\147B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\147D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\147E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1485.tmp.exe
C:\Users\aroco\AppData\Local\Temp\148C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\148D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\148F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1490.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1496.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1497.tmp.exe
C:\Users\aroco\AppData\Local\Temp\149E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14A1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14A2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14AE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14AF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14B2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14B7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14C0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14C1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14C3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14C4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14C8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14C9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14D1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14D2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14D4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14D5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14DA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14E3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14E6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14EA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14EB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14F4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14F5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14F7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\14FC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1505.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1507.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1508.tmp.exe
C:\Users\aroco\AppData\Local\Temp\150C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\150D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1516.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1517.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1519.tmp.exe
C:\Users\aroco\AppData\Local\Temp\151A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\151E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\151F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1528.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1529.tmp.exe
C:\Users\aroco\AppData\Local\Temp\152B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\152C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1530.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1539.tmp.exe
C:\Users\aroco\AppData\Local\Temp\153A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\153C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\153D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1540.tmp.exe
C:\Users\aroco\AppData\Local\Temp\154B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\154E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1551.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1552.tmp.exe
C:\Users\aroco\AppData\Local\Temp\155B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\155C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\155E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\155F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\156.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1560.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1563.tmp.exe
C:\Users\aroco\AppData\Local\Temp\156D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\156E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\157.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1571.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1573.tmp.exe
C:\Users\aroco\AppData\Local\Temp\157F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\158.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1582.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1583.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1584.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1585.tmp.exe
C:\Users\aroco\AppData\Local\Temp\158F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\159.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1590.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1593.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1594.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1595.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1596.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15A1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15A2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15A5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15A7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15B3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15B4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15B6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15B7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15B8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15C4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15C5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15C7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15C8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15C9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15D6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15D7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15D8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15DA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15DB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15EB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15EC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15F8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15F9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15FA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15FB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15FD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\15FE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16.tmp.exe
C:\Users\aroco\AppData\Local\Temp\160.tmp.exe
C:\Users\aroco\AppData\Local\Temp\160A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\160B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\160C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\160D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\160F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\161.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1610.tmp.exe
C:\Users\aroco\AppData\Local\Temp\161B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\161C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\161D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1620.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1621.tmp.exe
C:\Users\aroco\AppData\Local\Temp\162D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\162E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\163F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1640.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1641.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1650.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1651.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1652.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1653.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1661.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1662.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1663.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1664.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1665.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1673.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1674.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1675.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1676.tmp.exe
C:\Users\aroco\AppData\Local\Temp\168.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1683.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1684.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1686.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1687.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1688.tmp.exe
C:\Users\aroco\AppData\Local\Temp\169.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1695.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1696.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1697.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1698.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1699.tmp.exe
C:\Users\aroco\AppData\Local\Temp\169A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16A6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16A7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16A8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16A9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16AA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16AB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16B8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16B9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16BA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16BB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16BC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16BD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16CC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16CD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16CE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16CF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16D9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16DA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16DD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16DF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16EB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16EC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16EE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16EF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16F0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16F1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16FD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16FE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\16FF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1700.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1701.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1702.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1703.tmp.exe
C:\Users\aroco\AppData\Local\Temp\170E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\170F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1712.tmp.exe
C:\Users\aroco\AppData\Local\Temp\172.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1720.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1721.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1723.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1724.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1725.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1726.tmp.exe
C:\Users\aroco\AppData\Local\Temp\173.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1731.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1734.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1736.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1737.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1742.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1743.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1745.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1746.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1748.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1754.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1757.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1759.tmp.exe
C:\Users\aroco\AppData\Local\Temp\175A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1764.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1767.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1768.tmp.exe
C:\Users\aroco\AppData\Local\Temp\176A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\176B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1775.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1776.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1779.tmp.exe
C:\Users\aroco\AppData\Local\Temp\177C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\177D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1787.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1788.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1789.tmp.exe
C:\Users\aroco\AppData\Local\Temp\178A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\178D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\178E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\179.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1798.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1799.tmp.exe
C:\Users\aroco\AppData\Local\Temp\179B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\179C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\179F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17A0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17AA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17AB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17AD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17AE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17B1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17BB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17BC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17BE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17C1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17C2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17CD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17CF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17D0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17D3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17D4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17DE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17DF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17E1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17E2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17E5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17E6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17EF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17F0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17F2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17F3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17F6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\17F7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1801.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1802.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1804.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1805.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1808.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1809.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1815.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1816.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1819.tmp.exe
C:\Users\aroco\AppData\Local\Temp\181A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1822.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1823.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1827.tmp.exe
C:\Users\aroco\AppData\Local\Temp\182B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\182C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\183.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1834.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1835.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1838.tmp.exe
C:\Users\aroco\AppData\Local\Temp\183D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1845.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1848.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1849.tmp.exe
C:\Users\aroco\AppData\Local\Temp\184D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\184E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1856.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1857.tmp.exe
C:\Users\aroco\AppData\Local\Temp\185A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\185B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1868.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1869.tmp.exe
C:\Users\aroco\AppData\Local\Temp\186C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\186D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\186F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1870.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1871.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1879.tmp.exe
C:\Users\aroco\AppData\Local\Temp\187D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\187E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1881.tmp.exe
C:\Users\aroco\AppData\Local\Temp\188A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\188B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\188C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\188F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1892.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1893.tmp.exe
C:\Users\aroco\AppData\Local\Temp\189D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\189F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18A0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18A1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18A2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18A3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18A4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18AD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18AE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18B5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18B6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18BF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18C3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18C4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18C7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18C8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18CF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18D0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18D4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18D5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18D8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18D9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18DA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18E1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18E2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18E6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18EB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18F7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18F8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18FC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\18FD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1902.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1903.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1908.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1909.tmp.exe
C:\Users\aroco\AppData\Local\Temp\190D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\190E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1914.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1915.tmp.exe
C:\Users\aroco\AppData\Local\Temp\191A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\191B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\191F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1920.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1926.tmp.exe
C:\Users\aroco\AppData\Local\Temp\192B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1930.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1931.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1936.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1937.tmp.exe
C:\Users\aroco\AppData\Local\Temp\193C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\193D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\194.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1948.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1949.tmp.exe
C:\Users\aroco\AppData\Local\Temp\194E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\195.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1952.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1953.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1959.tmp.exe
C:\Users\aroco\AppData\Local\Temp\195A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\195E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\195F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1963.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1964.tmp.exe
C:\Users\aroco\AppData\Local\Temp\196B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\196C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1970.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1971.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1975.tmp.exe
C:\Users\aroco\AppData\Local\Temp\197D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\197E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1982.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1983.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1986.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1987.tmp.exe
C:\Users\aroco\AppData\Local\Temp\198E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\198F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1993.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1994.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1995.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1997.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1998.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19A0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19A9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19B1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19B2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19B5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19B6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19B9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19BA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19BB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19C2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19C3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19C7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19CC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19D4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19D5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19D8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19D9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19DD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19DE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19E5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19E6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19E9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19EA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19EE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19EF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19F7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19F8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19FB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\19FC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A00.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A09.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A0D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A0E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A11.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A12.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A19.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A1A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A1E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A1F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A20.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A22.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A2B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A2C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A33.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A40.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A41.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A43.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A44.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A4C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A4D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A4E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A52.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A53.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A55.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A56.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A5F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A64.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A65.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A67.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A68.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A6F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A70.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A75.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A76.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A78.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A81.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A82.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A87.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A88.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A89.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A8A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A93.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A94.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A99.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A9B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A9C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1A9D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AA4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AA9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AAA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AAD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AB5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AB6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AB7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1ABB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1ABC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1ABD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1ABE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1ABF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AC8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1ACF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AD0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AD8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AD9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1ADD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1ADE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AE1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AE2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AEA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AEF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AF0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AF3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AF4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AFA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1AFB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B00.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B01.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B04.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B05.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B0C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B0D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B12.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B13.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B14.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B16.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B17.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B1E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B25.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B26.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B28.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B29.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B2E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B2F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B36.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B37.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B39.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B3A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B40.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B48.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B49.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B4B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B4C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B51.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B52.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B59.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B5A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B5C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B62.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B63.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B6B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B6C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B6D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B74.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B75.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B7E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B7F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B85.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B8C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B8D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B8F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B90.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B96.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B97.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B98.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B9E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1B9F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BA1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BA9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BAA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BB0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BB1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BB2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BB3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BBA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BC1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BC2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BC3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BC4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BCB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BCC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BD3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BD4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BD5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BD6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BDD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BDE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BE4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BE5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BE6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BE7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BEE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BEF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BF6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BF7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BF8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1BF9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C00.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C01.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C08.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C09.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C0A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C0B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C11.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C12.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C19.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C1A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C1B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C1C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C23.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C2B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C2C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C2D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C2E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C34.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C35.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C3D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C3F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C45.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C4D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C4E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C4F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C56.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C57.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C5F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C60.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C61.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C6F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C70.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C71.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C72.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C77.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C78.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C79.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C81.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C83.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C8A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C92.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C93.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C94.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C95.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C9A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1C9B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CA3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CA4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CA5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CA6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CAC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CAD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CB5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CB7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CB8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CBE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CBF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CC6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CC7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CC9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CCA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CCB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CCF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CD0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CD7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CD8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CD9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CDB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CDC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CE1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CE2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CEA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CEB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CED.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CEE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CF3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CF4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CFB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1CFE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D04.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D05.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D0C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D0D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D0F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D10.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D16.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D1E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D1F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D21.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D22.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D26.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D27.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D2F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D30.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D32.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D33.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D38.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D39.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D41.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D42.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D43.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D44.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D45.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D4A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D54.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D56.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D5A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D5B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D64.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D65.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D66.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D67.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D6C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D6D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D76.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D77.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D78.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D79.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D7E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D87.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D89.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D8A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D8E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D8F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D98.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1D99.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DA0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DA1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DAA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DAB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DAC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DB1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DB2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DBA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DBB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DBC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DBD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DC3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DC4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DCC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DCD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DCE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DCF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DD5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DD6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DDE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DE0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DE6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DEE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DEF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DF0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DF1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DF7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1DF8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E00.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E01.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E02.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E03.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E09.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E0A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E11.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E13.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E14.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E1A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E22.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E23.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E24.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E25.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E26.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E2B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E35.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E36.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E37.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E38.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E3B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E3C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E46.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E48.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E4D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E4E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E57.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E58.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E59.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E5A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E5F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E69.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E6A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E6B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E6F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E70.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E7A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E7B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E81.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E82.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E8B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E8C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E8D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E93.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E94.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E9B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E9C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1E9D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EA4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EA5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EAD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EAE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EAF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EB0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EB6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EB7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EBF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EC1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EC7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EC8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1ECF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1ED0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1ED1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1ED2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1ED9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EDA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EE1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EE3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EEB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EEC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EF2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EF4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EF5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1EFC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F02.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F03.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F05.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F06.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F0D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F0E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F0F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F14.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F15.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F17.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F18.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F20.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F21.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F25.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F26.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F28.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F31.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F32.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F37.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F38.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F39.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F3A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F43.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F44.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F49.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F4A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F4B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F4C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F54.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F5A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F5C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F5D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F65.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F66.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F6B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F6C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F6E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F6F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F77.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F7E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F7F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F80.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F81.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F87.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F88.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F8F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F90.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F91.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F92.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F99.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1F9A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FA1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FA3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FA4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FAB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FAC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FB1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FB2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FB4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FB5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FBC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FC3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FC4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FCD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FCE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FD6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FD7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FDE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FDF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FE4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FE5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FE7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FE8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FF0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FF1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FF2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FF6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FF7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FF9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\1FFA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2003.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2004.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2008.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2009.tmp.exe
C:\Users\aroco\AppData\Local\Temp\200B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\200C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2014.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2019.tmp.exe
C:\Users\aroco\AppData\Local\Temp\201A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\201C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\201D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2025.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2026.tmp.exe
C:\Users\aroco\AppData\Local\Temp\202B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\202C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\202E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2037.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2038.tmp.exe
C:\Users\aroco\AppData\Local\Temp\203C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\203E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\203F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\204.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2040.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2048.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2049.tmp.exe
C:\Users\aroco\AppData\Local\Temp\204D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\204E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\204F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\205.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2051.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2052.tmp.exe
C:\Users\aroco\AppData\Local\Temp\205A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\206.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2060.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2061.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2063.tmp.exe
C:\Users\aroco\AppData\Local\Temp\206A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\206B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2071.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2072.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2073.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2074.tmp.exe
C:\Users\aroco\AppData\Local\Temp\207C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\207D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2083.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2085.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2086.tmp.exe
C:\Users\aroco\AppData\Local\Temp\208E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2094.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2095.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2097.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2098.tmp.exe
C:\Users\aroco\AppData\Local\Temp\209E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\209F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20A5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20A6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20B0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20B1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20B7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20B8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20B9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20BA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20C2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20C3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20C7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20C8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20CA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20D3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20D4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20D5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20D9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20DA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20DB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20DC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20E6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20E7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20EB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20ED.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20EE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20F7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20FB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20FC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20FE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\20FF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2108.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2109.tmp.exe
C:\Users\aroco\AppData\Local\Temp\210D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\210E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2110.tmp.exe
C:\Users\aroco\AppData\Local\Temp\211A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\211B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\211F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\212.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2120.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2121.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2122.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2123.tmp.exe
C:\Users\aroco\AppData\Local\Temp\212B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2130.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2131.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2133.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2134.tmp.exe
C:\Users\aroco\AppData\Local\Temp\213C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\213D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\213E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2142.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2143.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2145.tmp.exe
C:\Users\aroco\AppData\Local\Temp\214F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\215.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2150.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2153.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2154.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2155.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2156.tmp.exe
C:\Users\aroco\AppData\Local\Temp\216.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2160.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2165.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2167.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2168.tmp.exe
C:\Users\aroco\AppData\Local\Temp\217.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2171.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2172.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2176.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2177.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2179.tmp.exe
C:\Users\aroco\AppData\Local\Temp\217A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\218.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2182.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2183.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2187.tmp.exe
C:\Users\aroco\AppData\Local\Temp\218A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\218B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2194.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2195.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2198.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2199.tmp.exe
C:\Users\aroco\AppData\Local\Temp\219C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\219D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21AA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21AB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21AE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21B5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21B6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21BB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21BE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21BF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21C7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21C8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21CC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21CD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21D0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21D1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21D9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21DA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21DD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21E1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21EA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21EB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21EE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21EF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\21FC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\220.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2202.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2203.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2204.tmp.exe
C:\Users\aroco\AppData\Local\Temp\220C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\220D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\220F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2210.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2214.tmp.exe
C:\Users\aroco\AppData\Local\Temp\221E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\221F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2220.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2221.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2225.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2226.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2231.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2232.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2233.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2237.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2238.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2242.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2243.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2244.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2248.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2254.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2255.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2256.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2259.tmp.exe
C:\Users\aroco\AppData\Local\Temp\225A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2265.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2266.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2267.tmp.exe
C:\Users\aroco\AppData\Local\Temp\226A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\226B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\226C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\227.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2276.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2277.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2278.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2279.tmp.exe
C:\Users\aroco\AppData\Local\Temp\227A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\227D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\227E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\228.tmp.exe
C:\Users\aroco\AppData\Local\Temp\228B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\228C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\228F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\229.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2297.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2298.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2299.tmp.exe
C:\Users\aroco\AppData\Local\Temp\229C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\229D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\229F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22A0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22AA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22AE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22B1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22B2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22BB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22BC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22BF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22C0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22C3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22C4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22CC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22D0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22D1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22DD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22DE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22E4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22E5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22EF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22F0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22F1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22F2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22F5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\22F6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\230.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2300.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2301.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2303.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2304.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2307.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2308.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2312.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2313.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2315.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2316.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2319.tmp.exe
C:\Users\aroco\AppData\Local\Temp\231A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2323.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2326.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2327.tmp.exe
C:\Users\aroco\AppData\Local\Temp\232A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2334.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2335.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2338.tmp.exe
C:\Users\aroco\AppData\Local\Temp\233B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\233C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2346.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2347.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2349.tmp.exe
C:\Users\aroco\AppData\Local\Temp\234A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\234D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\234E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\234F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2357.tmp.exe
C:\Users\aroco\AppData\Local\Temp\235A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\235B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\235F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2368.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2369.tmp.exe
C:\Users\aroco\AppData\Local\Temp\236A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\236C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\236D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2370.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2371.tmp.exe
C:\Users\aroco\AppData\Local\Temp\237B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\237D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\237E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\238.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2381.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2382.tmp.exe
C:\Users\aroco\AppData\Local\Temp\238B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\238C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\238F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\239.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2393.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2394.tmp.exe
C:\Users\aroco\AppData\Local\Temp\239D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\239E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23A0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23A1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23A5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23AE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23AF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23B1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23B2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23B5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23B6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23B7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23C0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23C3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23C4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23C8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23D1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23D5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23D6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23D9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23DA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23E1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23E2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23E6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23EA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23EB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23F3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23F4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23F7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23F8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\23FC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2405.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2406.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2408.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2409.tmp.exe
C:\Users\aroco\AppData\Local\Temp\240C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\240D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\241.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2416.tmp.exe
C:\Users\aroco\AppData\Local\Temp\241A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\241B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\242.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2427.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2428.tmp.exe
C:\Users\aroco\AppData\Local\Temp\242E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\242F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2438.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2439.tmp.exe
C:\Users\aroco\AppData\Local\Temp\243B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\243C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\243F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2440.tmp.exe
C:\Users\aroco\AppData\Local\Temp\244A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\244B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\244C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\244D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\244E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2451.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2452.tmp.exe
C:\Users\aroco\AppData\Local\Temp\245D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\245F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2460.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2463.tmp.exe
C:\Users\aroco\AppData\Local\Temp\246D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\246E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2470.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2473.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2474.tmp.exe
C:\Users\aroco\AppData\Local\Temp\247F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2480.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2481.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2482.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2485.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2486.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2491.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2492.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2493.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2496.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2497.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24A2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24A4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24A5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24A8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24A9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24B3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24B6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24B7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24BA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24BB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24C3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24C4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24C7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24C8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24CB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24CC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24D5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24D6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24D9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24DA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24DD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24E7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24E8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24EB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24EE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24F8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24FB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24FC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\24FE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2509.tmp.exe
C:\Users\aroco\AppData\Local\Temp\250A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\250D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\250F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\251B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\251C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\251D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\251F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\252C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\252D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\252E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\252F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\253.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2530.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2531.tmp.exe
C:\Users\aroco\AppData\Local\Temp\253F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\254.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2541.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2542.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2543.tmp.exe
C:\Users\aroco\AppData\Local\Temp\254F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2550.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2552.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2553.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2561.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2562.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2563.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2564.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2565.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2573.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2574.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2575.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2576.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2577.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2578.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2584.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2585.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2586.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2587.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2588.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2596.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2597.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2598.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2599.tmp.exe
C:\Users\aroco\AppData\Local\Temp\259A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\259B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25A9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25AA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25AB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25AC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25B9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25BA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25BB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25BC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25BD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25CB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25CC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25CD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25CE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25CF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25D0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25DC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25DD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25DE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25DF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25E0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25E1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25EE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25F0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\25F1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2602.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2603.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2604.tmp.exe
C:\Users\aroco\AppData\Local\Temp\260E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\260F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2610.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2613.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2614.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2615.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2616.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2621.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2622.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2625.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2626.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2627.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2633.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2636.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2637.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2638.tmp.exe
C:\Users\aroco\AppData\Local\Temp\264.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2643.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2644.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2647.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2648.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2649.tmp.exe
C:\Users\aroco\AppData\Local\Temp\264A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\265.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2655.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2656.tmp.exe
C:\Users\aroco\AppData\Local\Temp\265B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\265C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2666.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2667.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2668.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2669.tmp.exe
C:\Users\aroco\AppData\Local\Temp\266A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\266C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\266D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2678.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2679.tmp.exe
C:\Users\aroco\AppData\Local\Temp\267B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\267E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\267F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\268A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\268B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\268C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\268D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2690.tmp.exe
C:\Users\aroco\AppData\Local\Temp\269B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\269D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\269E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26A0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26A1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26AC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26AD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26AF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26B0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26B2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26B3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26BE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26BF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26C0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26C1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26C3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26C4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26C5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26CF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26D2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26D3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26D6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26E0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26E4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26E5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26E7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26E8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26F0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26F1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26F5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26F6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26F8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\26F9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2702.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2703.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2707.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2708.tmp.exe
C:\Users\aroco\AppData\Local\Temp\270A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2714.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2715.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2719.tmp.exe
C:\Users\aroco\AppData\Local\Temp\271A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\271B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\271C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2725.tmp.exe
C:\Users\aroco\AppData\Local\Temp\272A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\272B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\272C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2736.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2737.tmp.exe
C:\Users\aroco\AppData\Local\Temp\273D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\273E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2748.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2749.tmp.exe
C:\Users\aroco\AppData\Local\Temp\274B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\274C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\274E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\274F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2759.tmp.exe
C:\Users\aroco\AppData\Local\Temp\275A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\275D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\275E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\276.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2760.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2761.tmp.exe
C:\Users\aroco\AppData\Local\Temp\276B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\276C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\276F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2770.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2772.tmp.exe
C:\Users\aroco\AppData\Local\Temp\277C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\277D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2780.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2781.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2782.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2783.tmp.exe
C:\Users\aroco\AppData\Local\Temp\278E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2792.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2794.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2795.tmp.exe
C:\Users\aroco\AppData\Local\Temp\279F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27A0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27A3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27A4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27A6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27A7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27A8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27B0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27B1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27B4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27B5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27B6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27B8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27C2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27C7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27C9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27CA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27D3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27D7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27D8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27DA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27DB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27E3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27E4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27E9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27EA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27EC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27F5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27F6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27FB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27FC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27FD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\27FE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28.tmp.exe
C:\Users\aroco\AppData\Local\Temp\280.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2806.tmp.exe
C:\Users\aroco\AppData\Local\Temp\280C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\280D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\280E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\281.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2817.tmp.exe
C:\Users\aroco\AppData\Local\Temp\281F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2820.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2828.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2829.tmp.exe
C:\Users\aroco\AppData\Local\Temp\282E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\282F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2831.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2832.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2839.tmp.exe
C:\Users\aroco\AppData\Local\Temp\283A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\283F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2840.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2842.tmp.exe
C:\Users\aroco\AppData\Local\Temp\284B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\284C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2851.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2853.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2854.tmp.exe
C:\Users\aroco\AppData\Local\Temp\285D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2861.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2862.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2864.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2865.tmp.exe
C:\Users\aroco\AppData\Local\Temp\286D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\287.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2873.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2874.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2876.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2877.tmp.exe
C:\Users\aroco\AppData\Local\Temp\287E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\287F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2885.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2886.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2888.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2889.tmp.exe
C:\Users\aroco\AppData\Local\Temp\288F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2896.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2897.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2899.tmp.exe
C:\Users\aroco\AppData\Local\Temp\289A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28A0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28A1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28A8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28A9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28AB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28AC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28B2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28BA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28BD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28C2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28C3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28CA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28CB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28CD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28CE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28D4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28DC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28DD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28DF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28E5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28E6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28ED.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28EE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28F6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28F7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\28FF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2900.tmp.exe
C:\Users\aroco\AppData\Local\Temp\291.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2910.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2911.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2912.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2917.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2918.tmp.exe
C:\Users\aroco\AppData\Local\Temp\292.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2921.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2922.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2923.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2929.tmp.exe
C:\Users\aroco\AppData\Local\Temp\292A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2933.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2934.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2935.tmp.exe
C:\Users\aroco\AppData\Local\Temp\293B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\293C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2946.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2947.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2948.tmp.exe
C:\Users\aroco\AppData\Local\Temp\294C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2957.tmp.exe
C:\Users\aroco\AppData\Local\Temp\295D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\295E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2968.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2969.tmp.exe
C:\Users\aroco\AppData\Local\Temp\296A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\296F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2970.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2978.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2979.tmp.exe
C:\Users\aroco\AppData\Local\Temp\297A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\297B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\298.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2980.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2981.tmp.exe
C:\Users\aroco\AppData\Local\Temp\298A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\298B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\298C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2992.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2993.tmp.exe
C:\Users\aroco\AppData\Local\Temp\299C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\299D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\299E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29A3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29A4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29AC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29AE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29AF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29B5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29BD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29C0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29C1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29C6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29C7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29CE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29CF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29D2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29D3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29D7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29D8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29DF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29E0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29E3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29E4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29E9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29F1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29F2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29F5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29FA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\29FB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A02.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A05.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A06.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A0B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A0C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A13.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A14.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A17.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A18.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A1D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A25.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A29.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A2A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A2D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A2E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A35.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A36.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A3F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A40.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A4A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A4B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A51.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A52.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A57.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A58.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A5C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A5D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A62.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A63.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A68.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A69.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A6D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A6E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A74.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A75.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A7A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A7F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A86.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A87.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A8A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A8B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A8F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A90.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A97.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A98.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2A9C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AA1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AA9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AAA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AAD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AAE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AB2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AB3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AB4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2ABA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2ABE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2ABF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AC4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AC5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2ACB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2ACC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2ACD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AD0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AD1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AD6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AD7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2ADE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2ADF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AE2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AE8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AE9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AEF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AF2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AF3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AF9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2AFA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B00.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B01.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B04.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B0B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B12.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B13.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B14.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B15.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B1B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B1C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B1D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B23.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B26.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B27.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B2E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B2F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B34.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B38.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B40.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B44.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B45.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B48.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B49.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B50.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B51.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B56.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B57.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B5A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B62.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B63.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B68.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B69.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B6B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B6C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B74.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B75.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B79.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B7C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B8A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B8B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B8D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B95.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B96.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B9C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B9D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2B9E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BA6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BA7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BAD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BAE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BAF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BB8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BB9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BBF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BC0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BC1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BCA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BCB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BD0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BD1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BD2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BDB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BDC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BE2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BE3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BE4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BED.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BF4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BF5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BF6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BFE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2BFF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C04.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C05.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C06.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C07.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C0F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C10.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C16.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C18.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C19.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C21.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C22.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C27.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C29.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C2A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C32.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C37.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C38.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C3B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C3C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C43.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C44.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C49.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C4A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C4D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C55.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C56.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C5A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C5B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C5D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C5E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C6C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C76.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C77.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C7D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C7E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C7F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C80.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C88.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C89.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C8E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C8F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C90.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C91.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C99.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2C9A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CA0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CA1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CA2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CA3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CAB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CAC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CB2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CB3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CB4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CBC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CBD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CC2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CC3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CC5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CCE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CD4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CD5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CD6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CD7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CDF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CE0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CE1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CE5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CE7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CE8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CE9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CF1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CF2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CF6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CF7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2CFA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D03.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D08.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D09.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D0B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D0C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D14.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D15.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D19.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D1C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D1D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D25.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D26.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D2A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D2B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D2E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D37.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D38.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D3C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D3D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D3E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D3F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D48.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D49.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D4A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D4D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D50.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D51.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D5B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D5C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D62.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D63.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D6D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D6E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D6F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D73.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D7F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D80.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D81.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D84.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D85.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D91.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D92.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D93.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2D96.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DA2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DA4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DA5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DA6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DA7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DB3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DB4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DC5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DC6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DC7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DC8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DD5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DD6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DD7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DD8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DD9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DDA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DE8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DE9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DEA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DEB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DF9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DFB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DFC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2DFD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E0A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E0B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E0D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E0E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E0F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E1C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E1D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E1F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E20.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E21.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E2D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E2E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E2F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E30.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E31.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E32.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E33.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E42.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E43.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E44.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E4F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E50.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E53.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E54.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E55.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E56.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E60.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E61.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E65.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E66.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E67.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E72.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E73.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E76.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E77.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E78.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E83.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E87.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E88.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E89.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E8A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E94.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2E95.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EA6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EA7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EA9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EAA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EAB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EAC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EB7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EB8.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EBA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EBB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EBD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EC9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2ECA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2ECC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2ECD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2ECE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2ECF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EDB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EDC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EDD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EDE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EE0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EEC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EED.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EEF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EF0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EF1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EFE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2EFF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F00.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F01.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F02.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F03.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F0F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F11.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F12.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F14.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F15.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F20.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F21.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F22.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F23.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F24.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F25.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F26.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F33.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F34.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F35.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F36.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F37.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F38.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F44.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F46.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F47.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F49.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F4A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F55.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F56.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F58.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F59.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F5A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F67.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F69.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F6B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F6C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F77.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F78.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F7A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F7B.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F7C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F8C.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F8D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F8E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F9.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F98.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F99.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F9A.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F9D.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F9E.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2F9F.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FA.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FA0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FAB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FAC.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FAF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FB.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FB0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FB1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FBD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FC1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FC2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FC3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FCD.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FCE.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FD1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FD2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FD4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FD5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FDF.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FE0.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FE5.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FE6.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FF1.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FF2.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FF3.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FF4.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FF7.tmp.exe
C:\Users\aroco\AppData\Local\Temp\2FF8.tmp.exe


#10 cloudsoda

cloudsoda
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:12:30 PM

Posted 23 April 2016 - 11:42 PM

This is... the forum does NOT like me posting all this stuff. Keeps giving me a "site is offline" message and I have to refresh. :S  I've done this about 3 times now. Sure I can't just upload the .txt file?

 

EDIT: I'm just gonna upload the FRST file and save us both the trouble.

 

 

Attached Files


Edited by cloudsoda, 24 April 2016 - 12:16 AM.


#11 polskamachina

polskamachina

  • Malware Response Team
  • 3,930 posts
  • ONLINE
  •  
  • Gender:Male
  • Local time:12:30 PM

Posted 24 April 2016 - 12:18 AM

Hi cloudsoda :)

 

Sorry you're having troubles. Please feel free to upload/attach the complete text file.

 

Let me know if you have any questions.

 

polskamachina



#12 cloudsoda

cloudsoda
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:12:30 PM

Posted 24 April 2016 - 11:15 AM

FRST.txt has been uploaded (I should have just done that in the first place  :rolleyes: ).



#13 polskamachina

polskamachina

  • Malware Response Team
  • 3,930 posts
  • ONLINE
  •  
  • Gender:Male
  • Local time:12:30 PM

Posted 24 April 2016 - 11:28 AM

Got it. Thank you.

 

polskamachina



#14 polskamachina

polskamachina

  • Malware Response Team
  • 3,930 posts
  • ONLINE
  •  
  • Gender:Male
  • Local time:12:30 PM

Posted 25 April 2016 - 07:03 PM

Hi cloudsoda,
 
Good work posting that lengthy FRST.txt file. :thumbup2:
 
First I would like to get a general report of your system info:

  • Press and hold the windows flag key, then tap the letter r on your keyboard at the same time
  • Type msinfo32 into the Run box, then press Enter
  • Left click on System Summary
  • Click File, Save..., and name the file Summary
  • Zip and attach that saved file into your next reply to me.

Next:

 

The following procedure will delete your numerous temporary files and also empty your recycle bin. If you have anything in the recycle bin that you'd like to retrieve, now is the time to restore those files.
 
We need to run a fix with FRST:
Please copy and paste the following text in its entirety into Notepad

CreateRestorePoint:
CloseProcesses:
HKU\S-1-5-21-735421175-1461169506-2791873875-1001\...\Run: [AdobeBridge] => [X]
S2 Eruvwee; "C:\Users\aroco\AppData\Roaming\LaexuGegobog\Reloace.exe" -cms [X]
Task: {AEF1AC9E-0C90-4231-A3EC-0A44B1C6E809} - \SecurityApps2 -> No File <==== ATTENTION
ShortcutWithArgument: C:\Users\aroco\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://navigation.iwatchavi.com/
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://navigation.iwatchavi.com/
ShortcutWithArgument: C:\Users\Public\Desktop\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://navigation.iwatchavi.com/
CMD: type "C:\Users\aroco\Desktop\JRT.txt"
CMD: type "C:\TDSSKiller.3.1.0.9_22.04.2016_23.04.28_log.txt"
emptytemp:

 
Save the file to your Desktop as fixlist.txt.
 
NOTE. It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work.

  • Run FRST64 and press the Fix button just once and wait.
  • If for some reason the tool needs a restart, please make sure you let the system restart normally. Due to the extreme number of temporary files on your system, it may take anywhere from a few minutes to more than an hour for the fix to complete. Please be patient!
  • When finished, FRST will generate a log on the Desktop, Fixlog.txt. Please copy and paste it into your next reply to me.

Next:
 
Please download AdwCleaner again by Xplode and save it to your Desktop.

  • Right-click it and select Run As Administrator
  • The tool will start to update the database, please wait a bit.
  • Click on I agree button.
  • Click on the Scan button.
  • AdwCleaner will begin...be patient as the scan may take some time to complete.
  • After the scan has finished, click on the Logfile button...a logfile (AdwCleaner[S#].txt) will open in Notepad for review (where the largest value of # represents the most recent report).
  • The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it. If you see an entry you want to keep, let me know about it.
  • Copy and paste the contents of that logfile in your next reply.
  • A copy of all logfiles are saved to C:\AdwCleaner.

In summary I will need from you:

  • Attached zip file of your msinfo32 Summary.
  • Fixlog.txt
  • AdwCleaner scan log
  • How is your computer performing now? Are you still being redirected?

Let me know if you have any questions.
 
polskamachina



#15 cloudsoda

cloudsoda
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:12:30 PM

Posted 25 April 2016 - 10:08 PM

So I restarted the computer and all per your instructions, but this time when I started Chrome, it didn't open with that redirect page!  :woot: I've attached the summary zip and fixlog. Here's Adwcleaner's logfile:

 

# AdwCleaner v5.113 - Logfile created 25/04/2016 at 20:05:27
# Updated 24/04/2016 by Xplode
# Database : 2016-04-24.3 [Server]
# Operating system : Windows 10 Home  (X64)
# Username : aroco - DESKTOP-97NB5PD
# Running from : C:\Users\aroco\Downloads\AdwCleaner.exe
# Option : Scan
 
***** [ Services ] *****
 
 
***** [ Folders ] *****
 
 
***** [ Files ] *****
 
 
***** [ DLL ] *****
 
 
***** [ Shortcuts ] *****
 
 
***** [ Scheduled tasks ] *****
 
 
***** [ Registry ] *****
 
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{730E03E4-350E-48E5-9D3E-4329903D454D}
 
***** [ Web browsers ] *****
 
 
*************************
 
C:\AdwCleaner\AdwCleaner[S1].txt - [757 bytes] - [23/04/2016 09:24:21]
C:\AdwCleaner\AdwCleaner[S2].txt - [829 bytes] - [23/04/2016 09:28:40]
C:\AdwCleaner\AdwCleaner[S3].txt - [901 bytes] - [23/04/2016 09:29:08]
C:\AdwCleaner\AdwCleaner[S4].txt - [926 bytes] - [25/04/2016 20:05:27]
 
########## EOF - C:\AdwCleaner\AdwCleaner[S4].txt - [998 bytes] ##########
 
Seems like a clean bill of health to me, aside from that registry entry.

Attached Files






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users