Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infected with a RAT or something for more than a year now. Help


  • This topic is locked This topic is locked
7 replies to this topic

#1 imasuperstar

imasuperstar

  • Members
  • 3 posts
  • OFFLINE
  •  

Posted 05 September 2017 - 03:44 AM

Hello guys,

A good friend of mine is infected with a rat or something else for over an year now. We know who the person is but don't know anything about him, no name, adress or anything else. We have friends working for the police but they can't do anything since the hacker didn't do any other fraud than breaking into the pc. We tried everything, fresh install, malwarebytes, we looked through every process and blocked all the ports he doesn't use and we can't figure it out how the hacker still gets acces to the system. We even called the isp and told them to change the ip and he somehow still finds a way in. We tried different programs to check for data usage and we don't know anything else what we can try. 

He is not a noob and he didn't open any links or exe's he doesn't know so that's not the problem. Firewall and antivirus is on, malwarebytes aswell. 

Do you have any idea what we could do to block the acces or find the rat?

The hacker get in the system and is writing him messages or moves his charachter in the game. I guess he only can control the keyboard so i'm not sure if he can control the mouse because he didn't do it.

We even have it on video how the hacker writes messages and the weird part is that he is only writing the same lines everytime so i guess it's something programmed to write and not the hacker himself.

Here are the FRST logs (Mod Edit:  Pasted log into post - Hamluis.)

 

 

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 20-08-2017
durchgeführt von Marko (Administrator) auf DESKTOP-1NN84TH (05-09-2017 09:15:14)
Gestartet von C:\Users\Marko Gast\Downloads
Geladene Profile: Marko & Marko Gast (Verfügbare Profile: defaultuser0 & Marko & Marko Gast & Administrator)
Platform: Windows 10 Pro Version 1607 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: Edge)
Start-Modus: Normal
 
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
 
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
 
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(BiniSoft.org) C:\Program Files\Windows Firewall Control\wfcs.exe
(Creative Technology Ltd) C:\Windows\SysWOW64\CtHdaSvc.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe
(Chip Digital GmbH) C:\Program Files (x86)\Chip Digital GmbH\chip1click\chip 1-click installer.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe
(Microsoft Corporation) C:\Windows\System32\InstallAgent.exe
(Microsoft Corporation) C:\Windows\System32\InstallAgentUserBroker.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
konnte nicht auf den Prozess zugreifen -> ATKEX_cmd.exe
(BiniSoft.org) C:\Program Files\Windows Firewall Control\wfc.exe
(CANON INC.) C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Sound Blaster Z-Series\Sound Blaster Z-Series Control Panel\SBZ.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\ShadowPlay\nvspcaps64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\ShadowPlay\nvsphelper64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe
(Node.js) C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
(Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\ielowutil.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
 
==================== Registry (Nicht auf der Ausnahmeliste) ====================
 
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
 
HKLM\...\Run: [WindowsDefender] => C:\Program Files\Windows Defender\MSASCuiL.exe [631808 2017-04-28] (Microsoft Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8899592 2016-08-19] (Realtek Semiconductor)
HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [3146704 2017-05-09] (Malwarebytes)
HKLM\...\Run: [ShadowPlay] => "C:\Windows\system32\rundll32.exe" C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [Windows Firewall Control] => C:\Program Files\Windows Firewall Control\wfc.exe [608768 2017-02-24] (BiniSoft.org)
HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] => C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [452272 2012-08-31] (CANON INC.)
HKLM-x32\...\Run: [UpdReg] => C:\Windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.)
HKLM-x32\...\Run: [Sound Blaster Z-Series Control Panel] => C:\Program Files (x86)\Creative\Sound Blaster Z-Series\Sound Blaster Z-Series Control Panel\SBZ.exe [877056 2014-11-24] (Creative Technology Ltd)
HKU\S-1-5-21-3743333113-854201390-2029011037-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3071776 2017-08-28] (Valve Corporation)
HKU\S-1-5-21-3743333113-854201390-2029011037-1002\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3071776 2017-08-28] (Valve Corporation)
HKU\S-1-5-18\...\RunOnce: [Application Restart #0] => C:\Program Files (x86)\ASUS\AURA(GRAPHICS CARD)\ledcontrolservice.exe  /RestartByRestartManager:96F651D9-83CA-49d9-AB7E-E7C7D83D9372
HKU\S-1-5-18\...\RunOnce: [Application Restart #1] => C:\Program Files (x86)\ASUS\AURA(GRAPHICS CARD)\ledcontrolservice.exe  /RestartByRestartManager:8B0A6C52-C211-4fa6-B686-F0C23732AE7B
 
==================== Internet (Nicht auf der Ausnahmeliste) ====================
 
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
 
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{d2bbed01-af80-4e87-9a50-edb25f990086}: [DhcpNameServer] 192.168.1.1
 
Internet Explorer:
==================
 
FireFox:
========
FF DefaultProfile: kytlvug2.default
FF ProfilePath: C:\Users\Marko\AppData\Roaming\Mozilla\Firefox\Profiles\kytlvug2.default [2017-09-03]
FF Extension: (Adblock Plus) - C:\Users\Marko\AppData\Roaming\Mozilla\Firefox\Profiles\kytlvug2.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2017-09-03]
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2017-04-01] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2017-04-01] (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-08-01] (Adobe Systems Inc.)
 
==================== Dienste (Nicht auf der Ausnahmeliste) ====================
 
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 
S2 ASGT; C:\Windows\SysWOW64\ASGT.exe [48640 2016-05-27] () [Datei ist nicht signiert]
R2 chip1click; C:\Program Files (x86)\Chip Digital GmbH\chip1click\chip 1-click installer.exe [91136 2016-10-27] (Chip Digital GmbH) [Datei ist nicht signiert]
R2 CTAudSvcService; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [423424 2012-10-08] (Creative Technology Ltd) [Datei ist nicht signiert]
R2 CtHdaSvc; C:\Windows\sysWow64\CtHdaSvc.exe [114176 2014-11-17] (Creative Technology Ltd)
S3 EasyAntiCheat; C:\Windows\SysWOW64\EasyAntiCheat.exe [392480 2017-02-24] (EasyAntiCheat Ltd)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4470736 2017-05-09] (Malwarebytes)
R2 NvContainerLocalSystem; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [512960 2017-07-26] (NVIDIA Corporation)
S3 NvContainerNetworkService; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [512960 2017-07-26] (NVIDIA Corporation)
R2 NVDisplay.ContainerLocalSystem; C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [462784 2017-04-01] (NVIDIA Corporation)
R2 NvTelemetryContainer; C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe [449984 2017-07-26] (NVIDIA Corporation)
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [118520 2013-03-01] (Riverbed Technology, Inc.)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [2889888 2017-08-01] (Microsoft Corporation)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347320 2017-04-28] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103712 2017-08-01] (Microsoft Corporation)
R2 _wfcs; C:\Program Files\Windows Firewall Control\wfcs.exe [102912 2017-02-24] (BiniSoft.org) [Datei ist nicht signiert]
 
===================== Treiber (Nicht auf der Ausnahmeliste) ======================
 
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2014-09-09] ()
R0 asstahci64; C:\Windows\System32\drivers\asstahci64.sys [88936 2015-06-17] (Asmedia Technology)
S3 CSRBC; C:\Windows\System32\Drivers\csrbc.sys [38400 2011-02-09] (CSR plc.)
R3 cthda; C:\Windows\system32\drivers\cthda.sys [1065728 2014-11-17] (Creative Technology Ltd)
R3 cthdb; C:\Windows\system32\DRIVERS\cthdb.sys [34048 2014-11-17] (Creative Technology Ltd)
S3 dg_ssudbus; C:\Windows\system32\DRIVERS\ssudbus.sys [131984 2017-05-18] (Samsung Electronics Co., Ltd.)
R3 e1dexpress; C:\Windows\system32\DRIVERS\e1d65x64.sys [559080 2016-04-20] (Intel Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [253856 2017-08-31] (Malwarebytes)
R1 MpKsl7cb5c4d2; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{50B3E28B-7DAB-4314-82F6-18AA55F7DEE3}\MpKsl7cb5c4d2.sys [44928 2017-09-04] (Microsoft Corporation)
S3 NetAdapterCx; C:\Windows\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
R2 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)
R3 nvlddmkm; C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_e69a53b8ddde469c\nvlddmkm.sys [14841784 2017-04-03] (NVIDIA Corporation)
S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [30144 2017-07-26] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [48064 2017-07-26] (NVIDIA Corporation)
R3 nvvhci; C:\Windows\System32\drivers\nvvhci.sys [57792 2017-07-26] (NVIDIA Corporation)
R0 pwdrvio; C:\Windows\System32\pwdrvio.sys [19152 2013-09-30] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [12504 2013-09-30] ()
S3 ssudmdm; C:\Windows\system32\DRIVERS\ssudmdm.sys [166288 2017-05-18] (Samsung Electronics Co., Ltd.)
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
 
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
 
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 
 
==================== Ein Monat: Erstellte Dateien und Ordner ========
 
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
 
2017-09-05 09:15 - 2017-09-05 09:15 - 000011483 _____ C:\Users\Marko Gast\Downloads\FRST.txt
2017-09-04 21:15 - 2017-09-04 21:15 - 000000000 ____D C:\Users\Marko Gast\Downloads\Scan mit Angesteckten Festplatten
2017-09-04 21:12 - 2017-09-04 21:12 - 000000000 ____D C:\Users\Marko Gast\Downloads\Scan ohne zocken und angesteckten festplatten
2017-09-04 21:10 - 2017-09-05 09:15 - 000000000 ____D C:\FRST
2017-09-04 21:09 - 2017-09-04 21:10 - 002395648 _____ (Farbar) C:\Users\Marko Gast\Downloads\FRST64.exe
2017-09-03 21:24 - 2017-09-03 21:24 - 000000000 ____D C:\Users\Marko Gast\AppData\Local\Rockstar Games
2017-09-03 21:24 - 2017-09-03 21:24 - 000000000 ____D C:\Program Files\Rockstar Games
2017-09-03 21:24 - 2017-09-03 21:24 - 000000000 ____D C:\Program Files (x86)\Rockstar Games
2017-09-03 21:07 - 2017-09-03 21:07 - 003976062 _____ C:\Users\Marko\Desktop\20S-v1.7.5_de.img
2017-09-03 21:06 - 2017-09-03 21:13 - 000001540 _____ C:\Users\Marko\Desktop\SenaBluetoothDeviceManager.lnk
2017-09-03 21:06 - 2017-09-03 21:06 - 006689773 _____ C:\Users\Marko Gast\Downloads\SenaBluetoothDeviceManagerForWindows-v3.5.1-setup_x64.exe
2017-09-03 21:06 - 2017-09-03 21:06 - 000000000 ____D C:\Users\Marko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sena Technologies
2017-09-03 21:06 - 2017-09-03 21:06 - 000000000 ____D C:\Program Files (x86)\Sena Technologies
2017-09-03 14:33 - 2017-09-03 14:33 - 000000000 ____D C:\Users\Marko\AppData\Local\UNP
2017-08-30 20:56 - 2017-08-30 21:18 - 000000000 ____D C:\Users\Marko\Downloads\Bos720PsO
2017-08-30 20:48 - 2017-08-04 07:31 - 001564512 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2017-08-30 20:48 - 2017-08-04 07:31 - 001214816 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2017-08-30 20:48 - 2017-08-04 07:31 - 000629088 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2017-08-30 20:48 - 2017-08-04 07:31 - 000544096 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2017-08-30 20:48 - 2017-08-04 07:31 - 000335712 _____ (Microsoft Corporation) C:\Windows\system32\dcntel.dll
2017-08-30 20:48 - 2017-08-04 07:31 - 000334176 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2017-08-30 20:48 - 2017-08-04 07:31 - 000233824 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2017-08-30 20:48 - 2017-08-04 07:31 - 000136032 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2017-08-30 20:48 - 2017-08-04 07:31 - 000096608 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2017-08-30 20:48 - 2017-08-04 07:31 - 000034656 _____ (Microsoft Corporation) C:\Windows\system32\DeviceCensus.exe
2017-08-30 20:48 - 2017-08-04 06:26 - 000192864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aepic.dll
2017-08-24 18:17 - 2017-09-03 14:35 - 000000000 ____D C:\Users\Marko\Desktop\Neuer Ordner
2017-08-24 18:17 - 2017-08-24 18:17 - 000001410 _____ C:\Users\Marko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Update- und Datenschutzeinstellungen.lnk
2017-08-22 13:39 - 2017-08-22 13:39 - 000061000 _____ C:\Users\Marko Gast\Downloads\Vorauswahl(4).pdf
2017-08-22 13:38 - 2017-08-22 13:38 - 000062345 _____ C:\Users\Marko Gast\Downloads\Vorauswahl(3).pdf
2017-08-22 13:37 - 2017-08-22 13:37 - 000059364 _____ C:\Users\Marko Gast\Downloads\Verständigung Stelle besetzt.pdf
2017-08-22 08:18 - 2017-08-22 08:18 - 000061000 _____ C:\Users\Marko Gast\Downloads\Vorauswahl(2).pdf
2017-08-15 12:25 - 2017-08-15 12:48 - 000000000 ____D C:\Users\Marko Gast\AppData\Roaming\Wireshark
2017-08-15 12:24 - 2017-08-15 12:24 - 000001827 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wireshark.lnk
2017-08-15 12:24 - 2017-08-15 12:24 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPcap
2017-08-15 12:24 - 2017-08-15 12:24 - 000000000 ____D C:\Program Files\Wireshark
2017-08-15 12:24 - 2017-08-15 12:24 - 000000000 ____D C:\Program Files (x86)\WinPcap
2017-08-15 09:27 - 2017-08-15 09:27 - 000319338 _____ C:\Users\Marko Gast\Downloads\ZUMO_220_handlebar_mount.zip
2017-08-13 12:09 - 2017-08-13 12:09 - 003463270 _____ C:\Users\Marko Gast\Downloads\Yamaha XJ6N Handbuch.PDF
2017-08-13 08:47 - 2017-08-13 08:47 - 000061000 _____ C:\Users\Marko Gast\Downloads\Vorauswahl(1).pdf
2017-08-13 08:46 - 2017-08-13 08:46 - 000062345 _____ C:\Users\Marko Gast\Downloads\Vorauswahl.pdf
2017-08-09 09:37 - 2017-08-01 21:32 - 000133984 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2017-08-09 09:37 - 2017-08-01 21:31 - 007780192 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2017-08-09 09:37 - 2017-08-01 21:29 - 000376672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\clfs.sys
2017-08-09 09:37 - 2017-08-01 21:27 - 000118112 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2017-08-09 09:37 - 2017-08-01 21:22 - 001860288 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.dll
2017-08-09 09:37 - 2017-08-01 21:22 - 000360040 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettingsAdminFlows.exe
2017-08-09 09:37 - 2017-08-01 21:21 - 002759712 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2017-08-09 09:37 - 2017-08-01 21:21 - 000857440 _____ (Microsoft Corporation) C:\Windows\system32\WWAHost.exe
2017-08-09 09:37 - 2017-08-01 21:20 - 000557408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\spaceport.sys
2017-08-09 09:37 - 2017-08-01 21:18 - 008169536 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Media.Protection.PlayReady.dll
2017-08-09 09:37 - 2017-08-01 21:18 - 004260064 _____ (Microsoft Corporation) C:\Windows\system32\mfcore.dll
2017-08-09 09:37 - 2017-08-01 21:18 - 001983408 _____ (Microsoft Corporation) C:\Windows\system32\mfmp4srcsnk.dll
2017-08-09 09:37 - 2017-08-01 21:18 - 001702392 _____ (Microsoft Corporation) C:\Windows\system32\mfasfsrcsnk.dll
2017-08-09 09:37 - 2017-08-01 21:18 - 000092512 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2017-08-09 09:37 - 2017-08-01 21:17 - 022220856 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2017-08-09 09:37 - 2017-08-01 21:17 - 001072248 _____ (Microsoft Corporation) C:\Windows\system32\mfnetcore.dll
2017-08-09 09:37 - 2017-08-01 21:17 - 000244816 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2017-08-09 09:37 - 2017-08-01 21:13 - 002532192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2017-08-09 09:37 - 2017-08-01 21:13 - 001102176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2017-08-09 09:37 - 2017-08-01 21:13 - 000387872 _____ (Microsoft Corporation) C:\Windows\system32\wmpps.dll
2017-08-09 09:37 - 2017-08-01 20:58 - 000299008 _____ (Microsoft Corporation) C:\Windows\system32\rdpinit.exe
2017-08-09 09:37 - 2017-08-01 20:57 - 000415744 _____ (Microsoft Corporation) C:\Windows\system32\rdpshell.exe
2017-08-09 09:37 - 2017-08-01 20:57 - 000372736 _____ (Microsoft Corporation) C:\Windows\system32\RDXTaskFactory.dll
2017-08-09 09:37 - 2017-08-01 20:53 - 000123904 _____ (Microsoft Corporation) C:\Windows\system32\mssprxy.dll
2017-08-09 09:37 - 2017-08-01 20:52 - 022569472 _____ (Microsoft Corporation) C:\Windows\system32\edgehtml.dll
2017-08-09 09:37 - 2017-08-01 20:52 - 000237568 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Web.Diagnostics.dll
2017-08-09 09:37 - 2017-08-01 20:51 - 000113664 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Networking.ServiceDiscovery.Dnssd.dll
2017-08-09 09:37 - 2017-08-01 20:50 - 000099328 _____ (Microsoft Corporation) C:\Windows\system32\browserbroker.dll
2017-08-09 09:37 - 2017-08-01 20:48 - 000223744 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2017-08-09 09:37 - 2017-08-01 20:48 - 000211968 _____ (Microsoft Corporation) C:\Windows\system32\InstallAgent.exe
2017-08-09 09:37 - 2017-08-01 20:47 - 000748544 _____ (Microsoft Corporation) C:\Windows\system32\StoreAgent.dll
2017-08-09 09:37 - 2017-08-01 20:47 - 000691200 _____ (Microsoft Corporation) C:\Windows\system32\ieproxy.dll
2017-08-09 09:37 - 2017-08-01 20:46 - 000590336 _____ (Microsoft Corporation) C:\Windows\system32\efswrt.dll
2017-08-09 09:37 - 2017-08-01 20:46 - 000349184 _____ (Microsoft Corporation) C:\Windows\system32\SearchProtocolHost.exe
2017-08-09 09:37 - 2017-08-01 20:46 - 000315904 _____ (Microsoft Corporation) C:\Windows\system32\Phoneutil.dll
2017-08-09 09:37 - 2017-08-01 20:46 - 000260608 _____ (Microsoft Corporation) C:\Windows\system32\InstallAgentUserBroker.exe
2017-08-09 09:37 - 2017-08-01 20:45 - 000805888 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2017-08-09 09:37 - 2017-08-01 20:45 - 000561664 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Wallet.dll
2017-08-09 09:37 - 2017-08-01 20:45 - 000456192 _____ (Microsoft Corporation) C:\Windows\system32\puiobj.dll
2017-08-09 09:37 - 2017-08-01 20:45 - 000425984 _____ (Microsoft Corporation) C:\Windows\system32\aadcloudap.dll
2017-08-09 09:37 - 2017-08-01 20:44 - 000642048 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Xaml.InkControls.dll
2017-08-09 09:37 - 2017-08-01 20:43 - 000963584 _____ (Microsoft Corporation) C:\Windows\system32\WebcamUi.dll
2017-08-09 09:37 - 2017-08-01 20:42 - 006288384 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Media.dll
2017-08-09 09:37 - 2017-08-01 20:38 - 013441536 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2017-08-09 09:37 - 2017-08-01 20:37 - 013091328 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2017-08-09 09:37 - 2017-08-01 20:36 - 023677440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2017-08-09 09:37 - 2017-08-01 20:35 - 001908224 _____ (Microsoft Corporation) C:\Windows\system32\AzureSettingSyncProvider.dll
2017-08-09 09:37 - 2017-08-01 20:32 - 008114688 _____ (Microsoft Corporation) C:\Windows\system32\Chakra.dll
2017-08-09 09:37 - 2017-08-01 20:32 - 004596224 _____ (Microsoft Corporation) C:\Windows\system32\xpsrchvw.exe
2017-08-09 09:37 - 2017-08-01 20:32 - 003401216 _____ (Microsoft Corporation) C:\Windows\system32\tquery.dll
2017-08-09 09:37 - 2017-08-01 20:30 - 000913920 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Networking.dll
2017-08-09 09:37 - 2017-08-01 20:29 - 004743680 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2017-08-09 09:37 - 2017-08-01 20:29 - 002852864 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettingsThresholdAdminFlowUI.dll
2017-08-09 09:37 - 2017-08-01 20:29 - 000874496 _____ (Microsoft Corporation) C:\Windows\system32\TokenBroker.dll
2017-08-09 09:37 - 2017-08-01 20:28 - 002895360 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2017-08-09 09:37 - 2017-08-01 20:27 - 008076288 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2017-08-09 09:37 - 2017-08-01 20:27 - 004149248 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2017-08-09 09:37 - 2017-08-01 20:27 - 002538496 _____ (Microsoft Corporation) C:\Windows\system32\mssrch.dll
2017-08-09 09:37 - 2017-08-01 20:27 - 001984000 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2017-08-09 09:37 - 2017-08-01 20:27 - 000903680 _____ (Microsoft Corporation) C:\Windows\system32\SearchIndexer.exe
2017-08-09 09:37 - 2017-08-01 20:27 - 000774656 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Web.dll
2017-08-09 09:37 - 2017-08-01 20:27 - 000765440 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Devices.Sensors.dll
2017-08-09 09:37 - 2017-08-01 20:26 - 001949696 _____ (Microsoft Corporation) C:\Windows\system32\PeerDistSvc.dll
2017-08-09 09:37 - 2017-08-01 20:26 - 001513472 _____ (Microsoft Corporation) C:\Windows\system32\win32kbase.sys
2017-08-09 09:37 - 2017-08-01 20:26 - 000701952 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Networking.Connectivity.dll
2017-08-09 09:37 - 2017-08-01 20:24 - 003299840 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2017-08-09 09:37 - 2017-08-01 20:24 - 000998912 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2017-08-09 09:37 - 2017-08-01 20:24 - 000924672 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Networking.BackgroundTransfer.dll
2017-08-09 09:37 - 2017-08-01 19:20 - 002264344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2017-08-09 09:37 - 2017-08-01 19:20 - 001431232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.dll
2017-08-09 09:37 - 2017-08-01 19:20 - 000781144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WWAHost.exe
2017-08-09 09:37 - 2017-08-01 19:20 - 000116576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CloudExperienceHostCommon.dll
2017-08-09 09:37 - 2017-08-01 19:19 - 001980776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2017-08-09 09:37 - 2017-08-01 19:19 - 000577976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2017-08-09 09:37 - 2017-08-01 19:19 - 000339896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Faultrep.dll
2017-08-09 09:37 - 2017-08-01 19:19 - 000266080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFault.exe
2017-08-09 09:37 - 2017-08-01 19:19 - 000120416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFaultSecure.exe
2017-08-09 09:37 - 2017-08-01 19:18 - 000139104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wermgr.exe
2017-08-09 09:37 - 2017-08-01 19:16 - 006665952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Media.Protection.PlayReady.dll
2017-08-09 09:37 - 2017-08-01 19:16 - 004023552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfcore.dll
2017-08-09 09:37 - 2017-08-01 19:16 - 001845512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmp4srcsnk.dll
2017-08-09 09:37 - 2017-08-01 19:15 - 020967840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2017-08-09 09:37 - 2017-08-01 19:15 - 001360464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfnetsrc.dll
2017-08-09 09:37 - 2017-08-01 19:15 - 001277856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfasfsrcsnk.dll
2017-08-09 09:37 - 2017-08-01 19:15 - 000981888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfnetcore.dll
2017-08-09 09:37 - 2017-08-01 19:10 - 000306800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Media.MediaControl.dll
2017-08-09 09:37 - 2017-08-01 19:07 - 005686784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Data.Pdf.dll
2017-08-09 09:37 - 2017-08-01 18:59 - 000035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tokenbinding.dll
2017-08-09 09:37 - 2017-08-01 18:58 - 000040960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TokenBrokerUI.dll
2017-08-09 09:37 - 2017-08-01 18:56 - 000177664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Web.Diagnostics.dll
2017-08-09 09:37 - 2017-08-01 18:56 - 000123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Networking.HostName.dll
2017-08-09 09:37 - 2017-08-01 18:55 - 000087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Networking.ServiceDiscovery.Dnssd.dll
2017-08-09 09:37 - 2017-08-01 18:54 - 000505856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcastdvr.exe
2017-08-09 09:37 - 2017-08-01 18:54 - 000184320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UserMgrProxy.dll
2017-08-09 09:37 - 2017-08-01 18:54 - 000180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InstallAgent.exe
2017-08-09 09:37 - 2017-08-01 18:53 - 000557568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\StoreAgent.dll
2017-08-09 09:37 - 2017-08-01 18:52 - 000533504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FXSCOMEX.dll
2017-08-09 09:37 - 2017-08-01 18:52 - 000117760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AuthBroker.dll
2017-08-09 09:37 - 2017-08-01 18:51 - 000483840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Devices.AllJoyn.dll
2017-08-09 09:37 - 2017-08-01 18:51 - 000426496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Wallet.dll
2017-08-09 09:37 - 2017-08-01 18:51 - 000388608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2017-08-09 09:37 - 2017-08-01 18:51 - 000306688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieproxy.dll
2017-08-09 09:37 - 2017-08-01 18:51 - 000223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InstallAgentUserBroker.exe
2017-08-09 09:37 - 2017-08-01 18:51 - 000145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWWIN.EXE
2017-08-09 09:37 - 2017-08-01 18:50 - 000431616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\efswrt.dll
2017-08-09 09:37 - 2017-08-01 18:50 - 000284672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apprepsync.dll
2017-08-09 09:37 - 2017-08-01 18:50 - 000260096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Phoneutil.dll
2017-08-09 09:37 - 2017-08-01 18:50 - 000125952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apprepapi.dll
2017-08-09 09:37 - 2017-08-01 18:49 - 004615168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Media.dll
2017-08-09 09:37 - 2017-08-01 18:48 - 000297472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
2017-08-09 09:37 - 2017-08-01 18:48 - 000267776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncryptprov.dll
2017-08-09 09:37 - 2017-08-01 18:47 - 000846336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebcamUi.dll
2017-08-09 09:37 - 2017-08-01 18:47 - 000787968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sbe.dll
2017-08-09 09:37 - 2017-08-01 18:47 - 000525824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PrintDialogs.dll
2017-08-09 09:37 - 2017-08-01 18:47 - 000396288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\werui.dll
2017-08-09 09:37 - 2017-08-01 18:47 - 000368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\puiobj.dll
2017-08-09 09:37 - 2017-08-01 18:45 - 002333184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll
2017-08-09 09:37 - 2017-08-01 18:45 - 001985536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certmgr.dll
2017-08-09 09:37 - 2017-08-01 18:42 - 018364928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\edgehtml.dll
2017-08-09 09:37 - 2017-08-01 18:41 - 000248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dlnashext.dll
2017-08-09 09:37 - 2017-08-01 18:40 - 019415040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2017-08-09 09:37 - 2017-08-01 18:40 - 012187136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2017-08-09 09:37 - 2017-08-01 18:39 - 007626240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2017-08-09 09:37 - 2017-08-01 18:39 - 001255936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AzureSettingSyncProvider.dll
2017-08-09 09:37 - 2017-08-01 18:38 - 000458752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlidprov.dll
2017-08-09 09:37 - 2017-08-01 18:37 - 012349440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2017-08-09 09:37 - 2017-08-01 18:37 - 003520512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xpsrchvw.exe
2017-08-09 09:37 - 2017-08-01 18:37 - 002641920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tquery.dll
2017-08-09 09:37 - 2017-08-01 18:37 - 000647168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comuid.dll
2017-08-09 09:37 - 2017-08-01 18:37 - 000468992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Xaml.InkControls.dll
2017-08-09 09:37 - 2017-08-01 18:36 - 007468544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2017-08-09 09:37 - 2017-08-01 18:35 - 000675840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Networking.dll
2017-08-09 09:37 - 2017-08-01 18:34 - 001170944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Media.Speech.dll
2017-08-09 09:37 - 2017-08-01 18:34 - 000886272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aadtb.dll
2017-08-09 09:37 - 2017-08-01 18:34 - 000709120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CPFilters.dll
2017-08-09 09:37 - 2017-08-01 18:33 - 006031872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Chakra.dll
2017-08-09 09:37 - 2017-08-01 18:33 - 000589312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Devices.Sensors.dll
2017-08-09 09:37 - 2017-08-01 18:32 - 002682880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netshell.dll
2017-08-09 09:37 - 2017-08-01 18:32 - 002648576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CertEnroll.dll
2017-08-09 09:37 - 2017-08-01 18:31 - 003664896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2017-08-09 09:37 - 2017-08-01 18:31 - 001988096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssrch.dll
2017-08-09 09:37 - 2017-08-01 18:31 - 000773120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchIndexer.exe
2017-08-09 09:37 - 2017-08-01 18:31 - 000690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TokenBroker.dll
2017-08-09 09:37 - 2017-08-01 18:31 - 000598528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Web.dll
2017-08-09 09:37 - 2017-08-01 18:31 - 000566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ShareHost.dll
2017-08-09 09:37 - 2017-08-01 18:31 - 000542208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Networking.Connectivity.dll
2017-08-09 09:37 - 2017-08-01 18:30 - 002997248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32kfull.sys
2017-08-09 09:37 - 2017-08-01 18:30 - 002482688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2017-08-09 09:37 - 2017-08-01 18:30 - 001886720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Logon.dll
2017-08-09 09:37 - 2017-08-01 18:30 - 001556992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Immersive.dll
2017-08-09 09:37 - 2017-08-01 18:30 - 001013248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Web.Http.dll
2017-08-09 09:37 - 2017-08-01 18:30 - 000751104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Networking.BackgroundTransfer.dll
2017-08-09 09:37 - 2017-08-01 18:30 - 000711168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Search.dll
2017-08-09 09:37 - 2017-08-01 18:29 - 003106304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2017-08-09 09:37 - 2017-08-01 18:28 - 000783360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2017-08-09 09:37 - 2017-08-01 16:15 - 001311744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msjet40.dll
2017-08-09 09:37 - 2017-08-01 16:15 - 000866816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswdat10.dll
2017-08-09 09:37 - 2017-08-01 16:15 - 000641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswstr10.dll
2017-08-09 09:37 - 2017-08-01 16:15 - 000616448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrepl40.dll
2017-08-09 09:37 - 2017-08-01 16:15 - 000518144 _____ C:\Windows\SysWOW64\msjetoledb40.dll
2017-08-09 09:37 - 2017-08-01 16:15 - 000475648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxbde40.dll
2017-08-09 09:37 - 2017-08-01 16:15 - 000375808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mspbde40.dll
2017-08-09 09:37 - 2017-08-01 16:15 - 000343552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrd3x40.dll
2017-08-09 09:37 - 2017-08-01 16:15 - 000339968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msexcl40.dll
2017-08-09 09:37 - 2017-08-01 16:15 - 000310272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrd2x40.dll
2017-08-09 09:37 - 2017-08-01 16:15 - 000290816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msjtes40.dll
2017-08-09 09:37 - 2017-08-01 16:15 - 000272896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstext40.dll
2017-08-09 09:37 - 2017-08-01 16:15 - 000240640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msltus40.dll
2017-08-09 09:37 - 2017-08-01 16:15 - 000144896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msjint40.dll
2017-08-09 09:37 - 2017-08-01 16:15 - 000083968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msjter40.dll
2017-08-09 09:37 - 2017-07-12 08:17 - 000081760 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\stornvme.sys
2017-08-09 09:37 - 2017-07-12 08:15 - 002213760 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2017-08-09 09:37 - 2017-07-12 08:15 - 000496872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dnsapi.dll
2017-08-09 09:37 - 2017-07-12 08:12 - 001706488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2017-08-09 09:37 - 2017-07-12 08:12 - 001573280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2017-08-09 09:37 - 2017-07-12 08:09 - 001181024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2017-08-09 09:37 - 2017-07-12 08:02 - 002186592 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2017-08-09 09:37 - 2017-07-12 08:02 - 000402776 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2017-08-09 09:37 - 2017-07-12 08:01 - 000715104 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vhdmp.sys
2017-08-09 09:37 - 2017-07-12 08:01 - 000156000 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wfplwfs.sys
2017-08-09 09:37 - 2017-07-12 08:00 - 000223072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2017-08-09 09:37 - 2017-07-12 08:00 - 000160608 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pacer.sys
2017-08-09 09:37 - 2017-07-12 08:00 - 000095584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sdstor.sys
2017-08-09 09:37 - 2017-07-12 07:59 - 000857952 _____ (Microsoft Corporation) C:\Windows\system32\NetSetupEngine.dll
2017-08-09 09:37 - 2017-07-12 07:59 - 000148832 _____ (Microsoft Corporation) C:\Windows\system32\NetSetupApi.dll
2017-08-09 09:37 - 2017-07-12 07:56 - 000277856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2017-08-09 09:37 - 2017-07-12 07:55 - 000607072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\NetSetupEngine.dll
2017-08-09 09:37 - 2017-07-12 07:55 - 000111968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\NetSetupApi.dll
2017-08-09 09:37 - 2017-07-12 07:52 - 004312760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
2017-08-09 09:37 - 2017-07-12 07:35 - 000008704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dabapi.dll
2017-08-09 09:37 - 2017-07-12 07:32 - 000227328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\container.dll
2017-08-09 09:37 - 2017-07-12 07:32 - 000068096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\frprov.dll
2017-08-09 09:37 - 2017-07-12 07:31 - 000130560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fdeploy.dll
2017-08-09 09:37 - 2017-07-12 07:31 - 000022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\perfnet.dll
2017-08-09 09:37 - 2017-07-12 07:30 - 000034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshhttp.dll
2017-08-09 09:37 - 2017-07-12 07:29 - 000328192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\daxexec.dll
2017-08-09 09:37 - 2017-07-12 07:29 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\httpapi.dll
2017-08-09 09:37 - 2017-07-12 07:25 - 000364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\NetSetupShim.dll
2017-08-09 09:37 - 2017-07-12 07:24 - 000124928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\scmdisk0101.sys
2017-08-09 09:37 - 2017-07-12 07:24 - 000025088 _____ (Microsoft Corporation) C:\Windows\system32\perfnet.dll
2017-08-09 09:37 - 2017-07-12 07:23 - 000671232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netlogon.dll
2017-08-09 09:37 - 2017-07-12 07:23 - 000238592 _____ (Microsoft Corporation) C:\Windows\system32\MusNotification.exe
2017-08-09 09:37 - 2017-07-12 07:23 - 000216576 _____ (Microsoft Corporation) C:\Windows\system32\RdpRelayTransport.dll
2017-08-09 09:37 - 2017-07-12 07:23 - 000098304 _____ (Microsoft Corporation) C:\Windows\system32\MusNotificationUx.exe
2017-08-09 09:37 - 2017-07-12 07:23 - 000076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\updatepolicy.dll
2017-08-09 09:37 - 2017-07-12 07:21 - 000711680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2017-08-09 09:37 - 2017-07-12 07:21 - 000042496 _____ (Microsoft Corporation) C:\Windows\system32\nshhttp.dll
2017-08-09 09:37 - 2017-07-12 07:19 - 006474752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mspaint.exe
2017-08-09 09:37 - 2017-07-12 07:18 - 000525312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\LogonController.dll
2017-08-09 09:37 - 2017-07-12 07:17 - 000552960 _____ (Microsoft Corporation) C:\Windows\system32\MusUpdateHandlers.dll
2017-08-09 09:37 - 2017-07-12 07:16 - 000431616 _____ (Microsoft Corporation) C:\Windows\system32\WpAXHolder.dll
2017-08-09 09:37 - 2017-07-12 07:15 - 000893440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\autochk.exe
2017-08-09 09:37 - 2017-07-12 07:15 - 000029184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iscsium.dll
2017-08-09 09:37 - 2017-07-12 07:14 - 000536064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\untfs.dll
2017-08-09 09:37 - 2017-07-12 07:13 - 000855040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\autofmt.exe
2017-08-09 09:37 - 2017-07-12 07:12 - 002750464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mispace.dll
2017-08-09 09:37 - 2017-07-12 07:11 - 002154496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\storagewmi.dll
2017-08-09 09:37 - 2017-07-12 07:10 - 000878592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\autoconv.exe
2017-08-09 09:37 - 2017-07-12 07:10 - 000546304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uReFS.dll
2017-08-09 09:37 - 2017-07-12 07:09 - 000641024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MCRecvSrc.dll
2017-08-09 09:37 - 2017-07-12 07:07 - 001572352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2017-08-09 09:37 - 2017-07-12 07:06 - 000937984 _____ (Microsoft Corporation) C:\Windows\system32\MCRecvSrc.dll
2017-08-09 09:37 - 2017-07-12 07:06 - 000549376 _____ (Microsoft Corporation) C:\Windows\system32\usocore.dll
2017-08-09 09:37 - 2017-07-12 07:05 - 000565248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasapi32.dll
2017-08-09 09:37 - 2017-07-12 07:03 - 000779776 _____ (Microsoft Corporation) C:\Windows\system32\cscui.dll
2017-08-09 09:37 - 2017-07-12 07:01 - 000266752 _____ (Microsoft Corporation) C:\Windows\system32\NetSetupSvc.dll
2017-08-09 09:37 - 2017-07-12 07:00 - 002370048 _____ (Microsoft Corporation) C:\Windows\system32\wlansvc.dll
2017-08-09 09:37 - 2017-07-12 06:58 - 001130496 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2017-08-09 09:37 - 2017-07-12 06:58 - 000392192 _____ (Microsoft Corporation) C:\Windows\system32\wuuhext.dll
2017-08-09 09:37 - 2017-07-12 06:57 - 000735744 _____ (Microsoft Corporation) C:\Windows\system32\LogonController.dll
2017-08-09 09:37 - 2017-07-12 06:56 - 001826816 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2017-08-09 09:37 - 2017-07-12 04:49 - 000448629 _____ C:\Windows\system32\ApnDatabase.xml
2017-08-09 09:37 - 2017-03-04 08:14 - 000588288 _____ (Microsoft Corporation) C:\Windows\system32\wlidprov.dll
2017-08-09 09:37 - 2017-03-04 08:05 - 001328640 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Web.Http.dll
2017-08-09 09:37 - 2017-03-04 08:05 - 000134144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ErrorDetails.dll
2017-08-09 09:37 - 2016-09-07 07:24 - 000057400 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2017-08-09 09:37 - 2016-08-02 10:13 - 001081856 _____ (Microsoft Corporation) C:\Windows\system32\Chakradiag.dll
2017-08-09 09:36 - 2017-08-01 21:25 - 000168800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2017-08-09 09:36 - 2017-08-01 21:21 - 000624048 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2017-08-09 09:36 - 2017-08-01 21:21 - 000295264 _____ (Microsoft Corporation) C:\Windows\system32\WerFault.exe
2017-08-09 09:36 - 2017-08-01 21:21 - 000146784 _____ (Microsoft Corporation) C:\Windows\system32\CloudExperienceHostCommon.dll
2017-08-09 09:36 - 2017-08-01 21:21 - 000124072 _____ (Microsoft Corporation) C:\Windows\system32\WerFaultSecure.exe
2017-08-09 09:36 - 2017-08-01 21:21 - 000026976 _____ (Microsoft Corporation) C:\Windows\system32\browser_broker.exe
2017-08-09 09:36 - 2017-08-01 21:20 - 002446704 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2017-08-09 09:36 - 2017-08-01 21:20 - 000684344 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2017-08-09 09:36 - 2017-08-01 21:20 - 000383776 _____ (Microsoft Corporation) C:\Windows\system32\Faultrep.dll
2017-08-09 09:36 - 2017-08-01 21:20 - 000144736 _____ (Microsoft Corporation) C:\Windows\system32\wermgr.exe
2017-08-09 09:36 - 2017-08-01 21:20 - 000079712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vmbkmcl.sys
2017-08-09 09:36 - 2017-08-01 21:17 - 001600632 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll
2017-08-09 09:36 - 2017-08-01 21:17 - 000241504 _____ (Microsoft Corporation) C:\Windows\system32\CloudExperienceHost.dll
2017-08-09 09:36 - 2017-08-01 21:01 - 007218176 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Data.Pdf.dll
2017-08-09 09:36 - 2017-08-01 20:54 - 000042496 _____ (Microsoft Corporation) C:\Windows\system32\tokenbinding.dll
2017-08-09 09:36 - 2017-08-01 20:52 - 000080896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vmbkmclr.sys
2017-08-09 09:36 - 2017-08-01 20:48 - 000289792 _____ (Microsoft Corporation) C:\Windows\system32\DeveloperOptionsSettingsHandlers.dll
2017-08-09 09:36 - 2017-08-01 20:47 - 000651264 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Devices.AllJoyn.dll
2017-08-09 09:36 - 2017-08-01 20:47 - 000268800 _____ (Microsoft Corporation) C:\Windows\system32\UserMgrProxy.dll
2017-08-09 09:36 - 2017-08-01 20:47 - 000223744 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Networking.HostName.dll
2017-08-09 09:36 - 2017-08-01 20:47 - 000049664 _____ (Microsoft Corporation) C:\Windows\system32\TokenBrokerUI.dll
2017-08-09 09:36 - 2017-08-01 20:46 - 000379904 _____ (Microsoft Corporation) C:\Windows\system32\apprepsync.dll
2017-08-09 09:36 - 2017-08-01 20:46 - 000176128 _____ (Microsoft Corporation) C:\Windows\system32\apprepapi.dll
2017-08-09 09:36 - 2017-08-01 20:46 - 000147456 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2017-08-09 09:36 - 2017-08-01 20:46 - 000094720 _____ (Microsoft Corporation) C:\Windows\system32\wercplsupport.dll
2017-08-09 09:36 - 2017-08-01 20:46 - 000078336 _____ (Microsoft Corporation) C:\Windows\system32\wsqmcons.exe
2017-08-09 09:36 - 2017-08-01 20:45 - 000472064 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2017-08-09 09:36 - 2017-08-01 20:45 - 000451072 _____ (Microsoft Corporation) C:\Windows\system32\werui.dll
2017-08-09 09:36 - 2017-08-01 20:45 - 000171008 _____ (Microsoft Corporation) C:\Windows\system32\DWWIN.EXE
2017-08-09 09:36 - 2017-08-01 20:44 - 001010176 _____ (Microsoft Corporation) C:\Windows\system32\enterprisecsps.dll
2017-08-09 09:36 - 2017-08-01 20:43 - 000966144 _____ (Microsoft Corporation) C:\Windows\system32\sbe.dll
2017-08-09 09:36 - 2017-08-01 20:43 - 000945664 _____ (Microsoft Corporation) C:\Windows\system32\iphlpsvc.dll
2017-08-09 09:36 - 2017-08-01 20:43 - 000156672 _____ (Microsoft Corporation) C:\Windows\system32\wersvc.dll
2017-08-09 09:36 - 2017-08-01 20:42 - 000775168 _____ (Microsoft Corporation) C:\Windows\system32\GamePanel.exe
2017-08-09 09:36 - 2017-08-01 20:41 - 002222080 _____ (Microsoft Corporation) C:\Windows\system32\certmgr.dll
2017-08-09 09:36 - 2017-08-01 20:40 - 002716672 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2017-08-09 09:36 - 2017-08-01 20:40 - 000945664 _____ (Microsoft Corporation) C:\Windows\system32\WpcWebFilter.dll
2017-08-09 09:36 - 2017-08-01 20:40 - 000800768 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Security.Authentication.Web.Core.dll
2017-08-09 09:36 - 2017-08-01 20:39 - 009129984 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
2017-08-09 09:36 - 2017-08-01 20:39 - 001281536 _____ (Microsoft Corporation) C:\Windows\system32\werconcpl.dll
2017-08-09 09:36 - 2017-08-01 20:39 - 000353280 _____ (Microsoft Corporation) C:\Windows\system32\windows.immersiveshell.serviceprovider.dll
2017-08-09 09:36 - 2017-08-01 20:39 - 000323072 _____ (Microsoft Corporation) C:\Windows\system32\ncryptprov.dll
2017-08-09 09:36 - 2017-08-01 20:38 - 001589760 _____ (Microsoft Corporation) C:\Windows\system32\msdtctm.dll
2017-08-09 09:36 - 2017-08-01 20:36 - 000295424 _____ (Microsoft Corporation) C:\Windows\system32\dlnashext.dll
2017-08-09 09:36 - 2017-08-01 20:34 - 001837056 _____ (Microsoft Corporation) C:\Windows\system32\workfolderssvc.dll
2017-08-09 09:36 - 2017-08-01 20:33 - 004749824 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers_nt.dll
2017-08-09 09:36 - 2017-08-01 20:33 - 000230400 _____ (Microsoft Corporation) C:\Windows\system32\windowslivelogin.dll
2017-08-09 09:36 - 2017-08-01 20:33 - 000167936 _____ (Microsoft Corporation) C:\Windows\system32\ErrorDetails.dll
2017-08-09 09:36 - 2017-08-01 20:32 - 000821248 _____ (Microsoft Corporation) C:\Windows\system32\comuid.dll
2017-08-09 09:36 - 2017-08-01 20:30 - 002916864 _____ (Microsoft Corporation) C:\Windows\system32\CertEnroll.dll
2017-08-09 09:36 - 2017-08-01 20:30 - 001643008 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Media.Speech.dll
2017-08-09 09:36 - 2017-08-01 20:30 - 000305152 _____ (Microsoft Corporation) C:\Windows\system32\srvsvc.dll
2017-08-09 09:36 - 2017-08-01 20:28 - 001490432 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2017-08-09 09:36 - 2017-08-01 20:27 - 002695680 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Logon.dll
2017-08-09 09:36 - 2017-08-01 20:27 - 000716800 _____ (Microsoft Corporation) C:\Windows\system32\ShareHost.dll
2017-08-09 09:36 - 2017-08-01 20:25 - 001726976 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Immersive.dll
2017-08-09 09:36 - 2017-08-01 20:24 - 001121280 _____ (Microsoft Corporation) C:\Windows\system32\aadtb.dll
2017-08-09 09:36 - 2017-08-01 20:23 - 003615744 _____ (Microsoft Corporation) C:\Windows\system32\win32kfull.sys
2017-08-09 09:36 - 2017-08-01 20:23 - 000886784 _____ (Microsoft Corporation) C:\Windows\system32\CPFilters.dll
2017-08-09 09:36 - 2017-08-01 18:47 - 000661504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WpcWebFilter.dll
2017-08-09 09:36 - 2017-07-12 08:16 - 000646688 _____ (Microsoft Corporation) C:\Windows\system32\dnsapi.dll
2017-08-09 09:36 - 2017-07-12 08:15 - 000101216 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2017-08-09 09:36 - 2017-07-12 08:14 - 001886896 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2017-08-09 09:36 - 2017-07-12 08:13 - 002253664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2017-08-09 09:36 - 2017-07-12 07:59 - 001100128 _____ (Microsoft Corporation) C:\Windows\system32\hvix64.exe
2017-08-09 09:36 - 2017-07-12 07:59 - 000989024 _____ (Microsoft Corporation) C:\Windows\system32\hvax64.exe
2017-08-09 09:36 - 2017-07-12 07:59 - 000947040 _____ (Microsoft Corporation) C:\Windows\system32\hvloader.efi
2017-08-09 09:36 - 2017-07-12 07:55 - 004674872 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2017-08-09 09:36 - 2017-07-12 07:25 - 000066560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wcnfs.sys
2017-08-09 09:36 - 2017-07-12 07:24 - 000013824 _____ (Microsoft Corporation) C:\Windows\system32\dabapi.dll
2017-08-09 09:36 - 2017-07-12 07:23 - 000328192 _____ (Microsoft Corporation) C:\Windows\system32\container.dll
2017-08-09 09:36 - 2017-07-12 07:23 - 000084480 _____ (Microsoft Corporation) C:\Windows\system32\frprov.dll
2017-08-09 09:36 - 2017-07-12 07:22 - 000033280 _____ (Microsoft Corporation) C:\Windows\system32\wcimage.dll
2017-08-09 09:36 - 2017-07-12 07:21 - 000329728 _____ (Microsoft Corporation) C:\Windows\system32\wc_storage.dll
2017-08-09 09:36 - 2017-07-12 07:21 - 000110080 _____ (Microsoft Corporation) C:\Windows\system32\dab.dll
2017-08-09 09:36 - 2017-07-12 07:20 - 000031232 _____ (Microsoft Corporation) C:\Windows\system32\httpapi.dll
2017-08-09 09:36 - 2017-07-12 07:19 - 000488960 _____ (Microsoft Corporation) C:\Windows\system32\NetSetupShim.dll
2017-08-09 09:36 - 2017-07-12 07:19 - 000463872 _____ (Microsoft Corporation) C:\Windows\system32\daxexec.dll
2017-08-09 09:36 - 2017-07-12 07:19 - 000156160 _____ (Microsoft Corporation) C:\Windows\system32\fdeploy.dll
2017-08-09 09:36 - 2017-07-12 07:17 - 000252416 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2017-08-09 09:36 - 2017-07-12 07:16 - 000142848 _____ (Microsoft Corporation) C:\Windows\system32\profsvcext.dll
2017-08-09 09:36 - 2017-07-12 07:15 - 000265216 _____ (Microsoft Corporation) C:\Windows\system32\dnsrslvr.dll
2017-08-09 09:36 - 2017-07-12 07:13 - 001478656 _____ (Microsoft Corporation) C:\Windows\system32\RecoveryDrive.exe
2017-08-09 09:36 - 2017-07-12 07:12 - 000970240 _____ (Microsoft Corporation) C:\Windows\system32\autochk.exe
2017-08-09 09:36 - 2017-07-12 07:12 - 000091648 _____ (Microsoft Corporation) C:\Windows\system32\updatepolicy.dll
2017-08-09 09:36 - 2017-07-12 07:12 - 000035328 _____ (Microsoft Corporation) C:\Windows\system32\iscsium.dll
2017-08-09 09:36 - 2017-07-12 07:11 - 000576512 _____ (Microsoft Corporation) C:\Windows\system32\untfs.dll
2017-08-09 09:36 - 2017-07-12 07:10 - 000927232 _____ (Microsoft Corporation) C:\Windows\system32\autofmt.exe
2017-08-09 09:36 - 2017-07-12 07:09 - 003291136 _____ (Microsoft Corporation) C:\Windows\system32\mispace.dll
2017-08-09 09:36 - 2017-07-12 07:08 - 002861056 _____ (Microsoft Corporation) C:\Windows\system32\storagewmi.dll
2017-08-09 09:36 - 2017-07-12 07:07 - 000954880 _____ (Microsoft Corporation) C:\Windows\system32\autoconv.exe
2017-08-09 09:36 - 2017-07-12 07:07 - 000629248 _____ (Microsoft Corporation) C:\Windows\system32\uReFS.dll
2017-08-09 09:36 - 2017-07-12 07:06 - 000956416 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentExtensions.desktop.dll
2017-08-09 09:36 - 2017-07-12 07:03 - 001692160 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentExtensions.onecore.dll
2017-08-09 09:36 - 2017-07-12 07:03 - 000826880 _____ (Microsoft Corporation) C:\Windows\system32\netlogon.dll
2017-08-09 09:36 - 2017-07-12 07:02 - 000869888 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2017-08-09 09:36 - 2017-07-12 07:01 - 002279424 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentServer.dll
2017-08-09 09:36 - 2017-07-12 06:59 - 006664192 _____ (Microsoft Corporation) C:\Windows\system32\mspaint.exe
2017-08-09 09:36 - 2017-07-12 06:59 - 002318336 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2017-08-09 09:36 - 2017-07-12 06:59 - 000632320 _____ (Microsoft Corporation) C:\Windows\system32\rasapi32.dll
2017-08-09 09:36 - 2017-07-12 06:58 - 001231872 _____ (Microsoft Corporation) C:\Windows\system32\dosvc.dll
2017-08-09 09:36 - 2017-03-04 08:57 - 000372432 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Media.MediaControl.dll
2017-08-09 09:36 - 2017-03-04 08:16 - 000187904 _____ (Microsoft Corporation) C:\Windows\system32\dialclient.dll
2017-08-09 09:36 - 2017-03-04 08:07 - 000909312 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Search.dll
 
==================== Ein Monat: Geänderte Dateien und Ordner ========
 
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
 
2017-09-05 09:15 - 2017-05-01 11:06 - 000004180 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{3D7ABB70-F58C-43B7-A47F-CC3B248EBDDF}
2017-09-05 09:15 - 2017-02-24 21:03 - 000000000 ____D C:\Users\Marko Gast\AppData\Local\CrashDumps
2017-09-05 09:14 - 2017-02-24 21:02 - 000000000 ____D C:\Users\Marko Gast\AppData\Local\Packages
2017-09-05 09:14 - 2017-02-24 21:02 - 000000000 ____D C:\Users\Marko Gast
2017-09-05 09:14 - 2017-02-24 16:46 - 000000000 ____D C:\ProgramData\NVIDIA
2017-09-05 09:14 - 2016-07-16 13:47 - 000000000 ____D C:\Windows\AppReadiness
2017-09-04 21:22 - 2017-02-24 23:02 - 000000000 ____D C:\Users\Marko Gast\AppData\Local\Ubisoft Game Launcher
2017-09-04 21:22 - 2017-02-24 18:42 - 000000000 ____D C:\Program Files (x86)\Steam
2017-09-03 22:53 - 2017-02-24 21:05 - 000000000 ____D C:\Users\Marko Gast\AppData\Roaming\TS3Client
2017-09-03 21:56 - 2016-07-16 13:45 - 000000000 ____D C:\Windows\INF
2017-09-03 21:24 - 2017-02-24 17:16 - 000000000 ____D C:\ProgramData\Package Cache
2017-09-03 21:06 - 2017-07-12 14:45 - 000000000 ____D C:\Program Files\DIFX
2017-09-03 20:43 - 2017-02-24 21:03 - 000000000 ____D C:\Users\Marko Gast\AppData\LocalLow\Mozilla
2017-09-03 20:43 - 2017-02-24 16:54 - 000000000 ____D C:\Program Files\Mozilla Firefox
2017-09-03 20:43 - 2017-02-24 16:54 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-09-03 20:41 - 2017-02-24 21:05 - 000000000 ____D C:\Users\Marko Gast\AppData\Local\TeamSpeak 3 Client
2017-09-03 20:20 - 2017-02-24 16:55 - 000000000 ____D C:\Users\Marko\AppData\LocalLow\Mozilla
2017-09-03 19:56 - 2017-02-24 16:44 - 003365826 _____ C:\Windows\system32\PerfStringBackup.INI
2017-09-03 19:56 - 2016-07-17 00:51 - 001516282 _____ C:\Windows\system32\perfh007.dat
2017-09-03 19:56 - 2016-07-17 00:51 - 000382194 _____ C:\Windows\system32\perfc007.dat
2017-09-03 19:51 - 2017-02-24 16:52 - 000000000 ____D C:\Users\Marko\AppData\Local\CrashDumps
2017-09-03 15:57 - 2017-02-24 16:38 - 000000000 ____D C:\Windows\system32\SleepStudy
2017-09-03 14:34 - 2016-07-16 13:47 - 000000000 ___HD C:\Program Files\WindowsApps
2017-09-01 12:00 - 2017-07-11 23:01 - 000002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2017-09-01 11:56 - 2016-07-16 13:47 - 000000000 ____D C:\Windows\LiveKernelReports
2017-08-31 10:24 - 2017-02-24 17:47 - 000253856 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-08-31 10:24 - 2017-02-24 16:38 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2017-08-30 21:22 - 2017-02-26 20:09 - 000000000 ____D C:\Users\Marko\AppData\Local\JDownloader 2.0
2017-08-30 21:22 - 2016-07-16 08:04 - 000524288 _____ C:\Windows\system32\config\BBI
2017-08-30 20:49 - 2016-07-16 13:36 - 000000000 ____D C:\Windows\CbsTemp
2017-08-28 09:13 - 2017-02-24 16:41 - 000000000 ____D C:\Users\Marko
2017-08-25 19:54 - 2017-02-24 21:04 - 000000000 ____D C:\Users\Marko Gast\AppData\Local\NVIDIA Corporation
2017-08-24 18:18 - 2017-02-24 17:26 - 000000000 ____D C:\Users\Marko\AppData\Local\NVIDIA Corporation
2017-08-24 18:17 - 2017-02-24 16:42 - 000000000 __RHD C:\Users\Public\AccountPictures
2017-08-24 18:17 - 2017-02-24 16:42 - 000000000 ____D C:\Users\Marko\AppData\Local\Packages
2017-08-20 19:31 - 2017-02-24 16:46 - 000000000 ____D C:\ProgramData\NVIDIA Corporation
2017-08-18 19:18 - 2017-03-21 15:22 - 000000057 _____ C:\Users\Marko Gast\Desktop\Cmd.txt
2017-08-18 19:14 - 2017-02-24 17:49 - 000004308 _____ C:\Windows\System32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-08-18 19:14 - 2017-02-24 17:49 - 000003894 _____ C:\Windows\System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-08-18 19:14 - 2017-02-24 17:49 - 000003866 _____ C:\Windows\System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-08-18 19:14 - 2017-02-24 17:49 - 000003858 _____ C:\Windows\System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-08-18 19:14 - 2017-02-24 17:49 - 000003696 _____ C:\Windows\System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-08-18 19:14 - 2017-02-24 17:49 - 000003654 _____ C:\Windows\System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2017-08-18 19:14 - 2017-02-24 16:46 - 000000000 ____D C:\Program Files\NVIDIA Corporation
2017-08-18 19:14 - 2017-02-24 16:46 - 000000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2017-08-18 09:59 - 2017-02-24 19:51 - 000544424 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2017-08-10 15:18 - 2017-07-15 10:16 - 000000000 ___RD C:\Users\Marko Gast\Desktop\3D Print
2017-08-10 12:58 - 2017-07-11 23:01 - 000004562 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2017-08-09 13:35 - 2016-07-16 13:47 - 000000000 ____D C:\Windows\rescache
2017-08-09 12:58 - 2017-02-24 16:38 - 000194296 _____ C:\Windows\system32\FNTCACHE.DAT
2017-08-09 11:36 - 2016-07-17 00:56 - 000000000 ____D C:\Program Files\Windows Defender Advanced Threat Protection
2017-08-09 11:36 - 2016-07-16 13:47 - 000000000 ___RD C:\Windows\ImmersiveControlPanel
2017-08-09 11:36 - 2016-07-16 13:47 - 000000000 ___RD C:\Program Files\Windows Defender
2017-08-09 11:36 - 2016-07-16 13:47 - 000000000 ____D C:\Windows\system32\oobe
2017-08-09 11:36 - 2016-07-16 13:47 - 000000000 ____D C:\Windows\ShellExperiences
2017-08-09 11:36 - 2016-07-16 13:47 - 000000000 ____D C:\Windows\Provisioning
2017-08-09 11:36 - 2016-07-16 13:47 - 000000000 ____D C:\Windows\PolicyDefinitions
2017-08-09 11:36 - 2016-07-16 13:47 - 000000000 ____D C:\Windows\bcastdvr
2017-08-09 11:36 - 2016-07-16 13:47 - 000000000 ____D C:\Program Files\Windows Photo Viewer
2017-08-09 11:36 - 2016-07-16 13:47 - 000000000 ____D C:\Program Files\Common Files\System
2017-08-09 11:36 - 2016-07-16 13:47 - 000000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2017-08-09 11:36 - 2016-07-16 13:47 - 000000000 ____D C:\Program Files (x86)\Windows Defender
2017-08-09 09:38 - 2017-02-24 19:51 - 140394280 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2017-08-09 09:38 - 2017-02-24 19:51 - 000000000 ____D C:\Windows\system32\MRT
 
Einige Dateien in TEMP:
====================
2017-02-26 20:09 - 2017-02-26 20:09 - 036403960 _____ (AppWork GmbH) C:\Users\Marko\AppData\Local\Temp\JDSetup131326061499721784.exe
2017-02-27 19:35 - 2017-02-27 19:35 - 036403960 _____ (AppWork GmbH) C:\Users\Marko\AppData\Local\Temp\JDSetup131326905077656060.exe
2017-02-24 16:46 - 2016-12-29 14:43 - 000860776 _____ (NVIDIA Corporation) C:\Users\Marko\AppData\Local\Temp\nvSCPAPI64.dll
2017-02-24 17:25 - 2016-12-29 14:43 - 000351680 _____ (NVIDIA Corporation) C:\Users\Marko\AppData\Local\Temp\nvStInst.exe
2017-02-27 19:35 - 2017-02-27 19:35 - 000040448 ____N () C:\Users\Marko\AppData\Local\Temp\proxy_vole5963336039245151801.dll
2017-03-02 21:28 - 2016-07-16 13:42 - 000616048 _____ (Microsoft Corporation) C:\Users\Marko Gast\AppData\Local\Temp\kernel32.dll
2017-08-23 16:40 - 2017-08-23 16:40 - 000040448 ____N () C:\Users\Marko Gast\AppData\Local\Temp\proxy_vole4993886941099080018.dll
2017-08-23 16:40 - 2017-08-23 16:40 - 000040448 ____N () C:\Users\Marko Gast\AppData\Local\Temp\proxy_vole511313540820091347.dll
2017-08-23 16:40 - 2017-08-23 16:40 - 000040448 _____ () C:\Users\Marko Gast\AppData\Local\Temp\proxy_vole6273739135071748116.dll
 
==================== Bamital & volsnap ======================
 
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
 
C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert
 
LastRegBack: 2017-08-30 21:01
 

==================== Ende von FRST.txt ============================



https://pastebin.com/yj8nMLLs

Addition Admin:  https://pastebin.com/tkVFa2vA

Hope you can help
Thanks in advance!


Edited by hamluis, 05 September 2017 - 04:36 AM.


BC AdBot (Login to Remove)

 


#2 Slurppa

Slurppa

  • Malware Study Hall Senior
  • 656 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:35 AM

Posted 09 September 2017 - 04:29 AM

Hi imasuperstar and
Welcome to the Bleeping Computer! :)

My name is Slurppa and I will be handling your log(s) to help you get cleaned up. Please give me some time to look it over and I will get back to you as soon as possible.

 

The hacker get in the system and is writing him messages or moves his charachter in the game. I guess he only can control the keyboard so i'm not sure if he can control the mouse because he didn't do it.

We even have it on video how the hacker writes messages and the weird part is that he is only writing the same lines everytime so i guess it's something programmed to write and not the hacker himself.


What kind of messages are we talking about and in what context do they appear? Screenshots are welcome :)



Please familiarize yourself with the following guidelines:

  • Complete all the steps in their given order.
  • Update me about the current state of your computer.
  • If you have any problems or questions please let me know. If your are unsure how to continue please let me know.
  • Do not run any other fixes/programs that I have not instructed.
  • Copy and paste all logs into your post directly unless otherwise instructed. Don't attach logs.
  • Lack of symptoms does not mean the computer is clean. Please stick with me until I give you green light.

Member of the Bleeping Computer A.I.I. early response team!


#3 imasuperstar

imasuperstar
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  

Posted 09 September 2017 - 06:09 AM

Hello there, and thanks for your help, let m3 explain you the situation, i know it sounds weird but this is what happened.

My friend, the one infected, sold a game key an year ago to some creppy looking dude over the internet, they met once when they did the transaction. That guy had some problem with that game and my friend gave him the money back. And this guy got pissed or something and keeps hacking my friend's pc and writes over and over again everything they discussed, but for instance we are playing gta online and the hacker opens the ingame chat and writes stuff, or my friend opens cmd and the hacker writes in it.

Here is a video if you want to see it. Look at the ingame chat window and you can see the keyboard nod being used. This was the other day in the game. He does this everytime a chatbox is open. Doesn't matter if it's a game, program, browser or anything else.

Edit: forgot the link to the video

https://youtu.be/68PMrLsxl_M

Edited by imasuperstar, 09 September 2017 - 06:09 AM.


#4 Slurppa

Slurppa

  • Malware Study Hall Senior
  • 656 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:35 AM

Posted 10 September 2017 - 09:45 AM

Hi imasuperstar

I suggest you change your password with games you are having problems with(GTA V)
using secure computer or phone.

I noticed you have has many cryptocurrency programs installed.
dashcore-0.12.1
cura 2.6
puravidacoin


Are these intentional?

:step1:

We need to analyze few files. Please make sure you can see hidden files by following these steps:
How to view hidden files in Windows

Please do steps below for all the files listed here:

C:\Windows\system32\wwahost.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Users\Marko Gast\AppData\Local\Temp\kernel32.dll


Steps:

  • Go to VirusTotal website https://www.virustotal.com/
  • Click Choose File button and select file specified and double click it.
  • Click Scan It button. This may take a while.
  • Once finishes copy the result(the address in your browser) and include it in your next post.

Include links to all entries in VirusTotal to your next post.


Member of the Bleeping Computer A.I.I. early response team!


#5 Slurppa

Slurppa

  • Malware Study Hall Senior
  • 656 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:35 AM

Posted 13 September 2017 - 07:02 AM

Hi imasuperstar

 

Are you still with me?


Member of the Bleeping Computer A.I.I. early response team!


#6 imasuperstar

imasuperstar
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  

Posted 13 September 2017 - 07:07 AM

Hi imasuperstar
 
Are you still with me?


Hey there, yes, sorry, my friend, the one who's infected is out of the country and i can't scan the files right now.

We changed all the passwords to random passwords and the mining software is intentional, so no worries about that.

Thanks a lot for your help and i'll get back to you when i get acces to the Computer again.

#7 Slurppa

Slurppa

  • Malware Study Hall Senior
  • 656 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:35 AM

Posted 14 September 2017 - 09:56 AM

Hi

 

Thats okay :)

 

Can you tell me when can I expect you back?


Member of the Bleeping Computer A.I.I. early response team!


#8 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,316 posts
  • ONLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:11:35 AM

Posted 19 September 2017 - 10:13 AM

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days.

Please include a link to your topic in the Private Message. Thank you.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users