Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Unknown Kernel Rootkit - Changes to UAC Settings & Unknown Users


  • This topic is locked This topic is locked
12 replies to this topic

#1 dareynedx

dareynedx

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:03:44 PM

Posted 11 July 2017 - 05:57 PM

Hi All. 
Mod Edit:  Merged posts - Hamluis.
 
I am at my wits end at flushing this thing out. I'm going to try this before I bite the bullet and wipe the system with a fresh Windows 7 install. 
 
There are a variety of suspicious events in the event manager,  along with users with special permissions to security & system settings folders with SIDs assigned to windows remote connection users. I believe that the rootkit has created a hidden partition and altered the MBR code thus subverting my anti virus and other detection tools upon standard boot.
 
I am currently booted to safe mode with networking enabled. DeFogger was run. 
 
Please advise on how to proceed. I have posted Farbar & GMER logs below. 
 
I really appreciate any help that may be available. 

FARBAR Log
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-07-2017
Ran by Main Account (12-07-2017 19:03:27)
Running from C:\Users\Main Account\Downloads
Windows 7 Home Premium Service Pack 1 (X64) (2015-03-23 08:10:11)
Boot Mode: Safe Mode (with Networking)
==========================================================
 
==================== Accounts: =============================
 Administrator (S-1-5-21-1617228817-3034643913-1761609342-500 - Administrator - Disabled)
Guest (S-1-5-21-1617228817-3034643913-1761609342-501 - Limited - Disabled)
Main Account (S-1-5-21-1617228817-3034643913-1761609342-1000 - Administrator - Enabled) => C:\Users\Main Account
 
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
 
AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}
AS: Malwarebytes (Enabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
µTorrent (HKU\S-1-5-21-1617228817-3034643913-1761609342-1000\...\uTorrent) (Version: 3.5.0.43916 - BitTorrent Inc.)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 17.0.0.124 - Adobe Systems Incorporated)
Adobe Flash Player 26 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 26.0.0.131 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.1 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.1.7.157 - Adobe Systems, Inc.)
Apple Application Support (32-bit) (HKLM-x32\...\{E92BB800-BCC5-4C25-8102-AC2C3B7C7C1E}) (Version: 5.5 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{9C912B1E-06DD-43EF-BB2B-45CB2C88BAAE}) (Version: 5.5 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{0A596141-97D5-45FA-9281-98DFAF48D579}) (Version: 10.3.2.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{52D87F32-70E4-4348-8148-C0B9F35B1314}) (Version: 2.3.0.177 - Apple Inc.)
Audacity 2.0.6 (HKLM-x32\...\Audacity_is1) (Version: 2.0.6 - Audacity Team)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
Comodo Dragon (HKLM-x32\...\Comodo Dragon) (Version: 57.0.2987.93 - Comodo)
CutePDF Writer 3.0 (HKLM\...\CutePDF Writer Installation) (Version:  3.0 - Acro Software Inc.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 59.0.3071.115 - Google Inc.)
Google Drive (HKLM-x32\...\{A1238426-ECDF-4639-BE2F-8D12A97AE23C}) (Version: 2.34.5075.1619 - Google, Inc.)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.5 - Google Inc.) Hidden
iCloud (HKLM\...\{5B1A59DA-D1EC-4C3A-A996-DF011A0A9668}) (Version: 6.2.2.39 - Apple Inc.)
Intel Security True Key (HKLM\...\TrueKey) (Version: 4.19.108.1 - Intel Security)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3368 - Intel Corporation)
Intel® Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.9.0.1001 - Intel Corporation)
Intel® USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 2.5.3.34 - Intel Corporation)
Internet Security Essentials (HKLM-x32\...\ComodoIse) (Version: 1.2.422025.92 - Comodo)
iTunes (HKLM\...\{F0C7385A-9D20-45F3-8101-05D383885180}) (Version: 12.6.1.25 - Apple Inc.)
Java 8 Update 40 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418040F0}) (Version: 8.0.400 - Oracle Corporation)
Java 8 Update 40 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218040F0}) (Version: 8.0.400 - Oracle Corporation)
Malwarebytes version 3.1.2.1733 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.1.2.1733 - Malwarebytes)
McAfee Security Scan Plus (HKLM-x32\...\McAfee Security Scan) (Version: 3.11.500.3 - McAfee, Inc.)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Qualcomm Atheros Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 10.0 - Qualcomm Atheros)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.39052 - Realtek Semiconductor Corp.)
RogueKiller version 12.11.5.0 (HKLM\...\8B3D7924-ED89-486B-8322-E8594065D5CB_is1) (Version: 12.11.5.0 - Adlice Software)
Spotify (HKU\S-1-5-21-1617228817-3034643913-1761609342-1000\...\Spotify) (Version: 0.9.15.27.g87efe634 - Spotify AB)
swMSM (HKLM-x32\...\{612C34C7-5E90-47D8-9B5C-0F717DD82726}) (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
VLC media player (HKLM\...\VLC media player) (Version: 2.2.0 - VideoLAN)
 
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
ShellIconOverlayIdentifiers: [  GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-03-21] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-03-21] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-03-21] (Google)
ContextMenuHandlers01: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2010-11-18] (Igor Pavlov)
ContextMenuHandlers01: [GDContextMenu] -> {BB02B294-8425-42E5-983F-41A1FA970CD6} => C:\Program Files (x86)\Google\Drive\contextmenu64.dll [2017-03-21] (Google)
ContextMenuHandlers01: [PhotoStreamsExt] -> {89D984B3-813B-406A-8298-118AFA3A22AE} => C:\Program Files\Common Files\Apple\Internet Services\ShellStreams64.dll [2017-05-09] (Apple Inc.)
ContextMenuHandlers04: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2010-11-18] (Igor Pavlov)
ContextMenuHandlers04: [GDContextMenu] -> {BB02B294-8425-42E5-983F-41A1FA970CD6} => C:\Program Files (x86)\Google\Drive\contextmenu64.dll [2017-03-21] (Google)
ContextMenuHandlers05: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => C:\Windows\system32\igfxpph.dll [2013-11-29] (Intel Corporation)
 
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {3FDAF069-0134-443A-BC26-1975DC5CFD2F} - System32\Tasks\McAfee Remediation (Prepare) => C:\Program Files\Common Files\AV\McAfee Anti-Virus And Anti-Spyware\upgrade.exe [2016-12-15] (McAfee, Inc.)
Task: {497B4E80-4507-44A7-81A7-54D1AFF52D0B} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-07-06] (Adobe Systems Incorporated)
Task: {9982ED34-DB94-4E0B-8BDC-8B6B82222C04} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-03-23] (Google Inc.)
Task: {B3B277EC-2986-4953-84C1-54DA2999761D} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_26_0_0_131_pepper.exe [2017-07-06] (Adobe Systems Incorporated)
Task: {F0537757-6B40-4A58-A58A-DEF9C588009E} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2017-02-14] (Apple Inc.)
Task: {F5E26E85-F7E2-48BF-AF4D-5CB0F56062AF} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-03-23] (Google Inc.)
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
 
==================== Shortcuts & WMI ========================
(The entries could be listed to be restored or removed.)
 
==================== Loaded Modules (Whitelisted) ==============
2017-07-06 20:12 - 2017-06-22 23:21 - 02692440 _____ () C:\Program Files (x86)\Google\Chrome\Application\59.0.3071.115\swiftshader\libglesv2.dll
2017-07-06 20:12 - 2017-06-22 23:21 - 00137048 _____ () C:\Program Files (x86)\Google\Chrome\Application\59.0.3071.115\swiftshader\libegl.dll
 
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
 
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option => "OptionValue"="2"
e"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMChameleon => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMSwissArmy => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMChameleon => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMSwissArmy => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SMR501 => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SMR501.SYS => ""="Driver"
 
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
 
 ==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2009-07-13 22:34 - 2009-06-10 17:00 - 00000824 _____ C:\Windows\system32\Drivers\etc\hosts

==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-1617228817-3034643913-1761609342-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Main Account\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 75.75.75.75 - 75.75.76.76
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 2) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
FirewallRules: [{18570D8A-E37A-4C2F-84AF-98AF3D86D065}] => (Allow) C:\Users\Main Account\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{EBAD8AEB-0B34-41CD-9793-88E0DF16F50A}] => (Allow) C:\Users\Main Account\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{50383B05-3DF9-4C67-975D-0A7B7492F939}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{D1F193DB-83D5-4C82-B3BF-B2A773CC9894}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{9747424F-027A-4160-B7BF-EA1F8B9791A9}] => (Allow) C:\Users\Main Account\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{6BA697D7-5B77-41FA-953F-57C080DC5117}] => (Allow) C:\Users\Main Account\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{268EBE22-7FF3-4795-B925-3A8521C4A87A}] => (Allow) C:\Users\Main Account\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{F6269103-9C71-4063-8798-AD3B40EF3321}] => (Allow) C:\Users\Main Account\AppData\Roaming\uTorrent\uTorrent.exe
 
==================== Restore Points =========================
10-07-2017 03:18:24 Windows Update
11-07-2017 08:25:40 Windows Update
12-07-2017 03:24:33 Windows Modules Installer
12-07-2017 04:24:15 Removed Java 8 Update 40
12-07-2017 04:25:06 Removed Java 8 Update 40 (64-bit)
 
==================== Faulty Device Manager Devices =============
Name: Ethernet Controller
Description: Ethernet Controller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
Name: SM Bus Controller
Description: SM Bus Controller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
Name: PCI Simple Communications Controller
Description: PCI Simple Communications Controller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
Name: Security Processor Loader Driver
Description: Security Processor Loader Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer: 
Service: spldr
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
 
Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (07/12/2017 06:41:42 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
 
Error: (07/12/2017 04:40:08 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: mhyocejq.exe, version: 2.2.19882.0, time stamp: 0x56e2cdca
Faulting module name: mhyocejq.exe, version: 2.2.19882.0, time stamp: 0x56e2cdca
Exception code: 0xc0000005
Fault offset: 0x000879fb
Faulting process id: 0x11e4
Faulting application start time: 0x01d2fae87c61023b
Faulting application path: C:\Users\Main Account\Downloads\mhyocejq.exe
Faulting module path: C:\Users\Main Account\Downloads\mhyocejq.exe
Report Id: b59727a1-66dd-11e7-81b2-d05349606db2
 
Error: (07/12/2017 04:23:33 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
 
Error: (07/12/2017 04:22:56 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program Explorer.EXE version 6.1.7601.23537 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
Process ID: 7a4
Start Time: 01d2fae7f55e89be
Termination Time: 0
Application Path: C:\Windows\Explorer.EXE
Report Id: 46b0d043-66db-11e7-81b2-d05349606db2
 
Error: (07/12/2017 03:49:25 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
 
Error: (07/12/2017 03:22:36 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: Failed to create restore point (Process = C:\Windows\system32\svchost.exe -k netsvcs; Description = Windows Update; Error = 0x81000101).
 
Error: (07/12/2017 03:22:24 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1325337
 
Error: (07/12/2017 03:22:24 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1325337
 
Error: (07/12/2017 03:22:24 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
 
Error: (07/12/2017 03:00:44 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 25256
 
System errors:
=============
Error: (07/12/2017 06:47:58 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: DCOM got error "1068" attempting to start the service BITS with arguments "" in order to run the server:
{4991D34B-80A1-4291-83B6-3328366B9097}
 
Error: (07/12/2017 06:41:15 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server:
{9E175B6D-F52A-11D8-B9A5-505054503030}
 
Error: (07/12/2017 06:41:15 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server:
{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
 
Error: (07/12/2017 06:41:09 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}
 
Error: (07/12/2017 06:40:40 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server:
{DD522ACC-F821-461A-A407-50B198B896DC}
 
Error: (07/12/2017 06:40:02 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load: 
discache
ESProtectionDriver
spldr
Wanarpv6
 
Error: (07/12/2017 06:40:00 PM) (Source: BugCheck) (EventID: 1001) (User: )
Description: The computer has rebooted from a bugcheck.  The bugcheck was: 0x00000124 (0x0000000000000000, 0xfffffa80067348f8, 0x0000000000000000, 0x0000000000000000). A dump was saved in: C:\Windows\Minidump\071217-18283-01.dmp. Report Id: 071217-18283-01.
 
Error: (07/12/2017 06:39:58 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 5:19:41 AM on ‎7/‎12/‎2017 was unexpected.
 
Error: (07/12/2017 04:22:25 AM) (Source: Microsoft-Windows-WHEA-Logger) (EventID: 18) (User: NT AUTHORITY)
Description: A fatal hardware error has occurred.
 
Reported by component: Processor Core
Error Source: 3
Error Type: 9
Processor ID: 0
 
The details view of this entry contains further information.
 
Error: (07/12/2017 04:22:25 AM) (Source: Microsoft-Windows-WHEA-Logger) (EventID: 18) (User: NT AUTHORITY)
Description: A fatal hardware error has occurred.
 
Reported by component: Processor Core
Error Source: 3
Error Type: 9
Processor ID: 0
 
The details view of this entry contains further information.
 
==================== Memory info =========================== 
Processor: Intel® Core™ i3-4030U CPU @ 1.90GHz
Percentage of memory in use: 33%
Total physical RAM: 6036.28 MB
Available physical RAM: 4020.08 MB
Total Virtual: 12070.74 MB
Available Virtual: 9944.37 MB
 
==================== Drives ================================
Drive c: (Windows8_OS) (Fixed) (Total:423.84 GB) (Free:355.74 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive d: (LENOVO) (Fixed) (Total:25 GB) (Free:23.02 GB) NTFS
Drive e: (Mar 23 2015) (CDROM) (Total:0.56 GB) (Free:0.21 GB) UDF
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: BCD71FA6)
 
Partition: GPT.
 
==================== End of Addition.txt ============================


FARBAR Base Log
 
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 11-07-2017
Ran by Main Account (administrator) on MACHINE (12-07-2017 19:02:24)
Running from C:\Users\Main Account\Downloads
Loaded Profiles: Main Account (Available Profiles: Main Account)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: "C:\Program Files (x86)\Comodo\Dragon\dragon.exe" -- "%1")
Boot Mode: Safe Mode (with Networking)
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Farbar) C:\Users\Main Account\Downloads\FRST64 (1).exe
 
==================== Registry (Whitelisted) ====================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [287592 2013-11-21] (Intel Corporation)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [303928 2017-05-09] (Apple Inc.)
HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [3146704 2017-05-09] (Malwarebytes)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2014-01-06] (Intel Corporation)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [335232 2015-02-10] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-12-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [IseUI] => C:\Program Files (x86)\COMODO\Internet Security Essentials\vkise.exe [3632848 2017-07-05] (COMODO)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1617228817-3034643913-1761609342-1000\...\Run: [uTorrent] => C:\Users\Main Account\AppData\Roaming\uTorrent\uTorrent.exe [2146496 2017-07-06] (BitTorrent Inc.)
HKU\S-1-5-21-1617228817-3034643913-1761609342-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [67384 2017-05-09] (Apple Inc.)
Lsa: [Notification Packages] scecli "C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter"
 
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76 75.75.76.76 75.75.76.76
Tcpip\..\Interfaces\{28A1BB79-7730-4744-8D3F-C6A46E7A3929}: [DhcpNameServer] 75.75.75.75 75.75.76.76 75.75.76.76 75.75.76.76
 
Internet Explorer:
==================
HKU\S-1-5-21-1617228817-3034643913-1761609342-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/?ocid=iehp
BHO: True Key Helper -> {0F4B8786-5502-4803-8EBC-F652A1153BB6} -> C:\Program Files\Intel Security\True Key\MSIE\truekey_ie64.dll [2017-06-26] (Intel Security)
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_40\bin\ssv.dll => No File
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_40\bin\jp2ssv.dll => No File
BHO-x32: True Key Helper -> {0F4B8786-5502-4803-8EBC-F652A1153BB6} -> C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll [2017-06-26] (Intel Security)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\ssv.dll [2015-03-23] (Oracle Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-03-23] (Oracle Corporation)
Toolbar: HKLM - True Key - {4BAAC1B8-0800-42C9-8FA6-08B211F356B8} - C:\Program Files\Intel Security\True Key\MSIE\truekey_ie64.dll [2017-06-26] (Intel Security)
Toolbar: HKLM-x32 - True Key - {4BAAC1B8-0800-42C9-8FA6-08B211F356B8} - C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll [2017-06-26] (Intel Security)
 
FireFox:
========
FF Plugin: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [No File]
FF Plugin: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [No File]
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.2.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1217157.dll [2015-02-16] (Adobe Systems, Inc.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-03-23] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-03-23] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-03-29] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-03-29] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
 
Chrome: 
=======
CHR DefaultProfile: Default
CHR Profile: C:\Users\Main Account\AppData\Local\Google\Chrome\User Data\Default [2017-07-12]
CHR Extension: (Google Slides) - C:\Users\Main Account\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-03-23]
CHR Extension: (Google Docs) - C:\Users\Main Account\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-03-23]
CHR Extension: (Google Drive) - C:\Users\Main Account\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-07-06]
CHR Extension: (YouTube) - C:\Users\Main Account\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-07-06]
CHR Extension: (Google Search) - C:\Users\Main Account\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-04-04]
CHR Extension: (Google Sheets) - C:\Users\Main Account\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-03-23]
CHR Extension: (Google Docs Offline) - C:\Users\Main Account\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-07-06]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Main Account\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-07-06]
CHR Extension: (Gmail) - C:\Users\Main Account\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-04]
CHR Extension: (Chrome Media Router) - C:\Users\Main Account\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-07-06]
 
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
S2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2017-04-03] (Apple Inc.)
S2 DragonUpdater; C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe [2273432 2017-04-28] (Comodo)
S2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-11-21] (Intel Corporation)
S2 isesrv; C:\Program Files (x86)\COMODO\Internet Security Essentials\isesrv.exe [133840 2017-07-05] (COMODO)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4470736 2017-05-09] (Malwarebytes)
S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\3.11.500\McCHSvc.exe [272136 2017-01-19] (McAfee, Inc.)
S2 TrueKey; C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe [1001920 2017-06-26] (McAfee, Inc.)
S2 TrueKeyScheduler; C:\Program Files\TrueKey\McTkSchedulerService.exe [16928 2017-06-26] (McAfee, Inc.)
S2 TrueKeyServiceHelper; C:\Program Files\TrueKey\McAfee.TrueKey.ServiceHelper.exe [87760 2017-06-26] (McAfee, Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 InstallerService; C:\Program Files\TrueKey\Mcafee.TrueKey.InstallerService.exe [X]
 
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
S4 aswSP; no ImagePath
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2013-11-21] (Intel Corporation)
S1 isedrv; C:\Windows\system32\drivers\isedrv.sys [50856 2017-07-05] (COMODO)
R2 MBAMChameleon; C:\Windows\system32\drivers\MBAMChameleon.sys [188352 2017-07-09] (Malwarebytes)
S3 MBAMFarflt; C:\Windows\system32\drivers\farflt.sys [101784 2017-07-12] (Malwarebytes)
S3 MBAMProtection; C:\Windows\system32\drivers\mbam.sys [45472 2017-07-12] (Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [253856 2017-07-12] (Malwarebytes)
S3 MBAMWebProtection; C:\Windows\system32\drivers\mwac.sys [84256 2017-07-12] (Malwarebytes)
U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [28272 2017-07-09] ()
 
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2017-07-12 19:02 - 2017-07-12 19:02 - 02435584 _____ (Farbar) C:\Users\Main Account\Downloads\FRST64 (1).exe
2017-07-12 19:01 - 2017-07-12 19:01 - 00050477 _____ C:\Users\Main Account\Downloads\Defogger.exe
2017-07-12 19:01 - 2017-07-12 19:01 - 00000000 _____ C:\Users\Main Account\defogger_reenable
2017-07-12 18:39 - 2017-07-12 18:39 - 00262144 ____N C:\Windows\Minidump\071217-18283-01.dmp
2017-07-12 05:10 - 2017-07-12 05:10 - 00025566 _____ C:\Users\Main Account\Downloads\MTB.txt
2017-07-12 05:04 - 2017-07-12 05:04 - 00892416 _____ (Farbar) C:\Users\Main Account\Downloads\MiniToolBox.exe
2017-07-12 05:04 - 2017-07-12 05:04 - 00892416 _____ (Farbar) C:\Users\Main Account\Downloads\MiniToolBox (1).exe
2017-07-12 04:21 - 2017-07-12 04:21 - 00262144 ____N C:\Windows\Minidump\071217-21855-01.dmp
2017-07-12 03:51 - 2017-07-12 04:23 - 00084256 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
2017-07-12 03:43 - 2017-07-12 04:23 - 00101784 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys
2017-07-11 15:04 - 2013-11-26 04:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2017-07-11 15:04 - 2013-11-22 18:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2017-07-10 19:52 - 2017-05-16 14:19 - 00394448 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2017-07-10 19:52 - 2017-05-16 13:35 - 00346320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2017-07-10 19:52 - 2017-05-14 16:46 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2017-07-10 19:52 - 2017-05-14 16:46 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2017-07-10 19:52 - 2017-05-14 16:28 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2017-07-10 19:52 - 2017-05-14 16:27 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2017-07-10 19:52 - 2017-05-14 16:27 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2017-07-10 19:52 - 2017-05-14 16:27 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2017-07-10 19:52 - 2017-05-14 16:26 - 00576512 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2017-07-10 19:52 - 2017-05-14 16:24 - 02899456 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2017-07-10 19:52 - 2017-05-14 16:19 - 25738752 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2017-07-10 19:52 - 2017-05-14 16:17 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2017-07-10 19:52 - 2017-05-14 16:16 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2017-07-10 19:52 - 2017-05-14 16:12 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2017-07-10 19:52 - 2017-05-14 16:10 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2017-07-10 19:52 - 2017-05-14 16:10 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2017-07-10 19:52 - 2017-05-14 16:10 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2017-07-10 19:52 - 2017-05-14 16:10 - 00116224 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2017-07-10 19:52 - 2017-05-14 16:01 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2017-07-10 19:52 - 2017-05-14 15:57 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2017-07-10 19:52 - 2017-05-14 15:55 - 05975040 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2017-07-10 19:52 - 2017-05-14 15:48 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2017-07-10 19:52 - 2017-05-14 15:47 - 00087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2017-07-10 19:52 - 2017-05-14 15:46 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2017-07-10 19:52 - 2017-05-14 15:42 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2017-07-10 19:52 - 2017-05-14 15:41 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2017-07-10 19:52 - 2017-05-14 15:38 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2017-07-10 19:52 - 2017-05-14 15:37 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2017-07-10 19:52 - 2017-05-14 15:36 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2017-07-10 19:52 - 2017-05-14 15:23 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2017-07-10 19:52 - 2017-05-14 15:23 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2017-07-10 19:52 - 2017-05-14 15:22 - 00499200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2017-07-10 19:52 - 2017-05-14 15:22 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2017-07-10 19:52 - 2017-05-14 15:22 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2017-07-10 19:52 - 2017-05-14 15:21 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2017-07-10 19:52 - 2017-05-14 15:20 - 00725504 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2017-07-10 19:52 - 2017-05-14 15:19 - 00806912 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2017-07-10 19:52 - 2017-05-14 15:18 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2017-07-10 19:52 - 2017-05-14 15:17 - 02132992 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2017-07-10 19:52 - 2017-05-14 15:16 - 02290176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2017-07-10 19:52 - 2017-05-14 15:15 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2017-07-10 19:52 - 2017-05-14 15:14 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2017-07-10 19:52 - 2017-05-14 15:12 - 00476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2017-07-10 19:52 - 2017-05-14 15:11 - 20274688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2017-07-10 19:52 - 2017-05-14 15:11 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2017-07-10 19:52 - 2017-05-14 15:10 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2017-07-10 19:52 - 2017-05-14 15:10 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2017-07-10 19:52 - 2017-05-14 15:02 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2017-07-10 19:52 - 2017-05-14 14:57 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2017-07-10 19:52 - 2017-05-14 14:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2017-07-10 19:52 - 2017-05-14 14:56 - 00091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2017-07-10 19:52 - 2017-05-14 14:54 - 15252992 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2017-07-10 19:52 - 2017-05-14 14:53 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2017-07-10 19:52 - 2017-05-14 14:52 - 03240960 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2017-07-10 19:52 - 2017-05-14 14:52 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2017-07-10 19:52 - 2017-05-14 14:50 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2017-07-10 19:52 - 2017-05-14 14:49 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2017-07-10 19:52 - 2017-05-14 14:44 - 04549120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2017-07-10 19:52 - 2017-05-14 14:42 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2017-07-10 19:52 - 2017-05-14 14:40 - 00693248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2017-07-10 19:52 - 2017-05-14 14:39 - 02057216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2017-07-10 19:52 - 2017-05-14 14:38 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2017-07-10 19:52 - 2017-05-14 14:37 - 01544704 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2017-07-10 19:52 - 2017-05-14 14:30 - 13664768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2017-07-10 19:52 - 2017-05-14 14:27 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2017-07-10 19:52 - 2017-05-14 14:15 - 02767872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2017-07-10 19:52 - 2017-05-14 14:11 - 01314816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2017-07-10 19:52 - 2017-05-14 14:11 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2017-07-10 19:52 - 2017-05-12 12:25 - 01251328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2017-07-10 19:52 - 2017-05-12 11:58 - 01648128 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2017-07-10 19:52 - 2017-05-12 11:58 - 01180160 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2017-07-10 19:52 - 2016-10-11 09:33 - 00187392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAnimation.dll
2017-07-10 19:52 - 2016-10-11 09:06 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\UIAnimation.dll
2017-07-10 19:50 - 2015-07-30 14:06 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2017-07-10 19:50 - 2015-07-30 13:57 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2017-07-10 19:47 - 2016-04-14 09:49 - 00603648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2017-07-10 19:47 - 2016-04-14 09:21 - 00647680 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2017-07-10 19:47 - 2015-12-08 17:54 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2017-07-10 19:47 - 2015-12-08 15:07 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2017-07-10 19:46 - 2016-04-09 00:20 - 01230848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2017-07-10 19:46 - 2016-04-08 23:52 - 01424896 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2017-07-10 19:46 - 2015-02-03 23:16 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2017-07-10 19:46 - 2015-02-03 22:54 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2017-07-10 18:34 - 2015-07-30 09:13 - 00124624 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2017-07-10 18:34 - 2015-07-30 09:13 - 00103120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2017-07-10 18:33 - 2013-10-14 18:00 - 00028368 _____ (Microsoft Corporation) C:\Windows\system32\IEUDINIT.EXE
2017-07-10 18:27 - 2017-07-10 18:27 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2017-07-10 18:27 - 2017-07-10 18:27 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2017-07-10 18:27 - 2017-07-10 18:27 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2017-07-10 18:27 - 2017-07-10 18:27 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2017-07-10 18:27 - 2017-07-10 18:27 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2017-07-10 18:27 - 2017-07-10 18:27 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2017-07-10 18:27 - 2017-07-10 18:27 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2017-07-10 18:27 - 2017-07-10 18:27 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2017-07-10 18:27 - 2017-07-10 18:27 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2017-07-10 18:27 - 2017-07-10 18:27 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2017-07-10 18:27 - 2017-07-10 18:27 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2017-07-10 18:27 - 2017-07-10 18:27 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2017-07-10 18:27 - 2017-07-10 18:27 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2017-07-10 18:27 - 2017-07-10 18:27 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2017-07-10 18:27 - 2017-07-10 18:27 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2017-07-10 18:27 - 2017-07-10 18:27 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2017-07-10 18:27 - 2017-07-10 18:27 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2017-07-10 18:27 - 2017-07-10 18:27 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2017-07-10 18:27 - 2017-07-10 18:27 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2017-07-10 18:27 - 2017-07-10 18:27 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2017-07-10 18:27 - 2017-07-10 18:27 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2017-07-10 18:27 - 2017-07-10 18:27 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2017-07-10 18:27 - 2017-07-10 18:27 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2017-07-10 18:27 - 2017-07-10 18:27 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2017-07-10 18:27 - 2017-07-10 18:27 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2017-07-10 18:27 - 2017-07-10 18:27 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2017-07-10 18:27 - 2017-07-10 18:27 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2017-07-10 18:27 - 2017-07-10 18:27 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2017-07-10 18:27 - 2017-07-10 18:27 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2017-07-10 18:27 - 2017-07-10 18:27 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2017-07-10 18:27 - 2017-07-10 18:27 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2017-07-10 18:27 - 2017-07-10 18:27 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2017-07-10 18:27 - 2017-07-10 18:27 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2017-07-10 18:27 - 2017-07-10 18:27 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2017-07-10 18:27 - 2017-07-10 18:27 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2017-07-10 18:27 - 2017-07-10 18:27 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2017-07-10 18:27 - 2017-07-10 18:27 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2017-07-10 18:27 - 2017-07-10 18:27 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2017-07-10 18:27 - 2017-07-10 18:27 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2017-07-10 18:27 - 2017-07-10 18:27 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2017-07-10 18:24 - 2017-07-10 18:24 - 01682432 _____ (Microsoft Corporation) C:\Windows\system32\XpsPrint.dll
2017-07-10 18:24 - 2017-07-10 18:24 - 01238528 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2017-07-10 18:24 - 2017-07-10 18:24 - 01158144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsPrint.dll
2017-07-10 18:24 - 2017-07-10 18:24 - 01080832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10.dll
2017-07-10 18:24 - 2017-07-10 18:24 - 00522752 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll
2017-07-10 18:24 - 2017-07-10 18:24 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll
2017-07-10 18:24 - 2017-07-10 18:24 - 00363008 _____ (Microsoft Corporation) C:\Windows\system32\dxgi.dll
2017-07-10 18:24 - 2017-07-10 18:24 - 00333312 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2017-07-10 18:24 - 2017-07-10 18:24 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2017-07-10 18:24 - 2017-07-10 18:24 - 00293376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxgi.dll
2017-07-10 18:24 - 2017-07-10 18:24 - 00249856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1core.dll
2017-07-10 18:24 - 2017-07-10 18:24 - 00245248 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecsExt.dll
2017-07-10 18:24 - 2017-07-10 18:24 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10core.dll
2017-07-10 18:24 - 2017-07-10 18:24 - 00207872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecsExt.dll
2017-07-10 18:24 - 2017-07-10 18:24 - 00194560 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2017-07-10 18:24 - 2017-07-10 18:24 - 00161792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1.dll
2017-07-10 18:24 - 2017-07-10 18:24 - 00010752 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l1-1-0.dll
2017-07-10 18:24 - 2017-07-10 18:24 - 00010752 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2017-07-10 18:24 - 2017-07-10 18:24 - 00009728 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2017-07-10 18:24 - 2017-07-10 18:24 - 00009728 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2017-07-10 18:24 - 2017-07-10 18:24 - 00005632 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2017-07-10 18:24 - 2017-07-10 18:24 - 00005632 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-ole32-l1-1-0.dll
2017-07-10 18:24 - 2017-07-10 18:24 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2017-07-10 18:24 - 2017-07-10 18:24 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2017-07-10 18:24 - 2017-07-10 18:24 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-user32-l1-1-0.dll
2017-07-10 18:24 - 2017-07-10 18:24 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2017-07-10 18:24 - 2017-07-10 18:24 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2017-07-10 18:24 - 2017-07-10 18:24 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2017-07-10 18:24 - 2017-07-10 18:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-version-l1-1-0.dll
2017-07-10 18:24 - 2017-07-10 18:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shell32-l1-1-0.dll
2017-07-10 18:24 - 2017-07-10 18:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2017-07-10 18:24 - 2017-07-10 18:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2017-07-10 18:24 - 2017-07-10 18:24 - 00002560 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2017-07-10 18:24 - 2017-07-10 18:24 - 00002560 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2017-07-09 09:34 - 2015-11-13 19:09 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\mapistub.dll
2017-07-09 09:34 - 2015-11-13 19:09 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\mapi32.dll
2017-07-09 09:34 - 2015-11-13 19:08 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\fixmapi.exe
2017-07-09 09:34 - 2015-11-13 18:50 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mapistub.dll
2017-07-09 09:34 - 2015-11-13 18:50 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mapi32.dll
2017-07-09 09:34 - 2015-11-13 18:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fixmapi.exe
2017-07-09 09:34 - 2015-06-01 20:07 - 00254976 _____ (Microsoft Corporation) C:\Windows\system32\cewmdm.dll
2017-07-09 09:34 - 2015-06-01 19:47 - 00210432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cewmdm.dll
2017-07-09 09:34 - 2015-04-12 23:28 - 00328704 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2017-07-09 09:33 - 2016-03-16 14:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\system32\mtxoci.dll
2017-07-09 09:33 - 2016-03-16 14:28 - 00176128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msorcl32.dll
2017-07-09 09:33 - 2016-03-16 14:28 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mtxoci.dll
2017-07-09 09:33 - 2015-08-05 13:56 - 01110016 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll
2017-07-09 09:33 - 2015-07-15 14:10 - 01743360 _____ (Microsoft Corporation) C:\Windows\system32\sysmain.dll
2017-07-09 09:33 - 2015-07-10 13:51 - 03722752 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2017-07-09 09:33 - 2015-07-10 13:51 - 00158720 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2017-07-09 09:33 - 2015-07-10 13:51 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2017-07-09 09:33 - 2015-07-10 13:34 - 03221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2017-07-09 09:33 - 2015-07-10 13:34 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2017-07-09 09:33 - 2015-07-10 13:33 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2017-07-09 09:33 - 2013-10-29 22:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2017-07-09 09:32 - 2016-06-25 20:27 - 00344576 _____ (Microsoft Corporation) C:\Windows\system32\ntprint.dll
2017-07-09 09:32 - 2016-06-25 20:27 - 00166400 _____ (Microsoft Corporation) C:\Windows\system32\inetpp.dll
2017-07-09 09:32 - 2016-06-25 20:27 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\inetppui.dll
2017-07-09 09:32 - 2016-06-25 15:53 - 00297472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntprint.dll
2017-07-09 09:32 - 2016-06-25 15:53 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\ntprint.exe
2017-07-09 09:32 - 2016-06-25 15:53 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\wpnpinst.exe
2017-07-09 09:32 - 2016-06-25 15:41 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntprint.exe
2017-07-09 09:32 - 2016-02-05 14:56 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\tbs.dll
2017-07-09 09:32 - 2016-02-05 14:54 - 00109568 _____ (Microsoft Corporation) C:\Windows\system32\fveapibase.dll
2017-07-09 09:32 - 2016-02-05 13:33 - 00015360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tbs.dll
2017-07-09 09:32 - 2016-01-20 20:51 - 00073664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\disk.sys
2017-07-09 09:32 - 2015-07-14 23:19 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\basesrv.dll
2017-07-09 09:32 - 2015-07-09 13:58 - 01632256 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2017-07-09 09:32 - 2015-07-09 13:58 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\dwmapi.dll
2017-07-09 09:32 - 2015-07-09 13:42 - 01372160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2017-07-09 09:32 - 2015-07-09 13:42 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmapi.dll
2017-07-09 09:32 - 2015-06-03 16:21 - 00451080 _____ (Microsoft Corporation) C:\Windows\system32\fveapi.dll
2017-07-09 09:32 - 2015-05-25 14:19 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2017-07-09 09:32 - 2015-05-25 14:18 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2017-07-09 09:32 - 2015-05-25 14:18 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2017-07-09 09:32 - 2015-05-25 14:18 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2017-07-09 09:32 - 2015-05-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2017-07-09 09:32 - 2015-05-25 14:18 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2017-07-09 09:32 - 2015-05-25 14:01 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2017-07-09 09:32 - 2015-05-25 14:00 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2017-07-09 09:32 - 2015-05-25 14:00 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2017-07-09 09:32 - 2015-05-25 14:00 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe
2017-07-09 09:32 - 2015-05-25 14:00 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2017-07-09 09:32 - 2015-05-25 14:00 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe
2017-07-09 09:31 - 2017-06-02 04:28 - 02317824 _____ (Microsoft Corporation) C:\Windows\system32\tquery.dll
2017-07-09 09:31 - 2017-06-02 04:28 - 02222080 _____ (Microsoft Corporation) C:\Windows\system32\mssrch.dll
2017-07-09 09:31 - 2017-06-02 04:28 - 00491520 _____ (Microsoft Corporation) C:\Windows\system32\mssph.dll
2017-07-09 09:31 - 2017-06-02 04:11 - 00591872 _____ (Microsoft Corporation) C:\Windows\system32\SearchIndexer.exe
2017-07-09 09:31 - 2017-06-02 04:10 - 00733696 _____ (Microsoft Corporation) C:\Windows\HelpPane.exe
2017-07-09 09:31 - 2017-06-02 04:09 - 01549824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tquery.dll
2017-07-09 09:31 - 2017-06-02 04:09 - 01400320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssrch.dll
2017-07-09 09:31 - 2017-05-21 00:28 - 00154856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2017-07-09 09:31 - 2017-05-21 00:24 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2017-07-09 09:31 - 2017-05-21 00:24 - 01212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2017-07-09 09:31 - 2017-05-21 00:24 - 00730624 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2017-07-09 09:31 - 2017-05-21 00:24 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2017-07-09 09:31 - 2017-05-21 00:24 - 00463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2017-07-09 09:31 - 2017-05-21 00:24 - 00345600 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2017-07-09 09:31 - 2017-05-21 00:24 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2017-07-09 09:31 - 2017-05-21 00:24 - 00312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2017-07-09 09:31 - 2017-05-21 00:24 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2017-07-09 09:31 - 2017-05-21 00:06 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2017-07-09 09:31 - 2017-05-21 00:06 - 00666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2017-07-09 09:31 - 2017-05-21 00:06 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2017-07-09 09:31 - 2017-05-21 00:06 - 00261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2017-07-09 09:31 - 2017-05-21 00:06 - 00254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2017-07-09 09:31 - 2017-05-21 00:06 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2017-07-09 09:31 - 2017-05-21 00:06 - 00141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2017-07-09 09:31 - 2017-05-20 23:48 - 00291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2017-07-09 09:31 - 2017-05-20 23:48 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2017-07-09 09:31 - 2017-05-20 23:48 - 00129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2017-07-09 09:31 - 2017-05-12 14:27 - 00631176 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2017-07-09 09:31 - 2017-05-12 14:26 - 05547752 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2017-07-09 09:31 - 2017-05-12 14:26 - 00706792 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2017-07-09 09:31 - 2017-05-12 14:26 - 00382696 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2017-07-09 09:31 - 2017-05-12 14:24 - 01732864 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2017-07-09 09:31 - 2017-05-12 14:22 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2017-07-09 09:31 - 2017-05-12 14:22 - 00880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2017-07-09 09:31 - 2017-05-12 14:22 - 00806912 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2017-07-09 09:31 - 2017-05-12 14:22 - 00419840 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2017-07-09 09:31 - 2017-05-12 14:22 - 00405504 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2017-07-09 09:31 - 2017-05-12 14:22 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2017-07-09 09:31 - 2017-05-12 14:07 - 04001000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2017-07-09 09:31 - 2017-05-12 14:07 - 03945704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2017-07-09 09:31 - 2017-05-12 14:07 - 00308456 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2017-07-09 09:31 - 2017-05-12 14:04 - 01314112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2017-07-09 09:31 - 2017-05-12 14:03 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2017-07-09 09:31 - 2017-05-12 14:03 - 00644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2017-07-09 09:31 - 2017-05-12 14:03 - 00629760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2017-07-09 09:31 - 2017-05-12 14:03 - 00313344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2017-07-09 09:31 - 2017-05-12 13:55 - 00148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2017-07-09 09:31 - 2017-05-12 13:52 - 03222528 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2017-07-09 09:31 - 2017-05-10 11:29 - 14183936 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2017-07-09 09:31 - 2017-05-10 11:29 - 03165184 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2017-07-09 09:31 - 2017-05-10 11:29 - 01867776 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2017-07-09 09:31 - 2017-05-10 11:29 - 00192512 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2017-07-09 09:31 - 2017-05-10 11:29 - 00098816 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2017-07-09 09:31 - 2017-05-10 11:28 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2017-07-09 09:31 - 2017-05-10 11:14 - 02651136 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2017-07-09 09:31 - 2017-05-10 11:13 - 00709120 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2017-07-09 09:31 - 2017-05-10 11:13 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2017-07-09 09:31 - 2017-05-10 11:13 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2017-07-09 09:31 - 2017-05-10 11:13 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2017-07-09 09:31 - 2017-05-10 11:13 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2017-07-09 09:31 - 2017-05-10 11:12 - 12880896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2017-07-09 09:31 - 2017-05-10 11:12 - 01499648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2017-07-09 09:31 - 2017-05-10 11:12 - 00174080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2017-07-09 09:31 - 2017-05-10 11:00 - 00573440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2017-07-09 09:31 - 2017-05-10 11:00 - 00093696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2017-07-09 09:31 - 2017-05-10 11:00 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2017-07-09 09:31 - 2017-05-10 11:00 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2017-07-09 09:31 - 2017-05-09 11:30 - 00757248 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2017-07-09 09:31 - 2017-05-09 11:29 - 00970240 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2017-07-09 09:31 - 2017-05-09 11:11 - 00497664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2017-07-09 09:31 - 2017-05-07 11:33 - 00094440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2017-07-09 09:31 - 2017-04-27 18:50 - 03550208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_47.dll
2017-07-09 09:31 - 2017-04-21 11:34 - 01133568 _____ (Microsoft Corporation) C:\Windows\system32\cdosys.dll
2017-07-09 09:31 - 2017-04-21 11:15 - 00805376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cdosys.dll
2017-07-09 09:31 - 2017-04-17 11:37 - 02065408 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2017-07-09 09:31 - 2017-04-17 11:37 - 00876544 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2017-07-09 09:31 - 2017-04-17 11:37 - 00512000 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
2017-07-09 09:31 - 2017-04-17 11:12 - 01417728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2017-07-09 09:31 - 2017-04-17 11:12 - 00581632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2017-07-09 09:31 - 2017-04-12 11:32 - 01483776 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2017-07-09 09:31 - 2017-04-12 11:32 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2017-07-09 09:31 - 2017-04-12 11:32 - 00190976 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2017-07-09 09:31 - 2017-04-12 11:32 - 00141824 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2017-07-09 09:31 - 2017-04-12 11:26 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2017-07-09 09:31 - 2017-04-12 11:25 - 01176064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2017-07-09 09:31 - 2017-04-12 11:25 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2017-07-09 09:31 - 2017-04-12 11:25 - 00106496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2017-07-09 09:31 - 2017-04-12 09:05 - 04296704 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_47.dll
2017-07-09 09:31 - 2017-04-07 11:34 - 00986856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2017-07-09 09:31 - 2017-04-07 11:34 - 00265448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2017-07-09 09:31 - 2017-04-05 10:55 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2017-07-09 09:31 - 2017-04-05 10:55 - 00405504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2017-07-09 09:31 - 2017-04-05 10:55 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2017-07-09 09:31 - 2017-04-04 11:34 - 01895656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2017-07-09 09:31 - 2017-04-04 11:34 - 00377576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2017-07-09 09:31 - 2017-04-04 11:34 - 00287976 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2017-07-09 09:31 - 2017-04-04 10:53 - 00496128 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2017-07-09 09:31 - 2017-03-10 12:32 - 01389056 _____ (Microsoft Corporation) C:\Windows\system32\pla.dll
2017-07-09 09:31 - 2017-03-10 12:32 - 00300544 _____ (Microsoft Corporation) C:\Windows\system32\pdh.dll
2017-07-09 09:31 - 2017-03-10 12:20 - 01508352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pla.dll
2017-07-09 09:31 - 2017-03-10 11:55 - 00205312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fastfat.sys
2017-07-09 09:31 - 2017-03-10 11:55 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\exfat.sys
2017-07-09 09:31 - 2017-03-03 21:27 - 01574912 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2017-07-09 09:31 - 2017-03-03 21:14 - 01329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2017-07-09 09:31 - 2017-02-09 12:32 - 00769536 _____ (Microsoft Corporation) C:\Windows\system32\samsrv.dll
2017-07-09 09:31 - 2017-02-09 12:31 - 00625664 _____ (Microsoft Corporation) C:\Windows\system32\mscms.dll
2017-07-09 09:31 - 2017-01-18 11:36 - 00994760 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll
2017-07-09 09:31 - 2017-01-18 11:36 - 00063840 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll
2017-07-09 09:31 - 2017-01-18 11:36 - 00020832 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll
2017-07-09 09:31 - 2017-01-18 11:36 - 00019808 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll
2017-07-09 09:31 - 2017-01-18 11:36 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll
2017-07-09 09:31 - 2017-01-18 11:36 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll
2017-07-09 09:31 - 2017-01-18 11:36 - 00016224 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
2017-07-09 09:31 - 2017-01-18 11:36 - 00015712 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll
2017-07-09 09:31 - 2017-01-18 11:36 - 00014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll
2017-07-09 09:31 - 2017-01-18 11:36 - 00014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll
2017-07-09 09:31 - 2017-01-18 11:36 - 00013664 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
2017-07-09 09:31 - 2017-01-18 11:36 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll
2017-07-09 09:31 - 2017-01-18 11:36 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll
2017-07-09 09:31 - 2017-01-18 11:36 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll
2017-07-09 09:31 - 2017-01-18 11:36 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll
2017-07-09 09:31 - 2017-01-18 11:36 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll
2017-07-09 09:31 - 2017-01-18 11:36 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll
2017-07-09 09:31 - 2017-01-18 11:36 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll
2017-07-09 09:31 - 2017-01-18 11:36 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll
2017-07-09 09:31 - 2017-01-18 11:36 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll
2017-07-09 09:31 - 2017-01-18 11:36 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll
2017-07-09 09:31 - 2017-01-18 11:36 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll
2017-07-09 09:31 - 2017-01-18 11:36 - 00011608 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll
2017-07-09 09:31 - 2017-01-18 11:35 - 00922432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ucrtbase.dll
2017-07-09 09:31 - 2017-01-18 11:35 - 00066400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-private-l1-1-0.dll
2017-07-09 09:31 - 2017-01-18 11:35 - 00022368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-math-l1-1-0.dll
2017-07-09 09:31 - 2017-01-18 11:35 - 00019808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll
2017-07-09 09:31 - 2017-01-18 11:35 - 00017760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-string-l1-1-0.dll
2017-07-09 09:31 - 2017-01-18 11:35 - 00017760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll
2017-07-09 09:31 - 2017-01-18 11:35 - 00016224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll
2017-07-09 09:31 - 2017-01-18 11:35 - 00015712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll
2017-07-09 09:31 - 2017-01-18 11:35 - 00014176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-time-l1-1-0.dll
2017-07-09 09:31 - 2017-01-18 11:35 - 00014176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll
2017-07-09 09:31 - 2017-01-18 11:35 - 00013664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll
2017-07-09 09:31 - 2017-01-18 11:35 - 00012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-process-l1-1-0.dll
2017-07-09 09:31 - 2017-01-18 11:35 - 00012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll
2017-07-09 09:31 - 2017-01-18 11:35 - 00012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll
2017-07-09 09:31 - 2017-01-18 11:35 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll
2017-07-09 09:31 - 2017-01-18 11:35 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll
2017-07-09 09:31 - 2017-01-18 11:35 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll
2017-07-09 09:31 - 2017-01-18 11:35 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll
2017-07-09 09:31 - 2017-01-18 11:35 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll
2017-07-09 09:31 - 2017-01-18 11:35 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l2-1-0.dll
2017-07-09 09:31 - 2017-01-18 11:35 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll
2017-07-09 09:31 - 2017-01-18 11:35 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll
2017-07-09 09:31 - 2017-01-18 11:35 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll
2017-07-09 09:31 - 2017-01-13 14:00 - 00976896 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2017-07-09 09:31 - 2017-01-13 13:45 - 00741888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2017-07-09 09:31 - 2017-01-11 14:01 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2017-07-09 09:31 - 2017-01-11 13:43 - 01241088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2017-07-09 09:31 - 2016-11-20 10:07 - 00467392 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2017-07-09 09:31 - 2016-11-17 12:41 - 00370920 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2017-07-09 09:31 - 2016-11-10 12:32 - 01009152 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2017-07-09 09:31 - 2016-11-10 12:19 - 00833024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2017-07-09 09:31 - 2016-11-09 12:41 - 00114408 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2017-07-09 09:31 - 2016-11-09 12:33 - 03244032 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2017-07-09 09:31 - 2016-11-09 12:33 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2017-07-09 09:31 - 2016-11-09 12:17 - 02365440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2017-07-09 09:31 - 2016-11-09 12:17 - 01806848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2017-07-09 09:31 - 2016-11-09 12:17 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2017-07-09 09:31 - 2016-11-09 12:02 - 00128512 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2017-07-09 09:31 - 2016-10-11 11:31 - 01068544 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2017-07-09 09:31 - 2016-10-11 11:31 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL
2017-07-09 09:31 - 2016-10-11 11:31 - 00176128 _____ (Microsoft Corporation) C:\Windows\system32\tintlgnt.ime
2017-07-09 09:31 - 2016-10-11 11:18 - 00829952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2017-07-09 09:31 - 2016-10-11 11:18 - 00701440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IMJP10K.DLL
2017-07-09 09:31 - 2016-10-11 11:18 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tintlgnt.ime
2017-07-09 09:31 - 2016-10-11 11:18 - 00090112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pintlgnt.ime
2017-07-09 09:31 - 2016-10-11 10:55 - 00346112 _____ (Microsoft Corporation) C:\Windows\system32\bcdedit.exe
2017-07-09 09:31 - 2016-10-11 09:18 - 00419648 _____ C:\Windows\SysWOW64\locale.nls
2017-07-09 09:31 - 2016-10-11 09:17 - 00419648 _____ C:\Windows\system32\locale.nls
2017-07-09 09:31 - 2016-10-08 09:06 - 00633296 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2017-07-09 09:31 - 2016-10-07 11:32 - 03649536 _____ (Microsoft Corporation) C:\Windows\system32\MSVidCtl.dll
2017-07-09 09:31 - 2016-10-07 11:12 - 02291712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSVidCtl.dll
2017-07-09 09:31 - 2016-10-05 10:54 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bowser.sys
2017-07-09 09:31 - 2016-09-15 10:56 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2017-07-09 09:31 - 2016-09-08 16:34 - 00263680 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2017-07-09 09:31 - 2016-09-08 16:34 - 00208896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2017-07-09 09:31 - 2016-09-08 16:34 - 00108544 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2017-07-09 09:31 - 2016-09-08 16:34 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2017-07-09 09:31 - 2016-09-08 10:55 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2017-07-09 09:31 - 2016-09-08 10:55 - 00106496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dfsc.sys
2017-07-09 09:31 - 2016-08-22 12:19 - 01386496 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2017-07-09 09:31 - 2016-08-12 13:02 - 14632960 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2017-07-09 09:31 - 2016-08-12 13:02 - 12574720 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2017-07-09 09:31 - 2016-08-12 12:47 - 12574208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2017-07-09 09:31 - 2016-08-12 12:47 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2017-07-09 09:31 - 2016-08-12 12:26 - 00461312 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2017-07-09 09:31 - 2016-08-06 11:31 - 02023424 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2017-07-09 09:31 - 2016-08-06 11:31 - 00347136 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll
2017-07-09 09:31 - 2016-08-06 11:31 - 00310784 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2017-07-09 09:31 - 2016-08-06 11:31 - 00182272 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll
2017-07-09 09:31 - 2016-08-06 11:15 - 01178112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll
2017-07-09 09:31 - 2016-08-06 11:15 - 00249344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll
2017-07-09 09:31 - 2016-08-06 11:15 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll
2017-07-09 09:31 - 2016-08-06 11:15 - 00146944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll
2017-07-09 09:31 - 2016-08-06 11:01 - 00266752 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe
2017-07-09 09:31 - 2016-08-06 10:53 - 00199168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe
2017-07-09 09:31 - 2016-06-14 13:16 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2017-07-09 09:31 - 2016-06-14 13:16 - 01202176 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2017-07-09 09:31 - 2016-06-14 13:16 - 01068544 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2017-07-09 09:31 - 2016-06-14 13:16 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2017-07-09 09:31 - 2016-06-14 13:16 - 00782848 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2017-07-09 09:31 - 2016-06-14 13:16 - 00680448 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2017-07-09 09:31 - 2016-06-14 13:16 - 00632320 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2017-07-09 09:31 - 2016-06-14 13:16 - 00499712 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2017-07-09 09:31 - 2016-06-14 13:16 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2017-07-09 09:31 - 2016-06-14 13:16 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2017-07-09 09:31 - 2016-06-14 13:16 - 00433152 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2017-07-09 09:31 - 2016-06-14 13:16 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2017-07-09 09:31 - 2016-06-14 13:16 - 00295936 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2017-07-09 09:31 - 2016-06-14 13:16 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2017-07-09 09:31 - 2016-06-14 13:16 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2017-07-09 09:31 - 2016-06-14 13:16 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2017-07-09 09:31 - 2016-06-14 13:11 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
2017-07-09 09:31 - 2016-06-14 11:21 - 03209216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2017-07-09 09:31 - 2016-06-14 11:21 - 01005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
2017-07-09 09:31 - 2016-06-14 11:21 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll
2017-07-09 09:31 - 2016-06-14 11:21 - 00744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll
2017-07-09 09:31 - 2016-06-14 11:21 - 00617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll
2017-07-09 09:31 - 2016-06-14 11:21 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2017-07-09 09:31 - 2016-06-14 11:21 - 00489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll
2017-07-09 09:31 - 2016-06-14 11:21 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2017-07-09 09:31 - 2016-06-14 11:21 - 00406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll
2017-07-09 09:31 - 2016-06-14 11:21 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2017-07-09 09:31 - 2016-06-14 11:21 - 00354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
2017-07-09 09:31 - 2016-06-14 11:21 - 00195072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2017-07-09 09:31 - 2016-06-14 11:15 - 00125952 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2017-07-09 09:31 - 2016-03-23 18:40 - 00546656 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2017-07-09 09:31 - 2016-02-04 21:19 - 00381440 _____ (Microsoft Corporation) C:\Windows\system32\mfds.dll
2017-07-09 09:31 - 2016-02-04 14:41 - 00296448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfds.dll
2017-07-09 09:31 - 2016-02-03 14:07 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBSTOR.SYS
2017-07-09 09:31 - 2016-01-11 15:11 - 01684416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2017-07-09 09:31 - 2015-11-11 14:53 - 01735680 _____ (Microsoft Corporation) C:\Windows\system32\comsvcs.dll
2017-07-09 09:31 - 2015-11-11 14:53 - 00525312 _____ (Microsoft Corporation) C:\Windows\system32\catsrvut.dll
2017-07-09 09:31 - 2015-11-11 14:39 - 01242624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comsvcs.dll
2017-07-09 09:31 - 2015-11-11 14:39 - 00487936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\catsrvut.dll
2017-07-09 09:31 - 2015-11-05 15:05 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\wshrm.dll
2017-07-09 09:31 - 2015-11-05 15:02 - 00014848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshrm.dll
2017-07-09 09:31 - 2015-11-05 05:53 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rmcast.sys
2017-07-09 09:31 - 2015-04-24 14:17 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2017-07-09 09:31 - 2015-04-24 13:56 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2017-07-09 09:31 - 2015-01-28 23:19 - 02543104 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2017-07-09 09:31 - 2015-01-28 23:02 - 02311168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll
2017-07-09 09:31 - 2014-07-08 22:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2017-07-09 09:31 - 2014-07-08 22:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2017-07-09 09:31 - 2014-07-08 22:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2017-07-09 09:31 - 2014-07-08 22:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2017-07-09 09:31 - 2014-07-08 22:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2017-07-09 09:31 - 2014-07-08 21:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2017-07-09 09:31 - 2014-07-08 21:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2017-07-09 09:31 - 2014-07-08 21:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2017-07-09 09:31 - 2014-07-08 21:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2017-07-09 09:31 - 2014-07-08 21:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2017-07-09 09:30 - 2017-06-02 04:28 - 00778240 _____ (Microsoft Corporation) C:\Windows\system32\mssvp.dll
2017-07-09 09:30 - 2017-06-02 04:28 - 00288256 _____ (Microsoft Corporation) C:\Windows\system32\mssphtb.dll
2017-07-09 09:30 - 2017-06-02 04:28 - 00115200 _____ (Microsoft Corporation) C:\Windows\system32\mssitlb.dll
2017-07-09 09:30 - 2017-06-02 04:28 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\mssprxy.dll
2017-07-09 09:30 - 2017-06-02 04:28 - 00075264 _____ (Microsoft Corporation) C:\Windows\system32\msscntrs.dll
2017-07-09 09:30 - 2017-06-02 04:28 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\msshooks.dll
2017-07-09 09:30 - 2017-06-02 04:11 - 00249856 _____ (Microsoft Corporation) C:\Windows\system32\SearchProtocolHost.exe
2017-07-09 09:30 - 2017-06-02 04:10 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\SearchFilterHost.exe
2017-07-09 09:30 - 2017-06-02 04:09 - 00666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssvp.dll
2017-07-09 09:30 - 2017-06-02 04:09 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssph.dll
2017-07-09 09:30 - 2017-06-02 04:09 - 00197120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssphtb.dll
2017-07-09 09:30 - 2017-06-02 04:09 - 00104448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssitlb.dll
2017-07-09 09:30 - 2017-06-02 04:09 - 00059392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscntrs.dll
2017-07-09 09:30 - 2017-06-02 04:09 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssprxy.dll
2017-07-09 09:30 - 2017-06-02 03:58 - 00427520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchIndexer.exe
2017-07-09 09:30 - 2017-06-02 03:58 - 00164352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
2017-07-09 09:30 - 2017-06-02 03:57 - 00086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchFilterHost.exe
2017-07-09 09:30 - 2017-06-02 03:57 - 00009728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msshooks.dll
2017-07-09 09:30 - 2017-05-21 00:28 - 00095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2017-07-09 09:30 - 2017-05-21 00:24 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2017-07-09 09:30 - 2017-05-21 00:24 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2017-07-09 09:30 - 2017-05-21 00:24 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2017-07-09 09:30 - 2017-05-21 00:24 - 00123904 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2017-07-09 09:30 - 2017-05-21 00:24 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2017-07-09 09:30 - 2017-05-21 00:24 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2017-07-09 09:30 - 2017-05-21 00:24 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2017-07-09 09:30 - 2017-05-21 00:24 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2017-07-09 09:30 - 2017-05-21 00:24 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2017-07-09 09:30 - 2017-05-21 00:24 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2017-07-09 09:30 - 2017-05-21 00:06 - 00342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2017-07-09 09:30 - 2017-05-21 00:06 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2017-07-09 09:30 - 2017-05-21 00:06 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2017-07-09 09:30 - 2017-05-21 00:06 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2017-07-09 09:30 - 2017-05-21 00:06 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2017-07-09 09:30 - 2017-05-21 00:06 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2017-07-09 09:30 - 2017-05-21 00:06 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2017-07-09 09:30 - 2017-05-21 00:06 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2017-07-09 09:30 - 2017-05-21 00:06 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2017-07-09 09:30 - 2017-05-20 23:55 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2017-07-09 09:30 - 2017-05-20 23:47 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2017-07-09 09:30 - 2017-05-20 23:46 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2017-07-09 09:30 - 2017-05-20 23:42 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:22 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:03 - 00275456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2017-07-09 09:30 - 2017-05-12 14:03 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2017-07-09 09:30 - 2017-05-12 14:03 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2017-07-09 09:30 - 2017-05-12 14:03 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2017-07-09 09:30 - 2017-05-12 14:03 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2017-07-09 09:30 - 2017-05-12 14:03 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2017-07-09 09:30 - 2017-05-12 14:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2017-07-09 09:30 - 2017-05-12 14:03 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:03 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2017-07-09 09:30 - 2017-05-12 14:03 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:03 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:03 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:03 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:03 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:03 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:03 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:03 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:03 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:03 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:03 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:03 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:03 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:03 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:03 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:03 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:03 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:03 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:03 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:03 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:03 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:03 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 14:03 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 13:54 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2017-07-09 09:30 - 2017-05-12 13:54 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2017-07-09 09:30 - 2017-05-12 13:51 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2017-07-09 09:30 - 2017-05-12 13:50 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2017-07-09 09:30 - 2017-05-12 13:46 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2017-07-09 09:30 - 2017-05-12 13:43 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2017-07-09 09:30 - 2017-05-12 13:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2017-07-09 09:30 - 2017-05-12 13:41 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2017-07-09 09:30 - 2017-05-12 13:41 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2017-07-09 09:30 - 2017-05-12 13:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2017-07-09 09:30 - 2017-05-12 13:40 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 13:40 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 13:40 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2017-07-09 09:30 - 2017-05-12 13:40 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2017-07-09 09:30 - 2017-05-10 11:33 - 00091368 _____ (Microsoft Corporation) C:\Windows\system32\MigAutoPlay.exe
2017-07-09 09:30 - 2017-05-10 11:16 - 00091368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MigAutoPlay.exe
2017-07-09 09:30 - 2017-05-10 11:13 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2017-07-09 09:30 - 2017-05-10 10:52 - 00117248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2017-07-09 09:30 - 2017-05-07 11:29 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2017-07-09 09:30 - 2017-04-17 11:37 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\oleres.dll
2017-07-09 09:30 - 2017-04-17 11:37 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\comcat.dll
2017-07-09 09:30 - 2017-04-17 11:12 - 00026112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleres.dll
2017-07-09 09:30 - 2017-04-17 10:54 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comcat.dll
2017-07-09 09:30 - 2017-04-07 11:30 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2017-07-09 09:30 - 2017-03-30 11:03 - 00046080 _____ (Microsoft Corporation) C:\Windows\system32\rundll32.exe
2017-07-09 09:30 - 2017-03-30 10:58 - 00045056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
2017-07-09 09:30 - 2017-03-10 12:20 - 00237056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pdh.dll
2017-07-09 09:30 - 2017-03-10 11:57 - 00009216 _____ (Microsoft Corporation) C:\Windows\system32\plasrv.exe
2017-07-09 09:30 - 2017-03-09 12:34 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2017-07-09 09:30 - 2017-03-09 12:19 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2017-07-09 09:30 - 2017-03-07 12:30 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\asycfilt.dll
2017-07-09 09:30 - 2017-03-07 12:17 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\asycfilt.dll
2017-07-09 09:30 - 2017-03-03 21:27 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\mfmjpegdec.dll
2017-07-09 09:30 - 2017-03-03 21:14 - 00077312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmjpegdec.dll
2017-07-09 09:30 - 2017-02-09 12:32 - 00106496 _____ (Microsoft Corporation) C:\Windows\system32\samlib.dll
2017-07-09 09:30 - 2017-02-09 12:32 - 00040960 _____ (Microsoft Corporation) C:\Windows\system32\WcsPlugInService.dll
2017-07-09 09:30 - 2017-02-09 12:31 - 00250880 _____ (Microsoft Corporation) C:\Windows\system32\icm32.dll
2017-07-09 09:30 - 2017-02-09 12:14 - 00481792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscms.dll
2017-07-09 09:30 - 2017-02-09 12:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icm32.dll
2017-07-09 09:30 - 2017-02-09 12:14 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\samlib.dll
2017-07-09 09:30 - 2017-02-09 11:51 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcsPlugInService.dll
2017-07-09 09:30 - 2017-01-13 14:00 - 00084480 _____ (Microsoft Corporation) C:\Windows\system32\INETRES.dll
2017-07-09 09:30 - 2017-01-13 13:45 - 00084480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\INETRES.dll
2017-07-09 09:30 - 2017-01-11 14:01 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2017-07-09 09:30 - 2017-01-11 13:43 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2017-07-09 09:30 - 2016-11-21 14:12 - 00109568 _____ (Microsoft Corporation) C:\Windows\system32\hlink.dll
2017-07-09 09:30 - 2016-11-20 12:19 - 00084992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\hlink.dll
2017-07-09 09:30 - 2016-11-09 12:33 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2017-07-09 09:30 - 2016-11-09 12:33 - 00070144 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2017-07-09 09:30 - 2016-11-09 12:33 - 00025088 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll
2017-07-09 09:30 - 2016-11-09 12:17 - 00025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msimsg.dll
2017-07-09 09:30 - 2016-11-09 11:55 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2017-07-09 09:30 - 2016-10-11 11:32 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\nlsbres.dll
2017-07-09 09:30 - 2016-10-11 11:31 - 01148416 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10.IME
2017-07-09 09:30 - 2016-10-11 11:31 - 00457216 _____ (Microsoft Corporation) C:\Windows\system32\imkr80.ime
2017-07-09 09:30 - 2016-10-11 11:31 - 00246784 _____ (Microsoft Corporation) C:\Windows\system32\input.dll
2017-07-09 09:30 - 2016-10-11 11:31 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\quick.ime
2017-07-09 09:30 - 2016-10-11 11:31 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\qintlgnt.ime
2017-07-09 09:30 - 2016-10-11 11:31 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\phon.ime
2017-07-09 09:30 - 2016-10-11 11:31 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\cintlgnt.ime
2017-07-09 09:30 - 2016-10-11 11:31 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\chajei.ime
2017-07-09 09:30 - 2016-10-11 11:31 - 00132608 _____ (Microsoft Corporation) C:\Windows\system32\pintlgnt.ime
2017-07-09 09:30 - 2016-10-11 11:18 - 00430080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imkr80.ime
2017-07-09 09:30 - 2016-10-11 11:18 - 00202240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\input.dll
2017-07-09 09:30 - 2016-10-11 11:18 - 00125952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quick.ime
2017-07-09 09:30 - 2016-10-11 11:18 - 00125952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qintlgnt.ime
2017-07-09 09:30 - 2016-10-11 11:18 - 00125952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\phon.ime
2017-07-09 09:30 - 2016-10-11 11:18 - 00125952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cintlgnt.ime
2017-07-09 09:30 - 2016-10-11 11:18 - 00125952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\chajei.ime
2017-07-09 09:30 - 2016-10-11 11:18 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlsbres.dll
2017-07-09 09:30 - 2016-09-12 17:08 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\adsmsext.dll
2017-07-09 09:30 - 2016-09-12 16:49 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adsmsext.dll
2017-07-09 09:30 - 2016-08-12 13:02 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2017-07-09 09:30 - 2016-08-12 13:02 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2017-07-09 09:30 - 2016-08-12 13:02 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2017-07-09 09:30 - 2016-08-12 12:31 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2017-07-09 09:30 - 2016-08-12 12:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2017-07-09 09:30 - 2016-08-12 12:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2017-07-09 09:30 - 2016-08-06 11:31 - 00054272 _____ (Microsoft Corporation) C:\Windows\system32\WsmRes.dll
2017-07-09 09:30 - 2016-08-06 11:31 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\wsmplpxy.dll
2017-07-09 09:30 - 2016-08-06 11:15 - 00054272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmRes.dll
2017-07-09 09:30 - 2016-08-06 11:01 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\wsmprovhost.exe
2017-07-09 09:30 - 2016-08-06 10:53 - 00012288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wsmprovhost.exe
2017-07-09 09:30 - 2016-08-06 10:53 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wsmplpxy.dll
2017-07-09 09:30 - 2016-06-14 13:16 - 00641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2017-07-09 09:30 - 2016-06-14 13:16 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2017-07-09 09:30 - 2016-06-14 13:16 - 00081920 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
2017-07-09 09:30 - 2016-06-14 13:16 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll
2017-07-09 09:30 - 2016-06-14 13:16 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll
2017-07-09 09:30 - 2016-06-14 13:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2017-07-09 09:30 - 2016-06-14 11:21 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll
2017-07-09 09:30 - 2016-06-14 11:21 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll
2017-07-09 09:30 - 2016-06-14 11:21 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2017-07-09 09:30 - 2016-06-14 11:21 - 00080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll
2017-07-09 09:30 - 2016-06-14 11:21 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2017-07-09 09:30 - 2016-06-14 11:15 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2017-07-09 09:30 - 2016-06-14 11:15 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2017-07-09 09:30 - 2016-06-14 11:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2017-07-09 09:30 - 2016-06-14 11:05 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2017-07-09 09:30 - 2016-06-14 11:00 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe
2017-07-09 09:30 - 2016-06-14 11:00 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe
2017-07-09 09:30 - 2016-05-12 09:05 - 00297984 _____ (Microsoft Corporation) C:\Windows\system32\bcryptprimitives.dll
2017-07-09 09:30 - 2016-05-12 09:04 - 00249352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcryptprimitives.dll
2017-07-09 09:29 - 2016-07-07 11:08 - 00046080 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpipreg.sys
2017-07-09 09:29 - 2016-05-11 13:02 - 00483840 _____ (Microsoft Corporation) C:\Windows\system32\StructuredQuery.dll
2017-07-09 09:29 - 2016-05-11 11:19 - 00363520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\StructuredQuery.dll
2017-07-09 09:29 - 2015-12-08 17:53 - 00509952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2017-07-09 09:29 - 2015-12-08 15:07 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2017-07-09 09:29 - 2015-12-08 15:07 - 01307136 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2adec.dll
2017-07-09 09:29 - 2015-12-08 15:07 - 00624640 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2017-07-09 09:29 - 2015-10-29 13:50 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2017-07-09 09:29 - 2015-10-29 13:50 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll
2017-07-09 09:29 - 2015-10-29 13:50 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2017-07-09 09:29 - 2015-10-29 13:50 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll
2017-07-09 09:29 - 2015-10-29 13:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimeng.dll
2017-07-09 09:29 - 2015-10-29 13:49 - 00295936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll
2017-07-09 09:29 - 2015-10-29 13:49 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe
2017-07-09 09:29 - 2015-07-22 20:02 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2017-07-09 09:29 - 2015-07-22 13:53 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2017-07-09 09:29 - 2015-07-09 13:57 - 00193536 _____ (Microsoft Corporation) C:\Windows\system32\notepad.exe
2017-07-09 09:29 - 2015-07-09 13:57 - 00193536 _____ (Microsoft Corporation) C:\Windows\notepad.exe
2017-07-09 09:29 - 2015-07-09 13:42 - 00179712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
2017-07-09 09:28 - 2016-08-29 11:04 - 03229696 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2017-07-09 09:28 - 2016-08-29 10:55 - 02972672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
2017-07-09 09:28 - 2016-05-12 13:15 - 00105472 _____ (Microsoft Corporation) C:\Windows\system32\winipsec.dll
2017-07-09 09:28 - 2016-05-12 13:14 - 00794624 _____ (Microsoft Corporation) C:\Windows\system32\gpsvc.dll
2017-07-09 09:28 - 2016-05-12 13:14 - 00502272 _____ (Microsoft Corporation) C:\Windows\system32\IPSECSVC.DLL
2017-07-09 09:28 - 2016-05-12 13:14 - 00373760 _____ (Microsoft Corporation) C:\Windows\system32\polstore.dll
2017-07-09 09:28 - 2016-05-12 13:14 - 00096256 _____ (Microsoft Corporation) C:\Windows\system32\gpapi.dll
2017-07-09 09:28 - 2016-05-12 13:14 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\FwRemoteSvr.dll
2017-07-09 09:28 - 2016-05-12 11:18 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\polstore.dll
2017-07-09 09:28 - 2016-05-12 11:18 - 00079360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gpapi.dll
2017-07-09 09:28 - 2016-05-12 11:18 - 00070144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winipsec.dll
2017-07-09 09:28 - 2016-05-12 11:18 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FwRemoteSvr.dll
2017-07-09 09:28 - 2016-05-11 13:02 - 00444928 _____ (Microsoft Corporation) C:\Windows\system32\winhttp.dll
2017-07-09 09:28 - 2016-05-11 13:02 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2017-07-09 09:28 - 2016-05-11 13:02 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\ws2_32.dll
2017-07-09 09:28 - 2016-05-11 11:19 - 00351744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winhttp.dll
2017-07-09 09:28 - 2016-05-11 11:19 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
2017-07-09 09:28 - 2016-05-11 11:19 - 00206336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ws2_32.dll
2017-07-09 09:28 - 2016-05-11 11:11 - 00025088 _____ (Microsoft Corporation) C:\Windows\system32\netbtugc.exe
2017-07-09 09:28 - 2016-05-11 11:01 - 00026624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netbtugc.exe
2017-07-09 09:28 - 2016-05-11 10:58 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netbt.sys
2017-07-09 09:28 - 2016-02-09 05:55 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\seclogon.dll
2017-07-09 09:28 - 2016-01-22 02:18 - 00961024 _____ (Microsoft Corporation) C:\Windows\system32\CPFilters.dll
2017-07-09 09:28 - 2016-01-22 02:18 - 00723968 _____ (Microsoft Corporation) C:\Windows\system32\EncDec.dll
2017-07-09 09:28 - 2016-01-22 02:04 - 00642048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CPFilters.dll
2017-07-09 09:28 - 2016-01-22 02:04 - 00535040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\EncDec.dll
2017-07-09 09:28 - 2015-12-08 17:54 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2017-07-09 09:28 - 2015-12-08 17:54 - 01568768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVENCOD.DLL
2017-07-09 09:28 - 2015-12-08 17:54 - 01325056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMSPDMOE.DLL
2017-07-09 09:28 - 2015-12-08 17:54 - 00902144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMADMOD.DLL
2017-07-09 09:28 - 2015-12-08 17:54 - 00815616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMADMOE.DLL
2017-07-09 09:28 - 2015-12-08 17:54 - 00740352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmpmde.dll
2017-07-09 09:28 - 2015-12-08 17:54 - 00739328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMSPDMOD.DLL
2017-07-09 09:28 - 2015-12-08 17:54 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVXENCD.DLL
2017-07-09 09:28 - 2015-12-08 17:54 - 00541184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVSDECD.DLL
2017-07-09 09:28 - 2015-12-08 17:54 - 00358400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVSENCD.DLL
2017-07-09 09:28 - 2015-12-08 17:54 - 00154112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VIDRESZR.DLL
2017-07-09 09:28 - 2015-12-08 17:53 - 00970240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2adec.dll
2017-07-09 09:28 - 2015-12-08 17:53 - 00829952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSMPEG2ENC.DLL
2017-07-09 09:28 - 2015-12-08 17:53 - 00609280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MFWMAAEC.DLL
2017-07-09 09:28 - 2015-12-08 17:53 - 00415744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MP4SDECD.DLL
2017-07-09 09:28 - 2015-12-08 17:53 - 00241152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MPG4DECD.DLL
2017-07-09 09:28 - 2015-12-08 17:53 - 00241152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MP43DECD.DLL
2017-07-09 09:28 - 2015-12-08 17:53 - 00206848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RESAMPLEDMO.DLL
2017-07-09 09:28 - 2015-12-08 17:53 - 00206848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qasf.dll
2017-07-09 09:28 - 2015-12-08 17:53 - 00193536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ksproxy.ax
2017-07-09 09:28 - 2015-12-08 17:53 - 00153600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\COLORCNV.DLL
2017-07-09 09:28 - 2015-12-08 17:53 - 00079872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MP3DMOD.DLL
2017-07-09 09:28 - 2015-12-08 17:53 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\devenum.dll
2017-07-09 09:28 - 2015-12-08 17:53 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfvdsp.dll
2017-07-09 09:28 - 2015-12-08 17:53 - 00004608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ksuser.dll
2017-07-09 09:28 - 2015-12-08 15:07 - 01955328 _____ (Microsoft Corporation) C:\Windows\system32\WMVENCOD.DLL
2017-07-09 09:28 - 2015-12-08 15:07 - 01575424 _____ (Microsoft Corporation) C:\Windows\system32\WMSPDMOE.DLL
2017-07-09 09:28 - 2015-12-08 15:07 - 01232896 _____ (Microsoft Corporation) C:\Windows\system32\WMADMOD.DLL
2017-07-09 09:28 - 2015-12-08 15:07 - 01160192 _____ (Microsoft Corporation) C:\Windows\system32\MSMPEG2ENC.DLL
2017-07-09 09:28 - 2015-12-08 15:07 - 01153024 _____ (Microsoft Corporation) C:\Windows\system32\WMADMOE.DLL
2017-07-09 09:28 - 2015-12-08 15:07 - 01026048 _____ (Microsoft Corporation) C:\Windows\system32\wmpmde.dll
2017-07-09 09:28 - 2015-12-08 15:07 - 01010688 _____ (Microsoft Corporation) C:\Windows\system32\mcmde.dll
2017-07-09 09:28 - 2015-12-08 15:07 - 00978944 _____ (Microsoft Corporation) C:\Windows\system32\WMSPDMOD.DLL
2017-07-09 09:28 - 2015-12-08 15:07 - 00666112 _____ (Microsoft Corporation) C:\Windows\system32\WMVSDECD.DLL
2017-07-09 09:28 - 2015-12-08 15:07 - 00653824 _____ (Microsoft Corporation) C:\Windows\system32\MP4SDECD.DLL
2017-07-09 09:28 - 2015-12-08 15:07 - 00642048 _____ (Microsoft Corporation) C:\Windows\system32\WMVXENCD.DLL
2017-07-09 09:28 - 2015-12-08 15:07 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\MFWMAAEC.DLL
2017-07-09 09:28 - 2015-12-08 15:07 - 00447488 _____ (Microsoft Corporation) C:\Windows\system32\WMVSENCD.DLL
2017-07-09 09:28 - 2015-12-08 15:07 - 00378880 _____ (Microsoft Corporation) C:\Windows\system32\SysFxUI.dll
2017-07-09 09:28 - 2015-12-08 15:07 - 00292352 _____ (Microsoft Corporation) C:\Windows\system32\VIDRESZR.DLL
2017-07-09 09:28 - 2015-12-08 15:07 - 00254464 _____ (Microsoft Corporation) C:\Windows\system32\qasf.dll
2017-07-09 09:28 - 2015-12-08 15:07 - 00225792 _____ (Microsoft Corporation) C:\Windows\system32\RESAMPLEDMO.DLL
2017-07-09 09:28 - 2015-12-08 15:07 - 00224768 _____ (Microsoft Corporation) C:\Windows\system32\MPG4DECD.DLL
2017-07-09 09:28 - 2015-12-08 15:07 - 00223744 _____ (Microsoft Corporation) C:\Windows\system32\MP43DECD.DLL
2017-07-09 09:28 - 2015-12-08 15:07 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\COLORCNV.DLL
2017-07-09 09:28 - 2015-12-08 15:07 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\MP3DMOD.DLL
2017-07-09 09:28 - 2015-12-08 15:07 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\devenum.dll
2017-07-09 09:28 - 2015-12-08 15:07 - 00070144 _____ (Microsoft Corporation) C:\Windows\system32\mfvdsp.dll
2017-07-09 09:28 - 2015-12-08 15:07 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\ksuser.dll
2017-07-09 09:28 - 2015-12-08 15:06 - 00250880 _____ (Microsoft Corporation) C:\Windows\system32\ksproxy.ax
2017-07-09 09:28 - 2015-12-08 14:54 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2017-07-09 09:28 - 2015-12-08 14:12 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2017-07-09 09:28 - 2015-12-08 14:11 - 00005632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmkaud.sys
2017-07-09 09:28 - 2015-08-27 14:18 - 02004480 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2017-07-09 09:28 - 2015-08-27 14:13 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2017-07-09 09:28 - 2015-08-27 13:58 - 01391104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2017-07-09 09:28 - 2015-08-27 13:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2017-07-09 09:28 - 2015-04-10 23:19 - 00069888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\stream.sys
2017-07-09 09:28 - 2015-02-24 23:18 - 00754688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2017-07-09 09:28 - 2012-11-22 23:13 - 00068608 _____ (Microsoft Corporation) C:\Windows\system32\taskhost.exe
2017-07-09 09:28 - 2012-07-06 16:07 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bthport.sys
2017-07-09 09:28 - 2011-04-27 23:54 - 00080384 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\BTHUSB.SYS
2017-07-09 09:27 - 2016-03-09 15:00 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\webio.dll
2017-07-09 09:27 - 2016-03-09 14:40 - 00316416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webio.dll
2017-07-09 09:27 - 2015-10-13 00:57 - 00950720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2017-07-09 09:07 - 2016-03-09 14:54 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2017-07-09 09:07 - 2016-03-09 14:34 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2017-07-09 09:07 - 2011-12-16 04:46 - 00634880 _____ (Microsoft Corporation) C:\Windows\system32\msvcrt.dll
2017-07-09 09:07 - 2011-12-16 03:52 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcrt.dll
2017-07-09 09:07 - 2011-03-11 02:41 - 00410496 _____ (Intel Corporation) C:\Windows\system32\Drivers\iaStorV.sys
2017-07-09 09:07 - 2011-03-11 02:41 - 00166272 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvstor.sys
2017-07-09 09:07 - 2011-03-11 02:41 - 00148352 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvraid.sys
2017-07-09 09:07 - 2011-03-11 02:41 - 00107904 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\amdsata.sys
2017-07-09 09:07 - 2011-03-11 02:41 - 00027008 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\amdxata.sys
2017-07-09 09:07 - 2011-03-11 02:33 - 02565632 _____ (Microsoft Corporation) C:\Windows\system32\esent.dll
2017-07-09 09:07 - 2011-03-11 02:30 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\fsutil.exe
2017-07-09 09:07 - 2011-03-11 01:33 - 01699328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\esent.dll
2017-07-09 09:07 - 2011-03-11 01:31 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fsutil.exe
2017-07-09 09:06 - 2015-11-03 15:04 - 00241664 _____ (Microsoft Corporation) C:\Windows\system32\els.dll
2017-07-09 09:06 - 2015-11-03 14:55 - 00179712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\els.dll
2017-07-09 08:50 - 2017-07-09 08:50 - 00262144 ____N C:\Windows\Minidump\070917-17706-01.dmp
2017-07-09 08:37 - 2017-07-09 08:37 - 00262144 ____N C:\Windows\Minidump\070917-19952-01.dmp
2017-07-09 08:32 - 2017-07-09 08:32 - 00000017 _____ C:\Users\Main Account\AppData\Local\resmon.resmoncfg
2017-07-09 08:31 - 2017-07-09 08:31 - 00000000 ____D C:\Windows\pss
2017-07-09 08:28 - 2017-07-09 08:28 - 00262144 ____N C:\Windows\Minidump\070917-19266-01.dmp
2017-07-09 08:12 - 2017-07-09 08:12 - 00000000 ____D C:\Users\Main Account\AppData\Local\ElevatedDiagnostics
2017-07-09 06:50 - 2017-07-09 06:50 - 00001326 _____ C:\Users\Main Account\Downloads\malware.txt
2017-07-09 06:30 - 2017-07-12 04:40 - 00000000 ____D C:\Users\Main Account\AppData\Local\CrashDumps
2017-07-09 06:30 - 2017-07-09 06:30 - 00000512 _____ C:\Users\Main Account\Downloads\kk
2017-07-09 06:00 - 2017-07-09 06:00 - 00000000 ____D C:\ProgramData\Sophos
2017-07-09 05:54 - 2017-07-09 05:55 - 239643336 _____ (Sophos Limited) C:\Users\Main Account\Downloads\SophosInstall.exe
2017-07-09 05:31 - 2017-07-12 18:40 - 00764936 _____ C:\Windows\ntbtlog.txt
2017-07-09 05:31 - 2017-07-09 05:31 - 00000000 ____D C:\NPE
2017-07-09 05:29 - 2017-07-09 05:52 - 00000000 ____D C:\Users\Main Account\AppData\Local\NPE
2017-07-09 05:29 - 2017-07-09 05:29 - 03422432 _____ (Symantec Corporation) C:\Users\Main Account\Downloads\NPE.exe
2017-07-09 05:29 - 2017-07-09 05:29 - 00000000 ____D C:\ProgramData\Norton
2017-07-09 05:01 - 2017-07-09 05:01 - 00380928 _____ C:\Users\Main Account\Downloads\wwohon1b.exe
2017-07-09 04:57 - 2017-07-09 04:57 - 06705178 _____ C:\Users\Main Account\Downloads\mbam-chameleon-3.1.33.0.zip
2017-07-09 04:43 - 2017-07-12 18:40 - 00253856 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-07-09 04:43 - 2017-07-12 18:40 - 00045472 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2017-07-09 04:43 - 2017-07-09 04:44 - 00188352 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMChameleon.sys
2017-07-09 04:43 - 2017-07-09 04:43 - 00001878 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-07-09 04:43 - 2017-07-09 04:43 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-07-09 04:43 - 2017-07-09 04:43 - 00000000 ____D C:\Program Files\Malwarebytes
2017-07-09 04:43 - 2017-06-27 12:06 - 00077376 _____ C:\Windows\system32\Drivers\mbae64.sys
2017-07-09 04:42 - 2017-07-09 04:43 - 65033984 _____ (Malwarebytes ) C:\Users\Main Account\Downloads\mb3-setup-consumer-3.1.2.1733-1.0.160-1.0.2251.exe
2017-07-09 04:31 - 2017-07-05 03:30 - 00256040 _____ (COMODO) C:\Windows\system32\iseguard64.dll
2017-07-09 04:31 - 2017-07-05 03:29 - 00205536 _____ (COMODO) C:\Windows\SysWOW64\iseguard32.dll
2017-07-09 04:31 - 2017-07-05 03:29 - 00050856 _____ (COMODO) C:\Windows\system32\Drivers\isedrv.sys
2017-07-09 04:30 - 2017-07-09 04:31 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Comodo
2017-07-09 04:30 - 2017-07-09 04:31 - 00000000 ____D C:\Program Files (x86)\Comodo
2017-07-09 04:30 - 2017-07-09 04:30 - 00002125 _____ C:\Users\Public\Desktop\Comodo Dragon.lnk
2017-07-09 04:30 - 2017-07-09 04:30 - 00000000 ____D C:\Users\Main Account\AppData\Local\Comodo
2017-07-09 04:27 - 2017-07-09 04:31 - 00000000 ____D C:\ProgramData\Comodo
2017-07-09 04:27 - 2017-07-09 04:27 - 05365800 _____ (COMODO) C:\Users\Main Account\Downloads\cav_installer.exe
2017-07-09 04:27 - 2017-07-09 04:27 - 00000000 ____D C:\ProgramData\Shared Space
2017-07-09 04:27 - 2017-07-09 04:27 - 00000000 ____D C:\ProgramData\Comodo Downloader
2017-07-09 04:06 - 2017-07-09 04:06 - 00380928 _____ C:\Users\Main Account\Downloads\mhyocejq.exe
2017-07-09 03:39 - 2017-07-09 04:00 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2017-07-09 03:38 - 2017-07-09 04:00 - 00000000 ____D C:\Users\Main Account\Desktop\mbar
2017-07-09 03:37 - 2017-07-09 03:38 - 16563352 _____ (Malwarebytes Corp.) C:\Users\Main Account\Downloads\mbar-1.09.3.1001.exe
2017-07-09 03:27 - 2017-07-09 03:27 - 00262144 ____N C:\Windows\Minidump\070917-26348-01.dmp
2017-07-09 03:19 - 2017-07-09 03:19 - 00262144 ____N C:\Windows\Minidump\070917-38547-01.dmp
2017-07-09 03:14 - 2017-07-09 03:14 - 00001176 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\True Key.lnk
2017-07-09 03:14 - 2017-07-09 03:14 - 00001162 _____ C:\Users\Public\Desktop\True Key.lnk
2017-07-09 02:49 - 2017-07-09 03:07 - 00194268 _____ C:\TDSSKiller.3.1.0.15_09.07.2017_02.49.17_log.txt
2017-07-09 02:48 - 2017-07-09 02:48 - 04830473 _____ C:\Users\Main Account\Downloads\tdsskiller.zip
2017-07-09 01:53 - 2017-07-09 01:53 - 00028272 _____ C:\Windows\system32\Drivers\TrueSight.sys
2017-07-09 01:53 - 2017-07-09 01:53 - 00000000 ____D C:\ProgramData\RogueKiller
2017-07-09 01:52 - 2017-07-09 01:52 - 00000869 _____ C:\Users\Public\Desktop\RogueKiller.lnk
2017-07-09 01:52 - 2017-07-09 01:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RogueKiller
2017-07-09 01:52 - 2017-07-09 01:52 - 00000000 ____D C:\Program Files\RogueKiller
2017-07-09 01:51 - 2017-07-09 01:51 - 35586304 _____ (Adlice Software ) C:\Users\Main Account\Downloads\RogueKiller_setup_ref3.exe
2017-07-09 01:38 - 2017-07-09 01:38 - 00033674 _____ C:\Users\Main Account\Downloads\Shortcut.txt
2017-07-09 01:38 - 2017-07-09 01:38 - 00020042 _____ C:\Users\Main Account\Downloads\Addition.txt
2017-07-09 01:37 - 2017-07-12 19:02 - 00011802 _____ C:\Users\Main Account\Downloads\FRST.txt
2017-07-09 01:35 - 2017-07-12 19:02 - 00000000 ____D C:\FRST
2017-07-09 01:35 - 2017-07-09 01:35 - 02437120 _____ (Farbar) C:\Users\Main Account\Downloads\FRST64.exe
2017-07-09 01:21 - 2017-07-09 01:21 - 05200384 _____ (AVAST Software) C:\Users\Main Account\Downloads\aswmbr (1).exe
2017-07-09 01:20 - 2017-07-09 01:20 - 04745728 _____ (AVAST Software) C:\Users\Main Account\Downloads\aswMBR.exe
2017-07-09 01:18 - 2017-07-09 01:18 - 00262144 ____N C:\Windows\Minidump\070917-25974-01.dmp
2017-07-09 01:17 - 2017-07-09 01:17 - 00262144 ____N C:\Windows\Minidump\070917-22744-01.dmp
2017-07-09 00:30 - 2017-07-12 18:40 - 00000000 ____D C:\Windows\Minidump
2017-07-09 00:29 - 2017-07-09 00:29 - 00262144 ____N C:\Windows\Minidump\070917-22214-01.dmp
2017-07-08 22:17 - 2017-07-08 22:17 - 00000000 ____D C:\ProgramData\SWCUTemp
2017-07-08 22:16 - 2017-07-08 22:16 - 00000000 ____D C:\Users\Main Account\AppData\Roaming\AVAST Software
2017-07-08 22:13 - 2017-07-08 22:17 - 00000000 ____D C:\Program Files\AVAST Software
2017-07-07 20:55 - 2017-07-08 23:46 - 00000000 ___SD C:\Windows\system32\CompatTel
2017-07-07 20:55 - 2017-07-08 23:46 - 00000000 ____D C:\Windows\system32\appraiser
2017-07-06 22:25 - 2016-10-11 11:18 - 01027584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IMJP10.IME
2017-07-06 22:01 - 2017-07-08 23:46 - 00000000 ____D C:\Users\Main Account\AppData\Roaming\Tenorshare
2017-07-06 22:01 - 2017-07-06 22:01 - 00000000 ____D C:\Tenorshare
2017-07-06 21:40 - 2017-07-06 21:40 - 00000000 ____D C:\Users\Main Account\AppData\Local\tkdata
2017-07-06 21:40 - 2017-07-06 21:40 - 00000000 ____D C:\Users\Main Account\AppData\Local\CEF
2017-07-06 21:39 - 2017-07-06 21:39 - 00000000 ____D C:\ProgramData\TrueKey
2017-07-06 21:38 - 2017-07-06 21:38 - 00000000 ____D C:\Users\Main Account\AppData\Roaming\Sun
2017-07-06 21:35 - 2017-07-06 21:35 - 00000000 ____D C:\Program Files\Intel Security
2017-07-06 21:34 - 2017-07-09 03:10 - 00000000 ____D C:\ProgramData\Package Cache
2017-07-06 21:31 - 2017-07-12 04:23 - 00000000 ____D C:\Users\Main Account\AppData\LocalLow\uTorrent
2017-07-06 21:31 - 2017-07-08 23:46 - 00000000 ____D C:\Program Files (x86)\McAfee
2017-07-06 21:31 - 2017-07-06 21:31 - 00003344 _____ C:\Windows\System32\Tasks\McAfee Remediation (Prepare)
2017-07-06 21:31 - 2017-07-06 21:31 - 00000000 ____D C:\Program Files\Common Files\McAfee
2017-07-06 21:31 - 2017-07-06 21:31 - 00000000 ____D C:\Program Files\Common Files\AV
2017-07-06 20:29 - 2017-07-08 23:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2017-07-06 20:29 - 2017-07-06 20:29 - 00001764 _____ C:\Users\Public\Desktop\iTunes.lnk
2017-07-06 20:29 - 2017-07-06 20:29 - 00000000 ____D C:\Program Files\iPod
2017-07-06 20:28 - 2017-07-06 20:29 - 00000000 ____D C:\Program Files\iTunes
2017-07-06 20:24 - 2017-07-06 20:24 - 00000000 ____D C:\Program Files\Bonjour
2017-07-06 20:24 - 2017-07-06 20:24 - 00000000 ____D C:\Program Files (x86)\Bonjour
2017-07-06 20:22 - 2017-07-08 23:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud
2017-07-06 20:22 - 2017-07-06 20:22 - 00000000 ____D C:\Windows\System32\Tasks\Apple
2017-07-06 20:22 - 2017-07-06 20:22 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
2017-07-06 20:17 - 2017-07-09 17:46 - 00000000 ____D C:\ProgramData\McAfee
2017-07-06 20:17 - 2017-07-09 03:27 - 00000000 ____D C:\Program Files\TrueKey
2017-07-06 20:17 - 2017-07-08 23:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
2017-07-06 20:17 - 2017-07-08 23:46 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2017-07-06 20:17 - 2017-07-08 23:46 - 00000000 ____D C:\Program Files (x86)\McAfee Security Scan
2017-07-06 20:17 - 2017-07-06 20:17 - 00803328 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2017-07-06 20:17 - 2017-07-06 20:17 - 00144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2017-07-06 20:17 - 2017-07-06 20:17 - 00004486 _____ C:\Windows\System32\Tasks\Adobe Flash Player PPAPI Notifier
2017-07-06 20:17 - 2017-07-06 20:17 - 00004324 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2017-07-06 20:17 - 2017-07-06 20:17 - 00002168 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2017-07-06 20:16 - 2017-07-06 20:17 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2017-07-06 20:16 - 2017-07-06 20:16 - 00000000 ____D C:\Windows\system32\Macromed
2017-07-06 20:15 - 2017-07-06 20:15 - 01202184 _____ (Adobe Systems Incorporated) C:\Users\Main Account\Downloads\flashplayer26pp_ka_install.exe
2017-07-06 20:10 - 2017-07-06 20:10 - 00000000 ____D C:\Users\Default\AppData\Local\Google
2017-07-06 20:10 - 2017-07-06 20:10 - 00000000 ____D C:\Users\Default User\AppData\Local\Google
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2017-07-12 19:01 - 2015-03-23 04:10 - 00000000 ____D C:\Users\Main Account
2017-07-12 18:45 - 2009-07-14 01:13 - 00817186 _____ C:\Windows\system32\PerfStringBackup.INI
2017-07-12 18:45 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\inf
2017-07-12 05:19 - 2015-04-04 10:38 - 00000000 ____D C:\Users\Main Account\AppData\Roaming\uTorrent
2017-07-12 04:31 - 2009-07-14 00:45 - 00022560 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-07-12 04:31 - 2009-07-14 00:45 - 00022560 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-07-12 04:21 - 2009-07-14 01:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-07-12 04:19 - 2009-07-14 01:08 - 00007368 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2017-07-11 15:00 - 2015-03-23 11:46 - 00000000 ____D C:\Program Files (x86)\Google
2017-07-11 08:50 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2017-07-10 19:16 - 2015-03-23 11:13 - 00058016 _____ C:\Users\Main Account\AppData\Local\GDIPFONTCACHEV1.DAT
2017-07-10 19:15 - 2015-03-23 04:12 - 00001428 _____ C:\Users\Main Account\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2017-07-10 19:12 - 2009-07-14 00:45 - 00267672 _____ C:\Windows\system32\FNTCACHE.DAT
2017-07-10 19:07 - 2009-07-14 01:32 - 00000000 ____D C:\Program Files\DVD Maker
2017-07-10 19:07 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\SysWOW64\migwiz
2017-07-10 19:07 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\SysWOW64\Dism
2017-07-10 19:07 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\system32\migwiz
2017-07-10 19:07 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\system32\Dism
2017-07-10 19:07 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\system32\AdvancedInstallers
2017-07-10 18:15 - 2015-03-23 11:25 - 00809892 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2017-07-09 19:31 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\rescache
2017-07-09 08:55 - 2015-03-23 11:57 - 00000000 ____D C:\ProgramData\Oracle
2017-07-09 08:52 - 2015-03-23 11:59 - 00000000 ____D C:\Program Files\Java
2017-07-09 04:43 - 2015-03-23 12:19 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-07-08 23:49 - 2009-07-13 23:20 - 00000000 __RSD C:\Windows\Media
2017-07-08 23:47 - 2009-07-14 01:32 - 00000000 ____D C:\Windows\Offline Web Pages
2017-07-08 23:47 - 2009-07-14 01:32 - 00000000 ____D C:\Windows\Downloaded Program Files
2017-07-08 23:47 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\servicing
2017-07-08 23:46 - 2015-03-23 11:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2017-07-08 23:46 - 2015-03-23 11:57 - 00000000 ____D C:\Program Files (x86)\Java
2017-07-08 23:46 - 2009-07-13 23:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2017-07-08 23:44 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\registration
2017-07-08 23:39 - 2015-03-23 11:46 - 00000000 ____D C:\Users\Main Account\AppData\Local\Google
2017-07-08 23:39 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\AppCompat
2017-07-08 22:17 - 2015-03-23 12:22 - 00000000 ____D C:\ProgramData\AVAST Software
2017-07-06 22:45 - 2015-03-23 12:12 - 00000000 ____D C:\Users\Main Account\AppData\Roaming\Apple Computer
2017-07-06 22:36 - 2015-03-23 12:12 - 00000000 ____D C:\Users\Main Account\AppData\Local\Apple Computer
2017-07-06 21:30 - 2009-07-14 01:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2017-07-06 21:19 - 2009-07-14 01:32 - 00000000 ____D C:\Program Files\Windows Defender
2017-07-06 21:19 - 2009-07-14 01:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2017-07-06 21:19 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\tracing
2017-07-06 21:19 - 2009-07-13 23:20 - 00000000 ____D C:\Program Files\Common Files\System
2017-07-06 20:28 - 2015-03-23 12:11 - 00000000 ____D C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2017-07-06 20:28 - 2015-03-23 12:11 - 00000000 ____D C:\Program Files\Common Files\Apple
2017-07-06 20:22 - 2015-03-23 12:11 - 00002519 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2017-07-06 20:16 - 2015-03-23 11:56 - 00000000 ____D C:\Users\Main Account\AppData\Local\Adobe
2017-07-06 20:13 - 2015-03-23 11:47 - 00002206 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-07-06 20:13 - 2015-03-23 11:47 - 00002194 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2017-07-06 20:10 - 2015-03-23 12:02 - 00002053 _____ C:\Users\Public\Desktop\Google Slides.lnk
2017-07-06 20:10 - 2015-03-23 12:02 - 00002051 _____ C:\Users\Public\Desktop\Google Sheets.lnk
2017-07-06 20:10 - 2015-03-23 12:02 - 00002041 _____ C:\Users\Public\Desktop\Google Docs.lnk
2017-07-06 20:10 - 2015-03-23 12:02 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2017-07-06 20:00 - 2015-03-23 11:46 - 00003330 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
 
==================== Files in the root of some directories =======
 
2017-07-09 08:32 - 2017-07-09 08:32 - 0000017 _____ () C:\Users\Main Account\AppData\Local\resmon.resmoncfg
 
Some files in TEMP:
====================
2017-07-09 01:53 - 2015-03-17 01:19 - 1727904 _____ (Microsoft Corporation) C:\Users\Main Account\AppData\Local\Temp\dllnt_dump.dll
 
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

Edited by hamluis, 11 July 2017 - 06:37 PM.


BC AdBot (Login to Remove)

 


#2 dareynedx

dareynedx
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:03:44 PM

Posted 11 July 2017 - 06:07 PM

GMER Log with suspicious kernel calls

 

GMER 2.2.19882 - http://www.gmer.net
Rootkit scan 2017-07-12 05:09:41
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\0000005e ST500LT0 rev.0002 465.76GB
Running: mhyocejq.exe; Driver: C:\Users\MAINAC~1\AppData\Local\Temp\axldypow.sys
 
---- User code sections - GMER 2.2 ----
.text  C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[2772] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                0000000076851401 2 bytes JMP 7644b233 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[2772] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                  0000000076851419 2 bytes JMP 7644b35e C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[2772] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                0000000076851431 2 bytes JMP 764c9149 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[2772] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                000000007685144a 2 bytes CALL 76424885 C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                  * 9
.text  C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[2772] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                   00000000768514dd 2 bytes JMP 764c8a42 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[2772] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17            00000000768514f5 2 bytes JMP 764c8c18 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[2772] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                   000000007685150d 2 bytes JMP 764c8938 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[2772] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17            0000000076851525 2 bytes JMP 764c8d02 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[2772] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                  000000007685153d 2 bytes JMP 7643fcc0 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[2772] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                       0000000076851555 2 bytes JMP 76446907 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[2772] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                000000007685156d 2 bytes JMP 764c9201 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[2772] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                  0000000076851585 2 bytes JMP 764c8d62 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[2772] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                     000000007685159d 2 bytes JMP 764c88fc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[2772] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                  00000000768515b5 2 bytes JMP 7643fd59 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[2772] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                00000000768515cd 2 bytes JMP 7644b2f4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[2772] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20            00000000768516b2 2 bytes JMP 764c90c4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[2772] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31            00000000768516bd 2 bytes JMP 764c8891 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Main Account\AppData\Roaming\uTorrent\uTorrent.exe[2884] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17            0000000076851401 2 bytes JMP 7644b233 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Main Account\AppData\Roaming\uTorrent\uTorrent.exe[2884] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17              0000000076851419 2 bytes JMP 7644b35e C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Main Account\AppData\Roaming\uTorrent\uTorrent.exe[2884] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17            0000000076851431 2 bytes JMP 764c9149 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Main Account\AppData\Roaming\uTorrent\uTorrent.exe[2884] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42            000000007685144a 2 bytes CALL 76424885 C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                  * 9
.text  C:\Users\Main Account\AppData\Roaming\uTorrent\uTorrent.exe[2884] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17               00000000768514dd 2 bytes JMP 764c8a42 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Main Account\AppData\Roaming\uTorrent\uTorrent.exe[2884] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17        00000000768514f5 2 bytes JMP 764c8c18 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Main Account\AppData\Roaming\uTorrent\uTorrent.exe[2884] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17               000000007685150d 2 bytes JMP 764c8938 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Main Account\AppData\Roaming\uTorrent\uTorrent.exe[2884] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17        0000000076851525 2 bytes JMP 764c8d02 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Main Account\AppData\Roaming\uTorrent\uTorrent.exe[2884] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17              000000007685153d 2 bytes JMP 7643fcc0 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Main Account\AppData\Roaming\uTorrent\uTorrent.exe[2884] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                   0000000076851555 2 bytes JMP 76446907 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Main Account\AppData\Roaming\uTorrent\uTorrent.exe[2884] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17            000000007685156d 2 bytes JMP 764c9201 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Main Account\AppData\Roaming\uTorrent\uTorrent.exe[2884] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17              0000000076851585 2 bytes JMP 764c8d62 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Main Account\AppData\Roaming\uTorrent\uTorrent.exe[2884] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                 000000007685159d 2 bytes JMP 764c88fc C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Main Account\AppData\Roaming\uTorrent\uTorrent.exe[2884] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17              00000000768515b5 2 bytes JMP 7643fd59 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Main Account\AppData\Roaming\uTorrent\uTorrent.exe[2884] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17            00000000768515cd 2 bytes JMP 7644b2f4 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Main Account\AppData\Roaming\uTorrent\uTorrent.exe[2884] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20        00000000768516b2 2 bytes JMP 764c90c4 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Main Account\AppData\Roaming\uTorrent\uTorrent.exe[2884] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31        00000000768516bd 2 bytes JMP 764c8891 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                           00000000775e6130 5 bytes JMP 00000000375e0178
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory              000000007760beb0 6 bytes {JMP QWORD [RIP+0x8b5514a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory               000000007760c230 6 bytes {JMP QWORD [RIP+0x8b74dca]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\system32\kernel32.dll!CopyFileW                         00000000774a8950 6 bytes {JMP QWORD [RIP+0x8c386aa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\system32\kernel32.dll!CreateProcessInternalW            00000000774bdd20 6 bytes {JMP QWORD [RIP+0x8b632da]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\system32\kernel32.dll!CreateProcessW                    00000000774c05e0 6 bytes {JMP QWORD [RIP+0x8ba0a1a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\system32\kernel32.dll!GetThreadSelectorEntry            00000000774f10d0 6 bytes {JMP QWORD [RIP+0x8c4ff2a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\system32\kernel32.dll!MoveFileW                         000000007752f7e0 6 bytes {JMP QWORD [RIP+0x8b7181a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\system32\kernel32.dll!MoveFileA                         000000007752f940 6 bytes {JMP QWORD [RIP+0x8b916ba]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\system32\kernel32.dll!CopyFileA                         0000000077535690 6 bytes {JMP QWORD [RIP+0x8bcb96a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\system32\kernel32.dll!CreateProcessInternalA            000000007753a2f0 6 bytes {JMP QWORD [RIP+0x8b06d0a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\system32\kernel32.dll!CreateProcessA                    000000007753afc0 6 bytes {JMP QWORD [RIP+0x8b4603a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\system32\kernel32.dll!WinExec                           000000007753b500 6 bytes {JMP QWORD [RIP+0x8be5afa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\system32\KERNELBASE.dll!VirtualAlloc                    000007fefd301900 6 bytes JMP 0
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\system32\KERNELBASE.dll!HeapCreate + 1                  000007fefd30b2d1 5 bytes {JMP QWORD [RIP+0x1b5d2a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\system32\KERNELBASE.dll!VirtualProtect                  000007fefd3113b0 6 bytes JMP d5730f
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\system32\KERNELBASE.dll!VirtualProtectEx                000007fefd3113e0 6 bytes {JMP QWORD [RIP+0x16fc1a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\system32\KERNELBASE.dll!VirtualAllocEx                  000007fefd333870 6 bytes JMP 0
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\system32\KERNELBASE.dll!WriteProcessMemory              000007fefd3338a0 6 bytes {JMP QWORD [RIP+0x16d75a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\system32\WS2_32.dll!WSAStartup                          000007feff304ae0 6 bytes JMP 0
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\system32\WININET.dll!HttpOpenRequestW                   000007fefedb9be0 6 bytes {JMP QWORD [RIP+0xb8741a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\system32\WININET.dll!HttpSendRequestW                   000007fefedc1140 6 bytes {JMP QWORD [RIP+0xc4feba]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\system32\WININET.dll!InternetReadFile                   000007fefedc2b50 6 bytes {JMP QWORD [RIP+0xc0e4aa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\system32\WININET.dll!InternetReadFileExW                000007fefedcec00 6 bytes {JMP QWORD [RIP+0xc223fa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\system32\WININET.dll!HttpSendRequestExW                 000007fefee1cf70 6 bytes {JMP QWORD [RIP+0xc3408a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\system32\WININET.dll!HttpSendRequestA                   000007fefee5e570 6 bytes {JMP QWORD [RIP+0xbd2a8a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\system32\WININET.dll!InternetOpenUrlA                   000007fefeebead0 6 bytes {JMP QWORD [RIP+0xaf252a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\system32\WININET.dll!InternetOpenUrlW                   000007fefeebf780 6 bytes {JMP QWORD [RIP+0xac187a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\system32\WININET.dll!HttpSendRequestExA                 000007fefeee8210 6 bytes {JMP QWORD [RIP+0xb88dea]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\system32\WININET.dll!HttpOpenRequestA                   000007fefeeeace0 6 bytes {JMP QWORD [RIP+0xa7631a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\system32\urlmon.dll!URLDownloadToCacheFileW + 1         000007feff0f1ce1 5 bytes {JMP QWORD [RIP+0x2bf31a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\system32\urlmon.dll!URLDownloadToFileW                  000007feff0f28b0 6 bytes {JMP QWORD [RIP+0x27e74a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\system32\urlmon.dll!URLDownloadToCacheFileA + 1         000007feff19e451 5 bytes JMP 0
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\system32\urlmon.dll!URLDownloadToFileA + 1              000007feff19e5d1 5 bytes {JMP QWORD [RIP+0x1f2a2a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\system32\urlmon.dll!URLOpenBlockingStreamA              000007feff19e720 6 bytes {JMP QWORD [RIP+0x7628da]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\system32\urlmon.dll!URLOpenBlockingStreamW              000007feff19e800 6 bytes {JMP QWORD [RIP+0x7327fa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\system32\urlmon.dll!URLOpenStreamA + 1                  000007feff19eb21 5 bytes {JMP QWORD [RIP+0x6724da]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\system32\urlmon.dll!URLOpenStreamW                      000007feff19ebf0 3 bytes JMP 0
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\system32\urlmon.dll!URLOpenStreamW + 4                  000007feff19ebf4 2 bytes JMP 0
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3920] C:\Windows\system32\CRYPT32.dll!CertVerifyCertificateChainPolicy   000000000228653c 7 bytes JMP 00000000375e01d8
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5036] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                           00000000775e6130 5 bytes JMP 00000000375e0178
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5036] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory              000000007760beb0 6 bytes {JMP QWORD [RIP+0x8b5514a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5036] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory               000000007760c230 6 bytes {JMP QWORD [RIP+0x8b74dca]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5036] C:\Windows\system32\kernel32.dll!CopyFileW                         00000000774a8950 6 bytes {JMP QWORD [RIP+0x8c386aa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5036] C:\Windows\system32\kernel32.dll!CreateProcessInternalW            00000000774bdd20 6 bytes {JMP QWORD [RIP+0x8b632da]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5036] C:\Windows\system32\kernel32.dll!CreateProcessW                    00000000774c05e0 6 bytes {JMP QWORD [RIP+0x8ba0a1a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5036] C:\Windows\system32\kernel32.dll!GetThreadSelectorEntry            00000000774f10d0 6 bytes {JMP QWORD [RIP+0x8c4ff2a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5036] C:\Windows\system32\kernel32.dll!MoveFileW                         000000007752f7e0 6 bytes {JMP QWORD [RIP+0x8b7181a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5036] C:\Windows\system32\kernel32.dll!MoveFileA                         000000007752f940 6 bytes {JMP QWORD [RIP+0x8b916ba]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5036] C:\Windows\system32\kernel32.dll!CopyFileA                         0000000077535690 6 bytes {JMP QWORD [RIP+0x8bcb96a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5036] C:\Windows\system32\kernel32.dll!CreateProcessInternalA            000000007753a2f0 6 bytes {JMP QWORD [RIP+0x8b06d0a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5036] C:\Windows\system32\kernel32.dll!CreateProcessA                    000000007753afc0 6 bytes {JMP QWORD [RIP+0x8b4603a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5036] C:\Windows\system32\kernel32.dll!WinExec                           000000007753b500 6 bytes {JMP QWORD [RIP+0x8be5afa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5036] C:\Windows\system32\KERNELBASE.dll!VirtualAlloc                    000007fefd301900 6 bytes {JMP QWORD [RIP+0x11f6fa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5036] C:\Windows\system32\KERNELBASE.dll!HeapCreate + 1                  000007fefd30b2d1 5 bytes {JMP QWORD [RIP+0x1b5d2a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5036] C:\Windows\system32\KERNELBASE.dll!VirtualProtect                  000007fefd3113b0 6 bytes {JMP QWORD [RIP+0x12fc4a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5036] C:\Windows\system32\KERNELBASE.dll!VirtualProtectEx                000007fefd3113e0 6 bytes {JMP QWORD [RIP+0x16fc1a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5036] C:\Windows\system32\KERNELBASE.dll!VirtualAllocEx                  000007fefd333870 6 bytes {JMP QWORD [RIP+0x12d78a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5036] C:\Windows\system32\KERNELBASE.dll!WriteProcessMemory              000007fefd3338a0 6 bytes {JMP QWORD [RIP+0x16d75a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5036] C:\Windows\system32\WS2_32.dll!WSAStartup                          000007feff304ae0 6 bytes {JMP QWORD [RIP+0x61c51a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5036] C:\Windows\system32\WININET.dll!HttpOpenRequestW                   000007fefedb9be0 6 bytes {JMP QWORD [RIP+0xb8741a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5036] C:\Windows\system32\WININET.dll!HttpSendRequestW                   000007fefedc1140 6 bytes {JMP QWORD [RIP+0xc4feba]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5036] C:\Windows\system32\WININET.dll!InternetReadFile                   000007fefedc2b50 6 bytes {JMP QWORD [RIP+0xc0e4aa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5036] C:\Windows\system32\WININET.dll!InternetReadFileExW                000007fefedcec00 6 bytes {JMP QWORD [RIP+0xc223fa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5036] C:\Windows\system32\WININET.dll!HttpSendRequestExW                 000007fefee1cf70 6 bytes {JMP QWORD [RIP+0xc3408a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5036] C:\Windows\system32\WININET.dll!HttpSendRequestA                   000007fefee5e570 6 bytes {JMP QWORD [RIP+0xbd2a8a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5036] C:\Windows\system32\WININET.dll!InternetOpenUrlA                   000007fefeebead0 6 bytes {JMP QWORD [RIP+0xaf252a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5036] C:\Windows\system32\WININET.dll!InternetOpenUrlW                   000007fefeebf780 6 bytes {JMP QWORD [RIP+0xac187a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5036] C:\Windows\system32\WININET.dll!HttpSendRequestExA                 000007fefeee8210 6 bytes {JMP QWORD [RIP+0xb88dea]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5036] C:\Windows\system32\WININET.dll!HttpOpenRequestA                   000007fefeeeace0 6 bytes {JMP QWORD [RIP+0xa7631a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5036] C:\Windows\system32\urlmon.dll!URLDownloadToCacheFileW + 1         000007feff0f1ce1 5 bytes {JMP QWORD [RIP+0x2bf31a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5036] C:\Windows\system32\urlmon.dll!URLDownloadToFileW                  000007feff0f28b0 6 bytes {JMP QWORD [RIP+0x27e74a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5036] C:\Windows\system32\urlmon.dll!URLDownloadToCacheFileA + 1         000007feff19e451 5 bytes {JMP QWORD [RIP+0x632baa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5036] C:\Windows\system32\urlmon.dll!URLDownloadToFileA + 1              000007feff19e5d1 5 bytes {JMP QWORD [RIP+0x1f2a2a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5036] C:\Windows\system32\urlmon.dll!URLOpenBlockingStreamA              000007feff19e720 6 bytes {JMP QWORD [RIP+0x7628da]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5036] C:\Windows\system32\urlmon.dll!URLOpenBlockingStreamW              000007feff19e800 6 bytes {JMP QWORD [RIP+0x7327fa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5036] C:\Windows\system32\urlmon.dll!URLOpenStreamA + 1                  000007feff19eb21 5 bytes {JMP QWORD [RIP+0x6724da]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5036] C:\Windows\system32\urlmon.dll!URLOpenStreamW                      000007feff19ebf0 3 bytes [FF, 25, 0A]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5036] C:\Windows\system32\urlmon.dll!URLOpenStreamW + 4                  000007feff19ebf4 2 bytes [65, 00]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                           00000000775e6130 5 bytes JMP 00000000375e0178
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory              000000007760beb0 6 bytes {JMP QWORD [RIP+0x8b5514a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory               000000007760c230 6 bytes {JMP QWORD [RIP+0x8b74dca]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4336] C:\Windows\system32\kernel32.dll!CopyFileW                         00000000774a8950 6 bytes {JMP QWORD [RIP+0x8c386aa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4336] C:\Windows\system32\kernel32.dll!CreateProcessInternalW            00000000774bdd20 6 bytes {JMP QWORD [RIP+0x8b632da]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4336] C:\Windows\system32\kernel32.dll!CreateProcessW                    00000000774c05e0 6 bytes {JMP QWORD [RIP+0x8ba0a1a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4336] C:\Windows\system32\kernel32.dll!GetThreadSelectorEntry            00000000774f10d0 6 bytes {JMP QWORD [RIP+0x8c4ff2a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4336] C:\Windows\system32\kernel32.dll!MoveFileW                         000000007752f7e0 6 bytes {JMP QWORD [RIP+0x8b7181a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4336] C:\Windows\system32\kernel32.dll!MoveFileA                         000000007752f940 6 bytes {JMP QWORD [RIP+0x8b916ba]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4336] C:\Windows\system32\kernel32.dll!CopyFileA                         0000000077535690 6 bytes {JMP QWORD [RIP+0x8bcb96a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4336] C:\Windows\system32\kernel32.dll!CreateProcessInternalA            000000007753a2f0 6 bytes {JMP QWORD [RIP+0x8b06d0a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4336] C:\Windows\system32\kernel32.dll!CreateProcessA                    000000007753afc0 6 bytes {JMP QWORD [RIP+0x8b4603a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4336] C:\Windows\system32\kernel32.dll!WinExec                           000000007753b500 6 bytes {JMP QWORD [RIP+0x8be5afa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4336] C:\Windows\system32\KERNELBASE.dll!VirtualAlloc                    000007fefd301900 6 bytes {JMP QWORD [RIP+0x11f6fa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4336] C:\Windows\system32\KERNELBASE.dll!HeapCreate + 1                  000007fefd30b2d1 5 bytes {JMP QWORD [RIP+0x1b5d2a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4336] C:\Windows\system32\KERNELBASE.dll!VirtualProtect                  000007fefd3113b0 6 bytes {JMP QWORD [RIP+0x12fc4a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4336] C:\Windows\system32\KERNELBASE.dll!VirtualProtectEx                000007fefd3113e0 6 bytes {JMP QWORD [RIP+0x16fc1a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4336] C:\Windows\system32\KERNELBASE.dll!VirtualAllocEx                  000007fefd333870 6 bytes {JMP QWORD [RIP+0x12d78a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4336] C:\Windows\system32\KERNELBASE.dll!WriteProcessMemory              000007fefd3338a0 6 bytes {JMP QWORD [RIP+0x16d75a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4336] C:\Windows\system32\WS2_32.dll!WSAStartup                          000007feff304ae0 6 bytes {JMP QWORD [RIP+0x61c51a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4336] C:\Windows\system32\WININET.dll!HttpOpenRequestW                   000007fefedb9be0 6 bytes {JMP QWORD [RIP+0xb8741a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4336] C:\Windows\system32\WININET.dll!HttpSendRequestW                   000007fefedc1140 6 bytes {JMP QWORD [RIP+0xc4feba]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4336] C:\Windows\system32\WININET.dll!InternetReadFile                   000007fefedc2b50 6 bytes {JMP QWORD [RIP+0xc0e4aa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4336] C:\Windows\system32\WININET.dll!InternetReadFileExW                000007fefedcec00 6 bytes {JMP QWORD [RIP+0xc223fa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4336] C:\Windows\system32\WININET.dll!HttpSendRequestExW                 000007fefee1cf70 6 bytes {JMP QWORD [RIP+0xc3408a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4336] C:\Windows\system32\WININET.dll!HttpSendRequestA                   000007fefee5e570 6 bytes {JMP QWORD [RIP+0xbd2a8a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4336] C:\Windows\system32\WININET.dll!InternetOpenUrlA                   000007fefeebead0 6 bytes {JMP QWORD [RIP+0xaf252a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4336] C:\Windows\system32\WININET.dll!InternetOpenUrlW                   000007fefeebf780 6 bytes {JMP QWORD [RIP+0xac187a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4336] C:\Windows\system32\WININET.dll!HttpSendRequestExA                 000007fefeee8210 6 bytes {JMP QWORD [RIP+0xb88dea]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4336] C:\Windows\system32\WININET.dll!HttpOpenRequestA                   000007fefeeeace0 6 bytes {JMP QWORD [RIP+0xa7631a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4336] C:\Windows\system32\urlmon.dll!URLDownloadToCacheFileW + 1         000007feff0f1ce1 5 bytes JMP 0
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4336] C:\Windows\system32\urlmon.dll!URLDownloadToFileW                  000007feff0f28b0 6 bytes {JMP QWORD [RIP+0x27e74a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4336] C:\Windows\system32\urlmon.dll!URLDownloadToCacheFileA + 1         000007feff19e451 5 bytes {JMP QWORD [RIP+0x632baa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4336] C:\Windows\system32\urlmon.dll!URLDownloadToFileA + 1              000007feff19e5d1 5 bytes {JMP QWORD [RIP+0x1f2a2a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4336] C:\Windows\system32\urlmon.dll!URLOpenBlockingStreamA              000007feff19e720 6 bytes {JMP QWORD [RIP+0x7628da]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4336] C:\Windows\system32\urlmon.dll!URLOpenBlockingStreamW              000007feff19e800 6 bytes JMP 0
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4336] C:\Windows\system32\urlmon.dll!URLOpenStreamA + 1                  000007feff19eb21 5 bytes {JMP QWORD [RIP+0x6724da]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4336] C:\Windows\system32\urlmon.dll!URLOpenStreamW                      000007feff19ebf0 3 bytes [FF, 25, 0A]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4336] C:\Windows\system32\urlmon.dll!URLOpenStreamW + 4                  000007feff19ebf4 2 bytes [65, 00]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                           00000000775e6130 5 bytes JMP 00000000375e0178
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread               000000007760be00 7 bytes [48, B8, 50, 40, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8           000000007760be08 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory              000000007760beb0 6 bytes {JMP QWORD [RIP+0x8b5514a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken                    000000007760bf70 7 bytes [48, B8, D0, 40, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8                000000007760bf78 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                        000000007760bf90 7 bytes [48, B8, C0, 44, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8                    000000007760bf98 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                 000000007760bfa0 7 bytes [48, B8, B0, 42, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8             000000007760bfa8 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                   000000007760bfb0 7 bytes [48, B8, 30, 3F, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8               000000007760bfb8 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection                 000000007760bfd0 7 bytes [48, B8, A0, 3F, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8             000000007760bfd8 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx                  000000007760c020 7 bytes [48, B8, 40, 41, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8              000000007760c028 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx                 000000007760c030 7 bytes [48, B8, 10, 45, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8             000000007760c038 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                           000000007760c060 7 bytes [48, B8, 30, 42, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8                       000000007760c068 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile                000000007760c100 7 bytes [48, B8, 70, 42, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8            000000007760c108 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory               000000007760c230 6 bytes {JMP QWORD [RIP+0x8b74dca]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                         000000007760c280 7 bytes [48, B8, B0, 41, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8                     000000007760c288 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken                   000000007760ccf0 7 bytes [48, B8, F0, 44, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8               000000007760ccf8 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                         000000007760cd40 7 bytes [48, B8, 90, 44, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8                     000000007760cd48 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile            000000007760ce90 7 bytes [48, B8, 90, 42, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8        000000007760ce98 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\system32\kernel32.dll!CopyFileW                         00000000774a8950 6 bytes {JMP QWORD [RIP+0x8c386aa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\system32\kernel32.dll!CreateProcessInternalW            00000000774bdd20 6 bytes {JMP QWORD [RIP+0x8b632da]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\system32\kernel32.dll!CreateProcessW                    00000000774c05e0 6 bytes {JMP QWORD [RIP+0x8ba0a1a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\system32\kernel32.dll!GetThreadSelectorEntry            00000000774f10d0 6 bytes {JMP QWORD [RIP+0x8c4ff2a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\system32\kernel32.dll!MoveFileW                         000000007752f7e0 6 bytes {JMP QWORD [RIP+0x8b7181a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\system32\kernel32.dll!MoveFileA                         000000007752f940 6 bytes {JMP QWORD [RIP+0x8b916ba]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\system32\kernel32.dll!CopyFileA                         0000000077535690 6 bytes {JMP QWORD [RIP+0x8bcb96a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\system32\kernel32.dll!CreateProcessInternalA            000000007753a2f0 6 bytes {JMP QWORD [RIP+0x8b06d0a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\system32\kernel32.dll!CreateProcessA                    000000007753afc0 6 bytes {JMP QWORD [RIP+0x8b4603a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\system32\kernel32.dll!WinExec                           000000007753b500 6 bytes {JMP QWORD [RIP+0x8be5afa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\system32\KERNELBASE.dll!VirtualAlloc                    000007fefd301900 6 bytes {JMP QWORD [RIP+0x11f6fa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\system32\KERNELBASE.dll!HeapCreate + 1                  000007fefd30b2d1 5 bytes {JMP QWORD [RIP+0x1b5d2a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\system32\KERNELBASE.dll!VirtualProtect                  000007fefd3113b0 6 bytes {JMP QWORD [RIP+0x12fc4a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\system32\KERNELBASE.dll!VirtualProtectEx                000007fefd3113e0 6 bytes {JMP QWORD [RIP+0x16fc1a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\system32\KERNELBASE.dll!VirtualAllocEx                  000007fefd333870 6 bytes {JMP QWORD [RIP+0x12d78a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\system32\KERNELBASE.dll!WriteProcessMemory              000007fefd3338a0 6 bytes {JMP QWORD [RIP+0x16d75a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\system32\WS2_32.dll!WSAStartup                          000007feff304ae0 6 bytes JMP 0
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\system32\WININET.dll!HttpOpenRequestW                   000007fefedb9be0 6 bytes {JMP QWORD [RIP+0xb8741a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\system32\WININET.dll!HttpSendRequestW                   000007fefedc1140 6 bytes {JMP QWORD [RIP+0xc4feba]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\system32\WININET.dll!InternetReadFile                   000007fefedc2b50 6 bytes {JMP QWORD [RIP+0xc0e4aa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\system32\WININET.dll!InternetReadFileExW                000007fefedcec00 6 bytes {JMP QWORD [RIP+0xc223fa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\system32\WININET.dll!HttpSendRequestExW                 000007fefee1cf70 6 bytes {JMP QWORD [RIP+0xc3408a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\system32\WININET.dll!HttpSendRequestA                   000007fefee5e570 6 bytes {JMP QWORD [RIP+0xbd2a8a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\system32\WININET.dll!InternetOpenUrlA                   000007fefeebead0 6 bytes JMP 0
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\system32\WININET.dll!InternetOpenUrlW                   000007fefeebf780 6 bytes {JMP QWORD [RIP+0xac187a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\system32\WININET.dll!HttpSendRequestExA                 000007fefeee8210 6 bytes {JMP QWORD [RIP+0xb88dea]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\system32\WININET.dll!HttpOpenRequestA                   000007fefeeeace0 6 bytes {JMP QWORD [RIP+0xa7631a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\system32\urlmon.dll!URLDownloadToCacheFileW + 1         000007feff0f1ce1 5 bytes {JMP QWORD [RIP+0x2bf31a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\system32\urlmon.dll!URLDownloadToFileW                  000007feff0f28b0 6 bytes {JMP QWORD [RIP+0x27e74a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\system32\urlmon.dll!URLDownloadToCacheFileA + 1         000007feff19e451 5 bytes {JMP QWORD [RIP+0x632baa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\system32\urlmon.dll!URLDownloadToFileA + 1              000007feff19e5d1 5 bytes {JMP QWORD [RIP+0x1f2a2a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\system32\urlmon.dll!URLOpenBlockingStreamA              000007feff19e720 6 bytes JMP 7fedcc9
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\system32\urlmon.dll!URLOpenBlockingStreamW              000007feff19e800 6 bytes JMP 0
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\system32\urlmon.dll!URLOpenStreamA + 1                  000007feff19eb21 5 bytes {JMP QWORD [RIP+0x6724da]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\system32\urlmon.dll!URLOpenStreamW                      000007feff19ebf0 3 bytes [FF, 25, 0A]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\system32\urlmon.dll!URLOpenStreamW + 4                  000007feff19ebf4 2 bytes [65, 00]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2036] C:\Windows\system32\CRYPT32.dll!CertVerifyCertificateChainPolicy   000000000253653c 7 bytes JMP 00000000375e01d8
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                           00000000775e6130 5 bytes JMP 00000000375e0178
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread               000000007760be00 7 bytes [48, B8, 50, 40, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8           000000007760be08 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory              000000007760beb0 6 bytes {JMP QWORD [RIP+0x8b5514a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken                    000000007760bf70 7 bytes [48, B8, D0, 40, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8                000000007760bf78 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                        000000007760bf90 7 bytes [48, B8, C0, 44, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8                    000000007760bf98 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                 000000007760bfa0 7 bytes [48, B8, B0, 42, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8             000000007760bfa8 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                   000000007760bfb0 7 bytes [48, B8, 30, 3F, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8               000000007760bfb8 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection                 000000007760bfd0 7 bytes [48, B8, A0, 3F, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8             000000007760bfd8 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx                  000000007760c020 7 bytes [48, B8, 40, 41, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8              000000007760c028 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx                 000000007760c030 7 bytes [48, B8, 10, 45, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8             000000007760c038 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                           000000007760c060 7 bytes [48, B8, 30, 42, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8                       000000007760c068 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile                000000007760c100 7 bytes [48, B8, 70, 42, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8            000000007760c108 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory               000000007760c230 6 bytes {JMP QWORD [RIP+0x8b74dca]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                         000000007760c280 7 bytes [48, B8, B0, 41, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8                     000000007760c288 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken                   000000007760ccf0 7 bytes [48, B8, F0, 44, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8               000000007760ccf8 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                         000000007760cd40 7 bytes [48, B8, 90, 44, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8                     000000007760cd48 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile            000000007760ce90 7 bytes [48, B8, 90, 42, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8        000000007760ce98 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\system32\kernel32.dll!CopyFileW                         00000000774a8950 6 bytes {JMP QWORD [RIP+0x8c386aa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\system32\kernel32.dll!CreateProcessInternalW            00000000774bdd20 6 bytes {JMP QWORD [RIP+0x8b632da]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\system32\kernel32.dll!CreateProcessW                    00000000774c05e0 6 bytes {JMP QWORD [RIP+0x8ba0a1a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\system32\kernel32.dll!GetThreadSelectorEntry            00000000774f10d0 6 bytes {JMP QWORD [RIP+0x8c4ff2a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\system32\kernel32.dll!MoveFileW                         000000007752f7e0 6 bytes {JMP QWORD [RIP+0x8b7181a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\system32\kernel32.dll!MoveFileA                         000000007752f940 6 bytes {JMP QWORD [RIP+0x8b916ba]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\system32\kernel32.dll!CopyFileA                         0000000077535690 6 bytes {JMP QWORD [RIP+0x8bcb96a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\system32\kernel32.dll!CreateProcessInternalA            000000007753a2f0 6 bytes {JMP QWORD [RIP+0x8b06d0a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\system32\kernel32.dll!CreateProcessA                    000000007753afc0 6 bytes {JMP QWORD [RIP+0x8b4603a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\system32\kernel32.dll!WinExec                           000000007753b500 6 bytes {JMP QWORD [RIP+0x8be5afa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\system32\KERNELBASE.dll!VirtualAlloc                    000007fefd301900 6 bytes {JMP QWORD [RIP+0x11f6fa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\system32\KERNELBASE.dll!HeapCreate + 1                  000007fefd30b2d1 5 bytes {JMP QWORD [RIP+0x1b5d2a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\system32\KERNELBASE.dll!VirtualProtect                  000007fefd3113b0 6 bytes {JMP QWORD [RIP+0x12fc4a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\system32\KERNELBASE.dll!VirtualProtectEx                000007fefd3113e0 6 bytes {JMP QWORD [RIP+0x16fc1a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\system32\KERNELBASE.dll!VirtualAllocEx                  000007fefd333870 6 bytes {JMP QWORD [RIP+0x12d78a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\system32\KERNELBASE.dll!WriteProcessMemory              000007fefd3338a0 6 bytes {JMP QWORD [RIP+0x16d75a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\system32\WS2_32.dll!WSAStartup                          000007feff304ae0 6 bytes {JMP QWORD [RIP+0x61c51a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\system32\WININET.dll!HttpOpenRequestW                   000007fefedb9be0 6 bytes {JMP QWORD [RIP+0xb8741a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\system32\WININET.dll!HttpSendRequestW                   000007fefedc1140 6 bytes {JMP QWORD [RIP+0xc4feba]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\system32\WININET.dll!InternetReadFile                   000007fefedc2b50 6 bytes {JMP QWORD [RIP+0xc0e4aa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\system32\WININET.dll!InternetReadFileExW                000007fefedcec00 6 bytes {JMP QWORD [RIP+0xc223fa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\system32\WININET.dll!HttpSendRequestExW                 000007fefee1cf70 6 bytes {JMP QWORD [RIP+0xc3408a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\system32\WININET.dll!HttpSendRequestA                   000007fefee5e570 6 bytes {JMP QWORD [RIP+0xbd2a8a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\system32\WININET.dll!InternetOpenUrlA                   000007fefeebead0 6 bytes {JMP QWORD [RIP+0xaf252a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\system32\WININET.dll!InternetOpenUrlW                   000007fefeebf780 6 bytes {JMP QWORD [RIP+0xac187a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\system32\WININET.dll!HttpSendRequestExA                 000007fefeee8210 6 bytes {JMP QWORD [RIP+0xb88dea]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\system32\WININET.dll!HttpOpenRequestA                   000007fefeeeace0 6 bytes {JMP QWORD [RIP+0xa7631a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\system32\urlmon.dll!URLDownloadToCacheFileW + 1         000007feff0f1ce1 5 bytes {JMP QWORD [RIP+0x2bf31a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\system32\urlmon.dll!URLDownloadToFileW                  000007feff0f28b0 6 bytes {JMP QWORD [RIP+0x27e74a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\system32\urlmon.dll!URLDownloadToCacheFileA + 1         000007feff19e451 5 bytes {JMP QWORD [RIP+0x632baa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\system32\urlmon.dll!URLDownloadToFileA + 1              000007feff19e5d1 5 bytes {JMP QWORD [RIP+0x1f2a2a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\system32\urlmon.dll!URLOpenBlockingStreamA              000007feff19e720 6 bytes {JMP QWORD [RIP+0x7628da]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\system32\urlmon.dll!URLOpenBlockingStreamW              000007feff19e800 6 bytes {JMP QWORD [RIP+0x7327fa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\system32\urlmon.dll!URLOpenStreamA + 1                  000007feff19eb21 5 bytes {JMP QWORD [RIP+0x6724da]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\system32\urlmon.dll!URLOpenStreamW                      000007feff19ebf0 3 bytes [FF, 25, 0A]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\system32\urlmon.dll!URLOpenStreamW + 4                  000007feff19ebf4 2 bytes [65, 00]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] C:\Windows\system32\CRYPT32.dll!CertVerifyCertificateChainPolicy   000000000124653c 7 bytes JMP 00000000375e01d8
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                           00000000775e6130 5 bytes JMP 00000000375e0178
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread               000000007760be00 7 bytes [48, B8, 50, 40, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8           000000007760be08 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory              000000007760beb0 6 bytes {JMP QWORD [RIP+0x8b5514a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken                    000000007760bf70 7 bytes [48, B8, D0, 40, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8                000000007760bf78 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                        000000007760bf90 7 bytes [48, B8, C0, 44, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8                    000000007760bf98 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                 000000007760bfa0 7 bytes [48, B8, B0, 42, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8             000000007760bfa8 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                   000000007760bfb0 7 bytes [48, B8, 30, 3F, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8               000000007760bfb8 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection                 000000007760bfd0 7 bytes [48, B8, A0, 3F, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8             000000007760bfd8 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx                  000000007760c020 7 bytes [48, B8, 40, 41, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8              000000007760c028 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx                 000000007760c030 7 bytes [48, B8, 10, 45, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8             000000007760c038 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                           000000007760c060 7 bytes [48, B8, 30, 42, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8                       000000007760c068 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile                000000007760c100 7 bytes [48, B8, 70, 42, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8            000000007760c108 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory               000000007760c230 6 bytes {JMP QWORD [RIP+0x8b74dca]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                         000000007760c280 7 bytes [48, B8, B0, 41, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8                     000000007760c288 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken                   000000007760ccf0 7 bytes [48, B8, F0, 44, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8               000000007760ccf8 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                         000000007760cd40 7 bytes [48, B8, 90, 44, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8                     000000007760cd48 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile            000000007760ce90 7 bytes [48, B8, 90, 42, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8        000000007760ce98 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\system32\kernel32.dll!CopyFileW                         00000000774a8950 6 bytes {JMP QWORD [RIP+0x8c386aa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\system32\kernel32.dll!CreateProcessInternalW            00000000774bdd20 6 bytes {JMP QWORD [RIP+0x8b632da]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\system32\kernel32.dll!CreateProcessW                    00000000774c05e0 6 bytes {JMP QWORD [RIP+0x8ba0a1a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\system32\kernel32.dll!GetThreadSelectorEntry            00000000774f10d0 6 bytes {JMP QWORD [RIP+0x8c4ff2a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\system32\kernel32.dll!MoveFileW                         000000007752f7e0 6 bytes {JMP QWORD [RIP+0x8b7181a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\system32\kernel32.dll!MoveFileA                         000000007752f940 6 bytes {JMP QWORD [RIP+0x8b916ba]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\system32\kernel32.dll!CopyFileA                         0000000077535690 6 bytes {JMP QWORD [RIP+0x8bcb96a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\system32\kernel32.dll!CreateProcessInternalA            000000007753a2f0 6 bytes {JMP QWORD [RIP+0x8b06d0a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\system32\kernel32.dll!CreateProcessA                    000000007753afc0 6 bytes {JMP QWORD [RIP+0x8b4603a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\system32\kernel32.dll!WinExec                           000000007753b500 6 bytes {JMP QWORD [RIP+0x8be5afa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\system32\KERNELBASE.dll!VirtualAlloc                    000007fefd301900 6 bytes {JMP QWORD [RIP+0x11f6fa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\system32\KERNELBASE.dll!HeapCreate + 1                  000007fefd30b2d1 5 bytes {JMP QWORD [RIP+0x1b5d2a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\system32\KERNELBASE.dll!VirtualProtect                  000007fefd3113b0 6 bytes {JMP QWORD [RIP+0x12fc4a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\system32\KERNELBASE.dll!VirtualProtectEx                000007fefd3113e0 6 bytes {JMP QWORD [RIP+0x16fc1a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\system32\KERNELBASE.dll!VirtualAllocEx                  000007fefd333870 6 bytes {JMP QWORD [RIP+0x12d78a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\system32\KERNELBASE.dll!WriteProcessMemory              000007fefd3338a0 6 bytes {JMP QWORD [RIP+0x16d75a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\system32\WS2_32.dll!WSAStartup                          000007feff304ae0 6 bytes {JMP QWORD [RIP+0x61c51a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\system32\WININET.dll!HttpOpenRequestW                   000007fefedb9be0 6 bytes {JMP QWORD [RIP+0xb8741a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\system32\WININET.dll!HttpSendRequestW                   000007fefedc1140 6 bytes {JMP QWORD [RIP+0xc4feba]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\system32\WININET.dll!InternetReadFile                   000007fefedc2b50 6 bytes {JMP QWORD [RIP+0xc0e4aa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\system32\WININET.dll!InternetReadFileExW                000007fefedcec00 6 bytes {JMP QWORD [RIP+0xc223fa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\system32\WININET.dll!HttpSendRequestExW                 000007fefee1cf70 6 bytes {JMP QWORD [RIP+0xc3408a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\system32\WININET.dll!HttpSendRequestA                   000007fefee5e570 6 bytes {JMP QWORD [RIP+0xbd2a8a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\system32\WININET.dll!InternetOpenUrlA                   000007fefeebead0 6 bytes {JMP QWORD [RIP+0xaf252a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\system32\WININET.dll!InternetOpenUrlW                   000007fefeebf780 6 bytes {JMP QWORD [RIP+0xac187a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\system32\WININET.dll!HttpSendRequestExA                 000007fefeee8210 6 bytes {JMP QWORD [RIP+0xb88dea]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\system32\WININET.dll!HttpOpenRequestA                   000007fefeeeace0 6 bytes {JMP QWORD [RIP+0xa7631a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\system32\urlmon.dll!URLDownloadToCacheFileW + 1         000007feff0f1ce1 5 bytes JMP 5370000
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\system32\urlmon.dll!URLDownloadToFileW                  000007feff0f28b0 6 bytes {JMP QWORD [RIP+0x27e74a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\system32\urlmon.dll!URLDownloadToCacheFileA + 1         000007feff19e451 5 bytes {JMP QWORD [RIP+0x632baa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\system32\urlmon.dll!URLDownloadToFileA + 1              000007feff19e5d1 5 bytes {JMP QWORD [RIP+0x1f2a2a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\system32\urlmon.dll!URLOpenBlockingStreamA              000007feff19e720 6 bytes JMP 9
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\system32\urlmon.dll!URLOpenBlockingStreamW              000007feff19e800 6 bytes JMP 0
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\system32\urlmon.dll!URLOpenStreamA + 1                  000007feff19eb21 5 bytes {JMP QWORD [RIP+0x6724da]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\system32\urlmon.dll!URLOpenStreamW                      000007feff19ebf0 3 bytes [FF, 25, 0A]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\system32\urlmon.dll!URLOpenStreamW + 4                  000007feff19ebf4 2 bytes [65, 00]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] C:\Windows\system32\CRYPT32.dll!CertVerifyCertificateChainPolicy   000000000124653c 7 bytes JMP 00000000375e01d8
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                           00000000775e6130 5 bytes JMP 00000000375e0178
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread               000000007760be00 7 bytes [48, B8, 50, 40, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8           000000007760be08 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory              000000007760beb0 6 bytes {JMP QWORD [RIP+0x8b5514a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken                    000000007760bf70 7 bytes [48, B8, D0, 40, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8                000000007760bf78 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                        000000007760bf90 7 bytes [48, B8, C0, 44, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8                    000000007760bf98 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                 000000007760bfa0 7 bytes [48, B8, B0, 42, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8             000000007760bfa8 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                   000000007760bfb0 7 bytes [48, B8, 30, 3F, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8               000000007760bfb8 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection                 000000007760bfd0 7 bytes [48, B8, A0, 3F, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8             000000007760bfd8 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx                  000000007760c020 7 bytes [48, B8, 40, 41, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8              000000007760c028 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx                 000000007760c030 7 bytes [48, B8, 10, 45, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8             000000007760c038 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                           000000007760c060 7 bytes [48, B8, 30, 42, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8                       000000007760c068 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile                000000007760c100 7 bytes [48, B8, 70, 42, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8            000000007760c108 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory               000000007760c230 6 bytes {JMP QWORD [RIP+0x8b74dca]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                         000000007760c280 7 bytes [48, B8, B0, 41, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8                     000000007760c288 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken                   000000007760ccf0 7 bytes [48, B8, F0, 44, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8               000000007760ccf8 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                         000000007760cd40 7 bytes [48, B8, 90, 44, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8                     000000007760cd48 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile            000000007760ce90 7 bytes [48, B8, 90, 42, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8        000000007760ce98 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\system32\kernel32.dll!CopyFileW                         00000000774a8950 6 bytes {JMP QWORD [RIP+0x8c386aa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\system32\kernel32.dll!CreateProcessInternalW            00000000774bdd20 6 bytes {JMP QWORD [RIP+0x8b632da]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\system32\kernel32.dll!CreateProcessW                    00000000774c05e0 6 bytes {JMP QWORD [RIP+0x8ba0a1a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\system32\kernel32.dll!GetThreadSelectorEntry            00000000774f10d0 6 bytes {JMP QWORD [RIP+0x8c4ff2a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\system32\kernel32.dll!MoveFileW                         000000007752f7e0 6 bytes {JMP QWORD [RIP+0x8b7181a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\system32\kernel32.dll!MoveFileA                         000000007752f940 6 bytes {JMP QWORD [RIP+0x8b916ba]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\system32\kernel32.dll!CopyFileA                         0000000077535690 6 bytes JMP 9b859785
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\system32\kernel32.dll!CreateProcessInternalA            000000007753a2f0 6 bytes {JMP QWORD [RIP+0x8b06d0a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\system32\kernel32.dll!CreateProcessA                    000000007753afc0 6 bytes {JMP QWORD [RIP+0x8b4603a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\system32\kernel32.dll!WinExec                           000000007753b500 6 bytes {JMP QWORD [RIP+0x8be5afa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\system32\KERNELBASE.dll!VirtualAlloc                    000007fefd301900 6 bytes {JMP QWORD [RIP+0x11f6fa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\system32\KERNELBASE.dll!HeapCreate + 1                  000007fefd30b2d1 5 bytes {JMP QWORD [RIP+0x1b5d2a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\system32\KERNELBASE.dll!VirtualProtect                  000007fefd3113b0 6 bytes {JMP QWORD [RIP+0x12fc4a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\system32\KERNELBASE.dll!VirtualProtectEx                000007fefd3113e0 6 bytes {JMP QWORD [RIP+0x16fc1a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\system32\KERNELBASE.dll!VirtualAllocEx                  000007fefd333870 6 bytes {JMP QWORD [RIP+0x12d78a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\system32\KERNELBASE.dll!WriteProcessMemory              000007fefd3338a0 6 bytes {JMP QWORD [RIP+0x16d75a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\system32\WS2_32.dll!WSAStartup                          000007feff304ae0 6 bytes {JMP QWORD [RIP+0x61c51a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\system32\WININET.dll!HttpOpenRequestW                   000007fefedb9be0 6 bytes {JMP QWORD [RIP+0xb8741a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\system32\WININET.dll!HttpSendRequestW                   000007fefedc1140 6 bytes {JMP QWORD [RIP+0xc4feba]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\system32\WININET.dll!InternetReadFile                   000007fefedc2b50 6 bytes {JMP QWORD [RIP+0xc0e4aa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\system32\WININET.dll!InternetReadFileExW                000007fefedcec00 6 bytes {JMP QWORD [RIP+0xc223fa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\system32\WININET.dll!HttpSendRequestExW                 000007fefee1cf70 6 bytes {JMP QWORD [RIP+0xc3408a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\system32\WININET.dll!HttpSendRequestA                   000007fefee5e570 6 bytes {JMP QWORD [RIP+0xbd2a8a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\system32\WININET.dll!InternetOpenUrlA                   000007fefeebead0 6 bytes {JMP QWORD [RIP+0xaf252a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\system32\WININET.dll!InternetOpenUrlW                   000007fefeebf780 6 bytes JMP 0
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\system32\WININET.dll!HttpSendRequestExA                 000007fefeee8210 6 bytes {JMP QWORD [RIP+0xb88dea]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\system32\WININET.dll!HttpOpenRequestA                   000007fefeeeace0 6 bytes {JMP QWORD [RIP+0xa7631a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\system32\urlmon.dll!URLDownloadToCacheFileW + 1         000007feff0f1ce1 5 bytes {JMP QWORD [RIP+0x2bf31a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\system32\urlmon.dll!URLDownloadToFileW                  000007feff0f28b0 6 bytes {JMP QWORD [RIP+0x27e74a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\system32\urlmon.dll!URLDownloadToCacheFileA + 1         000007feff19e451 5 bytes {JMP QWORD [RIP+0x632baa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\system32\urlmon.dll!URLDownloadToFileA + 1              000007feff19e5d1 5 bytes {JMP QWORD [RIP+0x1f2a2a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\system32\urlmon.dll!URLOpenBlockingStreamA              000007feff19e720 6 bytes JMP 1ebe1ebd
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\system32\urlmon.dll!URLOpenBlockingStreamW              000007feff19e800 6 bytes {JMP QWORD [RIP+0x7327fa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\system32\urlmon.dll!URLOpenStreamA + 1                  000007feff19eb21 5 bytes {JMP QWORD [RIP+0x6724da]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\system32\urlmon.dll!URLOpenStreamW                      000007feff19ebf0 3 bytes [FF, 25, 0A]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\system32\urlmon.dll!URLOpenStreamW + 4                  000007feff19ebf4 2 bytes [65, 00]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] C:\Windows\system32\CRYPT32.dll!CertVerifyCertificateChainPolicy   000000000116653c 7 bytes JMP 00000000375e01d8
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                           00000000775e6130 5 bytes JMP 00000000375e0178
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread               000000007760be00 7 bytes [48, B8, 50, 40, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8           000000007760be08 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory              000000007760beb0 6 bytes {JMP QWORD [RIP+0x8b5514a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken                    000000007760bf70 7 bytes [48, B8, D0, 40, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8                000000007760bf78 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                        000000007760bf90 7 bytes [48, B8, C0, 44, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8                    000000007760bf98 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                 000000007760bfa0 7 bytes [48, B8, B0, 42, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8             000000007760bfa8 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                   000000007760bfb0 7 bytes [48, B8, 30, 3F, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8               000000007760bfb8 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection                 000000007760bfd0 7 bytes [48, B8, A0, 3F, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8             000000007760bfd8 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx                  000000007760c020 7 bytes [48, B8, 40, 41, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8              000000007760c028 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx                 000000007760c030 7 bytes [48, B8, 10, 45, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8             000000007760c038 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                           000000007760c060 7 bytes [48, B8, 30, 42, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8                       000000007760c068 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile                000000007760c100 7 bytes [48, B8, 70, 42, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8            000000007760c108 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory               000000007760c230 6 bytes {JMP QWORD [RIP+0x8b74dca]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                         000000007760c280 7 bytes [48, B8, B0, 41, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8                     000000007760c288 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken                   000000007760ccf0 7 bytes [48, B8, F0, 44, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8               000000007760ccf8 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                         000000007760cd40 7 bytes [48, B8, 90, 44, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8                     000000007760cd48 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile            000000007760ce90 7 bytes [48, B8, 90, 42, 60, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8        000000007760ce98 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\system32\kernel32.dll!CopyFileW                         00000000774a8950 6 bytes {JMP QWORD [RIP+0x8c386aa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\system32\kernel32.dll!CreateProcessInternalW            00000000774bdd20 6 bytes {JMP QWORD [RIP+0x8b632da]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\system32\kernel32.dll!CreateProcessW                    00000000774c05e0 6 bytes {JMP QWORD [RIP+0x8ba0a1a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\system32\kernel32.dll!GetThreadSelectorEntry            00000000774f10d0 6 bytes {JMP QWORD [RIP+0x8c4ff2a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\system32\kernel32.dll!MoveFileW                         000000007752f7e0 6 bytes {JMP QWORD [RIP+0x8b7181a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\system32\kernel32.dll!MoveFileA                         000000007752f940 6 bytes {JMP QWORD [RIP+0x8b916ba]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\system32\kernel32.dll!CopyFileA                         0000000077535690 6 bytes {JMP QWORD [RIP+0x8bcb96a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\system32\kernel32.dll!CreateProcessInternalA            000000007753a2f0 6 bytes {JMP QWORD [RIP+0x8b06d0a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\system32\kernel32.dll!CreateProcessA                    000000007753afc0 6 bytes {JMP QWORD [RIP+0x8b4603a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\system32\kernel32.dll!WinExec                           000000007753b500 6 bytes {JMP QWORD [RIP+0x8be5afa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\system32\KERNELBASE.dll!VirtualAlloc                    000007fefd301900 6 bytes {JMP QWORD [RIP+0x11f6fa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\system32\KERNELBASE.dll!HeapCreate + 1                  000007fefd30b2d1 5 bytes {JMP QWORD [RIP+0x1b5d2a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\system32\KERNELBASE.dll!VirtualProtect                  000007fefd3113b0 6 bytes {JMP QWORD [RIP+0x12fc4a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\system32\KERNELBASE.dll!VirtualProtectEx                000007fefd3113e0 6 bytes {JMP QWORD [RIP+0x16fc1a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\system32\KERNELBASE.dll!VirtualAllocEx                  000007fefd333870 6 bytes {JMP QWORD [RIP+0x12d78a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\system32\KERNELBASE.dll!WriteProcessMemory              000007fefd3338a0 6 bytes {JMP QWORD [RIP+0x16d75a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\system32\WS2_32.dll!WSAStartup                          000007feff304ae0 6 bytes {JMP QWORD [RIP+0x61c51a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\system32\WININET.dll!HttpOpenRequestW                   000007fefedb9be0 6 bytes {JMP QWORD [RIP+0xb8741a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\system32\WININET.dll!HttpSendRequestW                   000007fefedc1140 6 bytes {JMP QWORD [RIP+0xc4feba]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\system32\WININET.dll!InternetReadFile                   000007fefedc2b50 6 bytes {JMP QWORD [RIP+0xc0e4aa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\system32\WININET.dll!InternetReadFileExW                000007fefedcec00 6 bytes {JMP QWORD [RIP+0xc223fa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\system32\WININET.dll!HttpSendRequestExW                 000007fefee1cf70 6 bytes {JMP QWORD [RIP+0xc3408a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\system32\WININET.dll!HttpSendRequestA                   000007fefee5e570 6 bytes {JMP QWORD [RIP+0xbd2a8a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\system32\WININET.dll!InternetOpenUrlA                   000007fefeebead0 6 bytes {JMP QWORD [RIP+0xaf252a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\system32\WININET.dll!InternetOpenUrlW                   000007fefeebf780 6 bytes {JMP QWORD [RIP+0xac187a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\system32\WININET.dll!HttpSendRequestExA                 000007fefeee8210 6 bytes {JMP QWORD [RIP+0xb88dea]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\system32\WININET.dll!HttpOpenRequestA                   000007fefeeeace0 6 bytes {JMP QWORD [RIP+0xa7631a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\system32\urlmon.dll!URLDownloadToCacheFileW + 1         000007feff0f1ce1 5 bytes {JMP QWORD [RIP+0x2bf31a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\system32\urlmon.dll!URLDownloadToFileW                  000007feff0f28b0 6 bytes JMP 0
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\system32\urlmon.dll!URLDownloadToCacheFileA + 1         000007feff19e451 5 bytes {JMP QWORD [RIP+0x632baa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\system32\urlmon.dll!URLDownloadToFileA + 1              000007feff19e5d1 5 bytes {JMP QWORD [RIP+0x1f2a2a]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\system32\urlmon.dll!URLOpenBlockingStreamA              000007feff19e720 6 bytes {JMP QWORD [RIP+0x7628da]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\system32\urlmon.dll!URLOpenBlockingStreamW              000007feff19e800 6 bytes {JMP QWORD [RIP+0x7327fa]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\system32\urlmon.dll!URLOpenStreamA + 1                  000007feff19eb21 5 bytes {JMP QWORD [RIP+0x6724da]}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\system32\urlmon.dll!URLOpenStreamW                      000007feff19ebf0 3 bytes [FF, 25, 0A]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\system32\urlmon.dll!URLOpenStreamW + 4                  000007feff19ebf4 2 bytes [65, 00]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] C:\Windows\system32\CRYPT32.dll!CertVerifyCertificateChainPolicy   00000000011b653c 7 bytes JMP 00000000375e01d8
 
---- User IAT/EAT - GMER 2.2 ----
 
IAT    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenServiceW]        [7fed3bb8508] C:\Program Files (x86)\Google\Chrome\Application\59.0.3071.115\chrome_child.dll
IAT    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!CloseServiceHandle]  [7fed3bb7d60] C:\Program Files (x86)\Google\Chrome\Application\59.0.3071.115\chrome_child.dll
IAT    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenSCManagerW]      [7fed3bb84f0] C:\Program Files (x86)\Google\Chrome\Application\59.0.3071.115\chrome_child.dll
IAT    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!StartServiceW]       [7fed3bb8750] C:\Program Files (x86)\Google\Chrome\Application\59.0.3071.115\chrome_child.dll
IAT    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4172] @ C:\Windows\system32\DWrite.dll[ntdll.dll!NtAlpcConnectPort]      [7fed2b73428] C:\Program Files (x86)\Google\Chrome\Application\59.0.3071.115\chrome_child.dll
IAT    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenServiceW]        [7fed3bb8508] C:\Program Files (x86)\Google\Chrome\Application\59.0.3071.115\chrome_child.dll
IAT    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!CloseServiceHandle]  [7fed3bb7d60] C:\Program Files (x86)\Google\Chrome\Application\59.0.3071.115\chrome_child.dll
IAT    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenSCManagerW]      [7fed3bb84f0] C:\Program Files (x86)\Google\Chrome\Application\59.0.3071.115\chrome_child.dll
IAT    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!StartServiceW]       [7fed3bb8750] C:\Program Files (x86)\Google\Chrome\Application\59.0.3071.115\chrome_child.dll
IAT    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4520] @ C:\Windows\system32\DWrite.dll[ntdll.dll!NtAlpcConnectPort]      [7fed2b73428] C:\Program Files (x86)\Google\Chrome\Application\59.0.3071.115\chrome_child.dll
IAT    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenServiceW]        [7fed3bb8508] C:\Program Files (x86)\Google\Chrome\Application\59.0.3071.115\chrome_child.dll
IAT    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!CloseServiceHandle]  [7fed3bb7d60] C:\Program Files (x86)\Google\Chrome\Application\59.0.3071.115\chrome_child.dll
IAT    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenSCManagerW]      [7fed3bb84f0] C:\Program Files (x86)\Google\Chrome\Application\59.0.3071.115\chrome_child.dll
IAT    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!StartServiceW]       [7fed3bb8750] C:\Program Files (x86)\Google\Chrome\Application\59.0.3071.115\chrome_child.dll
IAT    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4988] @ C:\Windows\system32\DWrite.dll[ntdll.dll!NtAlpcConnectPort]      [7fed2b73428] C:\Program Files (x86)\Google\Chrome\Application\59.0.3071.115\chrome_child.dll
IAT    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenServiceW]        [7fed3bb8508] C:\Program Files (x86)\Google\Chrome\Application\59.0.3071.115\chrome_child.dll
IAT    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!CloseServiceHandle]  [7fed3bb7d60] C:\Program Files (x86)\Google\Chrome\Application\59.0.3071.115\chrome_child.dll
IAT    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenSCManagerW]      [7fed3bb84f0] C:\Program Files (x86)\Google\Chrome\Application\59.0.3071.115\chrome_child.dll
IAT    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!StartServiceW]       [7fed3bb8750] C:\Program Files (x86)\Google\Chrome\Application\59.0.3071.115\chrome_child.dll
IAT    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4712] @ C:\Windows\system32\DWrite.dll[ntdll.dll!NtAlpcConnectPort]      [7fed2b73428] C:\Program Files (x86)\Google\Chrome\Application\59.0.3071.115\chrome_child.dll
 
---- Registry - GMER 2.2 ----
Reg    HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\d05349606db2                                                          
Reg    HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\d05349606db2 (not active ControlSet)                                      
 
---- Disk sectors - GMER 2.2 ----
Disk   \Device\Harddisk0\DR0                                                                                                                unknown MBR code
 
---- Files - GMER 2.2 ----
File   C:\Users\Main Account\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00020d                                                   136975 bytes
File   C:\Users\Main Account\AppData\Roaming\Microsoft\Windows\Cookies\EZT1X452.txt                                                         0 bytes
 
---- EOF - GMER 2.2 ----

Edited by hamluis, 11 July 2017 - 06:27 PM.


#3 dareynedx

dareynedx
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:03:44 PM

Posted 11 July 2017 - 07:05 PM

RKill Log

 

Rkill 2.8.4 by Lawrence Abrams (Grinler)
Copyright 2008-2017 BleepingComputer.com
More Information about Rkill can be found at this link:
 
Program started at: 07/12/2017 08:05:07 PM in x64 mode. (Safe Mode)
Windows Version: Windows 7 Home Premium Service Pack 1
 
Checking for Windows services to stop:
 
 * No malware services found to stop.
 
Checking for processes to terminate:
 
 * No malware processes found to kill.
 
Checking Registry for malware related settings:
 
 * No issues found in the Registry.
 
Resetting .EXE, .COM, & .BAT associations in the Windows Registry.
 
Performing miscellaneous checks:
 
 * No issues found.
 
Checking Windows Service Integrity: 
 
 * COM+ Event System (EventSystem) is not Running.
   Startup Type set to: Automatic
 
 * Security Center (wscsvc) is not Running.
   Startup Type set to: Automatic (Delayed Start)
 
 * Windows Update (wuauserv) is not Running.
   Startup Type set to: Automatic (Delayed Start)
 
 * TBS [Missing Service]
 
Searching for Missing Digital Signatures: 
 
 * No issues found.
 
Checking HOSTS File: 
 
 * No issues found.
 
Program finished at: 07/12/2017 08:06:12 PM


#4 dareynedx

dareynedx
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:03:44 PM

Posted 11 July 2017 - 07:21 PM

HijackThis Log
 
Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 8:22:10 PM, on 7/12/2017
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18698)
 
 
Boot mode: Safe mode with network support
 
Running processes:
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\Repair_Windows.exe
C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\WR_Tray_Icon.exe
C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe
C:\Users\Main Account\Downloads\HijackThis.exe
 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: True Key Helper - {0F4B8786-5502-4803-8EBC-F652A1153BB6} - C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_40\bin\ssv.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_40\bin\jp2ssv.dll
O3 - Toolbar: True Key - {4BAAC1B8-0800-42C9-8FA6-08B211F356B8} - C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll
O4 - HKLM\..\Run: [USB3MON] "C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [IseUI] C:\Program Files (x86)\COMODO\Internet Security Essentials\vkise.exe
O4 - HKCU\..\Run: [iCloudServices] C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07122017201158345\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User '?')
O4 - HKUS\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07122017201158345\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User '?')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07122017201158502\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User '?')
O4 - HKUS\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07122017201158502\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User '?')
O4 - HKUS\S-1-5-21-1617228817-3034643913-1761609342-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-07122017201158619\..\Run: [iCloudServices] C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (User '?')
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device Service - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel® Content Protection HECI Service (cphs) - Intel Corporation - C:\Windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: COMODO Dragon Update Service (DragonUpdater) - Comodo - C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Intel® Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: Service Installer TrueKey (InstallerService) - Unknown owner - C:\Program Files\TrueKey\Mcafee.TrueKey.InstallerService.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: isesrv - COMODO - C:\Program Files (x86)\COMODO\Internet Security Essentials\isesrv.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Malwarebytes Service (MBAMService) - Malwarebytes - C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files (x86)\McAfee Security Scan\3.11.500\McCHSvc.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Intel Security True Key (TrueKey) - McAfee, Inc. - C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe
O23 - Service: Intel Security True Key Scheduler (TrueKeyScheduler) - McAfee, Inc. - C:\Program Files\TrueKey\McTkSchedulerService.exe
O23 - Service: TrueKeyServiceHelper - McAfee, Inc. - C:\Program Files\TrueKey\McAfee.TrueKey.ServiceHelper.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
 
--
End of file - 9147 bytes


#5 dareynedx

dareynedx
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:03:44 PM

Posted 11 July 2017 - 07:27 PM

 
 
 
 
 
ListParts by Farbar Version: 31-07-2014
Ran by Main Account (administrator) on 12-07-2017 at 20:26:28
Windows 7 (X64)
Running From: C:\Users\Main Account\Downloads
Language: English (United States)
************************************************************
 
========================= Memory info ====================== 
 
Percentage of memory in use: 51%
Total physical RAM: 6036.28 MB
Available physical RAM: 2901.59 MB
Total Pagefile: 12070.74 MB
Available Pagefile: 8451.93 MB
Total Virtual: 8192 MB
Available Virtual: 8191.92 MB
 
======================= Partitions =========================
 
1 Drive c: (Windows8_OS) (Fixed) (Total:423.84 GB) (Free:355.29 GB) NTFS ==>[System with boot components (obtained from reading drive)]
2 Drive d: (LENOVO) (Fixed) (Total:25 GB) (Free:23.02 GB) NTFS
3 Drive e: (Mar 23 2015) (CDROM) (Total:0.56 GB) (Free:0.21 GB) UDF
 
  Disk ###  Status         Size     Free     Dyn  Gpt
  --------  -------------  -------  -------  ---  ---
  Disk 0    Online          465 GB      0 B        *
 
Partitions of Disk 0:
===============
 
Disk ID: {11B7E22D-C8CF-40ED-88B1-7504E5B60521}
 
  Partition ###  Type              Size     Offset
  -------------  ----------------  -------  -------
  Partition 1    Recovery          1000 MB  1024 KB
  Partition 2    System (partition with boot components)             260 MB  1001 MB
  Partition 3    OEM               1000 MB  1261 MB
  Partition 4    Reserved           128 MB  2261 MB
  Partition 5    Primary            423 GB  2389 MB
  Partition 6    Primary             25 GB   426 GB
  Partition 7    Recovery            14 GB   451 GB
 
======================================================================================================
 
Disk: 0
Partition 1
Type    : de94bba4-06d1-4d40-a16a-bfd50179d6ac
Hidden  : Yes
Required: Yes
Attrib  : 0X8000000000000001
 
  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 3         WINRE_DRV    NTFS   Partition   1000 MB  Healthy    Hidden  
 
======================================================================================================
 
Disk: 0
Partition 2
Type    : c12a7328-f81f-11d2-ba4b-00a0c93ec93b
Hidden  : Yes
Required: Yes
Attrib  : 0X8000000000000001
 
  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 4         SYSTEM_DRV   FAT32  Partition    260 MB  Healthy    System (partition with boot components)  
 
======================================================================================================
 
Disk: 0
Partition 3
Type    : bfbfafe7-a34f-448a-9a5b-6213eb736c22
Hidden  : Yes
Required: Yes
Attrib  : 0X8000000000000001
 
There is no volume associated with this partition.
 
======================================================================================================
 
Disk: 0
Partition 4
Type    : e3c9e316-0b5c-4db8-817d-f92df00215ae
Hidden  : Yes
Required: No
Attrib  : 0X8000000000000000
 
There is no volume associated with this partition.
 
======================================================================================================
 
Disk: 0
Partition 5
Type    : ebd0a0a2-b9e5-4433-87c0-68b6b72699c7
Hidden  : No
Required: No
Attrib  : 0000000000000000
 
  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 1     C   Windows8_OS  NTFS   Partition    423 GB  Healthy    Boot    
 
======================================================================================================
 
Disk: 0
Partition 6
Type    : ebd0a0a2-b9e5-4433-87c0-68b6b72699c7
Hidden  : No
Required: No
Attrib  : 0000000000000000
 
  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 2     D   LENOVO       NTFS   Partition     25 GB  Healthy            
 
======================================================================================================
 
Disk: 0
Partition 7
Type    : de94bba4-06d1-4d40-a16a-bfd50179d6ac
Hidden  : Yes
Required: Yes
Attrib  : 0X8000000000000001
 
  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 5         PBR_DRV      NTFS   Partition     14 GB  Healthy    Hidden  
 
======================================================================================================
============================== MBR Partition Table ==================
 
==============================
Partitions of Disk 0:
===============
Disk ID: BCD71FA6
 
Partition : GPT Partition Type
 
Firmware Boot Manager
---------------------
identifier              {fwbootmgr}
displayorder            {a4571a4f-d23c-11e4-81f6-806e6f6e6963}
                        {a4571a50-d23c-11e4-81f6-806e6f6e6963}
                        {a4571a4e-d23c-11e4-81f6-806e6f6e6963}
                        {bootmgr}
                        {ec735037-d1a1-11e4-825f-806e6f6e6963}
                        {aca46df9-b1ea-11e4-97a2-806e6f6e6963}
                        {aca46dfa-b1ea-11e4-97a2-806e6f6e6963}
                        {aca46dfb-b1ea-11e4-97a2-806e6f6e6963}
timeout                 2
 
Windows Boot Manager
--------------------
identifier              {bootmgr}
device                  partition=\Device\HarddiskVolume2
path                    \EFI\Microsoft\Boot\bootmgfw.efi
description             Windows Boot Manager
locale                  en-US
inherit                 {globalsettings}
default                 {current}
resumeobject            {43f770bd-b1e3-11e4-8258-68f7287cdb64}
displayorder            {current}
toolsdisplayorder       {memdiag}
timeout                 30
 
Firmware Application (101fffff)
-------------------------------
identifier              {a4571a4e-d23c-11e4-81f6-806e6f6e6963}
description             Network Boot: Realtek PXE B01 D00
 
Firmware Application (101fffff)
-------------------------------
identifier              {a4571a4f-d23c-11e4-81f6-806e6f6e6963}
description             SATA HDD    : ST500LT012-1DG142               
 
Firmware Application (101fffff)
-------------------------------
identifier              {a4571a50-d23c-11e4-81f6-806e6f6e6963}
description             SATA ODD    : MATbleepA DVD-RAM UJ8FBS         
 
Firmware Application (101fffff)
-------------------------------
identifier              {aca46df9-b1ea-11e4-97a2-806e6f6e6963}
description             EFI USB Device
 
Firmware Application (101fffff)
-------------------------------
identifier              {aca46dfa-b1ea-11e4-97a2-806e6f6e6963}
description             EFI DVD/CDROM
 
Firmware Application (101fffff)
-------------------------------
identifier              {aca46dfb-b1ea-11e4-97a2-806e6f6e6963}
description             EFI Network
 
Firmware Application (101fffff)
-------------------------------
identifier              {ec735037-d1a1-11e4-825f-806e6f6e6963}
device                  partition=\Device\HarddiskVolume3
path                    \EFI\Microsoft\Boot\LrsBootMgr.efi
description             Lenovo Recovery System
 
Windows Boot Loader
-------------------
identifier              {43f770bb-b1e3-11e4-8258-68f7287cdb64}
device                  ramdisk=[\Device\HarddiskVolume1]\Recovery\WindowsRE\Winre.wim,{43f770bc-b1e3-11e4-8258-68f7287cdb64}
path                    \windows\system32\winload.efi
description             Windows Recovery Environment
locale                  en-us
inherit                 {bootloadersettings}
custom:15000065         3
custom:15000066         3
osdevice                ramdisk=[\Device\HarddiskVolume1]\Recovery\WindowsRE\Winre.wim,{43f770bc-b1e3-11e4-8258-68f7287cdb64}
systemroot              \windows
nx                      OptIn
custom:250000c2         1
winpe                   Yes
 
Windows Boot Loader
-------------------
identifier              {current}
device                  partition=C:
path                    \Windows\system32\winload.efi
description             Windows 7
locale                  en-US
inherit                 {bootloadersettings}
recoverysequence        {43f770bf-b1e3-11e4-8258-68f7287cdb64}
recoveryenabled         Yes
osdevice                partition=C:
systemroot              \Windows
resumeobject            {43f770bd-b1e3-11e4-8258-68f7287cdb64}
nx                      OptOut
bootlog                 No
 
Windows Boot Loader
-------------------
identifier              {43f770bf-b1e3-11e4-8258-68f7287cdb64}
device                  ramdisk=[C:]\Recovery\43f770bf-b1e3-11e4-8258-68f7287cdb64\Winre.wim,{43f770c0-b1e3-11e4-8258-68f7287cdb64}
path                    \windows\system32\winload.efi
description             Windows Recovery Environment
inherit                 {bootloadersettings}
osdevice                ramdisk=[C:]\Recovery\43f770bf-b1e3-11e4-8258-68f7287cdb64\Winre.wim,{43f770c0-b1e3-11e4-8258-68f7287cdb64}
systemroot              \windows
nx                      OptIn
winpe                   Yes
 
Resume from Hibernate
---------------------
identifier              {43f770bd-b1e3-11e4-8258-68f7287cdb64}
device                  partition=C:
path                    \Windows\system32\winresume.efi
description             Windows Resume Application
locale                  en-US
inherit                 {resumeloadersettings}
filedevice              partition=C:
filepath                \hiberfil.sys
debugoptionenabled      No
 
Windows Memory Tester
---------------------
identifier              {memdiag}
device                  partition=\Device\HarddiskVolume2
path                    \EFI\Microsoft\Boot\memtest.efi
description             Windows Memory Diagnostic
locale                  en-US
inherit                 {globalsettings}
badmemoryaccess         Yes
 
EMS Settings
------------
identifier              {emssettings}
bootems                 Yes
 
Debugger Settings
-----------------
identifier              {dbgsettings}
debugtype               Serial
debugport               1
baudrate                115200
 
RAM Defects
-----------
identifier              {badmemory}
 
Global Settings
---------------
identifier              {globalsettings}
inherit                 {dbgsettings}
                        {emssettings}
                        {badmemory}
 
Boot Loader Settings
--------------------
identifier              {bootloadersettings}
inherit                 {globalsettings}
                        {hypervisorsettings}
 
Hypervisor Settings
-------------------
identifier              {hypervisorsettings}
hypervisordebugtype     Serial
hypervisordebugport     1
hypervisorbaudrate      115200
 
Resume Loader Settings
----------------------
identifier              {resumeloadersettings}
inherit                 {globalsettings}
 
Device options
--------------
identifier              {43f770bc-b1e3-11e4-8258-68f7287cdb64}
description             Windows Recovery
ramdisksdidevice        partition=\Device\HarddiskVolume1
ramdisksdipath          \Recovery\WindowsRE\boot.sdi
 
Device options
--------------
identifier              {43f770c0-b1e3-11e4-8258-68f7287cdb64}
description             Ramdisk Options
ramdisksdidevice        partition=C:
ramdisksdipath          \Recovery\43f770bf-b1e3-11e4-8258-68f7287cdb64\boot.sdi
 
Setup Ramdisk Options
---------------------
identifier              {ramdiskoptions}
description             Ramdisk options
ramdisksdidevice        boot
ramdisksdipath          \boot\boot.sdi
 
 
****** End Of Log ****** 


#6 dareynedx

dareynedx
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:03:44 PM

Posted 11 July 2017 - 07:37 PM

Startup List

 

StartupList report, 7/12/2017, 8:37:42 PM
StartupList version: 1.52.2
Started from : C:\Users\Main Account\Downloads\HijackThis.EXE
Detected: Windows 7 SP1 (WinNT 6.00.3505)
Detected: Internet Explorer v11.0 (11.00.9600.18698)
* Using default options
* Showing rarely important sections
==================================================
 
Running processes:
 
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\WR_Tray_Icon.exe
C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe
C:\Users\Main Account\Downloads\HijackThis.exe
 
--------------------------------------------------
 
Checking Windows NT UserInit:
 
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = userinit.exe
 
--------------------------------------------------
 
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
 
USB3MON = "C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
SunJavaUpdateSched = "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
Adobe ARM = "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
IseUI = C:\Program Files (x86)\COMODO\Internet Security Essentials\vkise.exe
 
--------------------------------------------------
 
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
 
iCloudServices = C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
 
--------------------------------------------------
 
File association entry for .HTA:
HKEY_CLASSES_ROOT\htafile\shell\open\command
 
(Default) = C:\Windows\SysWOW64\mshta.exe "%1" %*
 
--------------------------------------------------
 
Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)
 
[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
StubPath = %SystemRoot%\system32\unregmp2.exe /ShowWMP
 
[{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *
StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
 
[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
 
[{6BF52A52-394A-11d3-B153-00C04F79FAA6}] *
StubPath = %SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI
 
[{89820200-ECBD-11cf-8B85-00AA005B4340}] *
StubPath = regsvr32.exe /s /n /i:U shell32.dll
 
[{89B4C1CD-B018-4511-B0A1-5476DBF70820}] *
StubPath = C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
 
[{8A69D345-D564-463c-AFF1-A69D9E530F96}] *
StubPath = "C:\Program Files (x86)\Google\Chrome\Application\42.0.2311.135\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
 
--------------------------------------------------
 
Shell & screensaver key from C:\Windows\SYSTEM.INI:
 
Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*
 
Shell & screensaver key from Registry:
 
Shell=explorer.exe
SCRNSAVE.EXE=*Registry value not found*
drivers=*Registry value not found*
 
Policies Shell key:
 
HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*
 
--------------------------------------------------
 
Checking for EXPLORER.EXE instances:
 
C:\Windows\Explorer.exe: PRESENT!
 
C:\Explorer.exe: not present
C:\Windows\Explorer\Explorer.exe: not present
C:\Windows\System\Explorer.exe: not present
C:\Windows\System32\Explorer.exe: not present
C:\Windows\Command\Explorer.exe: not present
C:\Windows\Fonts\Explorer.exe: not present
 
--------------------------------------------------
 
Checking for superhidden extensions:
 
.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: *Registry key not found*
.shb: *Registry key not found*
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden
 
--------------------------------------------------
 
Verifying REGEDIT.EXE integrity:
 
- Regedit.exe found in C:\Windows
- .reg open command is normal (regedit.exe %1)
- Company name OK: 'Microsoft Corporation'
- Original filename NOT OK: 'REGEDIT.EXE.MUI'
- File description: 'Registry Editor'
 
Registry check failed!
 
--------------------------------------------------
 
Enumerating Browser Helper Objects:
 
True Key Helper - C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll - {0F4B8786-5502-4803-8EBC-F652A1153BB6}
(no name) - C:\Program Files (x86)\Java\jre1.8.0_40\bin\ssv.dll - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
(no name) - C:\Program Files (x86)\Java\jre1.8.0_40\bin\jp2ssv.dll - {DBC80044-A445-435b-BC74-9C25C1C588A9}
 
--------------------------------------------------
 
Enumerating Task Scheduler jobs:
 
Tweaking.com - Windows Repair Tray Icon.job
 
--------------------------------------------------
 
Enumerating Winsock LSP files:
 
NameSpace #1: C:\Windows\system32\NLAapi.dll
NameSpace #2: C:\Windows\system32\napinsp.dll
NameSpace #3: C:\Windows\system32\pnrpnsp.dll
NameSpace #4: C:\Windows\system32\pnrpnsp.dll
NameSpace #7: C:\Windows\system32\wshbth.dll
NameSpace #8: C:\Program Files (x86)\Bonjour\mdnsNSP.dll
 
--------------------------------------------------
 
Enumerating Windows NT/2000/XP services
 
Adobe Acrobat Update Service: "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe" (autostart)
Apple Mobile Device Service: "C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe" (autostart)
@%SystemRoot%\system32\audiosrv.dll,-204: %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted (autostart)
@%SystemRoot%\system32\audiosrv.dll,-200: %SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted (autostart)
@%SystemRoot%\system32\bfe.dll,-1001: %systemroot%\system32\svchost.exe -k LocalServiceNoNetwork (autostart)
@%SystemRoot%\system32\qmgr.dll,-1000: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Bonjour Service: "C:\Program Files\Bonjour\mDNSResponder.exe" (autostart)
Microsoft .NET Framework NGEN v4.0.30319_X86: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (autostart)
Microsoft .NET Framework NGEN v4.0.30319_X64: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe (autostart)
@%SystemRoot%\system32\cryptsvc.dll,-1001: %SystemRoot%\system32\svchost.exe -k NetworkService (autostart)
@oleres.dll,-5012: %SystemRoot%\system32\svchost.exe -k DcomLaunch (autostart)
@%SystemRoot%\system32\dhcpcore.dll,-100: %SystemRoot%\system32\svchost.exe -k LocalServiceNetworkRestricted (autostart)
@%SystemRoot%\system32\UtcResources.dll,-3001: %SystemRoot%\System32\svchost.exe -k utcsvc (autostart)
@%SystemRoot%\System32\dnsapi.dll,-101: %SystemRoot%\system32\svchost.exe -k NetworkService (autostart)
@%systemroot%\system32\dps.dll,-500: %SystemRoot%\System32\svchost.exe -k LocalServiceNoNetwork (autostart)
COMODO Dragon Update Service: "C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe" (autostart)
@%SystemRoot%\system32\wevtsvc.dll,-200: %SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted (autostart)
@comres.dll,-2450: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
@%systemroot%\system32\FntCache.dll,-100: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
@gpapi.dll,-112: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Google Update Service (gupdate): "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc (autostart)
Intel® Rapid Storage Technology: "C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe" (autostart)
@%SystemRoot%\system32\ikeext.dll,-501: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Service Installer TrueKey: C:\Program Files\TrueKey\Mcafee.TrueKey.InstallerService.exe (autostart)
@%SystemRoot%\system32\iphlpsvc.dll,-500: %SystemRoot%\System32\svchost.exe -k NetSvcs (autostart)
isesrv: "C:\Program Files (x86)\COMODO\Internet Security Essentials\isesrv.exe" -service (autostart)
@%systemroot%\system32\srvsvc.dll,-100: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
@%systemroot%\system32\wkssvc.dll,-100: %SystemRoot%\System32\svchost.exe -k NetworkService (autostart)
Link-Layer Topology Discovery Mapper I/O Driver: system32\DRIVERS\lltdio.sys (autostart)
@%SystemRoot%\system32\lmhsvc.dll,-101: %SystemRoot%\system32\svchost.exe -k LocalServiceNetworkRestricted (autostart)
@%systemroot%\system32\drivers\luafv.sys,-100: \SystemRoot\system32\drivers\luafv.sys (autostart)
Malwarebytes Service: "C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe" (autostart)
@%systemroot%\system32\mmcss.dll,-100: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
@%SystemRoot%\system32\FirewallAPI.dll,-23090: %SystemRoot%\system32\svchost.exe -k LocalServiceNoNetwork (autostart)
@%SystemRoot%\System32\nlasvc.dll,-1: %SystemRoot%\System32\svchost.exe -k NetworkService (autostart)
@%SystemRoot%\system32\nsisvc.dll,-200: %systemroot%\system32\svchost.exe -k LocalService (autostart)
@%SystemRoot%\system32\pcasvc.dll,-1: %systemroot%\system32\svchost.exe -k LocalSystemNetworkRestricted (autostart)
PEAUTH: system32\drivers\peauth.sys (autostart)
@%SystemRoot%\system32\umpnpmgr.dll,-100: %SystemRoot%\system32\svchost.exe -k DcomLaunch (autostart)
@%SystemRoot%\system32\umpo.dll,-100: %SystemRoot%\system32\svchost.exe -k DcomLaunch (autostart)
@%systemroot%\system32\profsvc.dll,-300: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
@%windir%\system32\RpcEpMap.dll,-1001: %SystemRoot%\system32\svchost.exe -k RPCSS (autostart)
@oleres.dll,-5010: %SystemRoot%\system32\svchost.exe -k rpcss (autostart)
Link-Layer Topology Discovery Responder: system32\DRIVERS\rspndr.sys (autostart)
@%SystemRoot%\system32\samsrv.dll,-1: %SystemRoot%\system32\lsass.exe (autostart)
@%SystemRoot%\system32\schedsvc.dll,-100: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
@%SystemRoot%\system32\Sens.dll,-200: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
@%SystemRoot%\System32\shsvcs.dll,-12288: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
@%systemroot%\system32\spoolsv.exe,-1: %SystemRoot%\System32\spoolsv.exe (autostart)
@%SystemRoot%\system32\sppsvc.exe,-101: %SystemRoot%\system32\sppsvc.exe (autostart)
@%SystemRoot%\system32\sysmain.dll,-1000: %systemroot%\system32\svchost.exe -k LocalSystemNetworkRestricted (autostart)
TCP/IP Registry Compatibility: System32\drivers\tcpipreg.sys (autostart)
@%SystemRoot%\System32\themeservice.dll,-8192: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
@%SystemRoot%\system32\trkwks.dll,-1: %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted (autostart)
Intel Security True Key: "C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe" (autostart)
Intel Security True Key Scheduler: "C:\Program Files\TrueKey\McTkSchedulerService.exe" (autostart)
TrueKeyServiceHelper: "C:\Program Files\TrueKey\McAfee.TrueKey.ServiceHelper.exe" (autostart)
@%SystemRoot%\system32\dwm.exe,-2000: %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted (autostart)
@%ProgramFiles%\Windows Defender\MsMpRes.dll,-103: %SystemRoot%\System32\svchost.exe -k secsvcs (autostart)
@%Systemroot%\system32\wbem\wmisvc.dll,-205: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
@%SystemRoot%\System32\wlansvc.dll,-257: %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted (autostart)
@%SystemRoot%\System32\wscsvc.dll,-200: %SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted (autostart)
@%systemroot%\system32\SearchIndexer.exe,-103: %systemroot%\system32\SearchIndexer.exe /Embedding (autostart)
@%systemroot%\system32\wuaueng.dll,-105: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
 
 
--------------------------------------------------
 
Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*
 
Windows NT checkdisk command:
BootExecute = autocheck autochk *
 
Windows NT 'Wininit.ini':
PendingFileRenameOperations: C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\msvbvm60.dll||C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\msvbvm60.dll||C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\msvbvm60.dll
 
 
--------------------------------------------------
 
Enumerating ShellServiceObjectDelayLoad items:
 
WebCheck: *Registry key not found*
 
--------------------------------------------------
End of report, 13,594 bytes
Report generated in 0.796 seconds
 
Command line options:
   /verbose  - to add additional info on each section
   /complete - to include empty sections and unsuspicious data
   /full     - to include several rarely-important sections
   /force9x  - to include Win9x-only startups even if running on WinNT
   /forcent  - to include WinNT-only startups even if running on Win9x
   /forceall - to include all Win9x and WinNT startups, regardless of platform
   /history  - to list version history only


#7 dareynedx

dareynedx
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:03:44 PM

Posted 12 July 2017 - 09:35 PM

Patiently awaiting the input of the professionals. In the meantime,can anyone chime in on these HitMan Pro early warning analysis logs? It seems suspicious that lsass.exe would be listening for inbound network connections with a paren name of wininit.exe.
 
Properties
Name lsass.exe
Location C:\Windows\System32
Size 30.0 KB
Time 4.5 days ago (2017-07-09 09:30:56)
Entropy 5.0
Product Microsoft® Windows® Operating System
Publisher Microsoft Corporation
Description Local Security Authority Process
Version 6.1.7601.23816
Copyright © Microsoft Corporation. All rights reserved.
Service VaultSvc
Parent Name C:\Windows\system32\wininit.exe
LanguageID 1033
SHA-256 B210C542A1CF930B69E5BB018464E49FA96FA08B2FB06DB4EE2924C3B86034CC
 
Scoring (13.0)
This program is actively listening for inbound network connections.
Starts automatically as a service during system bootup.
Time indicates that the file appeared recently on this computer.
The file is in use by one or more active processes.
The file is located in a folder that contains core operating system files from Windows. This is not typical for most programs and is only common to system tools, drivers and hacking utilities.
The file is protected by Windows File Protection (WFP). This is typical for critical Windows system files.
 
Memory
PID 640
 
Startup
HKLM\SYSTEM\CurrentControlSet\Services\EFS\
HKLM\SYSTEM\CurrentControlSet\Services\KeyIso\
HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\
HKLM\SYSTEM\CurrentControlSet\Services\ProtectedStorage\
HKLM\SYSTEM\CurrentControlSet\Services\SamSs\
HKLM\SYSTEM\CurrentControlSet\Services\VaultSvc\
 
Network Ports
0.0.0.0:49154
 
FINALLY,---------------------- This also seems suspicious. It is loaded as a custom SSP from a registry folder with a duplicate file path (/securityproviders/securityproviders)
 
Properties
Name credssp.dll
Location C:\Windows\System32
Size 21.5 KB
Time 4.5 days ago (2017-07-09 09:30:55)
Entropy 5.5
Product Microsoft® Windows® Operating System
Publisher Microsoft Corporation
Description Credential Delegation Security Package
Version 6.1.7601.23816
Copyright © Microsoft Corporation. All rights reserved.
LanguageID 1033
SHA-256 56AE72C53B78EDDBC7EC9DE907B743B5E3594C99602499DF56AC843B32371C80
 
Scoring (15.0)
Loads as a custom security support provider (SSP). Malware tends to start this way.
Program starts automatically without user intervention.
Time indicates that the file appeared recently on this computer.
The file is in use by one or more active processes.
The file is located in a folder that contains core operating system files from Windows. This is not typical for most programs and is only common to system tools, drivers and hacking utilities.
The file is protected by Windows File Protection (WFP). This is typical for critical Windows system files.
 
Startup
HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders

Edited by dareynedx, 12 July 2017 - 09:38 PM.


#8 King_Yoshi

King_Yoshi

  • Malware Study Hall Senior
  • 1,349 posts
  • OFFLINE
  •  
  • Local time:03:44 PM

Posted 15 July 2017 - 08:21 PM

Hello dareynedx,

My name is King_Yoshi and I will be helping you today.

If at any point you have any comments, questions or concerns, please do not hesitate to post them.

Allow me some time to review your post.

In the meantime please review the following rules.

Basic Rules:

1. First, I would like to inform you that most of us here at Bleeping Computer offer our expert assistance out of the goodness of our hearts.
Please try to match our commitment to you with your patience toward us.
I try to reply as soon as possible. (Typically every 24-48.)

2. Please do not run any tools or take any steps other than those I provide for you.
I need to be certain about the state of your computer in order to provide appropriate and effective steps for you to take.
If at any point you would prefer to take your own steps please let me know, I will not be offended. I would be happy to focus on the many others who are waiting in line for assistance.

3. Please perform all steps in the order they are listed, in each set of instructions. Some steps may be a bit complicated.
If things are not clear, be sure to stop and let me know.

4. Please copy and paste all logs into your post, unless directed otherwise.
Please do not re-run any programs I suggest.
If you encounter problems simply stop and tell me.

5. When you post your reply, use the 2ni7laq.jpg button.

6. In the upper right hand corner of the topic you will see the 15n7fnk.jpg button.
Please click on this then choose "Immediate E-Mail notification" and then "Proceed" and you will be sent an email once I have posted a response.

7. If you do not reply to your topic after 3 days I will bump the post. After 5 days of no reply we will assume it has been abandoned and I will close it.

8. When your computer is clean I will alert you of such.
I will also provide for you detailed information about how you can prevent and combat future infections.



#9 King_Yoshi

King_Yoshi

  • Malware Study Hall Senior
  • 1,349 posts
  • OFFLINE
  •  
  • Local time:03:44 PM

Posted 17 July 2017 - 09:13 AM

Hello dareynedx,
 

I am still working on analyzing the many logs you posted.

I understand you have been patiently awaiting help and would like to know if you are still with us.



#10 King_Yoshi

King_Yoshi

  • Malware Study Hall Senior
  • 1,349 posts
  • OFFLINE
  •  
  • Local time:03:44 PM

Posted 18 July 2017 - 08:55 AM

Hello dareynedx,

:step1: Could you kindly clarify what symptoms lead you to believe you were infected?
What did you mean by "users with special permissions to security & system settings folders with SIDs assigned to windows remote connection users"?

:step2: Did you install the TrueKey Password Filter?

If you did, we can keep it. If not, I could provide directions to have it uninstalled.

 

:step3: Going over your logs I noticed that you have µTorrent installed.

  • Avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs.
  • They are a security risk which can make your computer susceptible to a wide variety of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites.
  • Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users.
  • The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications.

It is pretty much certain that if you continue to use P2P programs, you will get infected again.
I would recommend that you uninstall µTorrent, however that choice is up to you. If you choose to remove these programs, you can do so via Start > Control Panel > Add/Remove Programs.



#11 King_Yoshi

King_Yoshi

  • Malware Study Hall Senior
  • 1,349 posts
  • OFFLINE
  •  
  • Local time:03:44 PM

Posted 22 July 2017 - 01:02 PM

Hello dareynedx,

Are you still with us?
It has been 3 days since I last posted, and have not had a response from yourself.
Kindly respond to this topic in two days.
Otherwise I will have to consider it abandoned, at which point it will be locked.



#12 King_Yoshi

King_Yoshi

  • Malware Study Hall Senior
  • 1,349 posts
  • OFFLINE
  •  
  • Local time:03:44 PM

Posted 24 July 2017 - 06:20 PM

Hello dareynedx,

Its been over 5 days since you last responded.
Therefore this thread will be locked.

If you wish to reopen this topic feel free to PM me and I will have a moderator unlock it.



#13 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,208 posts
  • ONLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:10:44 PM

Posted 25 July 2017 - 01:40 AM

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days.

Please include a link to your topic in the Private Message. Thank you.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users