Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 26-09-2017 01
Ran by Administrator (administrator) on DC01 (28-09-2017 08:43:07)
Running from C:\Users\Administrator.BOULET\Desktop
Loaded Profiles: Sforest & Administrator (Available Profiles: alexis & Sforest & caroll & Gabrielle & Yanick & PierreB & Melodie & Jerome & pvanier & Punch & Vannak & MichelleT & Alexandra & vannak2 & temp & taher & Options & Access & xerdox & DB_ADMIN & FRANCOISP & Administrator & Classic .NET AppPool)
Platform: Windows Server 2008 R2 Standard Service Pack 1 (X64) Language: Anglais (États-Unis)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\LogonUI.exe
(Microsoft Corporation) C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe
(Microsoft Corporation) C:\Windows\System32\dfsrs.exe
(Microsoft Corporation) C:\Windows\System32\inetsrv\inetinfo.exe
(Microsoft Corporation) C:\Windows\System32\mqsvc.exe
(iAnywhere Solutions, Inc.) C:\Program Files\Lathem Time Corporation\PayClock\dbsrv11.exe
(Lathem Time Corporation) C:\Program Files\Lathem Time Corporation\PayClock\Lathem.USBTM.Service.PC600.Service.exe
(VMware, Inc.) C:\Program Files\VMware\VMware Tools\vmtoolsd.exe
(Dyn, Inc.) C:\Program Files (x86)\DynDNS Updater\DynUpSvc.exe
(Microsoft Corporation) C:\Windows\System32\vds.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\rdpclip.exe
(VMware, Inc.) C:\Program Files\VMware\VMware Tools\vmtoolsd.exe
(Microsoft Corporation) C:\Windows\System32\ntfrs.exe
(Microsoft Corporation) C:\Windows\System32\dns.exe
(Microsoft Corporation) C:\Windows\System32\ismserv.exe
(Microsoft Corporation) C:\Windows\System32\inetsrv\w3wp.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(iAnywhere Solutions, Inc.) C:\Program Files\Lathem Time Corporation\PayClock\dbextclr11.exe
(Microsoft Corporation) C:\Windows\System32\svchost_w32time.exe
(Microsoft Corporation) C:\Windows\System32\rdpclip.exe
(VMware, Inc.) C:\Program Files\VMware\VMware Tools\vmtoolsd.exe
(MagicISO, Inc.) C:\Program Files (x86)\MagicDisc\MagicDisc.exe
(Microsoft Corporation) C:\Windows\System32\PrintIsolationHost.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWelcome.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWelcome.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Bitdefender) C:\Program Files\Bitdefender\Endpoint Security\epupdateservice.exe
(Bitdefender) C:\Program Files\Bitdefender\Endpoint Security\epsecurityservice.exe
(Bitdefender) C:\Program Files\Bitdefender\Endpoint Security\epag.exe
(Bitdefender) C:\Program Files\Bitdefender\Endpoint Security\epconsole.exe
(Bitdefender) C:\Program Files\Bitdefender\Endpoint Security\epconsole.exe
(Bitdefender) C:\Program Files\Bitdefender\Endpoint Security\epintegrationservice.exe
(Microsoft Corporation) C:\Windows\System32\UI0Detect.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFiles.exe
(Microsoft Corporation) C:\Program Files\Windows NT\Accessories\wordpad.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Seagull Drivers] => ssdal_nc.exe startup
HKLM\...\Run: [MsmqIntCert] => regsvr32 /s mqrt.dll
HKLM\...\Run: [VMware User Process] => C:\Program Files\VMware\VMware Tools\vmtoolsd.exe [74968 2015-06-18] (VMware, Inc.)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4174464 2017-05-23] (Safer-Networking Ltd.)
HKLM\...\Policies\Explorer: [ShowSuperHidden] 1
Lsa: [Notification Packages] scecli rassfm
SecurityProviders: credssp.dll, pwdssp.dll
Startup: C:\Users\Administrator.BOULET\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk [2010-09-27]
ShortcutTarget: MagicDisc.lnk -> C:\Program Files (x86)\MagicDisc\MagicDisc.exe (MagicISO, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\..\Interfaces\{F406FD58-EDD0-483D-8F1C-E6E74AA77001}: [NameServer] 127.0.0.1,192.168.0.250

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKU\S-1-5-21-606344767-3282361405-600652822-1117\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-606344767-3282361405-600652822-500\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\ssv.dll [2015-03-04] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-03-04] (Oracle Corporation)
DPF: HKLM-x32 {4871A87A-BFDD-4106-8153-FFDE2BAC2967} hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.7.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

FireFox:
========
FF Plugin-x32: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-03-04] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-03-04] (Oracle Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-07-31] (Adobe Systems Inc.)

Chrome: 
=======
CHR Profile: C:\Users\Administrator.BOULET\AppData\Local\Google\Chrome\User Data\Default [2017-09-28]
CHR Extension: (No Name) - C:\Users\Administrator.BOULET\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-06-01]
CHR Extension: (No Name) - C:\Users\Administrator.BOULET\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-06-01]
CHR Extension: (No Name) - C:\Users\Administrator.BOULET\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-06-01]
CHR Extension: (No Name) - C:\Users\Administrator.BOULET\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-06-01]
CHR Extension: (Adobe Acrobat) - C:\Users\Administrator.BOULET\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2017-06-27]
CHR Extension: (No Name) - C:\Users\Administrator.BOULET\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-06-01]
CHR Extension: (No Name) - C:\Users\Administrator.BOULET\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-06-27]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Administrator.BOULET\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-09-27]
CHR Extension: (No Name) - C:\Users\Administrator.BOULET\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-06-01]
CHR Extension: (Chrome Media Router) - C:\Users\Administrator.BOULET\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-09-27]
CHR Profile: C:\Users\Administrator.BOULET\AppData\Local\Google\Chrome\User Data\System Profile [2017-06-27]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 ADWS; C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe [487424 2013-01-25] (Microsoft Corporation)
S2 Dfs; C:\Windows\system32\dfssvc.exe [377344 2010-11-20] (Microsoft Corporation)
R2 DFSR; C:\Windows\system32\DFSRs.exe [4518400 2010-11-20] (Microsoft Corporation)
R2 DHCPServer; C:\Windows\System32\dhcpssvc.dll [729088 2010-11-20] (Microsoft Corporation)
R2 DNS; C:\Windows\system32\dns.exe [700928 2017-07-08] (Microsoft Corporation)
R2 Dyn Updater; C:\Program Files (x86)\DynDNS Updater\DynUpSvc.exe [95608 2011-11-15] (Dyn, Inc.)
R2 epag; C:\Program Files\Bitdefender\Endpoint Security\epag.exe [3565928 2017-08-23] (Bitdefender)
R2 EPIntegrationService; C:\Program Files\Bitdefender\Endpoint Security\EPIntegrationService.exe [100392 2017-09-28] (Bitdefender)
R2 EPSecurityService; C:\Program Files\Bitdefender\Endpoint Security\EPSecurityService.exe [100392 2017-09-28] (Bitdefender)
R2 EPUpdateService; C:\Program Files\Bitdefender\Endpoint Security\EPUpdateService.exe [100392 2017-09-28] (Bitdefender)
S3 FCRegSvc; C:\Windows\system32\FCRegSvc.dll [25600 2009-07-13] (Microsoft Corporation)
R2 IISADMIN; C:\Windows\system32\inetsrv\inetinfo.exe [15872 2010-11-20] (Microsoft Corporation)
R2 IsmServ; C:\Windows\System32\ismserv.exe [59392 2010-11-20] (Microsoft Corporation)
R2 kdc; C:\Windows\System32\lsass.exe [30720 2017-08-11] (Microsoft Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6058960 2017-08-07] (Malwarebytes)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [50688 2012-07-31] (Hewlett-Packard) [File not signed]
R2 NTDS; C:\Windows\System32\lsass.exe [30720 2017-08-11] (Microsoft Corporation)
R2 NtFrs; C:\Windows\system32\ntfrs.exe [1020416 2010-11-20] (Microsoft Corporation)
R2 PayClock_Sql_64; C:\Program Files\Lathem Time Corporation\PayClock\dbsrv11.exe [140152 2011-05-16] (iAnywhere Solutions, Inc.)
R2 PayClock_Terminal_Service; C:\Program Files\Lathem Time Corporation\PayClock\Lathem.USBTM.Service.PC600.Service.exe [20776 2013-12-10] (Lathem Time Corporation)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [66048 2012-07-31] (Hewlett-Packard) [File not signed]
S2 Printer DCA; C:\Program Files (x86)\Printer DCA\PrinterDCA.Service.exe [56832 2012-07-27] (PrintFleet Inc) [File not signed]
S3 RSoPProv; C:\Windows\system32\RSoPProv.exe [91648 2009-07-13] (Microsoft Corporation)
S3 sacsvr; C:\Windows\system32\sacsvr.dll [14848 2009-07-13] (Microsoft Corporation)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1776864 2017-05-23] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2131760 2017-05-23] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [233936 2017-05-23] (Safer-Networking Ltd.)
S3 SMTPSVC; C:\Windows\system32\inetsrv\inetinfo.exe [15872 2010-11-20] (Microsoft Corporation)
S3 SrmReports; C:\Windows\system32\srmhost.exe [76288 2010-11-20] (Microsoft Corporation)
R2 SrmSvc; C:\Windows\system32\srmsvc.dll [3489792 2010-11-20] (Microsoft Corporation)
R3 TermService; C:\Windows\system32\rdpwrap.dll [116736 2016-06-14] (Stas'M Corp.) [File not signed]
R2 TermServLicensing; C:\Windows\System32\lserver.dll [694784 2010-11-20] (Microsoft Corporation)
S3 LiveUpdate; "C:\PROGRA~2\Symantec\LIVEUP~1\LUCOMS~1.EXE" [X]

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R0 avc3; C:\Windows\System32\DRIVERS\avc3.sys [1763744 2017-08-23] (BitDefender)
R3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [882672 2017-08-23] (BitDefender)
R3 bddevflt; C:\Program Files\Bitdefender\Endpoint Security\bddevflt.sys [109272 2017-01-30] (BitDefender LLC)
R0 bdupflt; C:\Windows\System32\DRIVERS\bdupflt.sys [57544 2015-10-06] (Bitdefender)
R0 Datascrn; C:\Windows\System32\drivers\datascrn.sys [79936 2009-07-13] (Microsoft Corporation)
R1 DfsDriver; C:\Windows\System32\drivers\dfs.sys [51776 2009-07-13] (Microsoft Corporation)
R0 DfsrRo; C:\Windows\System32\drivers\dfsrro.sys [66944 2010-11-20] (Microsoft Corporation)
R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [77440 2017-08-24] ()
R0 gzflt; C:\Windows\System32\DRIVERS\gzflt.sys [187688 2017-09-27] (BitDefender LLC)
S3 ioatdma; C:\Windows\System32\Drivers\qd260x64.sys [35328 2009-06-10] (Intel Corporation)
R0 MBAMChameleon; C:\Windows\System32\drivers\MBAMChameleon.sys [192960 2017-09-28] (Malwarebytes)
R3 MBAMFarflt; C:\Windows\System32\DRIVERS\farflt.sys [101824 2017-09-28] (Malwarebytes)
R3 MBAMProtection; C:\Windows\system32\drivers\mbam.sys [45472 2017-09-28] (Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [253888 2017-09-28] (Malwarebytes)
R3 MBAMWebProtection; C:\Windows\system32\drivers\mwac.sys [84256 2017-09-28] (Malwarebytes)
R0 Quota; C:\Windows\System32\drivers\quota.sys [168016 2009-07-13] (Microsoft Corporation)
S0 sacdrv; C:\Windows\System32\DRIVERS\sacdrv.sys [96320 2009-07-13] (Microsoft Corporation)
R2 trufos; C:\Windows\System32\DRIVERS\trufos.sys [441112 2017-09-27] (BitDefender S.R.L.)
R2 VMMEMCTL; C:\Program Files\Common Files\VMware\Drivers\memctl\vmmemctl.sys [22744 2015-06-18] (VMware, Inc.)
R0 vsock; C:\Windows\System32\drivers\vsock.sys [73944 2014-02-10] (VMware, Inc.)
U4 npcap_wifi; no ImagePath
U3 tpautoconnsvc; no ImagePath
S4 vmrawdsk; \??\C:\Program Files\VMware\VMware Tools\vmrawdsk.sys [X]

========================== Drivers MD5 =======================

C:\Windows\system32\drivers\1394ohci.sys ==> MD5 is legit
C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit
C:\Windows\system32\drivers\acpipmi.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adp94xx.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpahci.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpu320.sys ==> MD5 is legit
C:\Windows\system32\drivers\afd.sys 0DC2A9882540DEA4A55B08785E09D8FC
C:\Windows\system32\drivers\agp440.sys ==> MD5 is legit
C:\Windows\system32\drivers\aliide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\amdk8.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\amdppm.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdsata.sys D4121AE6D0C0E7E13AA221AA57EF2D49
C:\Windows\system32\DRIVERS\amdsbs.sys ==> MD5 is legit
C:\Windows\System32\drivers\amdxata.sys 540DAF1CEA6094886D72126FD7C33048
C:\Windows\system32\drivers\appid.sys 086CA47573FAF282C93BE3416E1B6D65
C:\Windows\system32\DRIVERS\arc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\arcsas.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit
C:\Windows\System32\drivers\atapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\avc3.sys 8AFE08FD37D6F27C54A13118FD167786
C:\Windows\System32\DRIVERS\avckf.sys 8208896BDA980285901521F9524101DA
C:\Windows\system32\DRIVERS\bxvbda.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\b57nd60a.sys ==> MD5 is legit
C:\Program Files\Bitdefender\Endpoint Security\bddevflt.sys DFBB791B03DE8C2FD1A45555A4C6A97F
C:\Windows\System32\DRIVERS\bdupflt.sys 15EE4DF660019AC2390A8460FCEF0E0E
C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\blbdrive.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bowser.sys ABA3984C822E4D3F889699912D85D6C5
C:\Windows\system32\DRIVERS\BrFiltLo.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltUp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit
C:\Windows\system32\drivers\cdrom.sys ==> MD5 is legit
C:\Windows\System32\CLFS.sys 3963FEC1892368DD500E6ED1F5C286CE
C:\Windows\System32\DRIVERS\CmBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\cmdide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\cng.sys A98CED39AD91B445E2E442A9BD67E8B4
C:\Windows\System32\DRIVERS\compbatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\CompositeBus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\crcdisk.sys ==> MD5 is legit
C:\Windows\System32\drivers\datascrn.sys 05515E104AAE4FDB3DC66384FF745024
C:\Windows\System32\Drivers\dfsc.sys 9B38580063D281A99E68EF5813022A5F
C:\Windows\System32\drivers\dfs.sys FFFE7EF57BD8C93AB3076B340FAE0830
C:\Windows\System32\drivers\dfsrro.sys E66B02FC5250331BAAC1CAE2111D1288
C:\Windows\System32\drivers\discache.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\disk.sys ==> MD5 is legit
C:\Windows\System32\drivers\dxgkrnl.sys 5CEF80AE869336376F550ECAE91E424A
C:\Windows\System32\DRIVERS\E1G6032E.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\evbda.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\elxstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\errdev.sys ==> MD5 is legit
C:\Windows\system32\drivers\mbae64.sys 11B9D886D7AE2F2F5C6BC03D7C52FD31
C:\Windows\System32\Drivers\exfat.sys 7E45F8B117419ABA3BB26579F6E70324
C:\Windows\System32\Drivers\fastfat.sys 6EDFA237D25433C03F42FBFDB16BDD24
C:\Windows\System32\DRIVERS\fdc.sys ==> MD5 is legit
C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit
C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\flpydisk.sys ==> MD5 is legit
C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Fs_Rec.sys 6BD9295CC032DD3077C671FCCF579A7B
C:\Windows\system32\DRIVERS\gagp30kx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\gzflt.sys DD528E0A0C57B02A6FC311AA05D430C2
C:\Windows\system32\drivers\HDAudBus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\HidBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\hidusb.sys ==> MD5 is legit
C:\Windows\system32\drivers\HpSAMD.sys ==> MD5 is legit
C:\Windows\System32\drivers\HTTP.sys CF5C9BD985120781200D35FD445D0BD5
C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\i8042prt.sys ==> MD5 is legit
C:\Windows\system32\drivers\iaStorV.sys AAAF44DB3BD0B9D1FB6969B23ECC8366
C:\Windows\system32\DRIVERS\iirsp.sys ==> MD5 is legit
C:\Windows\System32\drivers\intelide.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\intelppm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\qd260x64.sys FF0FB51A0ACC2E2D0D412138A05A0B59
C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\IPMIDrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit
C:\Windows\system32\drivers\isapnp.sys ==> MD5 is legit
C:\Windows\system32\drivers\msiscsi.sys 96BB922A0981BC7432C8CF52B5410FE6
C:\Windows\system32\drivers\kbdclass.sys ==> MD5 is legit
C:\Windows\system32\drivers\kbdhid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\ksecdd.sys 7635071BC8EDBC8B501F4EF2B0A82820
C:\Windows\System32\Drivers\ksecpkg.sys 033937305C234FC8215A4692193AA43E
C:\Windows\system32\drivers\ksthunk.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_fc.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\lsi_sas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_scsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit
C:\Windows\System32\drivers\MBAMChameleon.sys 25FAEF6CCFF6D9912A65641AE60711EB
C:\Windows\System32\DRIVERS\farflt.sys 4988F9AEE3B9E4545975CAA9381DB0EF
C:\Windows\system32\drivers\mbam.sys 149E252142950594695178971748D056
C:\Windows\system32\drivers\MBAMSwissArmy.sys 94FCA94EE7937EA3ED75F39DE4C8E292
C:\Windows\system32\drivers\mwac.sys 530382A92353754F22DF0183D6A74BF8
C:\Windows\System32\DRIVERS\mcdbus.sys 79D51E7F5926E8CE1B3EBECEBAE28CFF
C:\Windows\SysWOW64\DRIVERS\mcdbus.sys 79D51E7F5926E8CE1B3EBECEBAE28CFF
C:\Windows\system32\DRIVERS\megasas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MegaSR.sys ==> MD5 is legit
C:\Windows\System32\drivers\modem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\mouhid.sys ==> MD5 is legit
C:\Windows\System32\drivers\mountmgr.sys 072D8646E23ECF8A3F5F0157017B4DB6
C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\mqac.sys CD22D2563039DDA6793F7624719363A7
C:\Windows\System32\DRIVERS\mrxsmb.sys F77E8ABD746B93B9B4F9C13250302C47
C:\Windows\System32\DRIVERS\mrxsmb10.sys FF1B4AF370481C25B078FEAEE5455EDC
C:\Windows\System32\DRIVERS\mrxsmb20.sys 125B7C9D7372711EDBD5BFEE2E33CE60
C:\Windows\system32\drivers\msahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit
C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\loop.sys 103B3BBE23AB774B009D182276EC6786
C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit
C:\Windows\system32\drivers\mssmbios.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MTConfig.sys ==> MD5 is legit
C:\Windows\System32\Drivers\mup.sys AA0C2BA3782E92BD85E2264BE418E67C
C:\Windows\System32\drivers\ndis.sys F7309F42555F8AAB7144A51A1F2585B0
C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbt.sys 734837208CAFD6E0959A7A0333C95C9D
C:\Windows\system32\DRIVERS\nfrd960.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys BE313E566EEA2A4B7F9AAC9782A567D4
C:\Windows\System32\Drivers\Ntfs.sys 7FD5A7FB8F55254E9AF5666C653AF3CA
C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit
C:\Windows\system32\drivers\nvraid.sys 0A92CB65770442ED0DC44834632F66AD
C:\Windows\system32\drivers\nvstor.sys DAB0E87525C10052BF65F06152F37E4A
C:\Windows\system32\drivers\nv_agp.sys ==> MD5 is legit
C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\parport.sys ==> MD5 is legit
C:\Windows\System32\drivers\partmgr.sys E9766131EEADE40A27DC27D2D68FBA9C
C:\Windows\System32\drivers\pci.sys ==> MD5 is legit
C:\Windows\system32\drivers\pciide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\pcmcia.sys ==> MD5 is legit
C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit
C:\Windows\System32\drivers\peauth.sys EA4D67448BE493D543F1730D6CD04694
C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\processr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\ql2300.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\ql40xx.sys ==> MD5 is legit
C:\Windows\System32\drivers\quota.sys 6BA43DAA24BE55DB3741732550584D24
C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdbss.sys 71B6F78D6444CCE6F77BC42917A4E8F7
C:\Windows\System32\DRIVERS\rdpbus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpdr.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RDPWD.sys FE571E088C2D83619D2D48D4E961BF41
C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit
C:\Windows\system32\drivers\vms3cap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\sacdrv.sys D65E5E5C59F70516E856F5350106CDAB
C:\Windows\system32\drivers\sbp2port.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit
C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\serenum.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\serial.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sermouse.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sfloppy.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\SiSRaid2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sisraid4.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit
C:\Windows\System32\Drivers\spldr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\srv.sys 9FDD80B815A7F29554FF6E0D77A7F60D
C:\Windows\System32\DRIVERS\srv2.sys D62B353400F2C1FD0A5E93F8BDA83715
C:\Windows\System32\DRIVERS\srvnet.sys CAEAA7FF473E33DB8E5B72AB145907D3
C:\Windows\system32\DRIVERS\stexstor.sys ==> MD5 is legit
C:\Windows\System32\drivers\vmstorfl.sys ==> MD5 is legit
C:\Windows\system32\drivers\storvsc.sys ==> MD5 is legit
C:\Windows\system32\drivers\storvsp.sys 6B567ABA6A040F73219628C510FE7144
C:\Windows\system32\drivers\swenum.sys ==> MD5 is legit
C:\Windows\System32\drivers\tcpip.sys 7FB36A0A036ADDACE0A868E4A43C1C27
C:\Windows\System32\DRIVERS\tcpip.sys 7FB36A0A036ADDACE0A868E4A43C1C27
C:\Windows\System32\drivers\tcpipreg.sys 1B16D0BD9841794A6E0CDE0CEF744ABC
C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit
C:\Windows\System32\drivers\tdtcp.sys 51C5ECEB1CDEE2468A1748BE550CFBC8
C:\Windows\System32\DRIVERS\tdx.sys 4DD986720F7CB7A8A5D1226793097B9A
C:\Windows\system32\drivers\termdd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\trufos.sys D6B788AAF4ED515CC285A49C588142CF
C:\Windows\System32\DRIVERS\tssecsrv.sys E232A3B43A894BB327FC161529BD9ED1
C:\Windows\System32\drivers\tsusbflt.sys E9981ECE8D894CEF7038FD1D040EB426
C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\uagp35.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit
C:\Windows\system32\drivers\uliagpkx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\umbus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\umpass.sys ==> MD5 is legit
C:\Windows\system32\drivers\usbccgp.sys DCA68B0943D6FA415F0C56C92158A83A
C:\Windows\system32\DRIVERS\usbehci.sys ==> MD5 is legit
C:\Windows\system32\drivers\usbhub.sys 8D1196CFBB223621F2C67D45710F25BA
C:\Windows\system32\DRIVERS\usbohci.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\usbprint.sys ==> MD5 is legit
C:\Windows\system32\drivers\USBSTOR.SYS D029DD09E22EB24318A8FC3D8138BA43
C:\Windows\system32\DRIVERS\usbuhci.sys ==> MD5 is legit
C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit
C:\Windows\System32\drivers\vga.sys ==> MD5 is legit
C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaide.sys ==> MD5 is legit
C:\Windows\system32\drivers\Vid.sys 1720D283BDB1EAA7F21976586FF52B95
C:\Windows\System32\DRIVERS\vm3dmp.sys 4B76095018EF1861B3F93E619552B0DB
C:\Windows\System32\drivers\vmbus.sys ==> MD5 is legit
C:\Windows\system32\drivers\VMBusHID.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vmci.sys BE8E5E5D53ACF71D4E8E686B68C99B04
C:\Program Files\Common Files\VMware\Drivers\memctl\vmmemctl.sys 29696FF37D319FFCE5E723BEB3CBE6AD
C:\Windows\System32\DRIVERS\vmmouse.sys BBE7ED0ED87295C4E4F7A323D260DE19
C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgrx.sys 85C5468BC395819AE2A0C747334BA14C
C:\Windows\System32\drivers\volsnap.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\vsmraid.sys ==> MD5 is legit
C:\Windows\System32\drivers\vsock.sys 2CE26100BB635E18E029E9DF66A51FE1
C:\Windows\system32\DRIVERS\wacompen.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\wd.sys ==> MD5 is legit
C:\Windows\System32\drivers\Wdf01000.sys E2C933EDBC389386EBE6D2BA953F43D8
C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit
C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\SysWOW64\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\system32\drivers\wmiacpi.sys ==> MD5 is legit
C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\WSDPrint.sys 8D918B1DB190A4D9B1753A66FA8C96E8
C:\Windows\System32\drivers\WudfPf.sys AB886378EEB55C6C75B4F2D14B6C869F

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

NETSVC: sacsvr -> C:\Windows\system32\sacsvr.dll (Microsoft Corporation)

==================== Three Months Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-09-28 08:43 - 2017-09-28 08:43 - 000030708 _____ C:\Users\Administrator.BOULET\Desktop\FRST.txt
2017-09-28 08:42 - 2017-09-28 08:43 - 000000000 ____D C:\FRST
2017-09-28 08:41 - 2017-09-28 08:41 - 000001067 _____ C:\Windows\wininit.ini
2017-09-28 08:41 - 2017-09-28 08:40 - 002399744 _____ (Farbar) C:\Users\Administrator.BOULET\Desktop\FRST64.exe
2017-09-28 08:25 - 2017-09-28 08:17 - 000315000 _____ C:\winchk_2.0.exe
2017-09-28 08:24 - 2017-09-28 08:25 - 000000875 _____ C:\WinChk.txt
2017-09-28 08:03 - 2017-09-28 08:03 - 000000000 ____D C:\Users\SFOREST\AppData\LocalLow\Temp
2017-09-28 00:52 - 2017-09-28 07:56 - 000084256 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
2017-09-28 00:52 - 2017-09-28 00:52 - 000253888 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-09-28 00:52 - 2017-09-28 00:52 - 000192960 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMChameleon.sys
2017-09-28 00:52 - 2017-09-28 00:52 - 000101824 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys
2017-09-28 00:52 - 2017-09-28 00:52 - 000045472 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2017-09-28 00:52 - 2017-09-28 00:52 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-09-28 00:52 - 2017-09-28 00:52 - 000000000 ____D C:\ProgramData\Malwarebytes
2017-09-28 00:52 - 2017-09-28 00:52 - 000000000 ____D C:\Program Files\Malwarebytes
2017-09-28 00:50 - 2017-09-28 00:51 - 068408664 _____ (Malwarebytes ) C:\Users\Administrator.BOULET\Downloads\mb3-setup-consumer-3.2.2.2029.exe
2017-09-27 23:53 - 2017-09-27 23:53 - 000388096 _____ C:\Users\Administrator.BOULET\Downloads\avcertclean_1.1.2.exe
2017-09-27 23:47 - 2017-09-27 23:47 - 000000000 ____D C:\Users\Administrator.BOULET\Documents\ProcAlyzer Dumps
2017-09-27 23:45 - 2017-09-28 08:37 - 000210469 _____ C:\Users\Administrator.BOULET\Desktop\ZHPDiag.txt
2017-09-27 23:41 - 2017-09-28 08:37 - 000000000 ____D C:\Users\Administrator.BOULET\AppData\Local\ZHP
2017-09-27 23:41 - 2017-09-28 08:35 - 000000000 ____D C:\Users\Administrator.BOULET\AppData\Roaming\ZHP
2017-09-27 23:41 - 2017-09-27 23:41 - 002892160 _____ C:\Users\Administrator.BOULET\Downloads\ZHPDiag3.exe
2017-09-27 23:41 - 2017-09-27 23:41 - 000000831 _____ C:\Users\Administrator.BOULET\Desktop\ZHPDiag.lnk
2017-09-27 23:38 - 2017-09-27 23:38 - 000133088 _____ C:\Users\Administrator.BOULET\Desktop\TeamSpybot-20170927-233857.cab
2017-09-27 22:46 - 2017-09-27 22:52 - 000000000 ____D C:\ProgramData\Spybot - Search & Destroy
2017-09-27 22:46 - 2017-09-27 22:48 - 000000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2017-09-27 22:46 - 2017-09-27 22:46 - 000001387 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2017-09-27 22:46 - 2017-09-27 22:46 - 000001375 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2017-09-27 22:46 - 2017-09-27 22:46 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2017-09-27 22:46 - 2017-05-23 09:22 - 000032240 _____ (Safer-Networking Ltd.) C:\Windows\system32\sdnclean64.exe
2017-09-27 22:44 - 2017-09-27 22:45 - 051725936 _____ (Safer-Networking Ltd. ) C:\Users\Administrator.BOULET\Downloads\spybotsd-2.6.46.exe
2017-09-27 22:07 - 2017-09-27 22:08 - 000388608 _____ (Trend Micro Inc.) C:\Users\Administrator.BOULET\Downloads\HijackThis.exe
2017-09-27 10:02 - 2017-09-27 10:02 - 001154750 _____ C:\ProgramData\1506520510.bdinstall.bin
2017-09-27 09:58 - 2017-09-27 09:58 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bitdefender Endpoint Security Tools
2017-09-27 09:58 - 2017-08-23 03:49 - 001763744 _____ (BitDefender) C:\Windows\system32\Drivers\avc3.sys
2017-09-27 09:58 - 2017-08-23 03:49 - 000882672 ____R (BitDefender) C:\Windows\system32\Drivers\avckf.sys
2017-09-27 09:58 - 2015-10-06 14:58 - 000057544 _____ (Bitdefender) C:\Windows\system32\Drivers\bdupflt.sys
2017-09-27 09:55 - 2017-09-27 09:55 - 000441112 _____ (BitDefender S.R.L.) C:\Windows\system32\Drivers\trufos.sys
2017-09-27 09:55 - 2017-09-27 09:54 - 000187688 _____ (BitDefender LLC) C:\Windows\system32\Drivers\gzflt.sys
2017-09-27 09:55 - 2017-09-27 09:54 - 000008136 _____ C:\Windows\system32\Drivers\gzflt.cat
2017-09-27 08:53 - 2017-09-27 08:55 - 147817656 _____ (WatchGuard Technologies, Inc. ) C:\Users\Administrator.BOULET\Downloads\WSM11_11_4.exe
2017-09-27 06:54 - 2017-09-27 09:01 - 000000000 ____D C:\Program Files\Npcap
2017-09-27 06:53 - 2017-09-27 09:01 - 000000000 ____D C:\Program Files (x86)\Nmap
2017-09-22 13:48 - 2017-09-22 13:49 - 000090113 _____ C:\ProgramData\1506102484.4192.bin
2017-09-22 13:48 - 2017-09-22 13:49 - 000049871 _____ C:\ProgramData\1506102484.1980.bin
2017-09-22 13:48 - 2017-09-22 13:49 - 000002271 _____ C:\ProgramData\1506102484.5788.bin
2017-09-14 07:50 - 2017-09-14 07:50 - 000058016 _____ C:\Users\CAROLL\AppData\Local\GDIPFONTCACHEV1.DAT
2017-09-14 07:50 - 2017-09-14 07:50 - 000001413 _____ C:\Users\CAROLL\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2017-09-14 07:50 - 2017-09-14 07:50 - 000000020 ___SH C:\Users\CAROLL\ntuser.ini
2017-09-14 07:50 - 2017-09-14 07:50 - 000000000 ____D C:\Users\CAROLL\AppData\Roaming\Adobe
2017-09-14 07:50 - 2017-09-14 07:50 - 000000000 ____D C:\Users\CAROLL\AppData\Local\VirtualStore
2017-09-14 07:50 - 2017-09-14 07:50 - 000000000 ____D C:\Users\CAROLL\AppData\Local\Google
2017-09-14 07:50 - 2017-09-14 07:50 - 000000000 ____D C:\Users\CAROLL
2017-09-13 09:33 - 2017-08-19 11:28 - 000197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2017-09-13 09:33 - 2017-08-19 11:10 - 000180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2017-09-13 09:33 - 2017-08-16 11:29 - 000806912 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2017-09-13 09:33 - 2017-08-16 11:10 - 000629760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2017-09-13 09:33 - 2017-08-16 10:57 - 003224576 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2017-09-13 09:33 - 2017-08-15 11:29 - 014182400 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2017-09-13 09:33 - 2017-08-15 11:29 - 001867264 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2017-09-13 09:33 - 2017-08-15 11:10 - 012880896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2017-09-13 09:33 - 2017-08-15 11:10 - 001499648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2017-09-13 09:33 - 2017-08-14 13:35 - 003203584 _____ (Microsoft Corporation) C:\Windows\system32\mmcndmgr.dll
2017-09-13 09:33 - 2017-08-14 13:35 - 002150912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mmcndmgr.dll
2017-09-13 09:33 - 2017-08-14 13:35 - 000355328 _____ (Microsoft Corporation) C:\Windows\system32\mmcbase.dll
2017-09-13 09:33 - 2017-08-14 13:35 - 000303104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mmcbase.dll
2017-09-13 09:33 - 2017-08-14 13:35 - 000172544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cic.dll
2017-09-13 09:33 - 2017-08-14 13:35 - 000131072 _____ (Microsoft Corporation) C:\Windows\system32\mmcshext.dll
2017-09-13 09:33 - 2017-08-14 13:35 - 000128512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mmcshext.dll
2017-09-13 09:33 - 2017-08-14 13:34 - 000211968 _____ (Microsoft Corporation) C:\Windows\system32\cic.dll
2017-09-13 09:33 - 2017-08-13 17:37 - 002144256 _____ (Microsoft Corporation) C:\Windows\system32\mmc.exe
2017-09-13 09:33 - 2017-08-13 17:30 - 001401344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mmc.exe
2017-09-13 09:33 - 2017-08-11 02:42 - 000631176 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2017-09-13 09:33 - 2017-08-11 02:38 - 005547752 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2017-09-13 09:33 - 2017-08-11 02:38 - 000706792 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2017-09-13 09:33 - 2017-08-11 02:38 - 000154856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2017-09-13 09:33 - 2017-08-11 02:38 - 000095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2017-09-13 09:33 - 2017-08-11 02:36 - 001732864 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2017-09-13 09:33 - 2017-08-11 02:35 - 002065408 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2017-09-13 09:33 - 2017-08-11 02:35 - 001212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2017-09-13 09:33 - 2017-08-11 02:35 - 000757248 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2017-09-13 09:33 - 2017-08-11 02:35 - 000512000 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
2017-09-13 09:33 - 2017-08-11 02:35 - 000362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2017-09-13 09:33 - 2017-08-11 02:35 - 000346112 _____ (Microsoft Corporation) C:\Windows\system32\ntprint.dll
2017-09-13 09:33 - 2017-08-11 02:35 - 000345600 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2017-09-13 09:33 - 2017-08-11 02:35 - 000313856 _____ (Microsoft Corporation) C:\Windows\system32\Wldap32.dll
2017-09-13 09:33 - 2017-08-11 02:35 - 000243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2017-09-13 09:33 - 2017-08-11 02:35 - 000215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2017-09-13 09:33 - 2017-08-11 02:35 - 000210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2017-09-13 09:33 - 2017-08-11 02:35 - 000190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2017-09-13 09:33 - 2017-08-11 02:35 - 000135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2017-09-13 09:33 - 2017-08-11 02:35 - 000086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2017-09-13 09:33 - 2017-08-11 02:35 - 000063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2017-09-13 09:33 - 2017-08-11 02:35 - 000028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2017-09-13 09:33 - 2017-08-11 02:35 - 000028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2017-09-13 09:33 - 2017-08-11 02:35 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\oleres.dll
2017-09-13 09:33 - 2017-08-11 02:35 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\nsisvc.dll
2017-09-13 09:33 - 2017-08-11 02:35 - 000025600 _____ (Microsoft Corporation) C:\Windows\system32\winnsi.dll
2017-09-13 09:33 - 2017-08-11 02:35 - 000016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2017-09-13 09:33 - 2017-08-11 02:35 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2017-09-13 09:33 - 2017-08-11 02:35 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\nsi.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 001460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 001163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000971776 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000731648 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000419840 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000316928 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000123904 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000044032 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000008704 _____ (Microsoft Corporation) C:\Windows\system32\comcat.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:34 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:24 - 004001000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2017-09-13 09:33 - 2017-08-11 02:24 - 003945704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2017-09-13 09:33 - 2017-08-11 02:21 - 001314112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2017-09-13 09:33 - 2017-08-11 02:20 - 000071680 _____ C:\Windows\system32\PrintBrmUi.exe
2017-09-13 09:33 - 2017-08-11 02:20 - 000061952 _____ (Microsoft Corporation) C:\Windows\system32\ntprint.exe
2017-09-13 09:33 - 2017-08-11 02:19 - 001417728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 001114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000554496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000497664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000299008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntprint.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000275456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000271360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wldap32.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000026112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleres.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000016384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winnsi.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000008704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nsi.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 02:12 - 000025088 _____ (Microsoft Corporation) C:\Windows\system32\netbtugc.exe
2017-09-13 09:33 - 2017-08-11 02:09 - 000061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntprint.exe
2017-09-13 09:33 - 2017-08-11 02:07 - 000148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2017-09-13 09:33 - 2017-08-11 02:07 - 000062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2017-09-13 09:33 - 2017-08-11 02:07 - 000017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2017-09-13 09:33 - 2017-08-11 02:06 - 000064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2017-09-13 09:33 - 2017-08-11 02:03 - 000338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2017-09-13 09:33 - 2017-08-11 02:03 - 000026624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netbtugc.exe
2017-09-13 09:33 - 2017-08-11 02:01 - 000007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comcat.dll
2017-09-13 09:33 - 2017-08-11 02:00 - 000262656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netbt.sys
2017-09-13 09:33 - 2017-08-11 02:00 - 000159744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2017-09-13 09:33 - 2017-08-11 02:00 - 000050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2017-09-13 09:33 - 2017-08-11 01:59 - 000460800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2017-09-13 09:33 - 2017-08-11 01:59 - 000405504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2017-09-13 09:33 - 2017-08-11 01:59 - 000291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2017-09-13 09:33 - 2017-08-11 01:59 - 000168448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2017-09-13 09:33 - 2017-08-11 01:59 - 000129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2017-09-13 09:33 - 2017-08-11 01:58 - 000112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2017-09-13 09:33 - 2017-08-11 01:58 - 000030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2017-09-13 09:33 - 2017-08-11 01:58 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\nsiproxy.sys
2017-09-13 09:33 - 2017-08-11 01:56 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2017-09-13 09:33 - 2017-08-11 01:56 - 000014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2017-09-13 09:33 - 2017-08-11 01:56 - 000007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2017-09-13 09:33 - 2017-08-11 01:56 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2017-09-13 09:33 - 2017-08-11 01:55 - 000036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2017-09-13 09:33 - 2017-08-11 01:55 - 000006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 01:55 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 01:55 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2017-09-13 09:33 - 2017-08-11 01:55 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2017-09-13 09:33 - 2017-07-29 10:56 - 000117248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2017-09-13 09:33 - 2017-07-21 10:26 - 000518144 _____ C:\Windows\SysWOW64\msjetoledb40.dll
2017-09-13 09:33 - 2017-07-21 10:26 - 000409600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msexch40.dll
2017-09-13 09:33 - 2017-07-21 10:26 - 000290816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msjtes40.dll
2017-09-13 09:33 - 2017-07-21 10:26 - 000282624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstext40.dll
2017-09-13 09:33 - 2017-07-14 11:29 - 002058240 _____ (Microsoft Corporation) C:\Windows\system32\Query.dll
2017-09-13 09:33 - 2017-07-14 11:29 - 000486400 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2017-09-13 09:33 - 2017-07-14 11:29 - 000034304 _____ (Microsoft Corporation) C:\Windows\system32\werdiagcontroller.dll
2017-09-13 09:33 - 2017-07-14 11:10 - 001363968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Query.dll
2017-09-13 09:33 - 2017-07-14 11:10 - 000382976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2017-09-13 09:33 - 2017-07-14 10:57 - 000050688 _____ (Microsoft Corporation) C:\Windows\system32\wermgr.exe
2017-09-13 09:33 - 2017-07-14 10:50 - 000054272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wermgr.exe
2017-09-13 09:33 - 2017-07-14 10:50 - 000028672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\werdiagcontroller.dll
2017-09-13 09:33 - 2017-07-08 11:34 - 000370920 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2017-09-13 09:33 - 2017-07-08 11:03 - 000700928 _____ (Microsoft Corporation) C:\Windows\system32\dns.exe
2017-09-13 09:33 - 2017-07-07 11:33 - 000363752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volmgrx.sys
2017-09-13 09:33 - 2017-07-07 11:29 - 000149504 _____ (Microsoft Corporation) C:\Windows\system32\t2embed.dll
2017-09-13 09:33 - 2017-07-07 11:11 - 000109568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\t2embed.dll
2017-09-13 09:33 - 2017-07-01 09:05 - 001311744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msjet40.dll
2017-09-13 09:33 - 2017-07-01 09:05 - 000866816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswdat10.dll
2017-09-13 09:33 - 2017-07-01 09:05 - 000641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswstr10.dll
2017-09-13 09:33 - 2017-07-01 09:05 - 000616448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrepl40.dll
2017-09-13 09:33 - 2017-07-01 09:05 - 000475648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxbde40.dll
2017-09-13 09:33 - 2017-07-01 09:05 - 000375808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mspbde40.dll
2017-09-13 09:33 - 2017-07-01 09:05 - 000343552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrd3x40.dll
2017-09-13 09:33 - 2017-07-01 09:05 - 000339968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msexcl40.dll
2017-09-13 09:33 - 2017-07-01 09:05 - 000310272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrd2x40.dll
2017-09-13 09:33 - 2017-07-01 09:05 - 000240640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msltus40.dll
2017-09-13 09:33 - 2017-07-01 09:05 - 000144896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msjint40.dll
2017-09-13 09:33 - 2017-07-01 09:05 - 000083968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msjter40.dll
2017-09-13 09:33 - 2017-06-15 16:23 - 000753664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2017-09-13 09:33 - 2017-06-12 18:49 - 001363456 _____ (Microsoft Corporation) C:\Windows\system32\wdc.dll
2017-09-13 09:33 - 2017-06-12 18:49 - 000594432 _____ (Microsoft Corporation) C:\Windows\system32\wvc.dll
2017-09-13 09:33 - 2017-06-12 18:49 - 000475136 _____ (Microsoft Corporation) C:\Windows\system32\sysmon.ocx
2017-09-13 09:33 - 2017-06-12 18:49 - 000058880 _____ (Microsoft Corporation) C:\Windows\system32\pdhui.dll
2017-09-13 09:33 - 2017-06-12 18:29 - 001227264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdc.dll
2017-09-13 09:33 - 2017-06-12 18:29 - 000444928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wvc.dll
2017-09-13 09:33 - 2017-06-12 18:29 - 000390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sysmon.ocx
2017-09-13 09:33 - 2017-06-12 18:28 - 000047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pdhui.dll
2017-09-13 09:33 - 2017-06-12 18:14 - 000379392 _____ (Microsoft Corporation) C:\Windows\system32\msinfo32.exe
2017-09-13 09:33 - 2017-06-12 18:14 - 000172544 _____ (Microsoft Corporation) C:\Windows\system32\perfmon.exe
2017-09-13 09:33 - 2017-06-12 18:14 - 000103936 _____ (Microsoft Corporation) C:\Windows\system32\resmon.exe
2017-09-13 09:33 - 2017-06-12 18:06 - 000303616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msinfo32.exe
2017-09-13 09:33 - 2017-06-12 18:06 - 000157184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\perfmon.exe
2017-09-13 09:33 - 2017-06-12 18:06 - 000103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\resmon.exe
2017-09-13 09:33 - 2017-06-10 11:59 - 002764288 _____ (Microsoft Corporation) C:\Windows\system32\ntdsai.dll
2017-09-13 09:33 - 2017-06-09 11:33 - 001680616 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2017-09-13 09:33 - 2017-05-30 00:56 - 001895656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2017-09-13 09:33 - 2017-05-30 00:56 - 000377576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2017-09-13 09:33 - 2017-05-30 00:56 - 000287976 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2017-09-13 09:33 - 2017-05-21 00:24 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2017-09-13 09:33 - 2017-05-21 00:06 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2017-09-13 09:33 - 2017-05-16 11:35 - 000986856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2017-09-13 09:33 - 2017-05-16 11:35 - 000265448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2017-09-13 09:33 - 2017-05-16 11:30 - 000144384 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2017-09-13 09:31 - 2017-08-15 21:10 - 000395976 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2017-09-13 09:31 - 2017-08-15 20:25 - 000347336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2017-09-13 09:31 - 2017-08-15 10:01 - 000416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2017-09-13 09:31 - 2017-08-15 10:01 - 000279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2017-09-13 09:31 - 2017-08-15 10:01 - 000076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2017-09-13 09:31 - 2017-08-15 09:58 - 013673984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2017-09-13 09:31 - 2017-08-13 13:24 - 002724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2017-09-13 09:31 - 2017-08-13 13:24 - 000004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2017-09-13 09:31 - 2017-08-13 13:05 - 000048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2017-09-13 09:31 - 2017-08-13 12:55 - 000034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2017-09-13 09:31 - 2017-08-13 12:54 - 020269056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2017-09-13 09:31 - 2017-08-13 12:51 - 000116224 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2017-09-13 09:31 - 2017-08-13 12:46 - 002724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2017-09-13 09:31 - 2017-08-13 12:41 - 000968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2017-09-13 09:31 - 2017-08-13 12:30 - 000062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2017-09-13 09:31 - 2017-08-13 12:29 - 000499200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2017-09-13 09:31 - 2017-08-13 12:29 - 000077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2017-09-13 09:31 - 2017-08-13 12:29 - 000047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2017-09-13 09:31 - 2017-08-13 12:28 - 000064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2017-09-13 09:31 - 2017-08-13 12:27 - 000107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2017-09-13 09:31 - 2017-08-13 12:24 - 002291200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2017-09-13 09:31 - 2017-08-13 12:22 - 000047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2017-09-13 09:31 - 2017-08-13 12:21 - 000030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2017-09-13 09:31 - 2017-08-13 12:20 - 000315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2017-09-13 09:31 - 2017-08-13 12:19 - 000476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2017-09-13 09:31 - 2017-08-13 12:18 - 000152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2017-09-13 09:31 - 2017-08-13 12:17 - 000663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2017-09-13 09:31 - 2017-08-13 12:17 - 000620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2017-09-13 09:31 - 2017-08-13 12:04 - 000807936 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2017-09-13 09:31 - 2017-08-13 12:04 - 000726528 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2017-09-13 09:31 - 2017-08-13 12:01 - 000073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2017-09-13 09:31 - 2017-08-13 12:01 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2017-09-13 09:31 - 2017-08-13 12:00 - 000091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2017-09-13 09:31 - 2017-08-13 11:53 - 000130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2017-09-13 09:31 - 2017-08-13 11:44 - 000694784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2017-09-13 09:31 - 2017-08-13 11:43 - 002058752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2017-09-13 09:31 - 2017-08-13 11:27 - 001544704 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2017-09-13 09:31 - 2017-08-13 11:14 - 000710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2017-09-13 09:31 - 2017-08-13 11:13 - 001314816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2017-09-13 09:30 - 2017-08-15 10:06 - 015260160 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2017-09-13 09:30 - 2017-08-13 14:58 - 025730560 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2017-09-13 09:30 - 2017-08-13 13:06 - 000066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2017-09-13 09:30 - 2017-08-13 13:05 - 000576512 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2017-09-13 09:30 - 2017-08-13 13:05 - 000417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2017-09-13 09:30 - 2017-08-13 13:05 - 000088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2017-09-13 09:30 - 2017-08-13 13:04 - 002899968 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2017-09-13 09:30 - 2017-08-13 12:56 - 000054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2017-09-13 09:30 - 2017-08-13 12:52 - 000615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2017-09-13 09:30 - 2017-08-13 12:51 - 005981696 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2017-09-13 09:30 - 2017-08-13 12:51 - 000144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2017-09-13 09:30 - 2017-08-13 12:50 - 000817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2017-09-13 09:30 - 2017-08-13 12:50 - 000814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2017-09-13 09:30 - 2017-08-13 12:38 - 000489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2017-09-13 09:30 - 2017-08-13 12:29 - 000341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2017-09-13 09:30 - 2017-08-13 12:29 - 000087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2017-09-13 09:30 - 2017-08-13 12:24 - 000199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2017-09-13 09:30 - 2017-08-13 12:23 - 000092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2017-09-13 09:30 - 2017-08-13 12:17 - 000115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2017-09-13 09:30 - 2017-08-13 12:07 - 000262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2017-09-13 09:30 - 2017-08-13 12:02 - 001359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2017-09-13 09:30 - 2017-08-13 12:01 - 002134528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2017-09-13 09:30 - 2017-08-13 11:57 - 000168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2017-09-13 09:30 - 2017-08-13 11:48 - 004547072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2017-09-13 09:30 - 2017-08-13 11:46 - 000230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2017-09-13 09:30 - 2017-08-13 11:43 - 001155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2017-09-13 09:30 - 2017-08-13 11:40 - 003241472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2017-09-13 09:30 - 2017-08-13 11:18 - 000800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2017-09-13 09:30 - 2017-08-13 11:17 - 002767872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2017-09-06 04:20 - 2017-09-06 04:20 - 000058016 _____ C:\Users\punch\AppData\Local\GDIPFONTCACHEV1.DAT
2017-09-06 04:20 - 2017-09-06 04:20 - 000001413 _____ C:\Users\punch\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2017-09-06 04:20 - 2017-09-06 04:20 - 000000000 ____D C:\Users\punch\AppData\Roaming\Adobe
2017-09-06 04:20 - 2017-09-06 04:20 - 000000000 ____D C:\Users\punch\AppData\Local\VirtualStore
2017-09-06 04:20 - 2017-09-06 04:20 - 000000000 ____D C:\Users\punch\AppData\Local\Google
2017-09-06 04:01 - 2017-09-06 04:20 - 000000000 ____D C:\Users\punch
2017-09-06 04:01 - 2017-09-06 04:01 - 000000020 ___SH C:\Users\punch\ntuser.ini
2017-08-30 02:23 - 2017-08-30 02:23 - 000875720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr120_clr0400.dll
2017-08-30 02:23 - 2017-08-30 02:23 - 000536768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp120_clr0400.dll
2017-08-30 02:23 - 2017-08-30 02:23 - 000028352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aspnet_counters.dll
2017-08-30 02:23 - 2017-08-30 02:23 - 000018088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr110_clr0400.dll
2017-08-30 02:23 - 2017-08-30 02:23 - 000018088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr100_clr0400.dll
2017-08-30 02:23 - 2017-08-30 02:23 - 000018088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp110_clr0400.dll
2017-08-30 01:45 - 2017-08-30 01:45 - 000869576 _____ (Microsoft Corporation) C:\Windows\system32\msvcr120_clr0400.dll
2017-08-30 01:45 - 2017-08-30 01:45 - 000678592 _____ (Microsoft Corporation) C:\Windows\system32\msvcp120_clr0400.dll
2017-08-30 01:45 - 2017-08-30 01:45 - 000029888 _____ (Microsoft Corporation) C:\Windows\system32\aspnet_counters.dll
2017-08-30 01:45 - 2017-08-30 01:45 - 000018088 _____ (Microsoft Corporation) C:\Windows\system32\msvcr110_clr0400.dll
2017-08-30 01:45 - 2017-08-30 01:45 - 000018088 _____ (Microsoft Corporation) C:\Windows\system32\msvcr100_clr0400.dll
2017-08-30 01:45 - 2017-08-30 01:45 - 000018088 _____ (Microsoft Corporation) C:\Windows\system32\msvcp110_clr0400.dll
2017-08-17 13:29 - 2017-08-17 13:29 - 000000000 ____D C:\Users\Francoisp\AppData\Roaming\FileZilla Server
2017-08-17 07:06 - 2017-08-17 07:06 - 000058016 _____ C:\Users\Francoisp\AppData\Local\GDIPFONTCACHEV1.DAT
2017-08-17 07:05 - 2017-08-17 07:05 - 000001413 _____ C:\Users\Francoisp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2017-08-17 07:05 - 2017-08-17 07:05 - 000000020 ___SH C:\Users\Francoisp\ntuser.ini
2017-08-17 07:05 - 2017-08-17 07:05 - 000000000 ____D C:\Users\Francoisp\AppData\Roaming\Adobe
2017-08-17 07:05 - 2017-08-17 07:05 - 000000000 ____D C:\Users\Francoisp\AppData\Local\VirtualStore
2017-08-17 07:05 - 2017-08-17 07:05 - 000000000 ____D C:\Users\Francoisp\AppData\Local\Google
2017-08-17 07:05 - 2017-08-17 07:05 - 000000000 ____D C:\Users\Francoisp
2017-08-17 00:31 - 2017-08-17 00:31 - 000000000 ____D C:\ProgramData\bdch
2017-08-16 10:58 - 2017-08-16 10:58 - 000000000 ____D C:\ProgramData\Veeam
2017-07-31 15:00 - 2017-07-31 15:02 - 000002248 ____H C:\Users\SFOREST\Documents\Default.rdp
2017-07-27 00:00 - 2017-07-27 00:00 - 000072400 _____ (Insecure.Com LLC.) C:\Windows\system32\Drivers\npcap.sys

==================== Three Months Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-09-28 08:04 - 2010-09-15 11:16 - 000000000 ____D C:\Windows\system32\dhcp
2017-09-28 07:30 - 2016-05-07 13:59 - 000000000 ____D C:\Program Files (x86)\Google
2017-09-28 01:20 - 2004-01-21 10:18 - 000000000 ___RD C:\Partage
2017-09-28 00:52 - 2017-04-25 07:16 - 000001867 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-09-27 23:47 - 2009-07-14 00:49 - 000022112 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-09-27 23:47 - 2009-07-14 00:49 - 000022112 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-09-27 22:16 - 2016-08-10 07:34 - 000000000 ____D C:\Users\Administrator.BOULET\AppData\Local\Google
2017-09-27 19:52 - 2009-07-13 23:20 - 000000000 ____D C:\Windows\rescache
2017-09-27 15:21 - 2010-09-15 11:09 - 000006200 _____ C:\Windows\system32\config\netlogon.dnb
2017-09-27 15:21 - 2010-09-15 11:09 - 000002121 _____ C:\Windows\system32\config\netlogon.dns
2017-09-27 14:39 - 2010-09-15 11:02 - 000000000 ____D C:\Windows\NTDS
2017-09-27 14:39 - 2010-09-15 11:01 - 000000000 ____D C:\Windows\system32\dns
2017-09-27 14:34 - 2015-04-30 14:00 - 000903288 _____ C:\Windows\system32\perfh00C.dat
2017-09-27 14:34 - 2015-04-30 14:00 - 000208140 _____ C:\Windows\system32\perfc00C.dat
2017-09-27 14:34 - 2009-07-14 01:10 - 002067694 _____ C:\Windows\system32\PerfStringBackup.INI
2017-09-27 14:34 - 2009-07-13 23:20 - 000000000 ____D C:\Windows\inf
2017-09-27 14:28 - 2009-07-13 23:20 - 000000000 ____D C:\Windows\system32\inetsrv
2017-09-27 14:27 - 2009-07-13 23:20 - 000000000 ____D C:\Windows\Registration
2017-09-27 14:26 - 2010-08-25 13:20 - 000000000 ____D C:\Windows\system32\lserver
2017-09-27 14:26 - 2009-07-14 01:06 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2017-09-27 12:26 - 2010-09-15 11:09 - 000002412 __RSH C:\ProgramData\ntuser.pol
2017-09-27 12:06 - 2009-07-14 01:07 - 000000000 ____D C:\Windows\system32\ServerManager
2017-09-27 11:13 - 2010-12-13 16:49 - 000007595 _____ C:\Users\Administrator.BOULET\AppData\Local\resmon.resmoncfg
2017-09-27 09:55 - 2016-08-11 09:53 - 000000000 ____D C:\Program Files\Bitdefender
2017-09-27 09:06 - 2015-01-08 06:29 - 000267816 _____ C:\Windows\system32\FNTCACHE.DAT
2017-09-27 08:58 - 2014-11-28 13:01 - 000000000 ____D C:\Windows\system32\MRT
2017-09-27 08:53 - 2010-08-25 11:13 - 138202976 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2017-09-27 08:51 - 2010-08-25 11:42 - 002053122 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2017-09-27 08:26 - 2010-09-16 08:48 - 000000000 ____D C:\Bureau
2017-09-27 08:26 - 2004-01-16 15:52 - 000000000 ____D C:\HomeFolders
2017-09-24 16:00 - 2010-09-22 15:42 - 000000000 ____D C:\inetpub
2017-09-24 16:00 - 2009-07-13 23:20 - 000000000 ____D C:\Windows\SysWOW64\inetsrv
2017-09-24 16:00 - 2009-07-13 23:20 - 000000000 ____D C:\Windows\Help
2017-09-22 08:22 - 2016-08-10 09:08 - 000000000 ____D C:\Users\Yanick\AppData\Local\Google
2017-09-22 08:07 - 2012-06-06 15:11 - 000058016 _____ C:\Users\Yanick\AppData\Local\GDIPFONTCACHEV1.DAT
2017-09-19 11:40 - 2010-09-16 09:42 - 000000000 ___RD C:\MenuDemarrerTS
2017-09-13 01:35 - 2012-10-11 08:59 - 000803328 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2017-09-13 01:35 - 2012-10-11 08:59 - 000004312 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2017-09-13 01:35 - 2012-10-11 08:59 - 000000000 ____D C:\Windows\system32\Macromed
2017-09-13 01:35 - 2011-11-02 10:57 - 000144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2017-09-13 01:35 - 2010-09-16 10:26 - 000000000 ____D C:\Windows\SysWOW64\Macromed
2017-09-05 10:45 - 2004-01-21 15:25 - 000000000 ____D C:\VOL1
2017-08-30 01:51 - 2017-06-27 19:26 - 000002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk

==================== Files in the root of some directories =======

2011-04-02 08:48 - 2011-11-04 10:59 - 000000600 _____ () C:\Users\Administrator.BOULET\AppData\Roaming\winscp.rnd
2011-04-02 09:38 - 2015-04-01 09:57 - 000000600 _____ () C:\Users\Administrator.BOULET\AppData\Local\PUTTY.RND
2010-12-13 16:49 - 2017-09-27 11:13 - 000007595 _____ () C:\Users\Administrator.BOULET\AppData\Local\resmon.resmoncfg
2016-08-11 09:53 - 2016-08-11 09:53 - 000055738 _____ () C:\ProgramData\1470923589.2368.bin
2016-08-11 09:53 - 2016-08-11 12:48 - 000015657 _____ () C:\ProgramData\1470923589.3556.bin
2016-08-11 09:53 - 2016-08-11 09:53 - 000000544 _____ () C:\ProgramData\1470923589.4048.bin
2016-08-11 09:53 - 2016-08-11 09:53 - 000001420 _____ () C:\ProgramData\1470923589.4884.bin
2016-08-11 13:21 - 2016-08-11 13:21 - 000283464 _____ () C:\ProgramData\1470935781.bdinstall.bin
2016-08-11 14:12 - 2016-08-11 14:12 - 000064600 _____ () C:\ProgramData\1470939156.bdinstall.bin
2016-08-11 14:13 - 2016-08-11 14:13 - 000064600 _____ () C:\ProgramData\1470939196.bdinstall.bin
2016-08-11 14:17 - 2016-08-11 14:17 - 000064600 _____ () C:\ProgramData\1470939426.bdinstall.bin
2017-04-24 14:30 - 2017-04-24 14:30 - 000145452 _____ () C:\ProgramData\1493058432.bdinstall.bin
2017-04-26 16:36 - 2017-04-26 16:36 - 001004517 _____ () C:\ProgramData\1493238659.bdinstall.bin
2017-09-22 13:48 - 2017-09-22 13:49 - 000049871 _____ () C:\ProgramData\1506102484.1980.bin
2017-09-22 13:48 - 2017-09-22 13:49 - 000090113 _____ () C:\ProgramData\1506102484.4192.bin
2017-09-22 13:48 - 2017-09-22 13:49 - 000002271 _____ () C:\ProgramData\1506102484.5788.bin
2017-09-27 10:02 - 2017-09-27 10:02 - 001154750 _____ () C:\ProgramData\1506520510.bdinstall.bin
2016-08-11 13:18 - 2016-08-11 13:18 - 000000219 _____ () C:\ProgramData\45.install.log
2017-04-26 16:33 - 2017-09-27 09:58 - 000000219 _____ () C:\ProgramData\50.install.log
2017-04-24 14:28 - 2017-09-22 13:49 - 000000669 _____ () C:\ProgramData\50.rollback.log
2014-09-02 16:25 - 2014-09-02 16:25 - 000000057 _____ () C:\ProgramData\Ament.ini
2016-08-08 20:00 - 2016-08-10 07:34 - 000001772 _____ () C:\ProgramData\cryptinfo.txt
2016-08-10 07:34 - 2016-08-10 07:34 - 000000017 _____ () C:\ProgramData\date_1.txt
2016-08-09 07:39 - 2016-08-09 07:39 - 000000000 _____ () C:\ProgramData\decrypting.txt
2016-08-08 20:00 - 2016-08-08 20:00 - 000000000 _____ () C:\ProgramData\start.txt

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-09-20 00:24

==================== End of FRST.txt ============================