Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Windows Script Host is trying to run a .vbs File


  • This topic is locked This topic is locked
8 replies to this topic

#1 Zerian

Zerian

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:04:30 PM

Posted 05 March 2017 - 05:37 AM

Hello,

 

Yesterday i opened a virus, and since then i tried to fix it by my self by deleting a part of the virus, but theres still a Popup going on thats telling me that:

 

The Script "C:\WmmzyT1JMkWmmzyT1JMk\WmmzyT1JMk.vbs" cant be found.

 

I think the script cant be found because i deleted it yesterday because it was a part of the virus, now i need you to help me fixing this popup. I think

that i need to find the file thats trying to run wscript.exe and opening the .vbs Script.

 

 

This is the first result of FRST - Im sorry that its in german, but idk how i can turn it in english

 

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 04-03-2017
durchgeführt von Luca (Administrator) auf DESKTOP-NTF4MSP (05-03-2017 11:29:29)
Gestartet von C:\Users\Luca\Downloads
Geladene Profile: Luca (Verfügbare Profile: defaultuser0 & Luca)
Platform: Windows 10 Pro Version 1607 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: Chrome)
Start-Modus: Normal
 
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
 
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
 
(AMD) C:\Windows\System32\atiesrxx.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Drivers\APOService\LogiRegistryService.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
() C:\Program Files\ATI Technologies\ATI.ACE\a4\AdaptiveSleepService.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe
(Skillbrains) C:\Program Files (x86)\Skillbrains\lightshot\5.4.0.1\Lightshot.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\AdobeIPCBroker.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.110.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
(Skype Technologies) C:\Program Files (x86)\Skype\Browser\SkypeBrowserHost.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
() C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\CCXProcess.exe
(Node.js) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\libs\node.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\CCLibrary.exe
(Node.js) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\libs\node.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Skype Technologies) C:\Program Files (x86)\Skype\Browser\SkypeBrowserHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(TeamSpeak Systems GmbH) C:\Users\Luca\AppData\Local\TeamSpeak 3 Client\ts3client_win64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
 
==================== Registry (Nicht auf der Ausnahmeliste) ====================
 
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
 
HKLM\...\Run: [WindowsDefender] => C:\Program Files\Windows Defender\MSASCuiL.exe [631808 2016-11-20] (Microsoft Corporation)
HKLM\...\Run: [Launch LCore] => C:\Program Files\Logitech Gaming Software\LCore.exe [17406072 2017-01-23] (Logitech Inc.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508128 2016-07-01] (Adobe Systems Incorporated)
HKLM\...\Run: [StartCN] => C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe [8027016 2016-11-21] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [2780112 2017-01-20] (Malwarebytes)
HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2384984 2016-12-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Lightshot] => C:\Program Files (x86)\Skillbrains\lightshot\Lightshot.exe [225944 2016-07-11] ()
HKU\S-1-5-21-2582490348-2044156764-553856435-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [27427808 2017-02-08] (Skype Technologies S.A.)
HKU\S-1-5-21-2582490348-2044156764-553856435-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2881824 2017-01-19] (Valve Corporation)
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-10-25] ()
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-10-25] ()
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-10-25] ()
 
==================== Internet (Nicht auf der Ausnahmeliste) ====================
 
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
 
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{52533d9b-0778-4a69-b63e-f575248b1c7a}: [DhcpNameServer] 192.168.0.1
 
Internet Explorer:
==================
 
FireFox:
========
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2016-12-09] (Adobe Systems)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2017-02-22] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2017-02-22] (Google Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2016-12-09] (Adobe Systems)
 
Chrome: 
=======
CHR StartupUrls: Default -> "hxxps://www.google.de/"
CHR Profile: C:\Users\Luca\AppData\Local\Google\Chrome\User Data\Default [2017-03-05]
CHR Extension: (Google Präsentationen) - C:\Users\Luca\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-02-22]
CHR Extension: (Google Docs) - C:\Users\Luca\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-02-22]
CHR Extension: (Google Drive) - C:\Users\Luca\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-02-22]
CHR Extension: (YouTube) - C:\Users\Luca\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-02-22]
CHR Extension: (Google Tabellen) - C:\Users\Luca\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-02-22]
CHR Extension: (Google Docs Offline) - C:\Users\Luca\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-02-22]
CHR Extension: (AdBlock) - C:\Users\Luca\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2017-02-26]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Luca\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-02-22]
CHR Extension: (Google Mail) - C:\Users\Luca\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-02-22]
CHR Extension: (Chrome Media Router) - C:\Users\Luca\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-02-22]
 
==================== Dienste (Nicht auf der Ausnahmeliste) ====================
 
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 
R2 AdaptiveSleepService; C:\Program Files\ATI Technologies\ATI.ACE\A4\AdaptiveSleepService.exe [155016 2016-11-21] ()
R2 AdobeUpdateService; C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [753240 2016-12-09] (Adobe Systems Incorporated)
R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2227312 2017-01-19] (Adobe Systems, Incorporated)
R2 igfxCUIService2.0.0.0; C:\Windows\system32\igfxCUIService.exe [373744 2016-11-01] (Intel Corporation)
R2 LogiRegistryService; C:\Program Files\Logitech Gaming Software\Drivers\APOService\LogiRegistryService.exe [225400 2017-01-23] (Logitech Inc.)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4355024 2017-01-20] (Malwarebytes)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [2889896 2016-11-20] (Microsoft Corporation)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)
 
===================== Treiber (Nicht auf der Ausnahmeliste) ======================
 
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 
R3 amdkmdag; C:\Windows\System32\DriverStore\FileRepository\c0309377.inf_amd64_7ab08912e1e1da0a\atikmdag.sys [26568848 2017-01-25] (Advanced Micro Devices, Inc.)
R3 amdkmdap; C:\Windows\System32\DriverStore\FileRepository\c0309377.inf_amd64_7ab08912e1e1da0a\atikmpag.sys [536600 2017-01-25] (Advanced Micro Devices, Inc.)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWT6.sys [110104 2016-09-28] (Advanced Micro Devices)
S3 CM_VENDER_CMD; C:\Program Files\Common Files\Logitech\G430Install\CMVC64.sys [17104 2014-07-30] (Windows ® Win 7 DDK provider)
R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [77408 2017-02-24] ()
R3 ladfGSS; C:\Windows\system32\drivers\ladfGSS.sys [54552 2017-01-23] (Logitech Inc.)
R2 LGCoreTemp; C:\Program Files\Logitech Gaming Software\Drivers\LgCoreTemp\lgcoretemp.sys [14184 2015-06-21] (Logitech)
R3 LGJoyXlCore; C:\Windows\system32\drivers\LGJoyXlCore.sys [67736 2017-01-23] (Logitech Inc.)
R3 Lycosa; C:\Windows\system32\drivers\Lycosa.sys [18816 2008-01-17] (Razer USA Ltd.)
R2 MBAMChameleon; C:\Windows\system32\drivers\MBAMChameleon.sys [186304 2017-03-04] (Malwarebytes)
R3 MBAMFarflt; C:\Windows\system32\drivers\farflt.sys [111544 2017-03-04] (Malwarebytes)
R3 MBAMProtection; C:\Windows\system32\drivers\mbam.sys [43968 2017-03-04] (Malwarebytes)
R0 MBAMSwissArmy; C:\Windows\System32\drivers\MBAMSwissArmy.sys [251840 2017-03-04] (Malwarebytes)
R3 MBAMWebProtection; C:\Windows\system32\drivers\mwac.sys [92088 2017-03-05] (Malwarebytes)
S3 NetAdapterCx; C:\Windows\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
 
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
 
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 
 
==================== Ein Monat: Erstellte Dateien und Ordner ========
 
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
 
2017-03-05 11:29 - 2017-03-05 11:29 - 00013342 _____ C:\Users\Luca\Downloads\FRST.txt
2017-03-05 11:17 - 2017-03-05 11:29 - 00000000 ____D C:\FRST
2017-03-05 11:17 - 2017-03-05 11:17 - 02423296 _____ (Farbar) C:\Users\Luca\Downloads\FRST64.exe
2017-03-04 17:03 - 2017-03-04 17:03 - 00005554 _____ C:\Windows\system32\PerfStringBackup.TMP
2017-03-04 16:57 - 2017-03-05 10:33 - 00000180 _____ C:\Windows\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2017-03-04 16:08 - 2017-03-04 16:56 - 00065536 _____ C:\Windows\system32\spu_storage.bin
2017-03-04 16:07 - 2017-03-04 16:08 - 05205586 _____ C:\Users\Luca\Desktop\2017-03-04 16-07-28.mp4
2017-03-04 15:16 - 2017-03-04 15:16 - 00002607 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Daphne.lnk
2017-03-04 15:16 - 2017-03-04 15:16 - 00000000 ____D C:\Program Files\DRK
2017-03-04 14:19 - 2017-03-05 11:18 - 00092088 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
2017-03-04 14:19 - 2017-03-04 16:57 - 00251840 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-03-04 14:19 - 2017-03-04 16:57 - 00186304 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMChameleon.sys
2017-03-04 14:19 - 2017-03-04 16:57 - 00111544 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys
2017-03-04 14:19 - 2017-03-04 16:57 - 00043968 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2017-03-04 14:19 - 2017-03-04 14:19 - 00001912 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-03-04 14:19 - 2017-03-04 14:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-03-04 14:19 - 2017-03-04 14:19 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-03-04 14:19 - 2017-03-04 14:19 - 00000000 ____D C:\Program Files\Malwarebytes
2017-03-04 14:19 - 2017-02-24 06:23 - 00077408 _____ C:\Windows\system32\Drivers\mbae64.sys
2017-03-04 13:27 - 2017-03-04 13:27 - 00000000 ____D C:\ProgramData\AMD
2017-03-04 11:27 - 2017-03-04 16:08 - 00000000 __SHD C:\WmmzyT1JMkWmmzyT1JMk
2017-03-04 11:27 - 2017-03-04 11:27 - 00003556 _____ C:\Windows\System32\Tasks\WmmzyT1JMk
2017-03-04 01:17 - 2017-03-04 01:18 - 00000016 _____ C:\Users\Luca\Desktop\Neues Textdokument.txt
2017-03-03 18:57 - 2017-03-03 19:12 - 00000000 ____D C:\Users\Luca\AppData\Roaming\Notepad++
2017-03-03 18:57 - 2017-03-03 18:57 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++
2017-03-03 18:57 - 2017-03-03 18:57 - 00000000 ____D C:\Program Files\Notepad++
2017-03-03 18:47 - 2016-09-03 18:03 - 01016320 _____ (we_sux (full updated for 0.3e by FYP)) C:\Users\Luca\Desktop\d3d9.dll
2017-03-03 18:31 - 2017-03-03 18:51 - 00000000 ____D C:\Users\Luca\Documents\GTA San Andreas User Files
2017-03-03 18:31 - 2017-03-03 18:31 - 00000000 ____D C:\Users\Luca\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\San Andreas Multiplayer
2017-03-02 19:25 - 2017-03-04 13:11 - 00000000 ____D C:\Users\Luca\Desktop\GTA SA
2017-03-02 19:17 - 2017-03-02 19:24 - 701897648 _____ C:\Users\Luca\Downloads\FSX.rar
2017-02-28 19:03 - 2017-03-03 21:03 - 00001441 _____ C:\Users\Public\Desktop\LOL SKIN.lnk
2017-02-28 19:03 - 2017-03-03 21:03 - 00000000 ____D C:\HoTroLoL
2017-02-28 19:03 - 2017-02-28 13:19 - 02091790 _____ C:\Users\Luca\Desktop\Data.lol
2017-02-28 19:03 - 2016-03-26 06:02 - 00303104 _____ (By ModskinlolVN.COM) C:\Users\Luca\Desktop\LOLPRO 7.4.1.exe
2017-02-27 18:50 - 2017-02-27 18:50 - 00000222 _____ C:\Users\Luca\Desktop\Arma 3.url
2017-02-27 18:50 - 2017-02-27 18:50 - 00000000 ____D C:\Users\Luca\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2017-02-27 17:57 - 2017-02-27 18:45 - 00000000 ____D C:\Users\Luca\AppData\Roaming\TeamViewer
2017-02-27 17:27 - 2017-02-27 17:41 - 00000000 ____D C:\Users\Luca\AppData\Roaming\EloBuddy
2017-02-27 17:27 - 2017-02-27 17:27 - 00001111 _____ C:\Users\Public\Desktop\EloBuddy.lnk
2017-02-27 17:27 - 2017-02-27 17:27 - 00000000 ____D C:\Program Files (x86)\EloBuddy
2017-02-27 17:26 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll
2017-02-27 17:26 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2017-02-27 17:26 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll
2017-02-27 17:26 - 2010-06-02 04:55 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_7.dll
2017-02-27 17:26 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2017-02-27 17:26 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll
2017-02-27 17:26 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2017-02-27 17:26 - 2010-05-26 11:41 - 02401112 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_43.dll
2017-02-27 17:26 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll
2017-02-27 17:26 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_43.dll
2017-02-27 17:26 - 2010-05-26 11:41 - 01907552 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll
2017-02-27 17:26 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll
2017-02-27 17:26 - 2010-05-26 11:41 - 00511328 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_43.dll
2017-02-27 17:26 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_43.dll
2017-02-27 17:26 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll
2017-02-27 17:26 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll
2017-02-27 17:26 - 2010-02-04 10:01 - 00530776 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_6.dll
2017-02-27 17:26 - 2010-02-04 10:01 - 00528216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_6.dll
2017-02-27 17:26 - 2010-02-04 10:01 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_6.dll
2017-02-27 17:26 - 2010-02-04 10:01 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_6.dll
2017-02-27 17:26 - 2010-02-04 10:01 - 00078680 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_4.dll
2017-02-27 17:26 - 2010-02-04 10:01 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_4.dll
2017-02-27 17:26 - 2010-02-04 10:01 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_7.dll
2017-02-27 17:26 - 2010-02-04 10:01 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_7.dll
2017-02-27 17:26 - 2009-09-04 17:44 - 00517960 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_5.dll
2017-02-27 17:26 - 2009-09-04 17:44 - 00515416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_5.dll
2017-02-27 17:26 - 2009-09-04 17:44 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_5.dll
2017-02-27 17:26 - 2009-09-04 17:44 - 00176968 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_5.dll
2017-02-27 17:26 - 2009-09-04 17:44 - 00073544 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_3.dll
2017-02-27 17:26 - 2009-09-04 17:44 - 00069464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_3.dll
2017-02-27 17:26 - 2009-09-04 17:29 - 05554512 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_42.dll
2017-02-27 17:26 - 2009-09-04 17:29 - 05501792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_42.dll
2017-02-27 17:26 - 2009-09-04 17:29 - 02582888 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_42.dll
2017-02-27 17:26 - 2009-09-04 17:29 - 02475352 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_42.dll
2017-02-27 17:26 - 2009-09-04 17:29 - 01974616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_42.dll
2017-02-27 17:26 - 2009-09-04 17:29 - 01892184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_42.dll
2017-02-27 17:26 - 2009-09-04 17:29 - 00523088 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll
2017-02-27 17:26 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_42.dll
2017-02-27 17:26 - 2009-09-04 17:29 - 00285024 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_42.dll
2017-02-27 17:26 - 2009-09-04 17:29 - 00235344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_42.dll
2017-02-27 17:26 - 2009-03-16 14:18 - 00521560 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_4.dll
2017-02-27 17:26 - 2009-03-16 14:18 - 00517448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_4.dll
2017-02-27 17:26 - 2009-03-16 14:18 - 00235352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_4.dll
2017-02-27 17:26 - 2009-03-16 14:18 - 00174936 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_4.dll
2017-02-27 17:26 - 2009-03-16 14:18 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_6.dll
2017-02-27 17:26 - 2009-03-16 14:18 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_6.dll
2017-02-27 17:26 - 2009-03-09 15:27 - 05425496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_41.dll
2017-02-27 17:26 - 2009-03-09 15:27 - 04178264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_41.dll
2017-02-27 17:26 - 2009-03-09 15:27 - 02430312 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_41.dll
2017-02-27 17:26 - 2009-03-09 15:27 - 01846632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_41.dll
2017-02-27 17:26 - 2009-03-09 15:27 - 00520544 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_41.dll
2017-02-27 17:26 - 2009-03-09 15:27 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_41.dll
2017-02-27 17:26 - 2008-10-27 10:04 - 00518480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_3.dll
2017-02-27 17:26 - 2008-10-27 10:04 - 00514384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_3.dll
2017-02-27 17:26 - 2008-10-27 10:04 - 00235856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_3.dll
2017-02-27 17:26 - 2008-10-27 10:04 - 00175440 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_3.dll
2017-02-27 17:26 - 2008-10-27 10:04 - 00074576 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_2.dll
2017-02-27 17:26 - 2008-10-27 10:04 - 00070992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_2.dll
2017-02-27 17:26 - 2008-10-27 10:04 - 00025936 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_5.dll
2017-02-27 17:26 - 2008-10-27 10:04 - 00023376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_5.dll
2017-02-27 17:26 - 2008-10-10 04:52 - 05631312 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_40.dll
2017-02-27 17:26 - 2008-10-10 04:52 - 04379984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_40.dll
2017-02-27 17:26 - 2008-10-10 04:52 - 02605920 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_40.dll
2017-02-27 17:26 - 2008-10-10 04:52 - 02036576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_40.dll
2017-02-27 17:26 - 2008-10-10 04:52 - 00519000 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_40.dll
2017-02-27 17:26 - 2008-10-10 04:52 - 00452440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_40.dll
2017-02-27 17:26 - 2008-07-31 10:41 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_2.dll
2017-02-27 17:26 - 2008-07-31 10:41 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_2.dll
2017-02-27 17:26 - 2008-07-31 10:41 - 00072200 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_1.dll
2017-02-27 17:26 - 2008-07-31 10:40 - 00513544 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_2.dll
2017-02-27 17:26 - 2008-07-10 11:00 - 04992520 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_39.dll
2017-02-27 17:26 - 2008-07-10 11:00 - 01942552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_39.dll
2017-02-27 17:26 - 2008-07-10 11:00 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_39.dll
2017-02-27 17:26 - 2008-05-30 14:19 - 00511496 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_1.dll
2017-02-27 17:26 - 2008-05-30 14:19 - 00507400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_1.dll
2017-02-27 17:26 - 2008-05-30 14:18 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_1.dll
2017-02-27 17:26 - 2008-05-30 14:18 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_1.dll
2017-02-27 17:26 - 2008-05-30 14:17 - 00068104 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_0.dll
2017-02-27 17:26 - 2008-05-30 14:17 - 00065032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_0.dll
2017-02-27 17:26 - 2008-05-30 14:17 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_4.dll
2017-02-27 17:26 - 2008-05-30 14:16 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_4.dll
2017-02-27 17:26 - 2008-05-30 14:11 - 04991496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_38.dll
2017-02-27 17:26 - 2008-05-30 14:11 - 03850760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_38.dll
2017-02-27 17:26 - 2008-05-30 14:11 - 01941528 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_38.dll
2017-02-27 17:26 - 2008-05-30 14:11 - 01491992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_38.dll
2017-02-27 17:26 - 2008-05-30 14:11 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_38.dll
2017-02-27 17:26 - 2008-05-30 14:11 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_38.dll
2017-02-27 17:26 - 2008-03-05 16:04 - 00489480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_0.dll
2017-02-27 17:26 - 2008-03-05 16:03 - 00479752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_0.dll
2017-02-27 17:26 - 2008-03-05 16:03 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_0.dll
2017-02-27 17:26 - 2008-03-05 16:03 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_0.dll
2017-02-27 17:26 - 2008-03-05 16:00 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_3.dll
2017-02-27 17:26 - 2008-03-05 16:00 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_3.dll
2017-02-27 17:26 - 2008-03-05 15:56 - 04910088 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_37.dll
2017-02-27 17:26 - 2008-03-05 15:56 - 03786760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_37.dll
2017-02-27 17:26 - 2008-03-05 15:56 - 01860120 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_37.dll
2017-02-27 17:26 - 2008-03-05 15:56 - 01420824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_37.dll
2017-02-27 17:26 - 2008-02-05 23:07 - 00529424 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_37.dll
2017-02-27 17:26 - 2008-02-05 23:07 - 00462864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_37.dll
2017-02-27 17:26 - 2007-10-22 03:40 - 00411656 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_10.dll
2017-02-27 17:26 - 2007-10-22 03:39 - 00267272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_10.dll
2017-02-27 17:26 - 2007-10-22 03:37 - 00021000 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_2.dll
2017-02-27 17:26 - 2007-10-22 03:37 - 00017928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_2.dll
2017-02-27 17:26 - 2007-10-12 15:14 - 05081608 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_36.dll
2017-02-27 17:26 - 2007-10-12 15:14 - 03734536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_36.dll
2017-02-27 17:26 - 2007-10-12 15:14 - 02006552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_36.dll
2017-02-27 17:26 - 2007-10-12 15:14 - 01374232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_36.dll
2017-02-27 17:26 - 2007-10-02 09:56 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_36.dll
2017-02-27 17:26 - 2007-10-02 09:56 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_36.dll
2017-02-27 17:26 - 2007-07-20 00:57 - 00411496 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_9.dll
2017-02-27 17:26 - 2007-07-20 00:57 - 00267112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_9.dll
2017-02-27 17:26 - 2007-07-19 18:14 - 05073256 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_35.dll
2017-02-27 17:26 - 2007-07-19 18:14 - 03727720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_35.dll
2017-02-27 17:26 - 2007-07-19 18:14 - 01985904 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_35.dll
2017-02-27 17:26 - 2007-07-19 18:14 - 01358192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_35.dll
2017-02-27 17:26 - 2007-07-19 18:14 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_35.dll
2017-02-27 17:26 - 2007-07-19 18:14 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_35.dll
2017-02-27 17:26 - 2007-06-20 20:49 - 00409960 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_8.dll
2017-02-27 17:26 - 2007-06-20 20:46 - 00266088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_8.dll
2017-02-27 17:26 - 2007-05-16 16:45 - 04496232 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_34.dll
2017-02-27 17:26 - 2007-05-16 16:45 - 03497832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_34.dll
2017-02-27 17:26 - 2007-05-16 16:45 - 01401200 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_34.dll
2017-02-27 17:26 - 2007-05-16 16:45 - 01124720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_34.dll
2017-02-27 17:26 - 2007-05-16 16:45 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_34.dll
2017-02-27 17:26 - 2007-05-16 16:45 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_34.dll
2017-02-27 17:26 - 2007-04-04 18:55 - 00403304 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_7.dll
2017-02-27 17:26 - 2007-04-04 18:55 - 00261480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_7.dll
2017-02-27 17:26 - 2007-04-04 18:54 - 00107368 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_3.dll
2017-02-27 17:26 - 2007-04-04 18:53 - 00081768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_3.dll
2017-02-27 17:26 - 2007-03-15 16:57 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_33.dll
2017-02-27 17:26 - 2007-03-15 16:57 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_33.dll
2017-02-27 17:26 - 2007-03-12 16:42 - 04494184 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_33.dll
2017-02-27 17:26 - 2007-03-12 16:42 - 03495784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_33.dll
2017-02-27 17:26 - 2007-03-12 16:42 - 01400176 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_33.dll
2017-02-27 17:26 - 2007-03-12 16:42 - 01123696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_33.dll
2017-02-27 17:26 - 2007-03-05 12:42 - 00017688 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_1.dll
2017-02-27 17:26 - 2007-03-05 12:42 - 00015128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_1.dll
2017-02-27 17:26 - 2007-01-24 15:27 - 00393576 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_6.dll
2017-02-27 17:26 - 2007-01-24 15:27 - 00255848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_6.dll
2017-02-27 17:26 - 2006-12-08 12:02 - 00251672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_5.dll
2017-02-27 17:26 - 2006-12-08 12:00 - 00390424 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_5.dll
2017-02-27 17:26 - 2006-11-29 13:06 - 04398360 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_32.dll
2017-02-27 17:26 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_32.dll
2017-02-27 17:26 - 2006-11-29 13:06 - 00469264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10.dll
2017-02-27 17:26 - 2006-11-29 13:06 - 00440080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10.dll
2017-02-27 17:26 - 2006-09-28 16:05 - 03977496 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_31.dll
2017-02-27 17:26 - 2006-09-28 16:05 - 02414360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_31.dll
2017-02-27 17:26 - 2006-09-28 16:05 - 00237848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_4.dll
2017-02-27 17:26 - 2006-09-28 16:04 - 00364824 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_4.dll
2017-02-27 17:26 - 2006-07-28 09:31 - 00083736 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_2.dll
2017-02-27 17:26 - 2006-07-28 09:30 - 00363288 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_3.dll
2017-02-27 17:26 - 2006-07-28 09:30 - 00236824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_3.dll
2017-02-27 17:26 - 2006-07-28 09:30 - 00062744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_2.dll
2017-02-27 17:26 - 2006-05-31 07:24 - 00230168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_2.dll
2017-02-27 17:26 - 2006-05-31 07:22 - 00354072 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_2.dll
2017-02-27 17:26 - 2006-03-31 12:41 - 03927248 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_30.dll
2017-02-27 17:26 - 2006-03-31 12:40 - 02388176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_30.dll
2017-02-27 17:26 - 2006-03-31 12:40 - 00352464 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_1.dll
2017-02-27 17:26 - 2006-03-31 12:39 - 00229584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_1.dll
2017-02-27 17:26 - 2006-03-31 12:39 - 00083664 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_1.dll
2017-02-27 17:26 - 2006-03-31 12:39 - 00062672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_1.dll
2017-02-27 17:25 - 2006-02-03 08:43 - 03830992 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_29.dll
2017-02-27 17:25 - 2006-02-03 08:43 - 02332368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_29.dll
2017-02-27 17:25 - 2006-02-03 08:42 - 00355536 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_0.dll
2017-02-27 17:25 - 2006-02-03 08:42 - 00230096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_0.dll
2017-02-27 17:25 - 2006-02-03 08:41 - 00016592 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_0.dll
2017-02-27 17:25 - 2006-02-03 08:41 - 00014032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_0.dll
2017-02-27 17:25 - 2005-12-05 18:09 - 03815120 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_28.dll
2017-02-27 17:25 - 2005-12-05 18:09 - 02323664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_28.dll
2017-02-27 17:25 - 2005-07-22 19:59 - 03807440 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_27.dll
2017-02-27 17:25 - 2005-07-22 19:59 - 02319568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_27.dll
2017-02-27 17:25 - 2005-05-26 15:34 - 03767504 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_26.dll
2017-02-27 17:25 - 2005-05-26 15:34 - 02297552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_26.dll
2017-02-27 17:25 - 2005-03-18 17:19 - 03823312 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_25.dll
2017-02-27 17:25 - 2005-02-05 19:45 - 03544272 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_24.dll
2017-02-27 17:25 - 2005-02-05 19:45 - 02222800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_24.dll
2017-02-27 17:24 - 2017-02-27 17:26 - 00000000 ____D C:\Windows\SysWOW64\directx
2017-02-27 17:24 - 2017-02-27 17:24 - 00000000 ___HD C:\Windows\msdownld.tmp
2017-02-27 17:22 - 2017-02-27 17:22 - 00000000 ____D C:\ProgramData\VsTelemetry
2017-02-25 18:54 - 2017-02-25 18:54 - 00000000 ____D C:\Users\Luca\Documents\League of Legends
2017-02-25 18:49 - 2017-02-27 17:23 - 00000000 ____D C:\Program Files (x86)\MSBuild
2017-02-25 18:49 - 2017-02-25 18:49 - 00000000 ____D C:\Windows\SysWOW64\XPSViewer
2017-02-25 18:49 - 2017-02-25 18:49 - 00000000 ____D C:\Program Files\Reference Assemblies
2017-02-25 18:49 - 2017-02-25 18:49 - 00000000 ____D C:\Program Files\MSBuild
2017-02-25 18:49 - 2017-02-25 18:49 - 00000000 ____D C:\Program Files (x86)\Reference Assemblies
2017-02-25 18:47 - 2017-02-25 18:47 - 00000000 ____D C:\ProgramData\Riot Games
2017-02-25 18:46 - 2017-02-25 18:54 - 00001749 _____ C:\Users\Public\Desktop\League of Legends.lnk
2017-02-25 18:46 - 2017-02-25 18:46 - 00000000 ____D C:\Riot Games
2017-02-25 18:46 - 2016-05-25 14:31 - 01166520 _____ (Microsoft Corporation) C:\Windows\system32\PresentationNative_v0300.dll
2017-02-25 18:46 - 2016-05-25 14:31 - 00124624 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2017-02-25 18:46 - 2016-05-25 14:31 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2017-02-25 18:46 - 2016-05-25 11:03 - 00778936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationNative_v0300.dll
2017-02-25 18:46 - 2016-05-25 11:03 - 00103120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2017-02-25 18:46 - 2016-05-25 11:03 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2017-02-25 18:46 - 2008-07-31 10:41 - 00068616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_1.dll
2017-02-25 18:46 - 2008-07-31 10:40 - 00509448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_2.dll
2017-02-25 18:46 - 2008-07-12 08:18 - 03851784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll
2017-02-25 18:46 - 2008-07-12 08:18 - 01493528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_39.dll
2017-02-25 18:46 - 2008-07-12 08:18 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_39.dll
2017-02-25 18:45 - 2017-02-25 18:45 - 00000000 ____D C:\Users\Luca\AppData\Roaming\Riot Games
2017-02-25 10:46 - 2017-02-25 10:46 - 00000000 ____D C:\Users\Luca\Documents\Lightshot
2017-02-25 10:36 - 2017-02-28 16:13 - 00000418 _____ C:\Windows\Tasks\update-sys.job
2017-02-25 10:36 - 2017-02-28 16:13 - 00000418 _____ C:\Windows\Tasks\update-S-1-5-21-2582490348-2044156764-553856435-1001.job
2017-02-25 10:36 - 2017-02-25 10:36 - 00003404 _____ C:\Windows\System32\Tasks\update-S-1-5-21-2582490348-2044156764-553856435-1001
2017-02-25 10:36 - 2017-02-25 10:36 - 00003344 _____ C:\Windows\System32\Tasks\update-sys
2017-02-25 10:36 - 2017-02-25 10:36 - 00000424 _____ C:\Users\Luca\AppData\Local\UserProducts.xml
2017-02-25 10:36 - 2017-02-25 10:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lightshot
2017-02-25 10:36 - 2017-02-25 10:36 - 00000000 ____D C:\Program Files (x86)\Skillbrains
2017-02-24 21:34 - 2017-03-04 16:57 - 00000000 ____D C:\Users\Luca\Desktop\EasyBot V2 Emulator
2017-02-24 21:29 - 2017-02-24 21:29 - 00000000 ____D C:\Users\Luca\AppData\Local\Manager_V2
2017-02-23 20:52 - 2017-02-23 20:52 - 00000000 ____D C:\Users\Luca\AppData\LocalLow\Adobe
2017-02-23 20:52 - 2017-02-23 20:52 - 00000000 ____D C:\Users\Luca\AppData\Local\Tempzxpsign73ea3c1007536cdf
2017-02-23 20:48 - 2017-02-23 20:48 - 00000000 ____D C:\Users\Luca\AppData\Local\Tempzxpsign876cde7496f6f207
2017-02-23 20:48 - 2017-02-23 20:48 - 00000000 ____D C:\Users\Luca\AppData\Local\Tempzxpsign09ebc62b7e4c3878
2017-02-23 20:42 - 2017-02-23 20:42 - 78796799 _____ C:\Users\Luca\Desktop\Ankündigungsvideo.mp4
2017-02-23 20:33 - 2017-02-23 20:33 - 22488960 _____ C:\Users\Luca\Desktop\Fertig.mp4
2017-02-23 19:36 - 2016-08-09 08:36 - 15576576 _____ (Trapcode AB) C:\Windows\system32\TCParticleBuilder.dll
2017-02-23 19:28 - 2017-02-23 19:28 - 00000000 ____D C:\ProgramData\Reprise
2017-02-23 19:25 - 2017-02-23 20:12 - 00000000 ____D C:\ProgramData\GenArts
2017-02-23 19:25 - 2017-02-23 19:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GenArts Sapphire AE
2017-02-23 19:25 - 2017-02-23 19:25 - 00000000 ____D C:\Program Files\GenArts
2017-02-23 19:19 - 2017-02-23 19:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ReelSmart Motion Blur 4, After Effects-compatible plugin set
2017-02-23 19:19 - 2008-01-30 18:36 - 00090112 _____ (MindVision Software) C:\Windows\unvise32.exe
2017-02-23 19:17 - 2017-02-23 19:17 - 00000000 ____D C:\Program Files (x86)\REVisionEffects
2017-02-23 19:07 - 2017-02-23 19:07 - 00000103 _____ C:\Windows\MSUTIL.INI
2017-02-23 19:07 - 2017-02-23 19:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GenArts Sapphire OFX
2017-02-23 19:07 - 2017-02-23 19:07 - 00000000 ____D C:\Program Files (x86)\GenArts
2017-02-23 19:07 - 2010-02-04 07:58 - 00584376 _____ (Intel Corporation) C:\Windows\system32\libiomp5md.dll
2017-02-23 19:07 - 2010-02-04 07:40 - 00575672 _____ (Intel Corporation) C:\Windows\SysWOW64\libiomp5md.dll
2017-02-23 19:04 - 2017-02-23 19:36 - 00000000 ____D C:\ProgramData\Red Giant
2017-02-23 19:04 - 2017-02-23 19:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Red Giant
2017-02-23 19:04 - 2017-02-23 19:04 - 00003748 _____ C:\Windows\System32\Tasks\Red Giant Link
2017-02-23 19:04 - 2017-02-23 19:04 - 00000000 ____D C:\Users\Luca\AppData\Roaming\Red Giant
2017-02-23 19:04 - 2017-02-23 19:04 - 00000000 ____D C:\Program Files (x86)\Red Giant Link
2017-02-23 19:03 - 2017-02-23 19:36 - 00000000 ____D C:\Program Files (x86)\Red Giant
2017-02-23 19:03 - 2017-02-23 19:03 - 00000000 ____D C:\ProgramData\RedGiant
2017-02-23 19:03 - 2017-02-23 19:03 - 00000000 ____D C:\Program Files\Red Giant
2017-02-23 19:03 - 2017-02-23 19:03 - 00000000 ____D C:\Program Files (x86)\LooksBuilder
2017-02-23 19:03 - 2017-01-30 10:10 - 64336384 _____ (Red Giant LLC) C:\Windows\system32\MBLooks4UI_x64.dll
2017-02-23 13:55 - 2017-02-23 13:55 - 00000000 ____D C:\Users\Luca\AppData\Local\Steam
2017-02-23 13:52 - 2017-03-05 10:39 - 00000000 ____D C:\Program Files (x86)\Steam
2017-02-23 13:52 - 2017-02-23 13:52 - 00001032 _____ C:\Users\Public\Desktop\Steam.lnk
2017-02-23 13:52 - 2017-02-23 13:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
2017-02-23 13:49 - 2017-02-23 13:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Settings
2017-02-23 13:49 - 2017-02-23 13:49 - 00000000 ____D C:\Program Files\ATI Technologies
2017-02-23 13:49 - 2017-02-23 13:49 - 00000000 ____D C:\Program Files (x86)\AMD
2017-02-22 23:47 - 2017-02-22 23:47 - 00000000 ____D C:\Windows\system32\ÿÿÿÿÿÿÿÿ8
2017-02-22 23:46 - 2017-02-22 23:46 - 00000000 ____D C:\Windows\system32\ÿÿÿÿÿÿÿÿerStore
2017-02-22 21:54 - 2017-02-22 21:54 - 00000000 ____D C:\Users\Luca\AppData\Roaming\jawset
2017-02-22 21:52 - 2017-02-22 21:53 - 00000000 ____D C:\Users\Luca\Desktop\CINEMA 4D R16 - by Prilann
2017-02-22 21:35 - 2017-02-22 21:54 - 00000000 ____D C:\Users\Luca\AppData\Roaming\MAXON
2017-02-22 19:36 - 2017-03-02 18:03 - 00000000 ____D C:\Users\Luca\AppData\Roaming\Audacity
2017-02-22 19:36 - 2017-02-22 19:36 - 00000000 ____D C:\Users\Luca\AppData\Local\Audacity
2017-02-22 19:35 - 2017-02-22 19:35 - 00001088 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk
2017-02-22 19:35 - 2017-02-22 19:35 - 00001076 _____ C:\Users\Public\Desktop\Audacity.lnk
2017-02-22 19:34 - 2017-02-22 19:36 - 00000000 ____D C:\Program Files (x86)\Audacity
2017-02-22 19:33 - 2017-03-05 10:36 - 00004168 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{D035C3B7-D925-4388-9AF2-1EEB06262305}
2017-02-22 19:26 - 2017-02-22 19:26 - 00000000 ____D C:\Users\Luca\AppData\Roaming\WinRAR
2017-02-22 19:26 - 2017-02-22 19:26 - 00000000 ____D C:\Users\Luca\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2017-02-22 19:26 - 2017-02-22 19:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2017-02-22 19:26 - 2017-02-22 19:26 - 00000000 ____D C:\Program Files\WinRAR
2017-02-22 18:47 - 2017-02-22 18:47 - 00000000 ____D C:\Users\Luca\AppData\Roaming\AMD
2017-02-22 18:26 - 2017-02-22 18:26 - 00000000 ____D C:\Users\Luca\AppData\Local\Tempzxpsigne929465219c689ae
2017-02-22 18:26 - 2017-02-22 18:26 - 00000000 ____D C:\Users\Luca\AppData\Local\Tempzxpsign8019bcf791f8abab
2017-02-22 18:26 - 2017-02-22 18:26 - 00000000 ____D C:\Users\Luca\AppData\Local\Tempzxpsign3c3a8ed1c62bc5d6
2017-02-22 18:24 - 2017-02-22 18:24 - 00001151 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Premiere Pro CC 2017.lnk
2017-02-22 18:24 - 2017-02-22 18:24 - 00000000 ____D C:\Users\Public\Documents\Adobe
2017-02-22 18:20 - 2017-02-22 18:20 - 00001377 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Character Animator CC (Beta).lnk
2017-02-22 18:18 - 2017-02-22 18:18 - 00001163 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Media Encoder CC 2017.lnk
2017-02-22 18:15 - 2017-03-04 16:08 - 00000000 ____D C:\Users\Luca\AppData\Roaming\obs-studio
2017-02-22 18:15 - 2017-02-22 18:15 - 00001085 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CC 2017.lnk
2017-02-22 18:14 - 2017-02-22 18:14 - 00001275 _____ C:\Users\Public\Desktop\OBS Studio.lnk
2017-02-22 18:14 - 2017-02-22 18:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OBS Studio
2017-02-22 18:14 - 2017-02-22 18:14 - 00000000 ____D C:\Program Files (x86)\obs-studio
2017-02-22 18:12 - 2017-02-22 18:12 - 00000000 ____D C:\Users\Luca\AppData\Local\PeerDistRepub
2017-02-22 18:11 - 2017-03-05 10:35 - 00000000 ___RD C:\Users\Luca\Creative Cloud Files
2017-02-22 18:11 - 2017-03-04 17:02 - 00000000 ____D C:\ProgramData\boost_interprocess
2017-02-22 18:11 - 2017-02-23 19:56 - 00000000 ____D C:\Users\Luca\Documents\Adobe
2017-02-22 18:11 - 2017-02-22 18:12 - 00000000 ____D C:\Users\Luca\AppData\Local\MSfree Inc
2017-02-22 18:11 - 2017-02-22 18:11 - 00003630 _____ C:\Windows\System32\Tasks\AdobeAAMUpdater-1.0-DESKTOP-NTF4MSP-Luca
2017-02-22 18:10 - 2017-02-24 23:46 - 00000000 ____D C:\Users\Luca\Desktop\Backup
2017-02-22 18:10 - 2017-02-22 18:10 - 00001271 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe After Effects CC 2017.lnk
2017-02-22 18:10 - 2017-02-22 18:10 - 00000000 ____D C:\Users\Luca\AppData\Local\CEF
2017-02-22 18:05 - 2017-02-22 18:12 - 00000000 ____D C:\Program Files\Common Files\Adobe
2017-02-22 18:04 - 2017-02-22 18:24 - 00000000 ____D C:\Program Files\Adobe
2017-02-22 18:03 - 2017-02-22 18:03 - 00001298 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Creative Cloud.lnk
2017-02-22 18:03 - 2017-02-22 18:03 - 00001286 _____ C:\Users\Public\Desktop\Adobe Creative Cloud.lnk
2017-02-22 18:01 - 2017-02-22 18:11 - 00000000 ____D C:\ProgramData\Adobe
2017-02-22 18:00 - 2017-02-22 18:00 - 00000000 ____D C:\Program Files (x86)\Adobe
2017-02-22 17:58 - 2017-03-05 10:36 - 00000000 ____D C:\Users\Luca\AppData\Local\Adobe
2017-02-22 17:37 - 2017-02-22 17:37 - 00000904 _____ C:\Users\Public\Desktop\NosTale.lnk
2017-02-22 17:37 - 2017-02-22 17:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nostale(DE)
2017-02-22 17:35 - 2017-03-02 16:48 - 00000000 ____D C:\Program Files (x86)\NosTale(DE)
2017-02-22 17:33 - 2017-02-22 17:33 - 00000000 ____D C:\ProgramData\LogiShrd
2017-02-22 17:32 - 2017-02-22 17:32 - 00000000 ____D C:\Users\Luca\AppData\Local\Logitech
2017-02-22 17:31 - 2017-02-22 17:31 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech
2017-02-22 17:30 - 2017-02-22 17:32 - 00000000 ____D C:\Program Files\Logitech Gaming Software
2017-02-22 17:30 - 2017-02-22 17:30 - 00000000 ____D C:\Users\Luca\AppData\Roaming\Logitech
2017-02-22 17:30 - 2017-02-22 17:30 - 00000000 ____D C:\Users\Luca\AppData\Roaming\Logishrd
2017-02-22 17:29 - 2017-02-22 17:29 - 00000000 ____D C:\Program Files\Common Files\Logitech
2017-02-22 17:27 - 2017-02-22 17:27 - 00000000 ____D C:\Users\Luca\AppData\Local\TeamSpeak 3
2017-02-22 17:27 - 2017-02-22 17:27 - 00000000 ____D C:\Users\Luca\.TeamSpeak 3
2017-02-22 17:27 - 2017-02-22 17:27 - 00000000 ____D C:\Users\Luca\.QtWebEngineProcess
2017-02-22 17:27 - 2017-02-22 16:50 - 00485032 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2017-02-22 17:26 - 2017-02-22 17:26 - 00001277 _____ C:\Users\Luca\Desktop\TeamSpeak 3 Client.lnk
2017-02-22 17:26 - 2017-02-22 17:26 - 00001235 _____ C:\Users\Luca\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client.lnk
2017-02-22 17:25 - 2017-02-24 13:56 - 00000000 ____D C:\Users\Luca\AppData\Local\TeamSpeak 3 Client
2017-02-22 17:23 - 2017-02-23 18:42 - 00000000 ____D C:\Windows\system32\MRT
2017-02-22 17:23 - 2017-02-23 18:41 - 138020592 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2017-02-22 17:22 - 2017-02-22 17:22 - 00002642 _____ C:\Users\Public\Desktop\Skype.lnk
2017-02-22 17:22 - 2017-02-22 17:22 - 00000000 ___RD C:\Program Files (x86)\Skype
2017-02-22 17:22 - 2017-02-22 17:22 - 00000000 ____D C:\Users\Luca\Tracing
2017-02-22 17:22 - 2017-02-22 17:22 - 00000000 ____D C:\ProgramData\Skype
2017-02-22 17:22 - 2017-02-22 17:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2017-02-22 17:18 - 2016-12-21 09:08 - 00245600 _____ (Microsoft Corporation) C:\Windows\system32\offlinesam.dll
2017-02-22 17:18 - 2016-12-21 09:08 - 00136032 _____ (Microsoft Corporation) C:\Windows\system32\ImplatSetup.dll
2017-02-22 17:18 - 2016-12-21 09:04 - 07816032 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2017-02-22 17:18 - 2016-12-21 08:49 - 00328008 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Storage.ApplicationData.dll
2017-02-22 17:18 - 2016-12-21 08:46 - 00624048 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2017-02-22 17:18 - 2016-12-21 08:43 - 04130440 _____ (Microsoft Corporation) C:\Windows\system32\mfcore.dll
2017-02-22 17:18 - 2016-12-21 08:43 - 01454504 _____ (Microsoft Corporation) C:\Windows\system32\mfnetsrc.dll
2017-02-22 17:18 - 2016-12-21 08:43 - 01071736 _____ (Microsoft Corporation) C:\Windows\system32\mfnetcore.dll
2017-02-22 17:18 - 2016-12-21 08:43 - 00092512 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2017-02-22 17:18 - 2016-12-21 08:42 - 22224480 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2017-02-22 17:18 - 2016-12-21 08:42 - 01988560 _____ (Microsoft Corporation) C:\Windows\system32\mfmp4srcsnk.dll
2017-02-22 17:18 - 2016-12-21 08:42 - 01702392 _____ (Microsoft Corporation) C:\Windows\system32\mfasfsrcsnk.dll
2017-02-22 17:18 - 2016-12-21 08:42 - 01300600 _____ (Microsoft Corporation) C:\Windows\system32\mfmpeg2srcsnk.dll
2017-02-22 17:18 - 2016-12-21 08:42 - 00241504 _____ (Microsoft Corporation) C:\Windows\system32\CloudExperienceHost.dll
2017-02-22 17:18 - 2016-12-21 08:41 - 01600632 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll
2017-02-22 17:18 - 2016-12-21 08:37 - 00455520 _____ (Microsoft Corporation) C:\Windows\system32\securekernel.exe
2017-02-22 17:18 - 2016-12-21 08:15 - 22563840 _____ (Microsoft Corporation) C:\Windows\system32\edgehtml.dll
2017-02-22 17:18 - 2016-12-21 08:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\LaunchWinApp.exe
2017-02-22 17:18 - 2016-12-21 08:13 - 00119808 _____ (Microsoft Corporation) C:\Windows\system32\KnobsCsp.dll
2017-02-22 17:18 - 2016-12-21 08:12 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\ProvPluginEng.dll
2017-02-22 17:18 - 2016-12-21 08:10 - 00234496 _____ (Microsoft Corporation) C:\Windows\system32\KnobsCore.dll
2017-02-22 17:18 - 2016-12-21 08:09 - 00368640 _____ (Microsoft Corporation) C:\Windows\system32\OneBackupHandler.dll
2017-02-22 17:18 - 2016-12-21 08:09 - 00363520 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.BioFeedback.dll
2017-02-22 17:18 - 2016-12-21 08:08 - 01292288 _____ (Microsoft Corporation) C:\Windows\system32\MSVPXENC.dll
2017-02-22 17:18 - 2016-12-21 08:08 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.BlockedShutdown.dll
2017-02-22 17:18 - 2016-12-21 08:08 - 00360448 _____ (Microsoft Corporation) C:\Windows\system32\rdpencom.dll
2017-02-22 17:18 - 2016-12-21 08:08 - 00349184 _____ (Microsoft Corporation) C:\Windows\system32\provengine.dll
2017-02-22 17:18 - 2016-12-21 08:08 - 00289792 _____ (Microsoft Corporation) C:\Windows\system32\DeveloperOptionsSettingsHandlers.dll
2017-02-22 17:18 - 2016-12-21 08:08 - 00211968 _____ (Microsoft Corporation) C:\Windows\system32\InstallAgent.exe
2017-02-22 17:18 - 2016-12-21 08:07 - 00748544 _____ (Microsoft Corporation) C:\Windows\system32\StoreAgent.dll
2017-02-22 17:18 - 2016-12-21 08:06 - 06285312 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Media.dll
2017-02-22 17:18 - 2016-12-21 08:06 - 00310784 _____ (Microsoft Corporation) C:\Windows\system32\SyncSettings.dll
2017-02-22 17:18 - 2016-12-21 08:06 - 00260608 _____ (Microsoft Corporation) C:\Windows\system32\InstallAgentUserBroker.exe
2017-02-22 17:18 - 2016-12-21 08:06 - 00147456 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2017-02-22 17:18 - 2016-12-21 08:05 - 00425984 _____ (Microsoft Corporation) C:\Windows\system32\aadcloudap.dll
2017-02-22 17:18 - 2016-12-21 08:05 - 00261632 _____ (Microsoft Corporation) C:\Windows\system32\indexeddbserver.dll
2017-02-22 17:18 - 2016-12-21 08:05 - 00049152 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Shell.dll
2017-02-22 17:18 - 2016-12-21 08:01 - 09131008 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
2017-02-22 17:18 - 2016-12-21 08:00 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\fhcfg.dll
2017-02-22 17:18 - 2016-12-21 07:59 - 01908224 _____ (Microsoft Corporation) C:\Windows\system32\AzureSettingSyncProvider.dll
2017-02-22 17:18 - 2016-12-21 07:59 - 00883712 _____ (Microsoft Corporation) C:\Windows\system32\samsrv.dll
2017-02-22 17:18 - 2016-12-21 07:58 - 23678464 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2017-02-22 17:18 - 2016-12-21 07:57 - 00462336 _____ (Microsoft Corporation) C:\Windows\system32\fhsettingsprovider.dll
2017-02-22 17:18 - 2016-12-21 07:56 - 00947712 _____ (Microsoft Corporation) C:\Windows\system32\MSVP9DEC.dll
2017-02-22 17:18 - 2016-12-21 07:56 - 00936960 _____ (Microsoft Corporation) C:\Windows\system32\MCRecvSrc.dll
2017-02-22 17:18 - 2016-12-21 07:55 - 08129536 _____ (Microsoft Corporation) C:\Windows\system32\Chakra.dll
2017-02-22 17:18 - 2016-12-21 07:55 - 04749312 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers_nt.dll
2017-02-22 17:18 - 2016-12-21 07:54 - 05511680 _____ (Microsoft Corporation) C:\Windows\system32\aclui.dll
2017-02-22 17:18 - 2016-12-21 07:53 - 06664192 _____ (Microsoft Corporation) C:\Windows\system32\mspaint.exe
2017-02-22 17:18 - 2016-12-21 07:53 - 04474368 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_47.dll
2017-02-22 17:18 - 2016-12-21 07:53 - 01692672 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentExtensions.onecore.dll
2017-02-22 17:18 - 2016-12-21 07:51 - 08075776 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2017-02-22 17:18 - 2016-12-21 07:51 - 05611008 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2017-02-22 17:18 - 2016-12-21 07:51 - 02275840 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentServer.dll
2017-02-22 17:18 - 2016-12-21 07:50 - 01490432 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2017-02-22 17:18 - 2016-12-21 07:49 - 04149248 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2017-02-22 17:18 - 2016-12-21 07:49 - 02691072 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Logon.dll
2017-02-22 17:18 - 2016-12-21 07:49 - 01062912 _____ (Microsoft Corporation) C:\Windows\system32\SettingSyncCore.dll
2017-02-22 17:18 - 2016-12-21 07:47 - 01121280 _____ (Microsoft Corporation) C:\Windows\system32\aadtb.dll
2017-02-22 17:18 - 2016-12-21 06:59 - 00218976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\offlinesam.dll
2017-02-22 17:18 - 2016-12-21 06:09 - 00263472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Storage.ApplicationData.dll
2017-02-22 17:18 - 2016-12-21 06:02 - 03892864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfcore.dll
2017-02-22 17:18 - 2016-12-21 06:02 - 01852720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmp4srcsnk.dll
2017-02-22 17:18 - 2016-12-21 06:02 - 01360464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfnetsrc.dll
2017-02-22 17:18 - 2016-12-21 06:02 - 01277344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfasfsrcsnk.dll
2017-02-22 17:18 - 2016-12-21 06:02 - 01201872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmpeg2srcsnk.dll
2017-02-22 17:18 - 2016-12-21 06:02 - 00980832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfnetcore.dll
2017-02-22 17:18 - 2016-12-21 06:01 - 20969928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2017-02-22 17:18 - 2016-12-21 05:46 - 00034304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\LaunchWinApp.exe
2017-02-22 17:18 - 2016-12-21 05:43 - 00285184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.BlockedShutdown.dll
2017-02-22 17:18 - 2016-12-21 05:41 - 00253952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.BioFeedback.dll
2017-02-22 17:18 - 2016-12-21 05:41 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.LockScreen.dll
2017-02-22 17:18 - 2016-12-21 05:40 - 00557568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\StoreAgent.dll
2017-02-22 17:18 - 2016-12-21 05:40 - 00318976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpencom.dll
2017-02-22 17:18 - 2016-12-21 05:40 - 00237056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SyncSettings.dll
2017-02-22 17:18 - 2016-12-21 05:40 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InstallAgent.exe
2017-02-22 17:18 - 2016-12-21 05:39 - 01300480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSVPXENC.dll
2017-02-22 17:18 - 2016-12-21 05:39 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InstallAgentUserBroker.exe
2017-02-22 17:18 - 2016-12-21 05:38 - 00866816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Cred.dll
2017-02-22 17:18 - 2016-12-21 05:35 - 04612608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Media.dll
2017-02-22 17:18 - 2016-12-21 05:35 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\indexeddbserver.dll
2017-02-22 17:18 - 2016-12-21 05:34 - 07626752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2017-02-22 17:18 - 2016-12-21 05:33 - 19413504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\edgehtml.dll
2017-02-22 17:18 - 2016-12-21 05:32 - 19417600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2017-02-22 17:18 - 2016-12-21 05:30 - 05398016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aclui.dll
2017-02-22 17:18 - 2016-12-21 05:30 - 01255936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AzureSettingSyncProvider.dll
2017-02-22 17:18 - 2016-12-21 05:27 - 00640000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MCRecvSrc.dll
2017-02-22 17:18 - 2016-12-21 05:26 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSVP9DEC.dll
2017-02-22 17:18 - 2016-12-21 05:25 - 07469056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2017-02-22 17:18 - 2016-12-21 05:25 - 06474752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mspaint.exe
2017-02-22 17:18 - 2016-12-21 05:24 - 06044160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Chakra.dll
2017-02-22 17:18 - 2016-12-21 05:24 - 05061120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2017-02-22 17:18 - 2016-12-21 05:24 - 03733504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_47.dll
2017-02-22 17:18 - 2016-12-21 05:24 - 00886272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aadtb.dll
2017-02-22 17:18 - 2016-12-21 05:22 - 01883648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Logon.dll
2017-02-22 17:18 - 2016-12-21 05:22 - 00860672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SettingSyncCore.dll
2017-02-22 17:18 - 2016-12-14 06:41 - 01235296 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2017-02-22 17:18 - 2016-12-14 06:41 - 00590960 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2017-02-22 17:18 - 2016-12-14 06:34 - 02482280 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2017-02-22 17:18 - 2016-12-14 06:33 - 02169184 _____ (Microsoft Corporation) C:\Windows\system32\AppVEntSubsystems64.dll
2017-02-22 17:18 - 2016-12-14 06:33 - 01669984 _____ (Microsoft Corporation) C:\Windows\system32\AppVIntegration.dll
2017-02-22 17:18 - 2016-12-14 06:33 - 01400160 _____ (Microsoft Corporation) C:\Windows\system32\AppVEntSubsystemController.dll
2017-02-22 17:18 - 2016-12-14 06:33 - 01356864 _____ (Microsoft Corporation) C:\Windows\system32\ClipUp.exe
2017-02-22 17:18 - 2016-12-14 06:33 - 01054048 _____ (Microsoft Corporation) C:\Windows\system32\AppVPolicy.dll
2017-02-22 17:18 - 2016-12-14 06:33 - 00992096 _____ (Microsoft Corporation) C:\Windows\system32\AppVManifest.dll
2017-02-22 17:18 - 2016-12-14 06:33 - 00822624 _____ (Microsoft Corporation) C:\Windows\system32\AppVClient.exe
2017-02-22 17:18 - 2016-12-14 06:33 - 00813408 _____ (Microsoft Corporation) C:\Windows\system32\AppVEntStreamingManager.dll
2017-02-22 17:18 - 2016-12-14 06:33 - 00779616 _____ (Microsoft Corporation) C:\Windows\system32\AppVReporting.dll
2017-02-22 17:18 - 2016-12-14 06:33 - 00752992 _____ (Microsoft Corporation) C:\Windows\system32\AppVOrchestration.dll
2017-02-22 17:18 - 2016-12-14 06:33 - 00704352 _____ (Microsoft Corporation) C:\Windows\system32\AppVEntVirtualization.dll
2017-02-22 17:18 - 2016-12-14 06:33 - 00696160 _____ (Microsoft Corporation) C:\Windows\system32\AppVPublishing.dll
2017-02-22 17:18 - 2016-12-14 06:33 - 00571744 _____ (Microsoft Corporation) C:\Windows\system32\AppVCatalog.dll
2017-02-22 17:18 - 2016-12-14 06:33 - 00513376 _____ (Microsoft Corporation) C:\Windows\system32\TransportDSA.dll
2017-02-22 17:18 - 2016-12-14 06:33 - 00406368 _____ (Microsoft Corporation) C:\Windows\system32\AppVScripting.dll
2017-02-22 17:18 - 2016-12-14 06:33 - 00241504 _____ (Microsoft Corporation) C:\Windows\system32\AppVShNotify.exe
2017-02-22 17:18 - 2016-12-14 06:33 - 00190816 _____ (Microsoft Corporation) C:\Windows\system32\AppVDllSurrogate.exe
2017-02-22 17:18 - 2016-12-14 06:26 - 01469792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AppVEntSubsystems32.dll
2017-02-22 17:18 - 2016-12-14 06:23 - 00404832 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2017-02-22 17:18 - 2016-12-14 06:21 - 02206496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2017-02-22 17:18 - 2016-12-14 06:19 - 00584544 _____ (Microsoft Corporation) C:\Windows\system32\SettingSyncHost.exe
2017-02-22 17:18 - 2016-12-14 06:18 - 00715104 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vhdmp.sys
2017-02-22 17:18 - 2016-12-14 06:18 - 00335712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pci.sys
2017-02-22 17:18 - 2016-12-14 06:17 - 00319288 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2017-02-22 17:18 - 2016-12-14 06:14 - 01694712 _____ (Microsoft Corporation) C:\Windows\system32\winmde.dll
2017-02-22 17:18 - 2016-12-14 06:14 - 00418952 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2017-02-22 17:18 - 2016-12-14 06:14 - 00089416 _____ (Microsoft Corporation) C:\Windows\system32\remoteaudioendpoint.dll
2017-02-22 17:18 - 2016-12-14 06:08 - 00341344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2017-02-22 17:18 - 2016-12-14 06:06 - 00509792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SettingSyncHost.exe
2017-02-22 17:18 - 2016-12-14 06:01 - 01557808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winmde.dll
2017-02-22 17:18 - 2016-12-14 06:01 - 00382784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2017-02-22 17:18 - 2016-12-14 06:01 - 00076984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\remoteaudioendpoint.dll
2017-02-22 17:18 - 2016-12-14 05:48 - 01631232 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Xaml.Resources.dll
2017-02-22 17:18 - 2016-12-14 05:46 - 01631232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Xaml.Resources.dll
2017-02-22 17:18 - 2016-12-14 05:46 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2017-02-22 17:18 - 2016-12-14 05:45 - 00147968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32k.sys
2017-02-22 17:18 - 2016-12-14 05:44 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netvsc.sys
2017-02-22 17:18 - 2016-12-14 05:43 - 00201728 _____ (Microsoft Corporation) C:\Windows\system32\ScDeviceEnum.dll
2017-02-22 17:18 - 2016-12-14 05:42 - 00352768 _____ (Microsoft Corporation) C:\Windows\system32\cloudAP.dll
2017-02-22 17:18 - 2016-12-14 05:42 - 00236544 _____ (Microsoft Corporation) C:\Windows\system32\WinSCard.dll
2017-02-22 17:18 - 2016-12-14 05:42 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Internal.UI.Logon.ProxyStub.dll
2017-02-22 17:18 - 2016-12-14 05:42 - 00167424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinSCard.dll
2017-02-22 17:18 - 2016-12-14 05:41 - 00223744 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2017-02-22 17:18 - 2016-12-14 05:40 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\domgmt.dll
2017-02-22 17:18 - 2016-12-14 05:40 - 00266752 _____ (Microsoft Corporation) C:\Windows\system32\ConsoleLogon.dll
2017-02-22 17:18 - 2016-12-14 05:40 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CloudBackupSettings.dll
2017-02-22 17:18 - 2016-12-14 05:40 - 00193536 _____ (Microsoft Corporation) C:\Windows\system32\certprop.dll
2017-02-22 17:18 - 2016-12-14 05:40 - 00104448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Internal.UI.Logon.ProxyStub.dll
2017-02-22 17:18 - 2016-12-14 05:39 - 00837632 _____ (Microsoft Corporation) C:\Windows\system32\wbiosrvc.dll
2017-02-22 17:18 - 2016-12-14 05:39 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\updatehandlers.dll
2017-02-22 17:18 - 2016-12-14 05:39 - 00257024 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.CredDialogController.dll
2017-02-22 17:18 - 2016-12-14 05:38 - 17188864 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Xaml.dll
2017-02-22 17:18 - 2016-12-14 05:38 - 13869056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Xaml.dll
2017-02-22 17:18 - 2016-12-14 05:38 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\CloudBackupSettings.dll
2017-02-22 17:18 - 2016-12-14 05:38 - 00213504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.CredDialogController.dll
2017-02-22 17:18 - 2016-12-14 05:37 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\updatepolicy.dll
2017-02-22 17:18 - 2016-12-14 05:36 - 01002496 _____ (Microsoft Corporation) C:\Windows\system32\SRH.dll
2017-02-22 17:18 - 2016-12-14 05:36 - 00539648 _____ (Microsoft Corporation) C:\Windows\system32\usocore.dll
2017-02-22 17:18 - 2016-12-14 05:36 - 00074752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\updatepolicy.dll
2017-02-22 17:18 - 2016-12-14 05:35 - 00755712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2017-02-22 17:18 - 2016-12-14 05:35 - 00712192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2017-02-22 17:18 - 2016-12-14 05:35 - 00600576 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2017-02-22 17:18 - 2016-12-14 05:35 - 00553984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
2017-02-22 17:18 - 2016-12-14 05:32 - 00806400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3D12.dll
2017-02-22 17:18 - 2016-12-14 05:32 - 00497152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\LogonController.dll
2017-02-22 17:18 - 2016-12-14 05:26 - 00932864 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2017-02-22 17:18 - 2016-12-14 05:26 - 00869888 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2017-02-22 17:18 - 2016-12-14 05:25 - 02009600 _____ (Microsoft Corporation) C:\Windows\system32\SRHInproc.dll
2017-02-22 17:18 - 2016-12-14 05:24 - 01005568 _____ (Microsoft Corporation) C:\Windows\system32\D3D12.dll
2017-02-22 17:18 - 2016-12-14 05:24 - 00673792 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2017-02-22 17:18 - 2016-12-14 05:23 - 03134976 _____ (Microsoft Corporation) C:\Windows\system32\rdpcore.dll
2017-02-22 17:18 - 2016-12-14 05:23 - 01231872 _____ (Microsoft Corporation) C:\Windows\system32\dosvc.dll
2017-02-22 17:18 - 2016-12-14 05:22 - 02998272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32kfull.sys
2017-02-22 17:18 - 2016-12-14 05:22 - 02748416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpcore.dll
2017-02-22 17:18 - 2016-12-14 05:22 - 02317824 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2017-02-22 17:18 - 2016-12-14 05:22 - 01513472 _____ (Microsoft Corporation) C:\Windows\system32\win32kbase.sys
2017-02-22 17:18 - 2016-12-14 05:22 - 00707584 _____ (Microsoft Corporation) C:\Windows\system32\LogonController.dll
2017-02-22 17:18 - 2016-12-14 05:22 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\wuuhext.dll
2017-02-22 17:18 - 2016-12-14 05:21 - 03616768 _____ (Microsoft Corporation) C:\Windows\system32\win32kfull.sys
2017-02-22 17:18 - 2016-12-09 11:42 - 01637728 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2017-02-22 17:18 - 2016-12-09 11:42 - 00137568 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2017-02-22 17:18 - 2016-12-09 11:34 - 01051112 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2017-02-22 17:18 - 2016-12-09 11:34 - 00894096 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2017-02-22 17:18 - 2016-12-09 11:33 - 01354320 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2017-02-22 17:18 - 2016-12-09 11:33 - 01173496 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2017-02-22 17:18 - 2016-12-09 11:30 - 00377184 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\clfs.sys
2017-02-22 17:18 - 2016-12-09 11:29 - 02681200 _____ C:\Windows\system32\CoreUIComponents.dll
2017-02-22 17:18 - 2016-12-09 11:28 - 00764392 _____ (Microsoft Corporation) C:\Windows\system32\CoreMessaging.dll
2017-02-22 17:18 - 2016-12-09 11:27 - 00172528 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2017-02-22 17:18 - 2016-12-09 11:20 - 02677544 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2017-02-22 17:18 - 2016-12-09 11:20 - 02189664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2017-02-22 17:18 - 2016-12-09 11:20 - 01738560 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2017-02-22 17:18 - 2016-12-09 11:20 - 00658784 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms2.sys
2017-02-22 17:18 - 2016-12-09 11:20 - 00402272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2017-02-22 17:18 - 2016-12-09 11:19 - 01293152 _____ (Microsoft Corporation) C:\Windows\system32\LicenseManager.dll
2017-02-22 17:18 - 2016-12-09 11:19 - 00168424 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2017-02-22 17:18 - 2016-12-09 11:18 - 02913144 _____ (Microsoft Corporation) C:\Windows\system32\combase.dll
2017-02-22 17:18 - 2016-12-09 11:18 - 01267512 _____ (Microsoft Corporation) C:\Windows\system32\WinTypes.dll
2017-02-22 17:18 - 2016-12-09 11:18 - 01100128 _____ (Microsoft Corporation) C:\Windows\system32\hvix64.exe
2017-02-22 17:18 - 2016-12-09 11:18 - 00989024 _____ (Microsoft Corporation) C:\Windows\system32\hvax64.exe
2017-02-22 17:18 - 2016-12-09 11:18 - 00947552 _____ (Microsoft Corporation) C:\Windows\system32\hvloader.efi
2017-02-22 17:18 - 2016-12-09 11:18 - 00811872 _____ (Microsoft Corporation) C:\Windows\system32\hvloader.exe
2017-02-22 17:18 - 2016-12-09 11:15 - 08168000 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Media.Protection.PlayReady.dll
2017-02-22 17:18 - 2016-12-09 11:14 - 01274712 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2017-02-22 17:18 - 2016-12-09 11:11 - 02048496 _____ C:\Windows\SysWOW64\CoreUIComponents.dll
2017-02-22 17:18 - 2016-12-09 11:10 - 01572768 _____ (Microsoft Corporation) C:\Windows\system32\gdi32full.dll
2017-02-22 17:18 - 2016-12-09 11:10 - 01461200 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2017-02-22 17:18 - 2016-12-09 11:01 - 02323728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2017-02-22 17:18 - 2016-12-09 11:01 - 01503544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2017-02-22 17:18 - 2016-12-09 11:01 - 00861024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\LicenseManager.dll
2017-02-22 17:18 - 2016-12-09 11:00 - 00106896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2017-02-22 17:18 - 2016-12-09 10:59 - 02166752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\combase.dll
2017-02-22 17:18 - 2016-12-09 10:59 - 00846560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinTypes.dll
2017-02-22 17:18 - 2016-12-09 10:57 - 06668040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Media.Protection.PlayReady.dll
2017-02-22 17:18 - 2016-12-09 10:56 - 00959112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2017-02-22 17:18 - 2016-12-09 10:52 - 01435896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2017-02-22 17:18 - 2016-12-09 10:52 - 01415752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32full.dll
2017-02-22 17:18 - 2016-12-09 10:51 - 00117240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2017-02-22 17:18 - 2016-12-09 10:45 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\WordBreakers.dll
2017-02-22 17:18 - 2016-12-09 10:42 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2017-02-22 17:18 - 2016-12-09 10:41 - 00380928 _____ (Microsoft Corporation) C:\Windows\system32\wincorlib.dll
2017-02-22 17:18 - 2016-12-09 10:41 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WordBreakers.dll
2017-02-22 17:18 - 2016-12-09 10:37 - 00411136 _____ (Microsoft Corporation) C:\Windows\system32\facecredentialprovider.dll
2017-02-22 17:18 - 2016-12-09 10:36 - 03059200 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2017-02-22 17:18 - 2016-12-09 10:36 - 00410112 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentClient.dll
2017-02-22 17:18 - 2016-12-09 10:34 - 00288768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincorlib.dll
2017-02-22 17:18 - 2016-12-09 10:33 - 03777536 _____ (Microsoft Corporation) C:\Windows\system32\MFMediaEngine.dll
2017-02-22 17:18 - 2016-12-09 10:33 - 01589760 _____ (Microsoft Corporation) C:\Windows\system32\msdtctm.dll
2017-02-22 17:18 - 2016-12-09 10:32 - 00635904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2017-02-22 17:18 - 2016-12-09 10:31 - 03689984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2017-02-22 17:18 - 2016-12-09 10:31 - 00313856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AppXDeploymentClient.dll
2017-02-22 17:18 - 2016-12-09 10:28 - 03306496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MFMediaEngine.dll
2017-02-22 17:18 - 2016-12-09 10:28 - 01004544 _____ (Microsoft Corporation) C:\Windows\system32\enterprisecsps.dll
2017-02-22 17:18 - 2016-12-09 10:27 - 13084160 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2017-02-22 17:18 - 2016-12-09 10:27 - 05114368 _____ (Microsoft Corporation) C:\Windows\system32\cdp.dll
2017-02-22 17:18 - 2016-12-09 10:27 - 00981504 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Security.Authentication.OnlineId.dll
2017-02-22 17:18 - 2016-12-09 10:25 - 00376832 _____ (Microsoft Corporation) C:\Windows\system32\CryptoWinRT.dll
2017-02-22 17:18 - 2016-12-09 10:23 - 12177920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2017-02-22 17:18 - 2016-12-09 10:22 - 02820096 _____ (Microsoft Corporation) C:\Windows\system32\InputService.dll
2017-02-22 17:18 - 2016-12-09 10:21 - 04746752 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2017-02-22 17:18 - 2016-12-09 10:21 - 00716800 _____ (Microsoft Corporation) C:\Windows\system32\ShareHost.dll
2017-02-22 17:18 - 2016-12-09 10:20 - 03198464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cdp.dll
2017-02-22 17:18 - 2016-12-09 10:20 - 00730624 _____ (Microsoft Corporation) C:\Windows\system32\fveapi.dll
2017-02-22 17:18 - 2016-12-09 10:20 - 00187392 _____ (Microsoft Corporation) C:\Windows\system32\mdmregistration.dll
2017-02-22 17:18 - 2016-12-09 10:20 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\DeviceEnroller.exe
2017-02-22 17:18 - 2016-12-09 10:19 - 00433664 _____ (Microsoft Corporation) C:\Windows\system32\TextInputFramework.dll
2017-02-22 17:18 - 2016-12-09 10:19 - 00261120 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Core.TextInput.dll
2017-02-22 17:18 - 2016-12-09 10:19 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\InputLocaleManager.dll
2017-02-22 17:18 - 2016-12-09 10:19 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\EditBufferTestHook.dll
2017-02-22 17:18 - 2016-12-09 10:18 - 03666432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2017-02-22 17:18 - 2016-12-09 10:18 - 02138112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InputService.dll
2017-02-22 17:18 - 2016-12-09 10:18 - 00165376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mdmregistration.dll
2017-02-22 17:18 - 2016-12-09 10:17 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ShareHost.dll
2017-02-22 17:18 - 2016-12-09 10:16 - 00353280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TextInputFramework.dll
2017-02-22 17:18 - 2016-12-09 10:15 - 00206848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Core.TextInput.dll
2017-02-22 17:18 - 2016-12-09 10:15 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InputLocaleManager.dll
2017-02-22 17:18 - 2016-12-09 10:15 - 00068096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\EditBufferTestHook.dll
2017-02-22 17:18 - 2016-12-09 09:54 - 00483840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CoreMessaging.dll
2017-02-22 17:18 - 2016-11-11 11:15 - 00198856 _____ (Microsoft Corporation) C:\Windows\system32\wscapi.dll
2017-02-22 17:18 - 2016-11-11 11:15 - 00101216 _____ (Microsoft Corporation) C:\Windows\system32\DeviceReactivation.dll
2017-02-22 17:18 - 2016-11-11 11:14 - 02186896 _____ (Microsoft Corporation) C:\Windows\system32\hevcdecoder.dll
2017-02-22 17:18 - 2016-11-11 11:14 - 00603488 _____ (Microsoft Corporation) C:\Windows\system32\ContentDeliveryManager.Utilities.dll
2017-02-22 17:18 - 2016-11-11 11:13 - 02213760 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2017-02-22 17:18 - 2016-11-11 11:13 - 01886344 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2017-02-22 17:18 - 2016-11-11 11:13 - 00352096 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fastfat.sys
2017-02-22 17:18 - 2016-11-11 11:12 - 00128352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\partmgr.sys
2017-02-22 17:18 - 2016-11-11 11:08 - 00142176 _____ (Microsoft Corporation) C:\Windows\system32\migisol.dll
2017-02-22 17:18 - 2016-11-11 11:03 - 01069720 _____ (Microsoft Corporation) C:\Windows\system32\MrmCoreR.dll
2017-02-22 17:18 - 2016-11-11 11:03 - 00266544 _____ (Microsoft Corporation) C:\Windows\system32\policymanager.dll
2017-02-22 17:18 - 2016-11-11 11:02 - 02828376 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll
2017-02-22 17:18 - 2016-11-11 11:02 - 00360040 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettingsAdminFlows.exe
2017-02-22 17:18 - 2016-11-11 11:01 - 07219672 _____ (Microsoft Corporation) C:\Windows\system32\windows.storage.dll
2017-02-22 17:18 - 2016-11-11 11:01 - 01859264 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.dll
2017-02-22 17:18 - 2016-11-11 11:01 - 00637400 _____ (Microsoft Corporation) C:\Windows\system32\dxgi.dll
2017-02-22 17:18 - 2016-11-11 11:00 - 00223584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2017-02-22 17:18 - 2016-11-11 11:00 - 00219488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tpm.sys
2017-02-22 17:18 - 2016-11-11 10:59 - 00433504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdbss.sys
2017-02-22 17:18 - 2016-11-11 10:57 - 01473048 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2017-02-22 17:18 - 2016-11-11 10:56 - 04673304 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2017-02-22 17:18 - 2016-11-11 10:56 - 01062480 _____ (Microsoft Corporation) C:\Windows\system32\mfsvr.dll
2017-02-22 17:18 - 2016-11-11 10:56 - 00424616 _____ (Microsoft Corporation) C:\Windows\system32\MFPlay.dll
2017-02-22 17:18 - 2016-11-11 10:56 - 00187520 _____ (Microsoft Corporation) C:\Windows\system32\CloudStorageWizard.exe
2017-02-22 17:18 - 2016-11-11 10:56 - 00163752 _____ (Microsoft Corporation) C:\Windows\system32\RTWorkQ.dll
2017-02-22 17:18 - 2016-11-11 10:56 - 00126568 _____ (Microsoft Corporation) C:\Windows\system32\mfaudiocnv.dll
2017-02-22 17:18 - 2016-11-11 10:55 - 00882680 _____ (Microsoft Corporation) C:\Windows\system32\EditionUpgradeManagerObj.dll
2017-02-22 17:18 - 2016-11-11 10:55 - 00743224 _____ (Microsoft Corporation) C:\Windows\system32\sppwinob.dll
2017-02-22 17:18 - 2016-11-11 10:54 - 01418312 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2017-02-22 17:18 - 2016-11-11 10:51 - 00454592 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2017-02-22 17:18 - 2016-11-11 10:31 - 00366080 _____ (Microsoft Corporation) C:\Windows\system32\RDXTaskFactory.dll
2017-02-22 17:18 - 2016-11-11 10:28 - 00040960 _____ (Microsoft Corporation) C:\Windows\system32\CbtBackgroundManagerPolicy.dll
2017-02-22 17:18 - 2016-11-11 10:27 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\NetCfgNotifyObjectHost.exe
2017-02-22 17:18 - 2016-11-11 10:27 - 00068096 _____ (Microsoft Corporation) C:\Windows\system32\lpremove.exe
2017-02-22 17:18 - 2016-11-11 10:26 - 00258560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\xboxgip.sys
2017-02-22 17:18 - 2016-11-11 10:26 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\EnterpriseModernAppMgmtCSP.dll
2017-02-22 17:18 - 2016-11-11 10:26 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\ReportingCSP.dll
2017-02-22 17:18 - 2016-11-11 10:26 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\modem.sys
2017-02-22 17:18 - 2016-11-11 10:26 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\ReAgentc.exe
2017-02-22 17:18 - 2016-11-11 10:25 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\BcastDVRHelper.dll
2017-02-22 17:18 - 2016-11-11 10:25 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\DisplayManager.dll
2017-02-22 17:18 - 2016-11-11 10:25 - 00151040 _____ (Microsoft Corporation) C:\Windows\system32\MapsBtSvc.dll
2017-02-22 17:18 - 2016-11-11 10:25 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\dmcertinst.exe
2017-02-22 17:18 - 2016-11-11 10:25 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\MosStorage.dll
2017-02-22 17:18 - 2016-11-11 10:25 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\HttpsDataSource.dll
2017-02-22 17:18 - 2016-11-11 10:25 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\Windows.StateRepositoryBroker.dll
2017-02-22 17:18 - 2016-11-11 10:24 - 00170496 _____ (Microsoft Corporation) C:\Windows\system32\AppCapture.dll
2017-02-22 17:18 - 2016-11-11 10:24 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\ACPBackgroundManagerPolicy.dll
2017-02-22 17:18 - 2016-11-11 10:24 - 00158720 _____ (Microsoft Corporation) C:\Windows\system32\VEStoreEventHandlers.dll
2017-02-22 17:18 - 2016-11-11 10:24 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sendmail.dll
2017-02-22 17:18 - 2016-11-11 10:24 - 00122880 _____ (Microsoft Corporation) C:\Windows\system32\Windows.StateRepositoryClient.dll
2017-02-22 17:18 - 2016-11-11 10:24 - 00110080 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Networking.BackgroundTransfer.BackgroundManagerPolicy.dll
2017-02-22 17:18 - 2016-11-11 10:24 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\VPNv2CSP.dll
2017-02-22 17:18 - 2016-11-11 10:24 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\browserbroker.dll
2017-02-22 17:18 - 2016-11-11 10:23 - 00567296 _____ (Microsoft Corporation) C:\Windows\system32\DevicePairing.dll
2017-02-22 17:18 - 2016-11-11 10:23 - 00409088 _____ (Microsoft Corporation) C:\Windows\system32\NgcCtnr.dll
2017-02-22 17:18 - 2016-11-11 10:23 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Shell.Search.UriHandler.dll
2017-02-22 17:18 - 2016-11-11 10:23 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\EAMProgressHandler.dll
2017-02-22 17:18 - 2016-11-11 10:22 - 00489472 _____ (Microsoft Corporation) C:\Windows\system32\NetSetupShim.dll
2017-02-22 17:18 - 2016-11-11 10:22 - 00143360 _____ (Microsoft Corporation) C:\Windows\system32\EDPCleanup.exe
2017-02-22 17:18 - 2016-11-11 10:22 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\moshost.dll
2017-02-22 17:18 - 2016-11-11 10:21 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\ieproxy.dll
2017-02-22 17:18 - 2016-11-11 10:21 - 00587776 _____ (Microsoft Corporation) C:\Windows\system32\vpnike.dll
2017-02-22 17:18 - 2016-11-11 10:21 - 00379392 _____ (Microsoft Corporation) C:\Windows\system32\apprepsync.dll
2017-02-22 17:18 - 2016-11-11 10:21 - 00313856 _____ (Microsoft Corporation) C:\Windows\system32\moshostcore.dll
2017-02-22 17:18 - 2016-11-11 10:20 - 00657920 _____ (Microsoft Corporation) C:\Windows\system32\rasmans.dll
2017-02-22 17:18 - 2016-11-11 10:20 - 00641024 _____ (Microsoft Corporation) C:\Windows\system32\ngccredprov.dll
2017-02-22 17:18 - 2016-11-11 10:20 - 00590336 _____ (Microsoft Corporation) C:\Windows\system32\efswrt.dll
2017-02-22 17:18 - 2016-11-11 10:20 - 00574464 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers_StorageSense.dll
2017-02-22 17:18 - 2016-11-11 10:20 - 00446976 _____ (Microsoft Corporation) C:\Windows\system32\MapConfiguration.dll
2017-02-22 17:18 - 2016-11-11 10:20 - 00407552 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Internal.Management.dll
2017-02-22 17:18 - 2016-11-11 10:20 - 00381952 _____ (Microsoft Corporation) C:\Windows\system32\cryptngc.dll
2017-02-22 17:18 - 2016-11-11 10:20 - 00339456 _____ (Microsoft Corporation) C:\Windows\system32\cdpusersvc.dll
2017-02-22 17:18 - 2016-11-11 10:20 - 00176128 _____ (Microsoft Corporation) C:\Windows\system32\apprepapi.dll
2017-02-22 17:18 - 2016-11-11 10:20 - 00125952 _____ (Microsoft Corporation) C:\Windows\system32\setupugc.exe
2017-02-22 17:18 - 2016-11-11 10:20 - 00115200 _____ (Microsoft Corporation) C:\Windows\system32\IdCtrls.dll
2017-02-22 17:18 - 2016-11-11 10:19 - 00620544 _____ (Microsoft Corporation) C:\Windows\system32\bcastdvr.exe
2017-02-22 17:18 - 2016-11-11 10:19 - 00495104 _____ (Microsoft Corporation) C:\Windows\system32\DataSenseHandlers.dll
2017-02-22 17:18 - 2016-11-11 10:19 - 00411648 _____ (Microsoft Corporation) C:\Windows\system32\cdpsvc.dll
2017-02-22 17:18 - 2016-11-11 10:19 - 00389632 _____ (Microsoft Corporation) C:\Windows\system32\ActivationManager.dll
2017-02-22 17:18 - 2016-11-11 10:19 - 00388096 _____ (Microsoft Corporation) C:\Windows\system32\zipfldr.dll
2017-02-22 17:18 - 2016-11-11 10:19 - 00366080 _____ (Microsoft Corporation) C:\Windows\system32\SearchFolder.dll
2017-02-22 17:18 - 2016-11-11 10:19 - 00320000 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2017-02-22 17:18 - 2016-11-11 10:19 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\EnterpriseAppMgmtSvc.dll
2017-02-22 17:18 - 2016-11-11 10:19 - 00198144 _____ (Microsoft Corporation) C:\Windows\system32\dpapisrv.dll
2017-02-22 17:18 - 2016-11-11 10:18 - 02084352 _____ (Microsoft Corporation) C:\Windows\system32\DeviceFlows.DataModel.dll
2017-02-22 17:18 - 2016-11-11 10:18 - 00278016 _____ (Microsoft Corporation) C:\Windows\system32\netplwiz.dll
2017-02-22 17:18 - 2016-11-11 10:17 - 01220096 _____ (Microsoft Corporation) C:\Windows\system32\wscui.cpl
2017-02-22 17:18 - 2016-11-11 10:17 - 00068096 _____ (Microsoft Corporation) C:\Windows\system32\ProvSysprep.dll
2017-02-22 17:18 - 2016-11-11 10:16 - 02716672 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2017-02-22 17:18 - 2016-11-11 10:16 - 01477632 _____ (Microsoft Corporation) C:\Windows\system32\wsecedit.dll
2017-02-22 17:18 - 2016-11-11 10:16 - 00560128 _____ (Microsoft Corporation) C:\Windows\system32\AppReadiness.dll
2017-02-22 17:18 - 2016-11-11 10:16 - 00184832 _____ (Microsoft Corporation) C:\Windows\system32\wscsvc.dll
2017-02-22 17:18 - 2016-11-11 10:16 - 00161792 _____ (Microsoft Corporation) C:\Windows\system32\EditionUpgradeHelper.dll
2017-02-22 17:18 - 2016-11-11 10:16 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\RjvMDMConfig.dll
2017-02-22 17:18 - 2016-11-11 10:15 - 00282624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2017-02-22 17:18 - 2016-11-11 10:15 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\wscinterop.dll
2017-02-22 17:18 - 2016-11-11 10:15 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe
2017-02-22 17:18 - 2016-11-11 10:14 - 07654400 _____ (Microsoft Corporation) C:\Windows\system32\mos.dll
2017-02-22 17:18 - 2016-11-11 10:14 - 02104320 _____ (Microsoft Corporation) C:\Windows\system32\wlidsvc.dll
2017-02-22 17:18 - 2016-11-11 10:14 - 00713216 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2017-02-22 17:18 - 2016-11-11 10:14 - 00615424 _____ (Microsoft Corporation) C:\Windows\system32\wpnprv.dll
2017-02-22 17:18 - 2016-11-11 10:14 - 00178176 _____ (Microsoft Corporation) C:\Windows\system32\sppnp.dll
2017-02-22 17:18 - 2016-11-11 10:13 - 07812096 _____ (Microsoft Corporation) C:\Windows\system32\BingMaps.dll
2017-02-22 17:18 - 2016-11-11 10:13 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\StorSvc.dll
2017-02-22 17:18 - 2016-11-11 10:13 - 00306176 _____ (Microsoft Corporation) C:\Windows\system32\msdtcuiu.dll
2017-02-22 17:18 - 2016-11-11 10:12 - 00870912 _____ (Microsoft Corporation) C:\Windows\system32\msdtcprx.dll
2017-02-22 17:18 - 2016-11-11 10:11 - 00870400 _____ (Microsoft Corporation) C:\Windows\system32\mfmkvsrcsnk.dll
2017-02-22 17:18 - 2016-11-11 10:11 - 00096256 _____ (Microsoft Corporation) C:\Windows\system32\umpoext.dll
2017-02-22 17:18 - 2016-11-11 10:09 - 01366016 _____ (Microsoft Corporation) C:\Windows\system32\wpncore.dll
2017-02-22 17:18 - 2016-11-11 10:09 - 00164352 _____ (Microsoft Corporation) C:\Windows\system32\dialserver.dll
2017-02-22 17:18 - 2016-11-11 10:08 - 00539136 _____ (Microsoft Corporation) C:\Windows\system32\PlayToManager.dll
2017-02-22 17:18 - 2016-11-11 10:07 - 03441152 _____ (Microsoft Corporation) C:\Windows\system32\MapRouter.dll
2017-02-22 17:18 - 2016-11-11 10:07 - 02953216 _____ (Microsoft Corporation) C:\Windows\system32\MapGeocoder.dll
2017-02-22 17:18 - 2016-11-11 10:07 - 02510848 _____ (Microsoft Corporation) C:\Windows\system32\NetworkMobileSettings.dll
2017-02-22 17:18 - 2016-11-11 10:07 - 01691136 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2017-02-22 17:18 - 2016-11-11 10:07 - 01060864 _____ (Microsoft Corporation) C:\Windows\system32\JpMapControl.dll
2017-02-22 17:18 - 2016-11-11 10:07 - 00991232 _____ (Microsoft Corporation) C:\Windows\system32\comdlg32.dll
2017-02-22 17:18 - 2016-11-11 10:07 - 00779776 _____ (Microsoft Corporation) C:\Windows\system32\cscui.dll
2017-02-22 17:18 - 2016-11-11 10:07 - 00347648 _____ (Microsoft Corporation) C:\Windows\system32\rascustom.dll
2017-02-22 17:18 - 2016-11-11 10:06 - 03400192 _____ (Microsoft Corporation) C:\Windows\system32\SyncCenter.dll
2017-02-22 17:18 - 2016-11-11 10:06 - 00960000 _____ (Microsoft Corporation) C:\Windows\system32\modernexecserver.dll
2017-02-22 17:18 - 2016-11-11 10:06 - 00650752 _____ (Microsoft Corporation) C:\Windows\system32\RDXService.dll
2017-02-22 17:18 - 2016-11-11 10:05 - 04136448 _____ (Microsoft Corporation) C:\Windows\system32\Windows.StateRepository.dll
2017-02-22 17:18 - 2016-11-11 10:05 - 02852864 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettingsThresholdAdminFlowUI.dll
2017-02-22 17:18 - 2016-11-11 10:05 - 01779712 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2017-02-22 17:18 - 2016-11-11 10:05 - 01031680 _____ (Microsoft Corporation) C:\Windows\system32\MapsStore.dll
2017-02-22 17:18 - 2016-11-11 10:04 - 02800128 _____ (Microsoft Corporation) C:\Windows\system32\netshell.dll
2017-02-22 17:18 - 2016-11-11 10:04 - 02611200 _____ (Microsoft Corporation) C:\Windows\system32\gameux.dll
2017-02-22 17:18 - 2016-11-11 10:04 - 01709056 _____ (Microsoft Corporation) C:\Windows\system32\UIAutomationCore.dll
2017-02-22 17:18 - 2016-11-11 10:04 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\usercpl.dll
2017-02-22 17:18 - 2016-11-11 10:04 - 00909312 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Search.dll
2017-02-22 17:18 - 2016-11-11 10:04 - 00691712 _____ (Microsoft Corporation) C:\Windows\system32\lsm.dll
2017-02-22 17:18 - 2016-11-11 10:04 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\dmenrollengine.dll
2017-02-22 17:18 - 2016-11-11 10:04 - 00389632 _____ (Microsoft Corporation) C:\Windows\system32\stobject.dll
2017-02-22 17:18 - 2016-11-11 10:03 - 04708864 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2017-02-22 17:18 - 2016-11-11 10:03 - 02669056 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2017-02-22 17:18 - 2016-11-11 10:03 - 02287616 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2017-02-22 17:18 - 2016-11-11 10:03 - 00905216 _____ (Microsoft Corporation) C:\Windows\system32\MapControlCore.dll
2017-02-22 17:18 - 2016-11-11 10:03 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\ntshrui.dll
2017-02-22 17:18 - 2016-11-11 10:03 - 00632320 _____ (Microsoft Corporation) C:\Windows\system32\rasapi32.dll
2017-02-22 17:18 - 2016-11-11 10:03 - 00283648 _____ (Microsoft Corporation) C:\Windows\system32\wkssvc.dll
2017-02-22 17:18 - 2016-11-11 10:02 - 03542016 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2017-02-22 17:18 - 2016-11-11 10:02 - 01726976 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Immersive.dll
2017-02-22 17:18 - 2016-11-11 10:02 - 00936448 _____ (Microsoft Corporation) C:\Windows\system32\NMAA.dll
2017-02-22 17:18 - 2016-11-11 09:01 - 01969912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\hevcdecoder.dll
2017-02-22 17:18 - 2016-11-11 09:01 - 00167848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscapi.dll
2017-02-22 17:18 - 2016-11-11 09:00 - 01706488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2017-02-22 17:18 - 2016-11-11 08:59 - 01572768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2017-02-22 17:18 - 2016-11-11 08:54 - 00122208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\migisol.dll
2017-02-22 17:18 - 2016-11-11 08:49 - 00869848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MrmCoreR.dll
2017-02-22 17:18 - 2016-11-11 08:49 - 00248480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\policymanager.dll
2017-02-22 17:18 - 2016-11-11 08:48 - 02277248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2017-02-22 17:18 - 2016-11-11 08:47 - 05722832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\windows.storage.dll
2017-02-22 17:18 - 2016-11-11 08:47 - 01430720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.dll
2017-02-22 17:18 - 2016-11-11 08:47 - 00527880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxgi.dll
2017-02-22 17:18 - 2016-11-11 08:42 - 01123912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
2017-02-22 17:18 - 2016-11-11 08:42 - 00952416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfsvr.dll
2017-02-22 17:18 - 2016-11-11 08:42 - 00374448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MFPlay.dll
2017-02-22 17:18 - 2016-11-11 08:42 - 00152416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RTWorkQ.dll
2017-02-22 17:18 - 2016-11-11 08:42 - 00091936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfaudiocnv.dll
2017-02-22 17:18 - 2016-11-11 08:41 - 04311736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
2017-02-22 17:18 - 2016-11-11 08:41 - 00157536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CloudStorageWizard.exe
2017-02-22 17:18 - 2016-11-11 08:38 - 01263856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2017-02-22 17:18 - 2016-11-11 08:27 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe
2017-02-22 17:18 - 2016-11-11 08:26 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ReAgentc.exe
2017-02-22 17:18 - 2016-11-11 08:25 - 00117248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MapsBtSvc.dll
2017-02-22 17:18 - 2016-11-11 08:25 - 00071168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MosStorage.dll
2017-02-22 17:18 - 2016-11-11 08:24 - 00519168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ngccredprov.dll
2017-02-22 17:18 - 2016-11-11 08:24 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\BcastDVRHelper.dll
2017-02-22 17:18 - 2016-11-11 08:24 - 00138240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DisplayManager.dll
2017-02-22 17:18 - 2016-11-11 08:24 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Shell.Search.UriHandler.dll
2017-02-22 17:18 - 2016-11-11 08:23 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AppCapture.dll
2017-02-22 17:18 - 2016-11-11 08:23 - 00094208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.StateRepositoryClient.dll
2017-02-22 17:18 - 2016-11-11 08:22 - 00505856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcastdvr.exe
2017-02-22 17:18 - 2016-11-11 08:22 - 00122880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sendmail.dll
2017-02-22 17:18 - 2016-11-11 08:21 - 00332288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MapConfiguration.dll
2017-02-22 17:18 - 2016-11-11 08:21 - 00091648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Networking.BackgroundTransfer.BackgroundManagerPolicy.dll
2017-02-22 17:18 - 2016-11-11 08:20 - 00306176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieproxy.dll
2017-02-22 17:18 - 2016-11-11 08:19 - 01755136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DeviceFlows.DataModel.dll
2017-02-22 17:18 - 2016-11-11 08:19 - 00506880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DevicePairing.dll
2017-02-22 17:18 - 2016-11-11 08:19 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\NetSetupShim.dll
2017-02-22 17:18 - 2016-11-11 08:19 - 00298496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Internal.Management.dll
2017-02-22 17:18 - 2016-11-11 08:19 - 00284672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apprepsync.dll
2017-02-22 17:18 - 2016-11-11 08:19 - 00125952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apprepapi.dll
2017-02-22 17:18 - 2016-11-11 08:19 - 00114176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setupugc.exe
2017-02-22 17:18 - 2016-11-11 08:18 - 02333184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll
2017-02-22 17:18 - 2016-11-11 08:18 - 01336320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wsecedit.dll
2017-02-22 17:18 - 2016-11-11 08:18 - 01196544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscui.cpl
2017-02-22 17:18 - 2016-11-11 08:18 - 00431616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\efswrt.dll
2017-02-22 17:18 - 2016-11-11 08:18 - 00318464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchFolder.dll
2017-02-22 17:18 - 2016-11-11 08:18 - 00108544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscinterop.dll
2017-02-22 17:18 - 2016-11-11 08:17 - 00333312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ActivationManager.dll
2017-02-22 17:18 - 2016-11-11 08:17 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe
2017-02-22 17:18 - 2016-11-11 08:16 - 00253952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2017-02-22 17:18 - 2016-11-11 08:15 - 01357824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAutomationCore.dll
2017-02-22 17:18 - 2016-11-11 08:15 - 00838144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JpMapControl.dll
2017-02-22 17:18 - 2016-11-11 08:15 - 00348672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\zipfldr.dll
2017-02-22 17:18 - 2016-11-11 08:15 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptngc.dll
2017-02-22 17:18 - 2016-11-11 08:14 - 00395264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dmenrollengine.dll
2017-02-22 17:18 - 2016-11-11 08:12 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdtcuiu.dll
2017-02-22 17:18 - 2016-11-11 08:10 - 06109184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mos.dll
2017-02-22 17:18 - 2016-11-11 08:10 - 00746496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdtcprx.dll
2017-02-22 17:18 - 2016-11-11 08:09 - 05380608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\BingMaps.dll
2017-02-22 17:18 - 2016-11-11 08:09 - 00545280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmkvsrcsnk.dll
2017-02-22 17:18 - 2016-11-11 08:08 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xolehlp.dll
2017-02-22 17:18 - 2016-11-11 08:06 - 02362880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MapRouter.dll
2017-02-22 17:18 - 2016-11-11 08:06 - 02109952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MapGeocoder.dll
2017-02-22 17:18 - 2016-11-11 08:06 - 01228288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usercpl.dll
2017-02-22 17:18 - 2016-11-11 08:06 - 00400384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PlayToManager.dll
2017-02-22 17:18 - 2016-11-11 08:06 - 00359936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mtxclu.dll
2017-02-22 17:18 - 2016-11-11 08:05 - 04423680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2017-02-22 17:18 - 2016-11-11 08:05 - 03370496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.StateRepository.dll
2017-02-22 17:18 - 2016-11-11 08:04 - 02682880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netshell.dll
2017-02-22 17:18 - 2016-11-11 08:04 - 01992704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2017-02-22 17:18 - 2016-11-11 08:04 - 01595392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2017-02-22 17:18 - 2016-11-11 08:04 - 00912896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comdlg32.dll
2017-02-22 17:18 - 2016-11-11 08:04 - 00715264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MapControlCore.dll
2017-02-22 17:18 - 2016-11-11 08:04 - 00358912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\stobject.dll
2017-02-22 17:18 - 2016-11-11 08:03 - 02484736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gameux.dll
2017-02-22 17:18 - 2016-11-11 08:03 - 02256384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2017-02-22 17:18 - 2016-11-11 08:03 - 01576448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll
2017-02-22 17:18 - 2016-11-11 08:03 - 01556480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Immersive.dll
2017-02-22 17:18 - 2016-11-11 08:03 - 00772608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntshrui.dll
2017-02-22 17:18 - 2016-11-11 08:03 - 00760832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\NMAA.dll
2017-02-22 17:18 - 2016-11-11 08:03 - 00565248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasapi32.dll
2017-02-22 17:18 - 2016-11-11 08:02 - 00711680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Search.dll
2017-02-22 17:04 - 2016-12-21 08:08 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2017-02-22 17:04 - 2016-12-21 05:44 - 00120320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2017-02-22 17:03 - 2017-02-22 17:03 - 00000000 ____D C:\Users\Luca\AppData\Local\Comms
2017-02-22 16:53 - 2017-02-22 16:53 - 00000000 ____D C:\Users\Luca\AppData\Local\Razer_Inc
2017-02-22 16:52 - 2017-02-23 13:48 - 00000000 ____D C:\Program Files (x86)\Razer
2017-02-22 16:52 - 2017-02-22 16:52 - 00000000 ____D C:\ProgramData\Razer
2017-02-22 16:51 - 2017-02-22 16:51 - 00003628 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2017-02-22 16:51 - 2017-02-22 16:51 - 00003504 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2017-02-22 16:51 - 2017-02-22 16:51 - 00002336 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-02-22 16:51 - 2017-02-22 16:51 - 00002324 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2017-02-22 16:51 - 2017-02-22 16:51 - 00000000 ____D C:\Users\Luca\AppData\LocalLow\AMD
2017-02-22 16:51 - 2017-02-22 16:51 - 00000000 ____D C:\Program Files (x86)\Google
2017-02-22 16:50 - 2017-03-04 11:13 - 00000000 __SHD C:\Users\Luca\IntelGraphicsProfiles
2017-02-22 16:50 - 2017-02-22 17:29 - 00000000 ____D C:\Users\Luca\AppData\Local\Google
2017-02-22 16:50 - 2017-02-22 16:50 - 00000000 ____D C:\Program Files\Intel
2017-02-22 16:50 - 2017-02-22 16:50 - 00000000 ____D C:\Program Files (x86)\Intel
2017-02-22 16:50 - 2017-02-22 16:50 - 00000000 ____D C:\Intel
2017-02-22 16:50 - 2017-02-22 16:50 - 00000000 _____ C:\Windows\system32\GfxValDisplayLog.bin
2017-02-22 16:49 - 2017-02-23 16:49 - 00003288 _____ C:\Windows\System32\Tasks\OneDrive Standalone Update Task v2
2017-02-22 16:49 - 2017-02-22 16:50 - 00000000 ____D C:\Users\Luca\AppData\Local\MicrosoftEdge
2017-02-22 16:48 - 2017-03-05 11:21 - 00000000 ____D C:\Users\Luca\AppData\Roaming\Skype
2017-02-22 16:48 - 2017-02-27 17:23 - 00000000 ____D C:\ProgramData\Package Cache
2017-02-22 16:48 - 2017-02-23 16:49 - 00002380 _____ C:\Users\Luca\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2017-02-22 16:48 - 2017-02-23 16:49 - 00000000 ___RD C:\Users\Luca\OneDrive
2017-02-22 16:48 - 2017-02-23 13:49 - 00000000 ____D C:\Users\Luca\AppData\Local\AMD
2017-02-22 16:48 - 2017-02-23 13:48 - 00000000 ____D C:\Program Files\AMD
2017-02-22 16:48 - 2017-02-22 23:46 - 00000000 ____D C:\AMD
2017-02-22 16:48 - 2017-02-22 16:48 - 00000000 ____D C:\Program Files\Common Files\ATI Technologies
2017-02-22 16:46 - 2017-03-04 16:16 - 00000000 ____D C:\Users\Luca\AppData\Local\VirtualStore
2017-02-22 16:46 - 2017-02-22 18:25 - 00000000 ____D C:\Users\Luca\AppData\Roaming\Adobe
2017-02-22 16:46 - 2017-02-22 16:46 - 00000000 ____D C:\Users\Luca\AppData\Local\Publishers
2017-02-22 16:45 - 2017-03-04 15:11 - 00000000 ____D C:\Users\Luca
2017-02-22 16:45 - 2017-02-23 13:54 - 00000000 ____D C:\Users\Luca\AppData\Local\ConnectedDevicesPlatform
2017-02-22 16:45 - 2017-02-22 18:02 - 00000000 ____D C:\Users\Luca\AppData\Local\Packages
2017-02-22 16:45 - 2017-02-22 16:45 - 00000020 ___SH C:\Users\Luca\ntuser.ini
2017-02-22 16:45 - 2017-02-22 16:45 - 00000000 _SHDL C:\Users\Luca\Vorlagen
2017-02-22 16:45 - 2017-02-22 16:45 - 00000000 _SHDL C:\Users\Luca\Startmenü
2017-02-22 16:45 - 2017-02-22 16:45 - 00000000 _SHDL C:\Users\Luca\Netzwerkumgebung
2017-02-22 16:45 - 2017-02-22 16:45 - 00000000 _SHDL C:\Users\Luca\Lokale Einstellungen
2017-02-22 16:45 - 2017-02-22 16:45 - 00000000 _SHDL C:\Users\Luca\Eigene Dateien
2017-02-22 16:45 - 2017-02-22 16:45 - 00000000 _SHDL C:\Users\Luca\Druckumgebung
2017-02-22 16:45 - 2017-02-22 16:45 - 00000000 _SHDL C:\Users\Luca\Documents\Eigene Videos
2017-02-22 16:45 - 2017-02-22 16:45 - 00000000 _SHDL C:\Users\Luca\Documents\Eigene Musik
2017-02-22 16:45 - 2017-02-22 16:45 - 00000000 _SHDL C:\Users\Luca\Documents\Eigene Bilder
2017-02-22 16:45 - 2017-02-22 16:45 - 00000000 _SHDL C:\Users\Luca\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2017-02-22 16:45 - 2017-02-22 16:45 - 00000000 _SHDL C:\Users\Luca\AppData\Local\Verlauf
2017-02-22 16:45 - 2017-02-22 16:45 - 00000000 _SHDL C:\Users\Luca\AppData\Local\Anwendungsdaten
2017-02-22 16:45 - 2017-02-22 16:45 - 00000000 _SHDL C:\Users\Luca\Anwendungsdaten
2017-02-22 16:45 - 2017-02-22 16:45 - 00000000 ____D C:\Users\Luca\AppData\Local\TileDataLayer
2017-02-22 16:44 - 2017-02-22 16:45 - 00000000 ____D C:\Users\defaultuser0\AppData\Local\Packages
2017-02-22 16:44 - 2017-02-22 16:44 - 00000000 ____D C:\Windows\CSC
2017-02-22 16:44 - 2017-02-22 16:44 - 00000000 ____D C:\Users\defaultuser0\AppData\Local\VirtualStore
2017-02-22 16:44 - 2017-02-22 16:44 - 00000000 ____D C:\Users\defaultuser0\AppData\Local\TileDataLayer
2017-02-22 16:44 - 2017-02-22 16:44 - 00000000 ____D C:\Users\defaultuser0\AppData\Local\ConnectedDevicesPlatform
2017-02-22 16:43 - 2017-02-22 16:43 - 00000020 ___SH C:\Users\defaultuser0\ntuser.ini
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Videos
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Musik
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Bilder
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\Users\defaultuser0\Vorlagen
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\Users\defaultuser0\Startmenü
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\Users\defaultuser0\Netzwerkumgebung
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\Users\defaultuser0\Lokale Einstellungen
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\Users\defaultuser0\Eigene Dateien
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\Users\defaultuser0\Druckumgebung
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\Users\defaultuser0\Documents\Eigene Videos
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\Users\defaultuser0\Documents\Eigene Musik
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\Users\defaultuser0\Documents\Eigene Bilder
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\Users\defaultuser0\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\Users\defaultuser0\AppData\Local\Verlauf
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\Users\defaultuser0\AppData\Local\Anwendungsdaten
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\Users\defaultuser0\Anwendungsdaten
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\Users\Default\Vorlagen
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\Users\Default\Startmenü
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\Users\Default\Netzwerkumgebung
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\Users\Default\Lokale Einstellungen
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\Users\Default\Eigene Dateien
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\Users\Default\Druckumgebung
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Videos
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Musik
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Bilder
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\Users\Default\AppData\Local\Verlauf
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\Users\Default\AppData\Local\Anwendungsdaten
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\Users\Default\Anwendungsdaten
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Videos
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Musik
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Bilder
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Verlauf
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Anwendungsdaten
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\Programme
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\ProgramData\Vorlagen
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\ProgramData\Startmenü
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\ProgramData\Microsoft\Windows\Start Menu\Programme
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\ProgramData\Dokumente
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\ProgramData\Anwendungsdaten
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\Program Files\Gemeinsame Dateien
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 _SHDL C:\Dokumente und Einstellungen
2017-02-22 16:43 - 2017-02-22 16:43 - 00000000 ____D C:\Users\defaultuser0
2017-02-22 16:41 - 2017-02-22 16:41 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
2017-02-22 16:39 - 2017-02-22 16:43 - 00000000 ____D C:\Windows\Panther
 
==================== Ein Monat: Geänderte Dateien und Ordner ========
 
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
 
2017-03-05 10:42 - 2016-11-20 13:36 - 00000000 ____D C:\Windows\system32\SleepStudy
2017-03-04 17:05 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\AppReadiness
2017-03-04 17:01 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\LiveKernelReports
2017-03-04 16:57 - 2016-11-20 22:50 - 00000000 __RHD C:\Users\Public\AccountPictures
2017-03-04 16:57 - 2016-11-20 22:36 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-03-04 16:56 - 2016-07-16 07:04 - 00262144 _____ C:\Windows\system32\config\BBI
2017-03-04 12:24 - 2016-07-16 12:45 - 00000000 ____D C:\Windows\INF
2017-03-04 11:52 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\rescache
2017-03-03 18:49 - 2016-08-30 16:56 - 00000000 ____D C:\Users\Luca\Desktop\glance_mod
2017-03-03 18:49 - 2016-07-16 12:43 - 00471040 _____ (Microsoft Corporation) C:\Windows\system32\dpnet.dll
2017-03-03 18:49 - 2016-07-16 12:43 - 00395264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpnet.dll
2017-03-03 18:49 - 2016-07-16 12:43 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpnathlp.dll
2017-03-03 18:49 - 2016-07-16 12:43 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpnsvr.exe
2017-03-03 18:49 - 2016-07-16 12:43 - 00008704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpnhupnp.dll
2017-03-03 18:49 - 2016-07-16 12:43 - 00008704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpnhpast.dll
2017-03-03 18:49 - 2016-07-16 12:43 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpnlobby.dll
2017-03-03 18:49 - 2016-07-16 12:43 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpnaddr.dll
2017-03-03 18:49 - 2016-07-16 12:36 - 00000000 ____D C:\Windows\CbsTemp
2017-03-03 18:48 - 2016-07-16 12:43 - 00220672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dplayx.dll
2017-03-03 18:48 - 2016-07-16 12:43 - 00068096 _____ (Microsoft Corporation) C:\Windows\system32\dpnathlp.dll
2017-03-03 18:48 - 2016-07-16 12:43 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpwsockx.dll
2017-03-03 18:48 - 2016-07-16 12:43 - 00027136 _____ (Microsoft Corporation) C:\Windows\system32\dpnsvr.exe
2017-03-03 18:48 - 2016-07-16 12:43 - 00025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpmodemx.dll
2017-03-03 18:48 - 2016-07-16 12:43 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dplaysvr.exe
2017-03-03 18:48 - 2016-07-16 12:43 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dpnhupnp.dll
2017-03-03 18:48 - 2016-07-16 12:43 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dpnhpast.dll
2017-03-03 18:48 - 2016-07-16 12:43 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\dpnlobby.dll
2017-03-03 18:48 - 2016-07-16 12:43 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\dpnaddr.dll
2017-03-02 13:51 - 2016-07-16 12:47 - 00000000 ___HD C:\Program Files\WindowsApps
2017-02-27 17:23 - 2016-07-16 12:47 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2017-02-25 18:49 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\SysWOW64\MUI
2017-02-25 18:49 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\system32\MUI
2017-02-24 17:45 - 2016-11-16 20:28 - 00000000 ____D C:\Users\Luca\Desktop\NosTale Multiclient Creator
2017-02-23 13:50 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\appcompat
2017-02-23 13:46 - 2016-11-20 13:36 - 04858776 _____ C:\Windows\system32\FNTCACHE.DAT
2017-02-22 23:50 - 2016-07-16 12:47 - 00000000 ___RD C:\Windows\ImmersiveControlPanel
2017-02-22 23:50 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\SysWOW64\oobe
2017-02-22 23:50 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\system32\WinBioPlugIns
2017-02-22 23:50 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\system32\oobe
2017-02-22 23:50 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\ShellExperiences
2017-02-22 23:50 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\Provisioning
2017-02-22 23:50 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\PolicyDefinitions
2017-02-22 23:50 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\bcastdvr
2017-02-22 23:50 - 2016-07-16 07:04 - 00000000 ____D C:\Windows\SysWOW64\Dism
2017-02-22 23:50 - 2016-07-16 07:04 - 00000000 ____D C:\Windows\system32\Sysprep
2017-02-22 23:50 - 2016-07-16 07:04 - 00000000 ____D C:\Windows\system32\Dism
2017-02-22 23:50 - 2016-07-16 07:04 - 00000000 ____D C:\Windows\servicing
2017-02-22 18:02 - 2016-07-16 12:47 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2017-02-22 17:00 - 2016-07-16 12:42 - 00180224 _____ (Microsoft Corporation) C:\Windows\system32\enrollmentapi.dll
2017-02-22 16:45 - 2016-07-16 12:47 - 00000000 ____D C:\Windows\system32\WinBioDatabase
2017-02-22 16:43 - 2016-07-16 12:47 - 00000000 ____D C:\Program Files\Windows NT
2017-02-22 16:39 - 2016-07-16 12:47 - 00028672 _____ C:\Windows\system32\config\BCD-Template
2017-02-06 20:48 - 2016-07-16 12:49 - 00835576 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2017-02-06 20:48 - 2016-07-16 12:49 - 00177656 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
 
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
 
2017-02-25 10:36 - 2017-02-25 10:36 - 0000003 _____ () C:\Users\Luca\AppData\Local\updater.log
2017-02-25 10:36 - 2017-02-25 10:36 - 0000424 _____ () C:\Users\Luca\AppData\Local\UserProducts.xml
 
==================== Bamital & volsnap ======================
 
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
 
C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert
 
LastRegBack: 2017-02-22 16:40
 
==================== Ende von FRST.txt ============================

Attached Files



BC AdBot (Login to Remove)

 


#2 B-boy/StyLe/

B-boy/StyLe/

    Bleepin' Freestyler


  • Malware Response Team
  • 8,307 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bulgaria
  • Local time:06:30 PM

Posted 05 March 2017 - 05:54 AM

Hello! Welcome to BleepingComputer Forums! :welcome:
My name is Georgi and and I will be helping you with your computer problems.

Before we begin, please note the following:

  • I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The logs can take some time to research, so please be patient with me.
  • Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
  • Instructions that I give are for your system only!
  • Please do not run any tools until requested ! The reason for this is so I know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.
  • Please perform all steps in the order received. If you can't understand something don't hesitate to ask.
  • Again I would like to remind you to make no further changes to your computer unless I direct you to do so. I will not help you if you do not follow my instructions.

 

Please download the following file => Attached File  fixlist.txt   2.5KB   6 downloads and save it to the Desktop.
NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

This script was written specifically for you, for use on that particular machine.

 

Let me know how it went. :)

 

 

Regards,

Georgi


cXfZ4wS.png


#3 Zerian

Zerian
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:04:30 PM

Posted 05 March 2017 - 06:09 AM

Hey Georgi,

 

Here is the Fixlog:

 

Entferungsergebnis von Farbar Recovery Scan Tool (x64) Version: 04-03-2017
durchgeführt von Luca (05-03-2017 12:01:55) Run:1
Gestartet von C:\Users\Luca\Desktop
Geladene Profile: Luca (Verfügbare Profile: defaultuser0 & Luca)
Start-Modus: Normal
==============================================
 
fixlist Inhalt:
*****************
start
CreateRestorePoint:
CloseProcesses:
CHR Extension: (Chrome Media Router) - C:\Users\Luca\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-02-22]
Folder: C:\ProgramData\AMD
Folder: C:\Users\Luca\AppData\Local\Tempzxpsign73ea3c1007536cdf
Folder: C:\Users\Luca\AppData\Local\Tempzxpsign876cde7496f6f207
Folder: C:\Users\Luca\AppData\Local\Tempzxpsign09ebc62b7e4c3878
Folder: C:\Windows\system32\ÿÿÿÿÿÿÿÿ8
Folder: C:\Windows\system32\ÿÿÿÿÿÿÿÿerStore
Folder: C:\Users\Luca\AppData\Local\Tempzxpsigne929465219c689ae
Folder: C:\Users\Luca\AppData\Local\Tempzxpsign8019bcf791f8abab
Folder: C:\Users\Luca\AppData\Local\Tempzxpsign3c3a8ed1c62bc5d6
CustomCLSID: HKU\S-1-5-21-2582490348-2044156764-553856435-1001_Classes\CLSID\{0E270DAA-1BE6-48F2-AC49-CB66C537038C}\InprocServer32 -> %%systemroot%%\system32\shell32.dll => Keine Datei
Task: {18EB28BF-4F1F-4344-915B-A078E20809C3} - System32\Tasks\WmmzyT1JMk => C:\WmmzyT1JMkWmmzyT1JMk\WmmzyT1JMk.vbs
2017-03-04 11:27 - 2017-03-04 16:08 - 00000000 __SHD C:\WmmzyT1JMkWmmzyT1JMk
2017-03-04 11:27 - 2017-03-04 11:27 - 00003556 _____ C:\Windows\System32\Tasks\WmmzyT1JMk
AlternateDataStreams: C:\ProgramData\Reprise:jhqduwvxlctbqqijsf`usjbm`bfjhinhqhifh [0]
EmptyTemp:
end
*****************
 
Wiederherstellungspunkt wurde erfolgreich erstellt.
Prozesse erfolgreich geschlossen.
C:\Users\Luca\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm => erfolgreich verschoben
 
========================= Folder: C:\ProgramData\AMD ========================
 
2017-03-04 13:27 - 2017-03-04 14:58 - 0000000 ____D () C:\ProgramData\AMD\A4
2017-03-04 14:58 - 2017-03-04 16:56 - 0000096 _____ () C:\ProgramData\AMD\A4\as4state.dat
2017-03-04 14:58 - 2017-03-04 16:56 - 0024256 _____ () C:\ProgramData\AMD\A4\cpredict.a4
 
====== Ende von Folder: ======
 
 
========================= Folder: C:\Users\Luca\AppData\Local\Tempzxpsign73ea3c1007536cdf ========================
 
 
====== Ende von Folder: ======
 
 
========================= Folder: C:\Users\Luca\AppData\Local\Tempzxpsign876cde7496f6f207 ========================
 
 
====== Ende von Folder: ======
 
 
========================= Folder: C:\Users\Luca\AppData\Local\Tempzxpsign09ebc62b7e4c3878 ========================
 
 
====== Ende von Folder: ======
 
 
========================= Folder: C:\Windows\system32\ÿÿÿÿÿÿÿÿ8 ========================
 
2017-02-22 23:47 - 2017-02-22 23:47 - 0000000 ____D () C:\Windows\system32\ÿÿÿÿÿÿÿÿ8\AMD
2017-02-22 23:47 - 2017-02-22 23:47 - 0000000 ____D () C:\Windows\system32\ÿÿÿÿÿÿÿÿ8\AMD\DxCache
2017-02-22 23:47 - 2017-02-22 23:47 - 0065536 _____ () C:\Windows\system32\ÿÿÿÿÿÿÿÿ8\AMD\DxCache\b326e1c41f557361b4e041e71a9bc92f7aa780ac998e1d90..bin
 
====== Ende von Folder: ======
 
 
========================= Folder: C:\Windows\system32\ÿÿÿÿÿÿÿÿerStore ========================
 
 
====== Ende von Folder: ======
 
 
========================= Folder: C:\Users\Luca\AppData\Local\Tempzxpsigne929465219c689ae ========================
 
 
====== Ende von Folder: ======
 
 
========================= Folder: C:\Users\Luca\AppData\Local\Tempzxpsign8019bcf791f8abab ========================
 
 
====== Ende von Folder: ======
 
 
========================= Folder: C:\Users\Luca\AppData\Local\Tempzxpsign3c3a8ed1c62bc5d6 ========================
 
 
====== Ende von Folder: ======
 
HKU\S-1-5-21-2582490348-2044156764-553856435-1001_Classes\CLSID\{0E270DAA-1BE6-48F2-AC49-CB66C537038C} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{18EB28BF-4F1F-4344-915B-A078E20809C3} => Schlüssel erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{18EB28BF-4F1F-4344-915B-A078E20809C3} => Schlüssel erfolgreich entfernt
C:\Windows\System32\Tasks\WmmzyT1JMk => erfolgreich verschoben
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WmmzyT1JMk => Schlüssel erfolgreich entfernt
C:\WmmzyT1JMkWmmzyT1JMk => erfolgreich verschoben
"C:\Windows\System32\Tasks\WmmzyT1JMk" => nicht gefunden.
C:\ProgramData\Reprise => ":jhqduwvxlctbqqijsf`usjbm`bfjhinhqhifh" ADS erfolgreich entfernt.
 
=========== EmptyTemp: ==========
 
BITS transfer queue => 0 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 46998219 B
Java, Flash, Steam htmlcache => 17522520 B
Windows/system/drivers => 1645272 B
Edge => 5842009 B
Chrome => 402123718 B
Firefox => 0 B
Opera => 0 B
 
Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 128 B
systemprofile32 => 992 B
LocalService => 0 B
NetworkService => 50168 B
defaultuser0 => 128 B
Luca => 2130373427 B
 
RecycleBin => 0 B
EmptyTemp: => 2.4 GB temporäre Dateien entfernt.
 
================================
 
 
Das System musste neu gestartet werden.
 
==== Ende von Fixlog 12:03:19 ====
 
It looks like that the Error is fixed, but lets see!


#4 B-boy/StyLe/

B-boy/StyLe/

    Bleepin' Freestyler


  • Malware Response Team
  • 8,307 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bulgaria
  • Local time:06:30 PM

Posted 05 March 2017 - 06:24 AM

Hi,

 

I am glad we nailed it down. :)

 
Here are the last set of steps just to make sure nothing is lurking in the dark corners.


STEP 1
 
 
Please download Malwarebytes Anti-Malware to your desktop.

  • Double-click mb3-setup-consumer-3.0.6.1469.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to the following:
    • Launch Malwarebytes Anti-Malware
    • A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
  • Click Finish.
  • On the Dashboard, click the 'Update Now >>' link
  • After the update completes, click the 'Scan Now >>' button.
  • Or, on the Dashboard, click the Scan Now >> button.
  • If an update is available, click the Update Now button.
  • A Threat Scan will begin.
  • When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
  • In most cases, a restart will be required.
  • Wait for the prompt to restart the computer to appear, then click on Yes.

How to get logs: (Export log to save as txt)

  • After the restart once you are back at your desktop, open MBAM once more.
  • Click on the History tab > Application Logs.
  • Double click on the scan log which shows the Date and time of the scan just performed.
  • Click 'Export'.
  • Click 'Text file (*.txt)'
  • In the Save File dialog box which appears, click on Desktop.
  • In the File name: box type a name for your scan log.
  • A message box named 'File Saved' should appear stating "Your file has been successfully exported".
  • Click Ok
  • Attach that saved log to your next reply.

(Copy to clipboard for pasting into forum replies or tickets)

  • After the restart once you are back at your desktop, open MBAM once more.
  • Click on the History tab > Application Logs.
  • Double click on the scan log which shows the Date and time of the scan just performed.
  • Click 'Copy to Clipboard'

 

 

STEP 2

 
1.Please download HitmanPro.

2.Launch the program by double clicking on the HitmanPro icon. (Windows Vista/7 users right click on the HitmanPro icon and select run as administrator).

Note: If the program won't run please then open the program while holding down the left CTRL key until the program is loaded.

3.Click on the next button. You must agree with the terms of EULA. (if asked)

4.Check the box beside "No, I only want to perform a one-time scan to check this computer".

5.Click on the next button.

6.The program will start to scan the computer. The scan will typically take no more than 5 minutes.

7.When the scan is done click on drop-down menu of the found entries (if any) and choose - Apply to all => Ignore <= IMPORTANT!!!
 
96QH4u9.jpg
 
8.Click on the next button.

9.Click on the "Save Log" button.

10.Save that file to your desktop and post the content of that file in your next reply.
 
Note: if there isn't a dropdown menu when the scan is done then please don't delete anything and close HitmanPro

Navigate to C:\ProgramData\HitmanPro\Logs open the report and copy and paste it to your next reply.
 

 

STEP 3
 

 

  • Download EmsisoftEmergencyKit, run the exe and extract the content in a folder of your choice like (C:\EEK) by clicking the Extract button.
  • Double-click the desktop-shortcut called Start Emsisoft Emergency Kit to start the tool.
  • Click on the "Yes" button when asked to obtain the latest malware definitions.
  • Once the update is complete click "Scan".
  • Click on the "Yes" button when asked to enable the scan for Potentially Unwanted Applications.
  • Next click on the Custom Scan and select only drive C:\ to be scanned and remove the rest of the drives from the list. When the scan complete, click on the View Report button (don't delete or quarantine anything).
  • Please attach the content of the report in your next reply.

 

 

STEP 4
 

Also let's check for outdated and vulnerable software on your pc
 
 
Download Security Check by screen317 from here.

  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

 

 

and then if there aren't any issues left I'll give you my final recommendations. ;)
 
 
Regards,
Georgi


cXfZ4wS.png


#5 Zerian

Zerian
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:04:30 PM

Posted 05 March 2017 - 07:36 AM

Hey again !
 
Malwarebytes Log:
 

Malwarebytes
www.malwarebytes.com
 
-Protokolldetails-
Scan-Datum: 05.03.17
Scan-Zeit: 12:27
Protokolldatei: 
Administrator: Ja
 
-Softwaredaten-
Version: 3.0.6.1469
Komponentenversion: 1.0.75
Version des Aktualisierungspakets: 1.0.1431
Lizenz: Testversion
 
-Systemdaten-
Betriebssystem: Windows 10
CPU: x64
Dateisystem: NTFS
Benutzer: DESKTOP-NTF4MSP\Luca
 
-Scan-Übersicht-
Scan-Typ: Bedrohungs-Scan
Ergebnis: Abgeschlossen
Gescannte Objekte: 405811
Abgelaufene Zeit: 5 Min., 46 Sek.
 
-Scan-Optionen-
Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert
 
-Scan-Details-
Prozess: 0
(keine bösartigen Elemente erkannt)
 
Modul: 0
(keine bösartigen Elemente erkannt)
 
Registrierungsschlüssel: 0
(keine bösartigen Elemente erkannt)
 
Registrierungswert: 0
(keine bösartigen Elemente erkannt)
 
Registrierungsdaten: 0
(keine bösartigen Elemente erkannt)
 
Daten-Stream: 0
(keine bösartigen Elemente erkannt)
 
Ordner: 0
(keine bösartigen Elemente erkannt)
 
Datei: 0
(keine bösartigen Elemente erkannt)
 
Physischer Sektor: 0
(keine bösartigen Elemente erkannt)
 
 
(end)

 

HitmanPro Log:

 

HitmanPro 3.7.15.281
www.hitmanpro.com
 
   Computer name . . . . : DESKTOP-NTF4MSP
   Windows . . . . . . . : 10.0.0.14393.X64/4
   User name . . . . . . : DESKTOP-NTF4MSP\Luca
   UAC . . . . . . . . . : Enabled
   License . . . . . . . : Free
 
   Scan date . . . . . . : 2017-03-05 12:48:43
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 3m 34s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No
 
   Threats . . . . . . . : 2
   Traces  . . . . . . . : 34
 
   Objects scanned . . . : 1.672.739
   Files scanned . . . . : 55.020
   Remnants scanned  . . : 532.129 files / 1.085.590 keys
 
Malware _____________________________________________________________________
 
   C:\Users\Luca\Desktop\Backup\KMSAuto Net.exe
      Size . . . . . . . : 9.022.080 bytes
      Age  . . . . . . . : 10.8 days (2017-02-22 18:10:59)
      Entropy  . . . . . : 7.1
      SHA-256  . . . . . : BEA219F0F08ED083677A0B869E658BA09785F470668EADC659DB2885FA89F3B9
      Needs elevation  . : Yes
      Product  . . . . . : KMSAuto Net
      Publisher  . . . . : MSFree Inc.
      Description  . . . : KMSAuto Net
      Version  . . . . . : 1.4.2
      RSA Key Size . . . : 1024
      LanguageID . . . . : 0
      Authenticode . . . : Self-signed
    > HitmanPro  . . . . : App/Generic-JJ
      Fuzzy  . . . . . . : 106.0
 
   C:\Users\Luca\Desktop\CINEMA 4D R16 - by Prilann\Keygen\mc4dr16_kg.exe
      Size . . . . . . . : 110.080 bytes
      Age  . . . . . . . : 10.6 days (2017-02-22 21:52:57)
      Entropy  . . . . . : 6.2
      SHA-256  . . . . . : D9E227DC952BEC9C444FB13562965305246159C47062C6AB513FF675D266CD2A
    > Bitdefender  . . . : Gen:Trojan.Heur.PT.gqW@aW1VmUai
      Fuzzy  . . . . . . : 112.0
 
 
Suspicious files ____________________________________________________________
 
   C:\Users\Luca\Desktop\FRST64.exe
      Size . . . . . . . : 2.423.296 bytes
      Age  . . . . . . . : 0.0 days (2017-03-05 11:17:26)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : EB50DCC525D3D509738006F1BC09E5C38D2CBE4DD1C9F3DD53EB8CA3A0C4B117
      Needs elevation  . : Yes
      Fuzzy  . . . . . . : 24.0
         Program has no publisher information but prompts the user for permission elevation.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Time indicates that the file appeared recently on this computer.
      Forensic Cluster
          0.0s C:\Users\Luca\Desktop\FRST64.exe
          0.1s C:\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.12.gthr
          0.1s C:\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.12.Crwl
          2.2s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\4\64\
          2.2s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\4\64\4C788D8C2D361570.dat
          2.2s C:\Windows\Logs\WindowsUpdate\WindowsUpdate.20170305.111728.863.1.etl
          3.4s C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\Data\f71611f35c9f2ac271c21200fbfab2aefb3a9d63
         31.6s C:\FRST\Logs\
         31.6s C:\FRST\
         31.6s C:\FRST\Hives\
         31.6s C:\FRST\Quarantine\
         32.0s C:\ProgramData\Microsoft\Windows Defender\Scans\RtSigs\Data\4e79e7f88e3605b8eba2e382e73ae5c15e10e2f0
         32.7s C:\FRST\Hives\ERDNT.INF
         32.7s C:\FRST\Hives\ERDNT.CON
         32.7s C:\FRST\Hives\SYSTEM
         32.8s C:\FRST\Hives\SOFTWARE
         33.4s C:\FRST\Hives\DEFAULT
         33.4s C:\FRST\Hives\SECURITY
         33.5s C:\FRST\Hives\SAM
         33.5s C:\FRST\Hives\BCD
         33.6s C:\Windows\Prefetch\FRST64.EXE-8EB4D04A.pf
         33.6s C:\FRST\Hives\Users\
         33.6s C:\FRST\Hives\Users\00000001\
         33.6s C:\FRST\Hives\Users\00000001\NTUSER.DAT
         33.7s C:\FRST\Hives\Users\00000002\
         33.7s C:\FRST\Hives\Users\00000002\UsrClass.dat
         33.9s C:\FRST\Hives\ERDNT.EXE
         33.9s C:\FRST\Hives\ERDNTWIN.LOC
         33.9s C:\FRST\Hives\ERDNTDOS.LOC
         33.9s C:\Windows\Prefetch\ERUNT.EXE-518CFD10.pf
         33.9s C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\2\64\4C788D8C2D361570.dat
 
 
Cookies _____________________________________________________________________
 
   C:\Users\Luca\AppData\Local\Google\Chrome\User Data\Default\Cookies:doubleclick.net
   C:\Users\Luca\AppData\Local\Microsoft\Windows\INetCookies\0JL13VZ7.cookie
   C:\Users\Luca\AppData\Local\Microsoft\Windows\INetCookies\0NAIL283.cookie
   C:\Users\Luca\AppData\Local\Microsoft\Windows\INetCookies\1SZAMP1I.cookie
   C:\Users\Luca\AppData\Local\Microsoft\Windows\INetCookies\1ZZDJCTF.cookie
   C:\Users\Luca\AppData\Local\Microsoft\Windows\INetCookies\2QM080OM.cookie
   C:\Users\Luca\AppData\Local\Microsoft\Windows\INetCookies\44YB102Y.cookie
   C:\Users\Luca\AppData\Local\Microsoft\Windows\INetCookies\61C3H6FQ.cookie
   C:\Users\Luca\AppData\Local\Microsoft\Windows\INetCookies\728RPNET.cookie
   C:\Users\Luca\AppData\Local\Microsoft\Windows\INetCookies\74VNNV0F.cookie
   C:\Users\Luca\AppData\Local\Microsoft\Windows\INetCookies\8KXUJA6E.cookie
   C:\Users\Luca\AppData\Local\Microsoft\Windows\INetCookies\CTFTGELE.cookie
   C:\Users\Luca\AppData\Local\Microsoft\Windows\INetCookies\DADH7GPY.cookie
   C:\Users\Luca\AppData\Local\Microsoft\Windows\INetCookies\GQZG4KX5.cookie
   C:\Users\Luca\AppData\Local\Microsoft\Windows\INetCookies\HQ1WG577.cookie
   C:\Users\Luca\AppData\Local\Microsoft\Windows\INetCookies\JYKGYLJG.cookie
   C:\Users\Luca\AppData\Local\Microsoft\Windows\INetCookies\KJ5YL1L3.cookie
   C:\Users\Luca\AppData\Local\Microsoft\Windows\INetCookies\L0GAVPZS.cookie
   C:\Users\Luca\AppData\Local\Microsoft\Windows\INetCookies\LSQMVF2A.cookie
   C:\Users\Luca\AppData\Local\Microsoft\Windows\INetCookies\MEDECF70.cookie
   C:\Users\Luca\AppData\Local\Microsoft\Windows\INetCookies\NQ9ZPEVQ.cookie
   C:\Users\Luca\AppData\Local\Microsoft\Windows\INetCookies\NWWTK4S4.cookie
   C:\Users\Luca\AppData\Local\Microsoft\Windows\INetCookies\P0SLQ2M7.cookie
   C:\Users\Luca\AppData\Local\Microsoft\Windows\INetCookies\P3BIBL6A.cookie
   C:\Users\Luca\AppData\Local\Microsoft\Windows\INetCookies\R2PC0ML8.cookie
   C:\Users\Luca\AppData\Local\Microsoft\Windows\INetCookies\RCGHY0XT.cookie
   C:\Users\Luca\AppData\Local\Microsoft\Windows\INetCookies\S8FWDWT6.cookie
   C:\Users\Luca\AppData\Local\Microsoft\Windows\INetCookies\SNQ4ERPT.cookie
   C:\Users\Luca\AppData\Local\Microsoft\Windows\INetCookies\TP6DFBSY.cookie
   C:\Users\Luca\AppData\Local\Microsoft\Windows\INetCookies\UAY0W1DS.cookie
   C:\Users\Luca\AppData\Local\Microsoft\Windows\INetCookies\XUV72TWE.cookie
 
 
 
EmsisoftEmergencyKit Log:
 

Emsisoft Emergency Kit – Version 2017.2
Letztes Update: 05.03.2017 12:55:59
Benutzerkonto: DESKTOP-NTF4MSP\Luca
Computer name: DESKTOP-NTF4MSP
OS version: Windows 10x64 
 
Scan-Einstellungen:
 
Scan-Methode: Eigener Scan
Objekte: Rootkits, Speicher, Traces, C:\
 
PUPs-Erkennung: An
Archiv-Scan: An
ADS-Scan: An
Dateierweiterungen: Aus
Direkter Festplattenzugriff: Aus
 
Scan-Beginn: 05.03.2017 12:56:18
C:\Users\Luca\Desktop\Backup\KMSCleaner.exe Gefunden: Adware.GenericKD.4385300 (B) [krnl.xmd]
 
Gescannt: 409251
Gefunden 1
 
Scan-Ende: 05.03.2017 13:35:23
Scan-Zeit: 0:39:05
 
Security Check Log:
 
 Results of screen317's Security Check version 1.014 --- 12/23/15  
   x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
Windows Defender   
 WMI entry may not exist for antivirus; attempting automatic update. 
`````````Anti-malware/Other Utilities Check:````````` 
 Google Chrome (56.0.2924.87) 
 Google Chrome (SetupMetrics...) 
````````Process Check: objlist.exe by Laurent````````  
 Windows Defender MSMpEng.exe 
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbamtray.exe  
 Windows Defender MSASCuiL.exe   
 Windows Defender MpCmdRun.exe   
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log`````````````````````` 


#6 B-boy/StyLe/

B-boy/StyLe/

    Bleepin' Freestyler


  • Malware Response Team
  • 8,307 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bulgaria
  • Local time:06:30 PM

Posted 05 March 2017 - 08:12 AM

Hi,

 

 

Your system is malware free and no more scans are required.

Thank you for following my instructions perfectly!

 

 

Now that we are at the end of our journey I have some final words for you.
All Clean !
Your machine appears to be clean, please take the time to read below on how to secure the machine and take the necessary steps to keep it Clean.

 

 

STEP 1 - UPDATING TASKS

 

 

You can consider replace Adobe Reader XI with Adobe Reader DC since Adobe Reader XI is no longer supported from what I am aware of.

 

 

  • It is possible for programs on your computer to have security vulnerability that can allow malware to infect you.
  • Therefore, it is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities.
  • You can check these by visiting Secunia Software Inspector or you can use the following application for this purpose PatchMyPC

 

 
Visit Microsoft's Windows Update Site Frequently

 

  • It is important that you visit Windows Update regularly.
  • This will ensure your computer has always the latest security updates available installed on your computer.
  • If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

 

 

STEP 2 - CLEANUP


Here are a few additional steps on how to remove all of the tools we used:

 

  • Please download Delfix.exe by Xplode and save it to your desktop.
  • Please start it and check the box next to "Remove disinfection tools" and uncheck the rest and click on the run button.
  • The tool will delete itself once it finishes.

Note: If any tool, file, log file or folder (belonging to the program we have used) hasn't been deleted, please delete it manually.

 

You can delete the following folders:

 

C:\ProgramData\HitmanPro => to delete the leftovers from HitmanPro
C:\EEK => to delete the leftovers from EmsisoftEmergencyKit

I suggest you leave Malwarebytes installed for on-demand scans but if you want to uninstall it then you can use this tool

 

 

STEP 3 - SECURITY ADVISES
 

 

Keep your antivirus software turned on and up-to-date

 

  • New viruses come out every minute, so it is essential that you have the latest signatures for your antivirus program to provide you with the best possible protection from malicious software.
  • Note: You should only have one antivirus installed at a time. Having more than one antivirus program installed at once is likely to cause conflicts and may well decrease your overall protection as well as impairing the performance of your PC.
  • Note2: You should scan your computer with an antimalware program like Malwarebytes' Anti-Malware on a regular basis just as you would an antivirus software. Be sure to check for and download any definition updates prior to performing a scan. Also keep in mind that MBAM is not a replacement for antivirus software, it is meant to complement the protection provided by a full antivirus product and is designed to detect the threats that are missed by most antivirus software.

 

 

Be prepared for CryptoLocker and similar threats:

 

 

Since the prevention is better than cure you can use Malwarebytes Anti-Ransomware or Kaspersky Antiransomware for business and CryptoPrevent to supplement them to secure the PC against these lockers.

You may want to check Malwarebytes Anti-Exploit and add install it to be safe when surfing the net. It work with the most popular browsers and it is very effective. See the article here. Keep in mind that Malwarebytes Anti-Ransomware and Malwarebytes Anti-Exploit are also included in the Premium version of Malwarebytes Anti-Malware 3.

 

Also you can use a standard user account with UAC enabled. If you need administrative privileges to perform some tasks, then you can use Run As or log on as the administrator account for that specific task.

 

 

Practice Safe Internet


One of the main reasons people get infected in the first place is that they are not practicing Safe Internet. You practice Safe Internet when you educate yourself on how to properly use the Internet through the use of security tools and good practice. Knowing how you can get infected and what types of files and sites to avoid will be the most crucial step in keeping your computer malware free. The reality is that the majority of people who are infected with malware are ones who click on things they shouldn't be clicking on. Whether these things are files or sites it doesn't really matter. If something is out to get you, and you click on it, it most likely will.  Below are a list of simple precautions to take to keep your computer clean and running securely:

  • If you receive an attachment from someone you do not know, DO NOT OPEN IT! Simple as that. Opening attachments from people you do not know is a very common method for viruses or worms to infect your computer.
  • .zip, .exe, .com, .bat, .pif, .scr, .cmd, .cab .vbs or .js do not open the attachment unless you know for a fact that it is clean. For the casual computer user, you will almost never receive a valid attachment of this type.
  • If you receive an attachment from someone you know, and it looks suspicious, then it probably is. The email could be from someone you know infected with a malware that is trying to infect everyone in their address book.
  • If you are browsing the Internet and a popup appears saying that you are infected, ignore it!. These are, as far as I am concerned, scams that are being used to scare you into purchasing a piece of software. For an example of these types of popups, or Foistware, you should read this article:
    Foistware, And how to avoid it. There are also programs that disguise themselves as Anti-Spyware or security products but are instead scams.  For a list of these types of programs we recommend you visit this link: About Malwares, Rogues, Scarewares, SmitfraudFix
  • Another tactic to fool you on the web is when a site displays a popup that looks like a normal Windows message or alert. When you click on them, though, they instead bring you to another site that is trying to push a product on you. I suggest that you close these windows by clicking on the X instead of the OK button. Alternatively, you can check to see if it's a real alert by right-clicking on the window. If there is a menu that comes up saying Add to Favorites... you know it's a fake.
  • Do not go to adult sites. I know this may bother some of you, but the fact is that a large amount of malware is pushed through these types of sites. I am not saying all adult sites do this, but a lot do.
  • When using an Instant Messaging program be cautious about clicking on links people send to you. It is not uncommon for infections to send a message to everyone in the infected person's contact list that contains a link to an infection. Instead when you receive a message that contains a link, message back to the person asking if it is legit before you click on it.
  • Stay away from Warez and Crack sites! In addition to the obvious copyright issues, the downloads from these sites are typically overrun with infections. Avoid using cracks and unknown programs from sources you don't trust. There are MANY alternative open-source applications. Malware writers just love cracks and keygens, and will often attach malicious code into them. By using cracks and/or keygens, you are asking for problems. So my advice is - stay away from them!
  • Be careful of what you download off of web sites and Peer-2-Peer networks. Some sites disguise malware as legitimate software to trick you into installing them and Peer-2-Peer networks are crawling with it. If you want to download a piece of software a from a site, and are not sure if they are legitimate, you can use Bitdefender TrafficLight or Avira Browser Safety to look up info on the site. Note: skip this advice if your antivirus have a Web Guard.
  • DO NOT INSTALL any software without first reading the End User License Agreement, otherwise known as the EULA. A tactic that some developers use is to offer their software for free, but have spyware and other programs you do not want bundled with it. This is where they make their money. By reading the agreement there is a good chance you can spot this and not install the software.
  • You may want to install Unchecky to prevent adware bundled into many free programs to install.
  • Make the extensions for known file types visible: Be worried of files with a double extension such as image.jpg.exe. As a default setting, Windows often hides common file extensions, meaning that a program like image.jpg.exe will appear to you as simply image.jpg. Double extensions exploit this by hiding the second, dangerous extension and reassuring you with the first one.Check this out - Show or hide file name extensions.
  • Disable Autorun: It's a good idea to disable the Autorun functionality to prevent spreading of the infections from USB flash drives. Check the article here for more information. Also you can install McShield - to prevent infections spread by removable media.
  • Disable and Windows Scripting Host: If you don't use any script files then you can go ahead and disable Windows Scripting Host using the tool provided by Symantec - NoScript.exe. Simple download and run it and click on the Disable button and reboot the computer. If you need to run any js. or vbs scripts at a later stage you should run NoScript.exe again and select Enable, then reboot the computer.
  • Install Adblock Plus to surf the web without annoying ads!

 

 
Create an image of your system (you can use the built-in Windows software as well if you prefer)

 

  • Now when your pc is malware free it is a good idea to do a backup of all important files just in case something happens it.
  • Macrium Reflect is very good choice that enables you to create an image of your system drive which can be restored in case of problems.
  • The download link is here.
  • The tutorial on how to create an system image can be found here.
  • It's a good idea to add Macrium to the boot menu to access it if Windows won't start and you don't have a Rescue CD.
  • The tutorial on how to restore an system image can be found here.
  • Be sure to read the tutorials first.

 

 

Follow this list and your potential for being infected again will reduce dramatically.

 

Safe Surfing !

 

Regards,
Georgi


cXfZ4wS.png


#7 Zerian

Zerian
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:04:30 PM

Posted 05 March 2017 - 08:20 AM

Thank you very much9 for taking your time to support me ;) I really enjoyed it :D

 

Edit: I cant download Delfix?


Edited by Zerian, 05 March 2017 - 08:21 AM.


#8 B-boy/StyLe/

B-boy/StyLe/

    Bleepin' Freestyler


  • Malware Response Team
  • 8,307 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bulgaria
  • Local time:06:30 PM

Posted 05 March 2017 - 11:28 AM

Hi,

 

I am glad I could help. It was a pleasure working with you.

 

You can download it from here => https://toolslib.net/downloads/finish/2-delfix/

 

I'll update the link in my instructions.

 

I am sorry for the inconvenience. :)

 

 

Regards,

Georgi


cXfZ4wS.png


#9 B-boy/StyLe/

B-boy/StyLe/

    Bleepin' Freestyler


  • Malware Response Team
  • 8,307 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bulgaria
  • Local time:06:30 PM

Posted 07 March 2017 - 03:09 AM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.

cXfZ4wS.png





2 user(s) are reading this topic

0 members, 2 guests, 0 anonymous users