Problémy s PC, nejdou aktualizace, vir?
Napsal: 09 pro 2017 14:20
Dobrý den, prosím o kontrolu logů, PC reaguje podivně, při uvolňování místa na disku se disk neustále zaplňoval místo uvolnění místa GB přibývaly. Reinstalovala jsem PC obnovením do továrního nastavení, ale problémy přetrvávají. Eset kupříkladu hlásil že nelze zapnout scanner pro detekci skript virů, když provádí kontroly uvádí množství červeně vypsaných souborů, jež "nelze otevřít" a zkontrolovat. PC se chová divně, aktualizace systému končí chybovou hláškou. Jedná se o virus? Děkuji
Logfile of random's system information tool 1.10 (written by random/random)
Run by Veronika at 2017-12-09 14:12:31
Microsoft Windows 10 Home
System drive C: has 10 GB (33%) free of 29 GB
Total RAM: 1972 MB (26% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:12:39, on 09.12.2017
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.10586.0020)
Boot mode: Normal
Running processes:
C:\Users\Veronika\AppData\Local\Microsoft\OneDrive\OneDrive.exe
C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe
C:\Windows10Upgrade\Windows10UpgraderApp.exe
C:\Program Files\trend micro\Veronika.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.umax.cz
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.umax.cz
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = %11%\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=
O2 - BHO: Skype for Business Click to Call BHO - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office16\OCHelper.dll
O2 - BHO: Microsoft OneDrive for Business Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\PROGRA~2\MICROS~1\Office16\GROOVEEX.DLL
O4 - HKCU\..\Run: [OneDrive] "C:\Users\Veronika\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\Program Files\Microsoft Office\Root\Office16\ONBttnIE.dll/105
O9 - Extra button: Poslat do OneNotu - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office16\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Poslat do On&eNotu - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office16\ONBttnIE.dll
O9 - Extra button: @%CommonProgramFiles%\Microsoft Shared\Office16\oregres.dll,-430 - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office16\OCHelper.dll
O9 - Extra 'Tools' menuitem: @%CommonProgramFiles%\Microsoft Shared\Office16\oregres.dll,-430 - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office16\OCHelper.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office16\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office16\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: http://help.eset.com (HKLM)
O15 - ESC Trusted Zone: http://help.eset.com (HKLM)
O18 - Protocol: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL
O18 - Protocol: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL
O18 - Protocol: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O18 - Protocol: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O18 - Filter hijack: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\MSOXMLMF.DLL
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\WINDOWS\SysWow64\IntelCpHeciSvc.exe
O23 - Service: @%SystemRoot%\system32\DiagSvcs\DiagnosticsHub.StandardCollector.ServiceRes.dll,-1000 (diagnosticshub.standardcollector.service) - Unknown owner - C:\WINDOWS\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Security\ekrn.exe
O23 - Service: @oem12.inf,%ServiceDisplayName%;ESIF Upper Framework Service (esifsvc) - Unknown owner - C:\WINDOWS\System32\Intel\DPTF\esif_uf.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\WINDOWS\system32\fxssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\WINDOWS\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel(R) HD Graphics Control Panel Service (igfxCUIService2.0.0.0) - Unknown owner - C:\WINDOWS\system32\igfxCUIService.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\WINDOWS\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SensorDataService.exe,-101 (SensorDataService) - Unknown owner - C:\WINDOWS\System32\SensorDataService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\WINDOWS\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\WINDOWS\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\WINDOWS\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\TieringEngineService.exe,-702 (TieringEngineService) - Unknown owner - C:\WINDOWS\system32\TieringEngineService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\WINDOWS\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\WINDOWS\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\WINDOWS\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
--
End of file - 8328 bytes
======Listing Processes======
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\svchost.exe -k RPCSS
C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-3fbadc3f-0576-4e8b-9bbd-814dce4f709a -SystemEventPortName:HostProcess-12f31f81-567a-41e7-b24a-3a8a7bf053a0 -IoCancelEventPortName:HostProcess-a6f00257-8590-417c-a53a-1e518bbb2133 -NonStateChangingEventPortName:HostProcess-1a2c272e-837e-486f-904e-96b173ecc435 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:8b4953b1-2314-4e61-a61e-26b69f51d1d3 -DeviceGroupId:
C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork
C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\igfxCUIService.exe
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\System32\spoolsv.exe
dashost.exe {263c00ba-baf9-49ba-bb0a9b9c898ee18c}
C:\WINDOWS\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\WINDOWS\System32\Intel\DPTF\esif_uf.exe
C:\WINDOWS\system32\svchost.exe -k appmodel
C:\WINDOWS\system32\SearchIndexer.exe /Embedding
C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
C:\WINDOWS\System32\svchost.exe -k utcsvc
C:\WINDOWS\System32\WinLogon.exe -SpecialSession
"dwm.exe"
sihost.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
igfxEM.exe
"C:\WINDOWS\TEMP\DPTF\esif_assist_64.exe"
igfxHK.exe
igfxTray.exe
C:\WINDOWS\Explorer.EXE
C:\Windows\System32\RuntimeBroker.exe -Embedding
"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
"C:\Program Files\ESET\ESET Security\egui.exe" /hide
"C:\Users\Veronika\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background
C:\WINDOWS\system32\ApplicationFrameHost.exe -Embedding
C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup
"C:\WINDOWS\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel
"C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe" -ServerName:SkypeHost.ServerServer
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
C:\WINDOWS\system32\browser_broker.exe -Embedding
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe" SCODEF:92 CREDAT:140545 EDGEHOST /prefetch:6
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe" SCODEF:92 CREDAT:140551 EDGEHOST /prefetch:6
"C:\WINDOWS\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-250986566-3304955990-3961839072-100133_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-250986566-3304955990-3961839072-100133 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
"C:\Program Files\rempl\remsh.exe"
C:\WINDOWS\servicing\TrustedInstaller.exe
C:\WINDOWS\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.10586.1040_none_366d2a34ce5cd854\TiWorker.exe -Embedding
C:\WINDOWS\System32\svchost.exe -k swprv
C:\WINDOWS\system32\DllHost.exe /Processid:{B366DEBE-645B-43A5-B865-DDD82C345492}
"C:\Windows10Upgrade\Windows10UpgraderApp.exe" /Install /ClientID Win10Upgrade:VNL:EosWu:{} /SkipEULA /EosUi
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe" SCODEF:92 CREDAT:337166 EDGEHOST /prefetch:6
"C:\WINDOWS\system32\SearchFilterHost.exe" 0 632 636 644 8192 640
"C:\Users\Veronika\Desktop\RSITx64.exe"
C:\WINDOWS\system32\wbem\wmiprvse.exe
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Skype for Business Browser Helper - C:\Program Files\Microsoft Office\Office16\OCHelper.dll [2015-07-31 226984]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft OneDrive for Business Browser Helper - C:\PROGRA~1\MICROS~1\Office16\GROOVEEX.DLL [2015-07-31 2165976]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Skype for Business Browser Helper - C:\Program Files (x86)\Microsoft Office\Office16\OCHelper.dll [2015-07-31 161448]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft OneDrive for Business Browser Helper - C:\PROGRA~2\MICROS~1\Office16\GROOVEEX.DLL [2015-07-31 1512152]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"egui"=C:\Program Files\ESET\ESET Security\ecmds.exe [2017-11-23 324352]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"OneDrive"=C:\Users\Veronika\AppData\Local\Microsoft\OneDrive\OneDrive.exe [2017-12-08 1551048]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ahcache.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CoreMessagingRegistrar]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\iai2c.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\iai2ce.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\iaspie.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SpbCx.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\StateRepository]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TileDataModelSvc]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\uefi.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\UserManager]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{F2E7DD72-6468-4E36-B6F1-6488F42C1B52}]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Ahcache.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\CoreMessagingRegistrar]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SpbCx.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\StateRepository]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TileDataModelSvc]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\uefi.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UserManager]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{F2E7DD72-6468-4E36-B6F1-6488F42C1B52}]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DSCAutomationHostEnabled"=2
"FilterAdministratorToken"=1
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"vidc.i420"=iyuv_32.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"MSVideo8"=VfWWDM32.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
======File associations======
.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
======List of files/folders created in the last 1 month======
2017-12-09 14:12:31 ----DC---- C:\rsit
2017-12-09 14:12:31 ----DC---- C:\Program Files\trend micro
2017-12-09 14:04:06 ----DC---- C:\FRST
2017-12-09 13:56:51 ----DC---- C:\WINDOWS\UpdateAssistant
2017-12-08 01:09:27 ----AC---- C:\WINDOWS\progress.ini
2017-12-08 00:48:13 ----HDC---- C:\$GetCurrent
2017-12-08 00:48:03 ----DC---- C:\Windows10Upgrade
2017-12-07 01:07:17 ----DC---- C:\WINDOWS\Minidump
2017-12-06 23:02:48 ----DC---- C:\Users\Veronika\AppData\Roaming\Macromedia
2017-12-06 21:32:15 ----DC---- C:\WINDOWS\system32\UNP
2017-12-06 21:32:15 ----ADC---- C:\Program Files\UNP
2017-12-06 19:25:47 ----DC---- C:\Program Files\Microsoft.NET
2017-12-06 19:23:29 ----ADC---- C:\Program Files\Common Files\DESIGNER
2017-12-06 19:23:04 ----DC---- C:\Program Files (x86)\Mozilla Firefox
2017-12-06 19:22:04 ----DC---- C:\Program Files (x86)\Microsoft SQL Server
2017-12-06 19:21:41 ----DC---- C:\WINDOWS\PCHEALTH
2017-12-06 19:21:41 ----DC---- C:\Program Files\Microsoft SQL Server
2017-12-06 19:16:18 ----DC---- C:\Program Files\Microsoft Analysis Services
2017-12-06 19:16:18 ----DC---- C:\Program Files (x86)\Microsoft Analysis Services
2017-12-06 19:15:19 ----DC---- C:\Program Files (x86)\Microsoft Office
2017-12-06 19:14:48 ----DC---- C:\ProgramData\Microsoft Help
2017-12-06 19:14:27 ----RHDC---- C:\MSOCache
2017-12-06 08:52:04 ----AC---- C:\Recovery.txt
2017-12-06 08:45:59 ----DC---- C:\WINDOWS\Panther
2017-12-06 08:45:59 ----DC---- C:\WINDOWS\InfusedApps
2017-12-06 08:43:29 ----DC---- C:\WINDOWS\Setup
2017-12-06 08:30:30 ----DC---- C:\WINDOWS\OCR
2017-12-06 08:25:00 ----AC---- C:\WINDOWS\system32\perfi005.dat
2017-12-06 08:25:00 ----AC---- C:\WINDOWS\system32\perfh005.dat
2017-12-06 08:25:00 ----AC---- C:\WINDOWS\system32\perfd005.dat
2017-12-06 08:25:00 ----AC---- C:\WINDOWS\system32\perfc005.dat
2017-12-06 08:24:34 ----DC---- C:\WINDOWS\SYSWOW64\winrm
2017-12-06 08:24:33 ----DC---- C:\WINDOWS\SYSWOW64\WCN
2017-12-06 08:24:33 ----DC---- C:\WINDOWS\SYSWOW64\sysprep
2017-12-06 08:24:33 ----DC---- C:\WINDOWS\SYSWOW64\slmgr
2017-12-06 08:24:33 ----DC---- C:\WINDOWS\SYSWOW64\Printing_Admin_Scripts
2017-12-06 08:24:33 ----DC---- C:\WINDOWS\SYSWOW64\en
2017-12-06 08:24:33 ----DC---- C:\WINDOWS\SYSWOW64\drivers\UMDF
2017-12-06 08:24:33 ----DC---- C:\WINDOWS\SYSWOW64\drivers\en-US
2017-12-06 08:24:33 ----DC---- C:\WINDOWS\SYSWOW64\drivers\cs-CZ
2017-12-06 08:24:31 ----DC---- C:\WINDOWS\SYSWOW64\cs
2017-12-06 08:24:30 ----DC---- C:\WINDOWS\SYSWOW64\0409
2017-12-06 08:24:30 ----DC---- C:\WINDOWS\system32\winrm
2017-12-06 08:24:30 ----DC---- C:\WINDOWS\system32\WCN
2017-12-06 08:24:29 ----DC---- C:\WINDOWS\system32\slmgr
2017-12-06 08:24:29 ----DC---- C:\WINDOWS\system32\Printing_Admin_Scripts
2017-12-06 08:24:28 ----DC---- C:\WINDOWS\system32\en
2017-12-06 08:24:27 ----DC---- C:\WINDOWS\system32\drivers\en-US
2017-12-06 08:24:26 ----DC---- C:\WINDOWS\system32\drivers\cs-CZ
2017-12-06 08:24:22 ----DC---- C:\WINDOWS\system32\cs
2017-12-06 08:24:21 ----DC---- C:\WINDOWS\system32\0409
2017-12-06 08:24:20 ----DC---- C:\WINDOWS\en-US
2017-12-06 08:24:20 ----DC---- C:\WINDOWS\DigitalLocker
2017-12-06 08:24:20 ----DC---- C:\WINDOWS\cs-CZ
2017-12-06 08:19:00 ----AC---- C:\WINDOWS\system32\perfi009.dat
2017-12-06 08:19:00 ----AC---- C:\WINDOWS\system32\perfh009.dat
2017-12-06 08:19:00 ----AC---- C:\WINDOWS\system32\perfd009.dat
2017-12-06 08:19:00 ----AC---- C:\WINDOWS\system32\perfc009.dat
2017-12-06 08:18:35 ----AC---- C:\WINDOWS\SYSWOW64\FlashPlayerApp.exe
2017-12-06 08:14:58 ----AC---- C:\WINDOWS\SYSWOW64\NOISE.DAT
2017-12-06 08:14:58 ----AC---- C:\WINDOWS\SYSWOW64\msclmd.dll
2017-12-06 08:14:55 ----AC---- C:\WINDOWS\SYSWOW64\dssec.dat
2017-12-06 08:14:32 ----AC---- C:\WINDOWS\system32\NOISE.DAT
2017-12-06 08:14:31 ----AC---- C:\WINDOWS\system32\msclmd.dll
2017-12-06 08:14:29 ----AC---- C:\WINDOWS\system32\dssec.dat
2017-12-06 08:14:19 ----RSHC---- C:\WINDOWS\fonts\StaticCache.dat
2017-12-06 08:14:15 ----AC---- C:\WINDOWS\fonts\desktop.ini
2017-12-06 08:14:12 ----ASHC---- C:\Program Files (x86)\desktop.ini
2017-12-06 08:14:09 ----ASHC---- C:\Program Files\desktop.ini
2017-12-06 08:14:04 ----SDC---- C:\WINDOWS\SYSWOW64\Nui
2017-12-06 08:14:04 ----SDC---- C:\WINDOWS\SYSWOW64\F12
2017-12-06 08:14:04 ----SDC---- C:\WINDOWS\SYSWOW64\DiagSvcs
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\Web
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\Vss
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\twain_32
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\tracing
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\Temp
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\TAPI
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\zh-TW
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\zh-HK
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\zh-CN
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\WinMetadata
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\WindowsPowerShell
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\wbem
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\uk-UA
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\tr-TR
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\th-TH
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\Tasks
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\sv-SE
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\sru
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\sr-Latn-RS
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\sr-Latn-CS
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\sppui
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\spp
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\Speech_OneCore
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\Speech
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\SMI
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\sl-SI
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\sk-SK
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\setup
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\ru-RU
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\ro-RO
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\restore
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\Recovery
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\RasToast
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\ras
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\pt-PT
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\pt-BR
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\pl-PL
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\oobe
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\nl-NL
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\networklist
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\NDF
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\nb-NO
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\MUI
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\MsDtc
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\MSDRM
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\migwiz
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\migration
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\MailContactsCalendarSync
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\Macromed
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\lv-LV
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\lt-LT
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\LogFiles
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\Licenses
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\ko-KR
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\ja-JP
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\it-IT
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\Ipmi
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\InstallShield
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\InputMethod
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\inetsrv
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\IME
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\icsxml
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\hu-HU
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\hr-HR
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\he-IL
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\GroupPolicyUsers
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\GroupPolicy
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\FxsTmp
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\fr-FR
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\fr-CA
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\fi-FI
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\et-EE
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\es-MX
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\es-ES
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\en-US
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\en-GB
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\el-GR
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\DriverStore
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\drivers
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\downlevel
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\Dism
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\de-DE
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\da-DK
2017-12-06 08:14:03 ----SDC---- C:\WINDOWS\SYSWOW64\Configuration
2017-12-06 08:14:03 ----DC---- C:\WINDOWS\SYSWOW64\cs-CZ
2017-12-06 08:14:03 ----DC---- C:\WINDOWS\SYSWOW64\config
2017-12-06 08:14:03 ----DC---- C:\WINDOWS\SYSWOW64\Com
2017-12-06 08:14:03 ----DC---- C:\WINDOWS\SYSWOW64\catroot
2017-12-06 08:14:03 ----DC---- C:\WINDOWS\SYSWOW64\Bthprops
2017-12-06 08:14:03 ----DC---- C:\WINDOWS\SYSWOW64\bg-BG
2017-12-06 08:14:03 ----DC---- C:\WINDOWS\SYSWOW64\ar-SA
2017-12-06 08:14:03 ----DC---- C:\WINDOWS\SYSWOW64\AppLocker
2017-12-06 08:14:03 ----DC---- C:\WINDOWS\SYSWOW64\AdvancedInstallers
2017-12-06 08:14:03 ----DC---- C:\WINDOWS\syswow64
2017-12-06 08:14:03 ----DC---- C:\WINDOWS\SystemResources
2017-12-06 08:14:02 ----SDC---- C:\WINDOWS\system32\Nui
2017-12-06 08:14:02 ----SDC---- C:\WINDOWS\system32\F12
2017-12-06 08:14:02 ----SDC---- C:\WINDOWS\system32\dsc
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\SystemApps
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\zh-TW
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\zh-HK
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\zh-CN
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\WinMetadata
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\winevt
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\WindowsPowerShell
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\WinBioPlugIns
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\WinBioDatabase
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\WDI
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\wbem
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\uk-UA
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\tr-TR
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\th-TH
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\Tasks
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\SystemResetPlatform
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\sv-SE
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\sru
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\sr-Latn-RS
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\sr-Latn-CS
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\sppui
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\spp
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\spool
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\Speech_OneCore
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\Speech
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\sl-SI
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\sk-SK
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\setup
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\SecureBootUpdates
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\ru-RU
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\ro-RO
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\restore
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\Recovery
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\RasToast
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\ras
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\pt-PT
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\pt-BR
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\ProximityToast
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\PointOfService
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\pl-PL
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\oobe
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\nl-NL
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\networklist
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\NDF
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\nb-NO
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\MUI
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\MsDtc
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\MSDRM
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\migwiz
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\migration
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\MailContactsCalendarSync
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\Macromed
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\lv-LV
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\lt-LT
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\LogFiles
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\Licenses
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\ko-KR
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\ja-JP
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\it-IT
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\Ipmi
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\InputMethod
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\inetsrv
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\IME
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\icsxml
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\ias
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\hu-HU
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\hr-HR
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\he-IL
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\FxsTmp
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\fr-FR
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\fr-CA
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\fi-FI
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\et-EE
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\es-MX
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\es-ES
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\en-US
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\en-GB
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\el-GR
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\drivers\etc
2017-12-06 08:14:01 ----SHDC---- C:\WINDOWS\Installer
2017-12-06 08:14:01 ----SHDC---- C:\Program Files\Windows Sidebar
2017-12-06 08:14:01 ----SHDC---- C:\Program Files (x86)\Windows Sidebar
2017-12-06 08:14:01 ----SDC---- C:\WINDOWS\system32\DiagSvcs
2017-12-06 08:14:01 ----SDC---- C:\WINDOWS\system32\Configuration
2017-12-06 08:14:01 ----SDC---- C:\WINDOWS\Downloaded Program Files
2017-12-06 08:14:01 ----SDC---- C:\ProgramData\Microsoft
2017-12-06 08:14:01 ----SDC---- C:\Program Files\WindowsPowerShell
2017-12-06 08:14:01 ----SDC---- C:\Program Files (x86)\WindowsPowerShell
2017-12-06 08:14:01 ----RSDC---- C:\WINDOWS\Media
2017-12-06 08:14:01 ----RSDC---- C:\WINDOWS\Fonts
2017-12-06 08:14:01 ----RDC---- C:\WINDOWS\PurchaseDialog
2017-12-06 08:14:01 ----RDC---- C:\WINDOWS\PrintDialog
2017-12-06 08:14:01 ----RDC---- C:\WINDOWS\Offline Web Pages
2017-12-06 08:14:01 ----RDC---- C:\WINDOWS\MiracastView
2017-12-06 08:14:01 ----RDC---- C:\WINDOWS\ImmersiveControlPanel
2017-12-06 08:14:01 ----RDC---- C:\WINDOWS\DevicesFlow
2017-12-06 08:14:01 ----RDC---- C:\WINDOWS\DesktopTileResources
2017-12-06 08:14:01 ----HDC---- C:\WINDOWS\ELAMBKUP
2017-12-06 08:14:01 ----HDC---- C:\ProgramData
2017-12-06 08:14:01 ----HDC---- C:\Program Files\WindowsApps
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\system32\downlevel
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\system32\Dism
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\system32\de-DE
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\system32\da-DK
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\system32\cs-CZ
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\system32\Com
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\system32\CodeIntegrity
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\system32\catroot2
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\system32\Bthprops
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\system32\Boot
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\system32\bg-BG
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\system32\ar-SA
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\system32\appraiser
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\system32\AppLocker
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\system32\AdvancedInstallers
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\System
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\Speech_OneCore
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\Speech
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\SKB
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\schemas
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\SchCache
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\security
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\Resources
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\rescache
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\Registration
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\Provisioning
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\prefetch
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\PolicyDefinitions
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\PLA
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\Performance
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\ModemLogs
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\Migration
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\Logs
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\LiveKernelReports
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\L2Schemas
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\InputMethod
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\IME
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\Help
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\Globalization
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\diagnostics
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\debug
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\Cursors
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\Branding
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\Boot
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\bcastdvr
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\AppReadiness
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\AppPatch
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\appcompat
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\addins
2017-12-06 08:14:01 ----DC---- C:\ProgramData\USOPrivate
2017-12-06 08:14:01 ----DC---- C:\ProgramData\SoftwareDistribution
2017-12-06 08:14:01 ----DC---- C:\ProgramData\Comms
2017-12-06 08:14:01 ----DC---- C:\Program Files\Windows Portable Devices
2017-12-06 08:14:01 ----DC---- C:\Program Files\Windows Photo Viewer
2017-12-06 08:14:01 ----DC---- C:\Program Files\Windows NT
2017-12-06 08:14:01 ----DC---- C:\Program Files\Windows Multimedia Platform
2017-12-06 08:14:01 ----DC---- C:\Program Files\Windows Media Player
2017-12-06 08:14:01 ----DC---- C:\Program Files\Windows Mail
2017-12-06 08:14:01 ----DC---- C:\Program Files\Windows Defender
2017-12-06 08:14:01 ----DC---- C:\Program Files\Internet Explorer
2017-12-06 08:14:01 ----DC---- C:\Program Files\Common Files\System
2017-12-06 08:14:01 ----DC---- C:\Program Files\Common Files\Services
2017-12-06 08:14:01 ----DC---- C:\Program Files (x86)\Windows Portable Devices
2017-12-06 08:14:01 ----DC---- C:\Program Files (x86)\Windows Photo Viewer
2017-12-06 08:14:01 ----DC---- C:\Program Files (x86)\Windows NT
2017-12-06 08:14:01 ----DC---- C:\Program Files (x86)\Windows Multimedia Platform
2017-12-06 08:14:01 ----DC---- C:\Program Files (x86)\Windows Media Player
2017-12-06 08:14:01 ----DC---- C:\Program Files (x86)\Windows Mail
2017-12-06 08:14:01 ----DC---- C:\Program Files (x86)\Windows Defender
2017-12-06 08:14:01 ----DC---- C:\Program Files (x86)\Internet Explorer
2017-12-06 08:14:01 ----DC---- C:\PerfLogs
2017-12-06 08:14:01 ----ADC---- C:\ProgramData\regid.1991-06.com.microsoft
2017-12-06 08:14:01 ----ADC---- C:\Program Files\Common Files\microsoft shared
2017-12-06 08:14:01 ----ADC---- C:\Program Files (x86)\Microsoft.NET
2017-12-06 08:14:00 ----RDC---- C:\WINDOWS\assembly
2017-12-06 08:14:00 ----DC---- C:\WINDOWS\system32\Sysprep
2017-12-06 08:14:00 ----DC---- C:\WINDOWS\Microsoft.NET
2017-12-06 08:13:13 ----DC---- C:\WINDOWS\system32\drivers\UMDF
2017-12-06 08:13:09 ----DC---- C:\WINDOWS\system32\drivers
2017-12-06 08:10:42 ----DC---- C:\WINDOWS\INF
2017-12-06 07:52:37 ----DC---- C:\WINDOWS\CbsTemp
2017-12-06 07:32:19 ----RDC---- C:\Users
2017-12-06 07:32:19 ----RDC---- C:\Program Files (x86)
2017-12-06 07:32:19 ----RDC---- C:\Program Files
2017-12-06 07:32:19 ----DC---- C:\WINDOWS\WinSxS
2017-12-06 07:32:19 ----DC---- C:\WINDOWS\system32\SMI
2017-12-06 07:32:19 ----DC---- C:\WINDOWS\system32\DriverStore
2017-12-06 07:32:19 ----DC---- C:\WINDOWS\system32\config
2017-12-06 07:32:19 ----DC---- C:\WINDOWS\system32\CatRoot
2017-12-06 07:32:19 ----DC---- C:\WINDOWS\System32
2017-12-06 07:32:19 ----DC---- C:\WINDOWS\servicing
2017-12-06 07:32:19 ----DC---- C:\Windows
2017-12-06 07:32:19 ----DC---- C:\Program Files\Common Files
2017-12-06 07:32:19 ----DC---- C:\Program Files (x86)\Common Files
2017-12-06 07:32:19 ----ASH---- C:\pagefile.sys
2017-12-06 00:37:17 ----AC---- C:\WINDOWS\SYSWOW64\OpenCL.DLL
2017-12-06 00:37:17 ----AC---- C:\WINDOWS\system32\OpenCL.DLL
2017-12-06 00:37:17 ----AC---- C:\WINDOWS\system32\{EC94D02F-D200-4428-9531-05AF7F9799CB}.bat
2017-12-06 00:30:10 ----AC---- C:\WINDOWS\system32\emptyregdb.dat
2017-12-06 00:28:24 ----AC---- C:\WINDOWS\SYSWOW64\PrintConfig.dll
2017-12-06 00:25:48 ----ASH---- C:\hiberfil.sys
2017-12-06 00:05:03 ----DC---- C:\ProgramData\ESET
2017-12-06 00:05:03 ----DC---- C:\Program Files\ESET
2017-12-06 00:02:54 ----C---- C:\WINDOWS\system32\MpSigStub.exe
2017-12-05 23:57:31 ----AS---- C:\WINDOWS\bootstat.dat
2017-12-05 23:54:22 ----DC---- C:\WINDOWS\system32\Intel
2017-12-05 23:53:19 ----DC---- C:\WINDOWS\system32\SleepStudy
2017-12-05 23:53:19 ----DC---- C:\WINDOWS\ServiceProfiles
2017-12-05 23:53:17 ----SDC---- C:\WINDOWS\system32\Microsoft
2017-12-05 23:53:11 ----AC---- C:\WINDOWS\system32\FNTCACHE.DAT
2017-12-05 23:53:01 ----ASH---- C:\swapfile.sys
2017-12-05 23:46:26 ----ADC---- C:\Program Files\rempl
2017-12-05 23:45:17 ----AC---- C:\WINDOWS\system32\wuauclt.exe
2017-12-05 23:45:16 ----AC---- C:\WINDOWS\system32\dosvc.dll
2017-12-05 23:45:16 ----AC---- C:\WINDOWS\system32\domgmt.dll
2017-12-05 23:45:15 ----AC---- C:\WINDOWS\system32\wuaueng.dll
Logfile of random's system information tool 1.10 (written by random/random)
Run by Veronika at 2017-12-09 14:12:31
Microsoft Windows 10 Home
System drive C: has 10 GB (33%) free of 29 GB
Total RAM: 1972 MB (26% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:12:39, on 09.12.2017
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.10586.0020)
Boot mode: Normal
Running processes:
C:\Users\Veronika\AppData\Local\Microsoft\OneDrive\OneDrive.exe
C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe
C:\Windows10Upgrade\Windows10UpgraderApp.exe
C:\Program Files\trend micro\Veronika.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.umax.cz
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.umax.cz
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = %11%\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=
O2 - BHO: Skype for Business Click to Call BHO - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office16\OCHelper.dll
O2 - BHO: Microsoft OneDrive for Business Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\PROGRA~2\MICROS~1\Office16\GROOVEEX.DLL
O4 - HKCU\..\Run: [OneDrive] "C:\Users\Veronika\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\Program Files\Microsoft Office\Root\Office16\ONBttnIE.dll/105
O9 - Extra button: Poslat do OneNotu - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office16\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Poslat do On&eNotu - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office16\ONBttnIE.dll
O9 - Extra button: @%CommonProgramFiles%\Microsoft Shared\Office16\oregres.dll,-430 - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office16\OCHelper.dll
O9 - Extra 'Tools' menuitem: @%CommonProgramFiles%\Microsoft Shared\Office16\oregres.dll,-430 - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office16\OCHelper.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office16\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office16\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: http://help.eset.com (HKLM)
O15 - ESC Trusted Zone: http://help.eset.com (HKLM)
O18 - Protocol: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL
O18 - Protocol: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL
O18 - Protocol: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O18 - Protocol: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O18 - Filter hijack: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\MSOXMLMF.DLL
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\WINDOWS\SysWow64\IntelCpHeciSvc.exe
O23 - Service: @%SystemRoot%\system32\DiagSvcs\DiagnosticsHub.StandardCollector.ServiceRes.dll,-1000 (diagnosticshub.standardcollector.service) - Unknown owner - C:\WINDOWS\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Security\ekrn.exe
O23 - Service: @oem12.inf,%ServiceDisplayName%;ESIF Upper Framework Service (esifsvc) - Unknown owner - C:\WINDOWS\System32\Intel\DPTF\esif_uf.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\WINDOWS\system32\fxssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\WINDOWS\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel(R) HD Graphics Control Panel Service (igfxCUIService2.0.0.0) - Unknown owner - C:\WINDOWS\system32\igfxCUIService.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\WINDOWS\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SensorDataService.exe,-101 (SensorDataService) - Unknown owner - C:\WINDOWS\System32\SensorDataService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\WINDOWS\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\WINDOWS\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\WINDOWS\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\TieringEngineService.exe,-702 (TieringEngineService) - Unknown owner - C:\WINDOWS\system32\TieringEngineService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\WINDOWS\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\WINDOWS\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\WINDOWS\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
--
End of file - 8328 bytes
======Listing Processes======
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\svchost.exe -k RPCSS
C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-3fbadc3f-0576-4e8b-9bbd-814dce4f709a -SystemEventPortName:HostProcess-12f31f81-567a-41e7-b24a-3a8a7bf053a0 -IoCancelEventPortName:HostProcess-a6f00257-8590-417c-a53a-1e518bbb2133 -NonStateChangingEventPortName:HostProcess-1a2c272e-837e-486f-904e-96b173ecc435 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:8b4953b1-2314-4e61-a61e-26b69f51d1d3 -DeviceGroupId:
C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork
C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\igfxCUIService.exe
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\System32\spoolsv.exe
dashost.exe {263c00ba-baf9-49ba-bb0a9b9c898ee18c}
C:\WINDOWS\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\WINDOWS\System32\Intel\DPTF\esif_uf.exe
C:\WINDOWS\system32\svchost.exe -k appmodel
C:\WINDOWS\system32\SearchIndexer.exe /Embedding
C:\WINDOWS\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
C:\WINDOWS\System32\svchost.exe -k utcsvc
C:\WINDOWS\System32\WinLogon.exe -SpecialSession
"dwm.exe"
sihost.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
igfxEM.exe
"C:\WINDOWS\TEMP\DPTF\esif_assist_64.exe"
igfxHK.exe
igfxTray.exe
C:\WINDOWS\Explorer.EXE
C:\Windows\System32\RuntimeBroker.exe -Embedding
"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
"C:\Program Files\ESET\ESET Security\egui.exe" /hide
"C:\Users\Veronika\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background
C:\WINDOWS\system32\ApplicationFrameHost.exe -Embedding
C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup
"C:\WINDOWS\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel
"C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe" -ServerName:SkypeHost.ServerServer
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
C:\WINDOWS\system32\browser_broker.exe -Embedding
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe" SCODEF:92 CREDAT:140545 EDGEHOST /prefetch:6
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe" SCODEF:92 CREDAT:140551 EDGEHOST /prefetch:6
"C:\WINDOWS\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-250986566-3304955990-3961839072-100133_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-250986566-3304955990-3961839072-100133 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
"C:\Program Files\rempl\remsh.exe"
C:\WINDOWS\servicing\TrustedInstaller.exe
C:\WINDOWS\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.10586.1040_none_366d2a34ce5cd854\TiWorker.exe -Embedding
C:\WINDOWS\System32\svchost.exe -k swprv
C:\WINDOWS\system32\DllHost.exe /Processid:{B366DEBE-645B-43A5-B865-DDD82C345492}
"C:\Windows10Upgrade\Windows10UpgraderApp.exe" /Install /ClientID Win10Upgrade:VNL:EosWu:{} /SkipEULA /EosUi
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe" SCODEF:92 CREDAT:337166 EDGEHOST /prefetch:6
"C:\WINDOWS\system32\SearchFilterHost.exe" 0 632 636 644 8192 640
"C:\Users\Veronika\Desktop\RSITx64.exe"
C:\WINDOWS\system32\wbem\wmiprvse.exe
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Skype for Business Browser Helper - C:\Program Files\Microsoft Office\Office16\OCHelper.dll [2015-07-31 226984]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft OneDrive for Business Browser Helper - C:\PROGRA~1\MICROS~1\Office16\GROOVEEX.DLL [2015-07-31 2165976]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Skype for Business Browser Helper - C:\Program Files (x86)\Microsoft Office\Office16\OCHelper.dll [2015-07-31 161448]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft OneDrive for Business Browser Helper - C:\PROGRA~2\MICROS~1\Office16\GROOVEEX.DLL [2015-07-31 1512152]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"egui"=C:\Program Files\ESET\ESET Security\ecmds.exe [2017-11-23 324352]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"OneDrive"=C:\Users\Veronika\AppData\Local\Microsoft\OneDrive\OneDrive.exe [2017-12-08 1551048]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ahcache.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CoreMessagingRegistrar]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\iai2c.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\iai2ce.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\iaspie.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SpbCx.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\StateRepository]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TileDataModelSvc]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\uefi.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\UserManager]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{F2E7DD72-6468-4E36-B6F1-6488F42C1B52}]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Ahcache.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\CoreMessagingRegistrar]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SpbCx.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\StateRepository]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TileDataModelSvc]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\uefi.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UserManager]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{F2E7DD72-6468-4E36-B6F1-6488F42C1B52}]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DSCAutomationHostEnabled"=2
"FilterAdministratorToken"=1
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"vidc.i420"=iyuv_32.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"MSVideo8"=VfWWDM32.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
======File associations======
.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
======List of files/folders created in the last 1 month======
2017-12-09 14:12:31 ----DC---- C:\rsit
2017-12-09 14:12:31 ----DC---- C:\Program Files\trend micro
2017-12-09 14:04:06 ----DC---- C:\FRST
2017-12-09 13:56:51 ----DC---- C:\WINDOWS\UpdateAssistant
2017-12-08 01:09:27 ----AC---- C:\WINDOWS\progress.ini
2017-12-08 00:48:13 ----HDC---- C:\$GetCurrent
2017-12-08 00:48:03 ----DC---- C:\Windows10Upgrade
2017-12-07 01:07:17 ----DC---- C:\WINDOWS\Minidump
2017-12-06 23:02:48 ----DC---- C:\Users\Veronika\AppData\Roaming\Macromedia
2017-12-06 21:32:15 ----DC---- C:\WINDOWS\system32\UNP
2017-12-06 21:32:15 ----ADC---- C:\Program Files\UNP
2017-12-06 19:25:47 ----DC---- C:\Program Files\Microsoft.NET
2017-12-06 19:23:29 ----ADC---- C:\Program Files\Common Files\DESIGNER
2017-12-06 19:23:04 ----DC---- C:\Program Files (x86)\Mozilla Firefox
2017-12-06 19:22:04 ----DC---- C:\Program Files (x86)\Microsoft SQL Server
2017-12-06 19:21:41 ----DC---- C:\WINDOWS\PCHEALTH
2017-12-06 19:21:41 ----DC---- C:\Program Files\Microsoft SQL Server
2017-12-06 19:16:18 ----DC---- C:\Program Files\Microsoft Analysis Services
2017-12-06 19:16:18 ----DC---- C:\Program Files (x86)\Microsoft Analysis Services
2017-12-06 19:15:19 ----DC---- C:\Program Files (x86)\Microsoft Office
2017-12-06 19:14:48 ----DC---- C:\ProgramData\Microsoft Help
2017-12-06 19:14:27 ----RHDC---- C:\MSOCache
2017-12-06 08:52:04 ----AC---- C:\Recovery.txt
2017-12-06 08:45:59 ----DC---- C:\WINDOWS\Panther
2017-12-06 08:45:59 ----DC---- C:\WINDOWS\InfusedApps
2017-12-06 08:43:29 ----DC---- C:\WINDOWS\Setup
2017-12-06 08:30:30 ----DC---- C:\WINDOWS\OCR
2017-12-06 08:25:00 ----AC---- C:\WINDOWS\system32\perfi005.dat
2017-12-06 08:25:00 ----AC---- C:\WINDOWS\system32\perfh005.dat
2017-12-06 08:25:00 ----AC---- C:\WINDOWS\system32\perfd005.dat
2017-12-06 08:25:00 ----AC---- C:\WINDOWS\system32\perfc005.dat
2017-12-06 08:24:34 ----DC---- C:\WINDOWS\SYSWOW64\winrm
2017-12-06 08:24:33 ----DC---- C:\WINDOWS\SYSWOW64\WCN
2017-12-06 08:24:33 ----DC---- C:\WINDOWS\SYSWOW64\sysprep
2017-12-06 08:24:33 ----DC---- C:\WINDOWS\SYSWOW64\slmgr
2017-12-06 08:24:33 ----DC---- C:\WINDOWS\SYSWOW64\Printing_Admin_Scripts
2017-12-06 08:24:33 ----DC---- C:\WINDOWS\SYSWOW64\en
2017-12-06 08:24:33 ----DC---- C:\WINDOWS\SYSWOW64\drivers\UMDF
2017-12-06 08:24:33 ----DC---- C:\WINDOWS\SYSWOW64\drivers\en-US
2017-12-06 08:24:33 ----DC---- C:\WINDOWS\SYSWOW64\drivers\cs-CZ
2017-12-06 08:24:31 ----DC---- C:\WINDOWS\SYSWOW64\cs
2017-12-06 08:24:30 ----DC---- C:\WINDOWS\SYSWOW64\0409
2017-12-06 08:24:30 ----DC---- C:\WINDOWS\system32\winrm
2017-12-06 08:24:30 ----DC---- C:\WINDOWS\system32\WCN
2017-12-06 08:24:29 ----DC---- C:\WINDOWS\system32\slmgr
2017-12-06 08:24:29 ----DC---- C:\WINDOWS\system32\Printing_Admin_Scripts
2017-12-06 08:24:28 ----DC---- C:\WINDOWS\system32\en
2017-12-06 08:24:27 ----DC---- C:\WINDOWS\system32\drivers\en-US
2017-12-06 08:24:26 ----DC---- C:\WINDOWS\system32\drivers\cs-CZ
2017-12-06 08:24:22 ----DC---- C:\WINDOWS\system32\cs
2017-12-06 08:24:21 ----DC---- C:\WINDOWS\system32\0409
2017-12-06 08:24:20 ----DC---- C:\WINDOWS\en-US
2017-12-06 08:24:20 ----DC---- C:\WINDOWS\DigitalLocker
2017-12-06 08:24:20 ----DC---- C:\WINDOWS\cs-CZ
2017-12-06 08:19:00 ----AC---- C:\WINDOWS\system32\perfi009.dat
2017-12-06 08:19:00 ----AC---- C:\WINDOWS\system32\perfh009.dat
2017-12-06 08:19:00 ----AC---- C:\WINDOWS\system32\perfd009.dat
2017-12-06 08:19:00 ----AC---- C:\WINDOWS\system32\perfc009.dat
2017-12-06 08:18:35 ----AC---- C:\WINDOWS\SYSWOW64\FlashPlayerApp.exe
2017-12-06 08:14:58 ----AC---- C:\WINDOWS\SYSWOW64\NOISE.DAT
2017-12-06 08:14:58 ----AC---- C:\WINDOWS\SYSWOW64\msclmd.dll
2017-12-06 08:14:55 ----AC---- C:\WINDOWS\SYSWOW64\dssec.dat
2017-12-06 08:14:32 ----AC---- C:\WINDOWS\system32\NOISE.DAT
2017-12-06 08:14:31 ----AC---- C:\WINDOWS\system32\msclmd.dll
2017-12-06 08:14:29 ----AC---- C:\WINDOWS\system32\dssec.dat
2017-12-06 08:14:19 ----RSHC---- C:\WINDOWS\fonts\StaticCache.dat
2017-12-06 08:14:15 ----AC---- C:\WINDOWS\fonts\desktop.ini
2017-12-06 08:14:12 ----ASHC---- C:\Program Files (x86)\desktop.ini
2017-12-06 08:14:09 ----ASHC---- C:\Program Files\desktop.ini
2017-12-06 08:14:04 ----SDC---- C:\WINDOWS\SYSWOW64\Nui
2017-12-06 08:14:04 ----SDC---- C:\WINDOWS\SYSWOW64\F12
2017-12-06 08:14:04 ----SDC---- C:\WINDOWS\SYSWOW64\DiagSvcs
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\Web
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\Vss
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\twain_32
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\tracing
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\Temp
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\TAPI
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\zh-TW
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\zh-HK
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\zh-CN
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\WinMetadata
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\WindowsPowerShell
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\wbem
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\uk-UA
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\tr-TR
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\th-TH
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\Tasks
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\sv-SE
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\sru
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\sr-Latn-RS
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\sr-Latn-CS
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\sppui
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\spp
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\Speech_OneCore
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\Speech
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\SMI
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\sl-SI
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\sk-SK
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\setup
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\ru-RU
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\ro-RO
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\restore
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\Recovery
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\RasToast
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\ras
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\pt-PT
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\pt-BR
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\pl-PL
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\oobe
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\nl-NL
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\networklist
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\NDF
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\nb-NO
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\MUI
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\MsDtc
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\MSDRM
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\migwiz
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\migration
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\MailContactsCalendarSync
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\Macromed
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\lv-LV
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\lt-LT
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\LogFiles
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\Licenses
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\ko-KR
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\ja-JP
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\it-IT
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\Ipmi
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\InstallShield
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\InputMethod
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\inetsrv
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\IME
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\icsxml
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\hu-HU
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\hr-HR
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\he-IL
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\GroupPolicyUsers
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\GroupPolicy
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\FxsTmp
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\fr-FR
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\fr-CA
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\fi-FI
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\et-EE
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\es-MX
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\es-ES
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\en-US
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\en-GB
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\el-GR
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\DriverStore
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\drivers
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\downlevel
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\Dism
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\de-DE
2017-12-06 08:14:04 ----DC---- C:\WINDOWS\SYSWOW64\da-DK
2017-12-06 08:14:03 ----SDC---- C:\WINDOWS\SYSWOW64\Configuration
2017-12-06 08:14:03 ----DC---- C:\WINDOWS\SYSWOW64\cs-CZ
2017-12-06 08:14:03 ----DC---- C:\WINDOWS\SYSWOW64\config
2017-12-06 08:14:03 ----DC---- C:\WINDOWS\SYSWOW64\Com
2017-12-06 08:14:03 ----DC---- C:\WINDOWS\SYSWOW64\catroot
2017-12-06 08:14:03 ----DC---- C:\WINDOWS\SYSWOW64\Bthprops
2017-12-06 08:14:03 ----DC---- C:\WINDOWS\SYSWOW64\bg-BG
2017-12-06 08:14:03 ----DC---- C:\WINDOWS\SYSWOW64\ar-SA
2017-12-06 08:14:03 ----DC---- C:\WINDOWS\SYSWOW64\AppLocker
2017-12-06 08:14:03 ----DC---- C:\WINDOWS\SYSWOW64\AdvancedInstallers
2017-12-06 08:14:03 ----DC---- C:\WINDOWS\syswow64
2017-12-06 08:14:03 ----DC---- C:\WINDOWS\SystemResources
2017-12-06 08:14:02 ----SDC---- C:\WINDOWS\system32\Nui
2017-12-06 08:14:02 ----SDC---- C:\WINDOWS\system32\F12
2017-12-06 08:14:02 ----SDC---- C:\WINDOWS\system32\dsc
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\SystemApps
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\zh-TW
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\zh-HK
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\zh-CN
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\WinMetadata
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\winevt
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\WindowsPowerShell
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\WinBioPlugIns
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\WinBioDatabase
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\WDI
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\wbem
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\uk-UA
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\tr-TR
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\th-TH
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\Tasks
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\SystemResetPlatform
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\sv-SE
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\sru
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\sr-Latn-RS
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\sr-Latn-CS
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\sppui
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\spp
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\spool
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\Speech_OneCore
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\Speech
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\sl-SI
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\sk-SK
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\setup
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\SecureBootUpdates
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\ru-RU
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\ro-RO
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\restore
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\Recovery
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\RasToast
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\ras
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\pt-PT
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\pt-BR
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\ProximityToast
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\PointOfService
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\pl-PL
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\oobe
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\nl-NL
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\networklist
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\NDF
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\nb-NO
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\MUI
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\MsDtc
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\MSDRM
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\migwiz
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\migration
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\MailContactsCalendarSync
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\Macromed
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\lv-LV
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\lt-LT
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\LogFiles
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\Licenses
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\ko-KR
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\ja-JP
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\it-IT
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\Ipmi
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\InputMethod
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\inetsrv
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\IME
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\icsxml
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\ias
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\hu-HU
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\hr-HR
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\he-IL
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\FxsTmp
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\fr-FR
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\fr-CA
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\fi-FI
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\et-EE
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\es-MX
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\es-ES
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\en-US
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\en-GB
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\el-GR
2017-12-06 08:14:02 ----DC---- C:\WINDOWS\system32\drivers\etc
2017-12-06 08:14:01 ----SHDC---- C:\WINDOWS\Installer
2017-12-06 08:14:01 ----SHDC---- C:\Program Files\Windows Sidebar
2017-12-06 08:14:01 ----SHDC---- C:\Program Files (x86)\Windows Sidebar
2017-12-06 08:14:01 ----SDC---- C:\WINDOWS\system32\DiagSvcs
2017-12-06 08:14:01 ----SDC---- C:\WINDOWS\system32\Configuration
2017-12-06 08:14:01 ----SDC---- C:\WINDOWS\Downloaded Program Files
2017-12-06 08:14:01 ----SDC---- C:\ProgramData\Microsoft
2017-12-06 08:14:01 ----SDC---- C:\Program Files\WindowsPowerShell
2017-12-06 08:14:01 ----SDC---- C:\Program Files (x86)\WindowsPowerShell
2017-12-06 08:14:01 ----RSDC---- C:\WINDOWS\Media
2017-12-06 08:14:01 ----RSDC---- C:\WINDOWS\Fonts
2017-12-06 08:14:01 ----RDC---- C:\WINDOWS\PurchaseDialog
2017-12-06 08:14:01 ----RDC---- C:\WINDOWS\PrintDialog
2017-12-06 08:14:01 ----RDC---- C:\WINDOWS\Offline Web Pages
2017-12-06 08:14:01 ----RDC---- C:\WINDOWS\MiracastView
2017-12-06 08:14:01 ----RDC---- C:\WINDOWS\ImmersiveControlPanel
2017-12-06 08:14:01 ----RDC---- C:\WINDOWS\DevicesFlow
2017-12-06 08:14:01 ----RDC---- C:\WINDOWS\DesktopTileResources
2017-12-06 08:14:01 ----HDC---- C:\WINDOWS\ELAMBKUP
2017-12-06 08:14:01 ----HDC---- C:\ProgramData
2017-12-06 08:14:01 ----HDC---- C:\Program Files\WindowsApps
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\system32\downlevel
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\system32\Dism
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\system32\de-DE
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\system32\da-DK
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\system32\cs-CZ
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\system32\Com
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\system32\CodeIntegrity
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\system32\catroot2
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\system32\Bthprops
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\system32\Boot
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\system32\bg-BG
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\system32\ar-SA
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\system32\appraiser
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\system32\AppLocker
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\system32\AdvancedInstallers
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\System
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\Speech_OneCore
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\Speech
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\SKB
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\schemas
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\SchCache
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\security
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\Resources
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\rescache
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\Registration
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\Provisioning
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\prefetch
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\PolicyDefinitions
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\PLA
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\Performance
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\ModemLogs
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\Migration
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\Logs
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\LiveKernelReports
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\L2Schemas
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\InputMethod
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\IME
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\Help
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\Globalization
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\diagnostics
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\debug
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\Cursors
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\Branding
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\Boot
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\bcastdvr
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\AppReadiness
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\AppPatch
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\appcompat
2017-12-06 08:14:01 ----DC---- C:\WINDOWS\addins
2017-12-06 08:14:01 ----DC---- C:\ProgramData\USOPrivate
2017-12-06 08:14:01 ----DC---- C:\ProgramData\SoftwareDistribution
2017-12-06 08:14:01 ----DC---- C:\ProgramData\Comms
2017-12-06 08:14:01 ----DC---- C:\Program Files\Windows Portable Devices
2017-12-06 08:14:01 ----DC---- C:\Program Files\Windows Photo Viewer
2017-12-06 08:14:01 ----DC---- C:\Program Files\Windows NT
2017-12-06 08:14:01 ----DC---- C:\Program Files\Windows Multimedia Platform
2017-12-06 08:14:01 ----DC---- C:\Program Files\Windows Media Player
2017-12-06 08:14:01 ----DC---- C:\Program Files\Windows Mail
2017-12-06 08:14:01 ----DC---- C:\Program Files\Windows Defender
2017-12-06 08:14:01 ----DC---- C:\Program Files\Internet Explorer
2017-12-06 08:14:01 ----DC---- C:\Program Files\Common Files\System
2017-12-06 08:14:01 ----DC---- C:\Program Files\Common Files\Services
2017-12-06 08:14:01 ----DC---- C:\Program Files (x86)\Windows Portable Devices
2017-12-06 08:14:01 ----DC---- C:\Program Files (x86)\Windows Photo Viewer
2017-12-06 08:14:01 ----DC---- C:\Program Files (x86)\Windows NT
2017-12-06 08:14:01 ----DC---- C:\Program Files (x86)\Windows Multimedia Platform
2017-12-06 08:14:01 ----DC---- C:\Program Files (x86)\Windows Media Player
2017-12-06 08:14:01 ----DC---- C:\Program Files (x86)\Windows Mail
2017-12-06 08:14:01 ----DC---- C:\Program Files (x86)\Windows Defender
2017-12-06 08:14:01 ----DC---- C:\Program Files (x86)\Internet Explorer
2017-12-06 08:14:01 ----DC---- C:\PerfLogs
2017-12-06 08:14:01 ----ADC---- C:\ProgramData\regid.1991-06.com.microsoft
2017-12-06 08:14:01 ----ADC---- C:\Program Files\Common Files\microsoft shared
2017-12-06 08:14:01 ----ADC---- C:\Program Files (x86)\Microsoft.NET
2017-12-06 08:14:00 ----RDC---- C:\WINDOWS\assembly
2017-12-06 08:14:00 ----DC---- C:\WINDOWS\system32\Sysprep
2017-12-06 08:14:00 ----DC---- C:\WINDOWS\Microsoft.NET
2017-12-06 08:13:13 ----DC---- C:\WINDOWS\system32\drivers\UMDF
2017-12-06 08:13:09 ----DC---- C:\WINDOWS\system32\drivers
2017-12-06 08:10:42 ----DC---- C:\WINDOWS\INF
2017-12-06 07:52:37 ----DC---- C:\WINDOWS\CbsTemp
2017-12-06 07:32:19 ----RDC---- C:\Users
2017-12-06 07:32:19 ----RDC---- C:\Program Files (x86)
2017-12-06 07:32:19 ----RDC---- C:\Program Files
2017-12-06 07:32:19 ----DC---- C:\WINDOWS\WinSxS
2017-12-06 07:32:19 ----DC---- C:\WINDOWS\system32\SMI
2017-12-06 07:32:19 ----DC---- C:\WINDOWS\system32\DriverStore
2017-12-06 07:32:19 ----DC---- C:\WINDOWS\system32\config
2017-12-06 07:32:19 ----DC---- C:\WINDOWS\system32\CatRoot
2017-12-06 07:32:19 ----DC---- C:\WINDOWS\System32
2017-12-06 07:32:19 ----DC---- C:\WINDOWS\servicing
2017-12-06 07:32:19 ----DC---- C:\Windows
2017-12-06 07:32:19 ----DC---- C:\Program Files\Common Files
2017-12-06 07:32:19 ----DC---- C:\Program Files (x86)\Common Files
2017-12-06 07:32:19 ----ASH---- C:\pagefile.sys
2017-12-06 00:37:17 ----AC---- C:\WINDOWS\SYSWOW64\OpenCL.DLL
2017-12-06 00:37:17 ----AC---- C:\WINDOWS\system32\OpenCL.DLL
2017-12-06 00:37:17 ----AC---- C:\WINDOWS\system32\{EC94D02F-D200-4428-9531-05AF7F9799CB}.bat
2017-12-06 00:30:10 ----AC---- C:\WINDOWS\system32\emptyregdb.dat
2017-12-06 00:28:24 ----AC---- C:\WINDOWS\SYSWOW64\PrintConfig.dll
2017-12-06 00:25:48 ----ASH---- C:\hiberfil.sys
2017-12-06 00:05:03 ----DC---- C:\ProgramData\ESET
2017-12-06 00:05:03 ----DC---- C:\Program Files\ESET
2017-12-06 00:02:54 ----C---- C:\WINDOWS\system32\MpSigStub.exe
2017-12-05 23:57:31 ----AS---- C:\WINDOWS\bootstat.dat
2017-12-05 23:54:22 ----DC---- C:\WINDOWS\system32\Intel
2017-12-05 23:53:19 ----DC---- C:\WINDOWS\system32\SleepStudy
2017-12-05 23:53:19 ----DC---- C:\WINDOWS\ServiceProfiles
2017-12-05 23:53:17 ----SDC---- C:\WINDOWS\system32\Microsoft
2017-12-05 23:53:11 ----AC---- C:\WINDOWS\system32\FNTCACHE.DAT
2017-12-05 23:53:01 ----ASH---- C:\swapfile.sys
2017-12-05 23:46:26 ----ADC---- C:\Program Files\rempl
2017-12-05 23:45:17 ----AC---- C:\WINDOWS\system32\wuauclt.exe
2017-12-05 23:45:16 ----AC---- C:\WINDOWS\system32\dosvc.dll
2017-12-05 23:45:16 ----AC---- C:\WINDOWS\system32\domgmt.dll
2017-12-05 23:45:15 ----AC---- C:\WINDOWS\system32\wuaueng.dll