| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Windows 10: mögliche Infektion durch USB-Stick (Manuel.doc/Forbix.A?)Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
09.02.2017, 16:17
| #1 |
 |  Windows 10: mögliche Infektion durch USB-Stick (Manuel.doc/Forbix.A?) Hallo, folgendes Szenario: Mein USB-Stick wurde in der Uni an einen PC angeschlossen und dort wahrscheinlich (zunächst unbemerkt) mit einem Wurm infiziert. Alle Dateien wurden mit den flags "system" und "hidden" entsprechend versteckt, zurück blieben nur noch Dateiverknüfungen, die mit dem Startbefehl via VBS versuchen, Schadcode aus einer "Manuel.doc" auf dem Stick auszuführen. Nach Anschluss am heimischen PC habe ich Depp natürlich erst mal verwundert auf eine der Verknüpfungen geklickt. Auftritt: Comodo, das den Zugriff blockiert und die Datei nach Nachfrage in die Quarantäne geschoben hat (siehe Log). Insofern ist das VBS-Skript, soweit ich es erkennen kann, nicht zur Ausführung gekommen. Der Stick wurde mit Rem-VBSworm-Tool entsprechend der hier verfügbaren Anleitung gesäubert und dann zur Sicherheit formatiert. Die Frage ist nun: Ist nicht doch etwas durchgekommen? Wurde eine Backdoor installiert? Da ich das System produktiv nutze und beruflich darauf angewiesen bin, wäre es nett, hier professionelle Hilfe zu bekommen. Soweit ich das mit meinem Kenntnissstand erkennen kann, wurde das Schlimmste noch einmal verhindert - aber ich möchte auf Nummer sicher gehen. Besten Dank! Logfiles: Comodo Code:
ATTFilter Antivirus-Ereignisse
COMODO Internet Security Premium Einträge
Tabelle: Antivirus-Ereignisse
Erstellungsdatum: 2017-02-09 15:12:00
Anzahl der Einträge: 3
Datum
Ort
Name der Malware
Aktion
Status
2017-02-08 19:12:07
I:\Manuel.doc
Malware@#267cv0z484h1y
Quarantäne
Erfolgreich
2017-02-08 19:11:56
I:\Manuel.doc
Malware@#267cv0z484h1y
Fragen
Erfolgreich
2017-02-08 19:11:55
I:\Manuel.doc
Malware@#267cv0z484h1y
Erkennen
Erfolgreich
Ende des Berichts
FRST Logfile: Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 05-02-2017
durchgeführt von ***** (Administrator) auf ***** (09-02-2017 15:11:20)
Gestartet von C:\Users\*****\Desktop\Programme
Geladene Profile: ***** (Verfügbare Profile: *****)
Platform: Windows 10 Pro Version 1607 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
(Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
() C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe
(DTS) C:\Program Files\Realtek\Audio\HDA\DTSAudioService64.exe
(Micro-Star INT'L CO., LTD.) C:\Program Files (x86)\MSI\Gaming APP\GamingHotkey_Service.exe
(Micro-Star Int'l Co., Ltd.) C:\Program Files (x86)\MSI\Gaming APP\GamingApp_Service.exe
() C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe
(Micro-Star INT'L CO., LTD.) C:\Program Files (x86)\MSI\MSI OC Kit\ActiveX_Service\MSI_ActiveX_Service.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\HelperService.exe
(Micro-Star INT'L CO., LTD.) C:\Program Files (x86)\MSI\Live Update\MSI_LiveUpdate_Service.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(Electronic Arts) C:\Program Files (x86)\Origin\OriginWebHelperService.exe
(Microsoft Corporation) C:\Windows\System32\mqsvc.exe
(Micro-Star INT'L CO., LTD.) C:\MSI\MSIRegister\MSIRegisterService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Valve Corporation) D:\Steam\Steam.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Volume Panel\VolPanlu.exe
(Creative Technology Ltd) C:\Windows\SysWOW64\CTxfispi.exe
(Creative Technology Ltd) C:\Windows\SysWOW64\Ctxfihlp.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cistray.exe
(Micro-Star INT'L CO., LTD.) C:\Program Files (x86)\MSI\Gaming APP\OSD\x64\MsiGamingOSD_x64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Micro-Star INT'L CO., LTD.) C:\Program Files (x86)\MSI\Gaming APP\OSD\x86\MsiGamingOSD_x86.exe
(MSI) C:\Windows\SysWOW64\muachost.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cis.exe
(Valve Corporation) D:\Steam\bin\cef\cef.win7\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Dominik Reichl) C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe
(Microsoft Corporation) C:\Windows\System32\InstallAgent.exe
(Microsoft Corporation) C:\Windows\System32\InstallAgentUserBroker.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\reader_sl.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe
==================== Registry (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12558440 2011-07-07] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_DTS] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2226280 2011-06-03] (Realtek Semiconductor)
HKLM\...\Run: [Eraser] => C:\Program Files\Eraser\Eraser.exe [1074088 2016-02-08] (The Eraser Project)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [176952 2016-09-11] (Apple Inc.)
HKLM-x32\...\Run: [amd_dc_opt] => C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe [77824 2008-07-22] (AMD)
HKLM-x32\...\Run: [NWEReboot] => [X]
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2015-08-20] (Apple Inc.)
HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [975760 2016-01-02] (Cisco Systems, Inc.)
HKLM-x32\...\Run: [KeePass 2 PreLoad] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [2770944 2016-06-04] (Dominik Reichl)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [598552 2016-08-07] (Oracle Corporation)
HKLM-x32\...\Run: [VolPanel] => C:\Program Files (x86)\Creative\Volume Panel\VolPanlu.exe [241789 2016-08-10] (Creative Technology Ltd)
HKLM-x32\...\Run: [CTxfiHlp] => C:\Windows\SysWOW64\CTXFIHLP.EXE [26112 2016-08-10] (Creative Technology Ltd)
HKLM-x32\...\Run: [Live Update] => C:\Program Files (x86)\MSI\Live Update\Live Update.exe [13388752 2017-01-20] (Micro-Star INT'L CO., LTD.)
HKLM-x32\...\Run: [MSIRegister] => C:\MSI\MSIRegister\MSIRegister.exe [1258448 2017-01-20] (Micro-Star INT'L CO., LTD.)
HKLM Group Policy restriction on software: %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot% <====== ACHTUNG
HKLM Group Policy restriction on software: %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir% <====== ACHTUNG
HKU\S-1-5-21-2015921152-1024863377-2374061687-1000\...\Run: [Steam] => D:\Steam\steam.exe [3018016 2017-02-05] (Valve Corporation)
HKU\S-1-5-21-2015921152-1024863377-2374061687-1000\...\Run: [SandboxieControl] => C:\Program Files\Sandboxie\SbieCtrl.exe [797328 2016-07-22] (Sandboxie Holdings, LLC)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll [2013-09-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll [2013-09-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll [2013-09-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll [2013-09-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll [2013-09-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll [2013-09-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll [2013-09-11] (Dropbox, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\errorlog.txt [2017-02-08] ()
GroupPolicy: Beschränkung <======= ACHTUNG
GroupPolicyScripts: Beschränkung <======= ACHTUNG
GroupPolicyScripts\User: Beschränkung <======= ACHTUNG
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{96af5b1b-04b9-4121-b4f9-7031bc057d7a}: [DhcpNameServer] 172.20.10.1
Tcpip\..\Interfaces\{fbdae894-07e8-48b9-94f2-0d09a5403ba5}: [DhcpNameServer] 192.168.178.1
Internet Explorer:
==================
HKU\S-1-5-21-2015921152-1024863377-2374061687-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://startpage.com/
BHO: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\system32\mscoree.dll [2016-07-16] (Microsoft Corporation)
BHO: Hotspot Shield Class -> {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} -> C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE_64.dll => Keine Datei
BHO-x32: PDF Architect Helper -> {3A2D5EBA-F86D-4BD3-A177-019765996711} -> C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll [2013-04-08] (pdfforge GmbH)
BHO-x32: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll [2010-10-27] (Atheros Commnucations)
Toolbar: HKLM-x32 - PDF Architect Toolbar - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Program Files (x86)\PDF Architect\PDFIEPlugin.dll [2013-04-08] (pdfforge GmbH)
DPF: HKLM-x32 {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: HKLM-x32 {E705A591-DA3C-4228-B0D5-A356DBA42FBF} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab
DPF: HKLM-x32 {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/110926/CTPID.cab
FireFox:
========
FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\*****.default [2017-02-09]
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\*****.default -> Wikipedia (de)
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\*****.default -> Wikipedia (de)
FF Session Restore: Mozilla\Firefox\Profiles\*****.default -> ist aktiviert.
FF NetworkProxy: Mozilla\Firefox\Profiles\*****.default -> http", "212.82.126.32"
FF NetworkProxy: Mozilla\Firefox\Profiles\*****.default -> http_port", 80
FF NetworkProxy: Mozilla\Firefox\Profiles\*****.default -> type", 0
FF Extension: (Firebug) - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\*****.default\Extensions\firebug@software.joehewitt.com.xpi [2016-10-21]
FF Extension: (Ghostery) - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\*****.default\Extensions\firefox@ghostery.com.xpi [2016-08-12]
FF Extension: (HTTPS Everywhere) - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\*****.default\Extensions\https-everywhere-eff@eff.org.xpi [2017-01-27]
FF Extension: (Random Agent Spoofer) - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\*****.default\Extensions\jid1-AVgCeF1zoVzMjA@jetpack.xpi [2016-04-19]
FF Extension: (KeeFox) - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\*****.default\Extensions\keefox@chris.tomlinson [2016-11-23]
FF Extension: (Personas Plus) - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\*****.default\Extensions\personas@christopher.beard.xpi [2016-12-07]
FF Extension: (uBlock Origin) - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\*****.default\Extensions\uBlock0@raymondhill.net.xpi [2017-01-25]
FF Extension: (HTML5 Player) - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\*****.default\Extensions\{030de924-fe30-4d29-9b28-6b1bd2637351}.xpi [2015-12-18] [ist nicht signiert]
FF Extension: (Flagfox) - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\*****.default\Extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}.xpi [2017-01-16]
FF Extension: (ChatZilla) - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\*****.default\Extensions\{59c81df5-4b7a-477b-912d-4e0fdf64e5f2} [2016-11-11]
FF Extension: (NoScript) - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\*****.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2016-08-10]
FF Extension: (FoxClocks) - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\*****.default\Extensions\{d37dc5d0-431d-44e5-8c91-49419370caa1}.xpi [2016-04-17]
FF Extension: (BetterPrivacy) - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\*****.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2015-12-04]
FF Extension: (Fox!Box) - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\*****.default\Extensions\{df4e4df5-5cb7-46b0-9aef-6c784c3249f8}.xpi [2016-04-29]
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\*****.default\searchplugins\duckduckgo.xml [2012-02-29]
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\*****.default\searchplugins\startpage-https---deutsch.xml [2017-02-09]
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\*****.default\searchplugins\youtube-ssl.xml [2013-10-24]
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: (PDF Architect Converter For Firefox) - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2013-12-14] [ist nicht signiert]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-12-18] ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.0 -> C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.0\npesnsonar.dll [Keine Datei]
FF Plugin-x32: @esn/esnlaunch,version=1.104.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.104.0\npesnlaunch.dll [Keine Datei]
FF Plugin-x32: @esn/esnlaunch,version=1.116.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.116.0\npesnlaunch.dll [Keine Datei]
FF Plugin-x32: @esn/esnlaunch,version=1.96.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.96.0\npesnlaunch.dll [Keine Datei]
FF Plugin-x32: @esn/esnlaunch,version=2.3.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.3.0\npesnlaunch.dll [Keine Datei]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-10-21] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2017-02-08] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2017-02-08] (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [Keine Datei]
FF Plugin-x32: @sony.com/ReaderDesktop -> C:\Program Files (x86)\Sony\ReaderDesktop\npreaderdetectmoz.dll [2013-11-27] (Sony Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.1.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2016-06-23] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2015921152-1024863377-2374061687-1000: @Google.com/GoogleEarthPlugin -> C:\Users\*****\AppData\Local\Google\Google Earth\plugin\npgeplugin.dll [Keine Datei]
FF Plugin HKU\S-1-5-21-2015921152-1024863377-2374061687-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\*****\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [Keine Datei]
FF Plugin HKU\S-1-5-21-2015921152-1024863377-2374061687-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2016-12-15] ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL [2006-10-26] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2016-06-23] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll [2015-08-20] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll [2015-08-20] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll [2015-08-20] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll [2015-08-20] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll [2015-08-20] (Apple Inc.)
==================== Dienste (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-09-11] (Apple Inc.)
R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe [918144 2010-11-03] ()
R2 asHmComSvc; C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe [915584 2010-12-02] ()
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [52896 2010-10-27] (Atheros Commnucations) [Datei ist nicht signiert]
R2 cmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [5817256 2016-09-27] (COMODO)
R3 cmdvirth; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [2271928 2016-09-27] (COMODO)
S3 Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2015-07-21] (Creative Labs) [Datei ist nicht signiert]
R2 CTAudSvcService; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [286720 2016-08-10] (Creative Technology Ltd) [Datei ist nicht signiert]
R2 DirMngr; C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe [216576 2014-09-03] () [Datei ist nicht signiert]
R2 DTSAudioService; C:\Program Files\Realtek\Audio\HDA\DTSAudioService64.exe [210024 2011-05-31] (DTS)
S3 EasyAntiCheat; C:\WINDOWS\SysWOW64\EasyAntiCheat.exe [387856 2016-11-29] (EasyAntiCheat Ltd)
S3 ElfoService; C:\Program Files (x86)\ElsterFormular Update Service\bin\ElfoService.exe [1283376 2016-11-10] ()
R2 GamingApp_Service; C:\Program Files (x86)\MSI\Gaming APP\GamingApp_Service.exe [39888 2016-11-29] (Micro-Star Int'l Co., Ltd.)
R2 GamingHotkey_Service; C:\Program Files (x86)\MSI\Gaming APP\GamingHotkey_Service.exe [2019792 2016-11-29] (Micro-Star INT'L CO., LTD.)
S4 Hamachi2Svc; C:\Program Files (x86)\Hamachi\hamachi-2.exe [2470736 2013-06-28] (LogMeIn Inc.)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [Datei ist nicht signiert]
S3 IEEtwCollectorService; C:\Windows\system32\IEEtwCollector.exe [114688 2016-07-17] (Microsoft Corporation) [Datei ist nicht signiert]
R2 MSIREGISTER_MR; C:\MSI\MSIRegister\MSIRegisterService.exe [132048 2017-01-20] (Micro-Star INT'L CO., LTD.)
R2 MSI_ActiveX_Service; C:\Program Files (x86)\MSI\MSI OC Kit\ActiveX_Service\MSI_ActiveX_Service.exe [54200 2016-11-29] (Micro-Star INT'L CO., LTD.)
R2 MSI_LiveUpdate_Service; C:\Program Files (x86)\MSI\Live Update\MSI_LiveUpdate_Service.exe [2237392 2017-01-20] (Micro-Star INT'L CO., LTD.)
R2 NVDisplay.ContainerLocalSystem; C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [458176 2017-02-08] (NVIDIA Corporation)
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2119688 2017-01-06] (Electronic Arts)
R2 Origin Web Helper Service; C:\Program Files (x86)\Origin\OriginWebHelperService.exe [2180624 2017-01-06] (Electronic Arts)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-03-30] ()
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [117264 2010-06-25] (CACE Technologies, Inc.)
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [197264 2016-07-22] (Sandboxie Holdings, LLC)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [2889896 2016-09-29] (Microsoft Corporation)
S3 Sony SCSI Helper Service; C:\Program Files (x86)\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe [73728 2013-11-26] (Sony Corporation) [Datei ist nicht signiert]
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [Datei ist nicht signiert]
S3 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [10351856 2017-01-28] (TeamViewer GmbH)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)
===================== Treiber (Nicht auf der Ausnahmeliste) ======================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
S3 ArgusMonitor; C:\Windows\SysWow64\drivers\ArgusMonitor.sys [72128 2013-07-06] (Argotronic UG (haftungsbeschraenkt))
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-24] ()
R2 atksgt; C:\WINDOWS\System32\DRIVERS\atksgt.sys [314016 2014-02-20] ()
R1 cmderd; C:\WINDOWS\System32\DRIVERS\cmderd.sys [40960 2016-09-08] (COMODO)
R1 cmdGuard; C:\WINDOWS\System32\DRIVERS\cmdguard.sys [862648 2016-09-08] (COMODO)
R1 cmdHlp; C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [54336 2016-09-08] (COMODO)
R3 I2cHkBurn; C:\WINDOWS\system32\drivers\I2cHkBurn.sys [41760 2016-11-29] (FINTEK Corp.)
R1 inspect; C:\WINDOWS\system32\DRIVERS\inspect.sys [147304 2016-09-08] (COMODO)
R2 lirsgt; C:\WINDOWS\System32\DRIVERS\lirsgt.sys [43680 2014-02-20] ()
S3 mbamchameleon; C:\WINDOWS\system32\drivers\mbamchameleon.sys [109272 2017-02-08] (Malwarebytes)
S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
S3 NPF; C:\WINDOWS\System32\drivers\npf.sys [35344 2010-06-25] (CACE Technologies, Inc.)
S3 NPF; C:\Windows\SysWOW64\drivers\npf.sys [32000 2005-08-08] (NetGroup - Politecnico di Torino) [Datei ist nicht signiert]
R3 nvlddmkm; C:\WINDOWS\System32\DriverStore\FileRepository\nv_dispiwu.inf_amd64_b67dc924fff8de6d\nvlddmkm.sys [14199224 2017-02-08] (NVIDIA Corporation)
S3 nvvad_WaveExtensible; C:\WINDOWS\system32\drivers\nvvad64v.sys [56384 2016-11-29] (NVIDIA Corporation)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [589824 2016-07-16] (Realtek )
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [204944 2016-06-14] (Sandboxie Holdings, LLC)
S3 sclbl; D:\Spiele\Scarlet Blade\ScarletBlade\avital\scarbt64.sys [86352 2014-08-21] ()
S3 slb; D:\Spiele\Scarlet Blade\ScarletBlade\avital\scarlb64.sys [81880 2013-06-20] () [Datei ist nicht signiert]
S3 tap0901; C:\WINDOWS\System32\DRIVERS\tap0901.sys [36736 2013-02-08] (The OpenVPN Project) [Datei ist nicht signiert]
S3 vpnva; C:\WINDOWS\System32\drivers\vpnva64-6.sys [52592 2015-01-07] (Cisco Systems, Inc.)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
S3 xhunter1; C:\WINDOWS\xhunter1.sys [35880 2016-12-23] (Wellbia.com Co., Ltd.)
S3 GPCIDrv; \??\C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\GPCIDrv64.sys [X]
U3 idsvc; kein ImagePath
S3 MSICDSetup; \??\G:\CDriver64.sys [X]
S3 NTIOLib_1_0_C; \??\G:\NTIOLib_X64.sys [X]
U3 wpcsvc; kein ImagePath
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2017-02-09 15:12 - 2017-02-09 15:12 - 00003820 _____ C:\Users\*****\Desktop\comodo.htm
2017-02-09 15:06 - 2017-02-09 15:06 - 00000022 _____ C:\WINDOWS\S.dirmngr
2017-02-08 21:48 - 2017-02-08 21:50 - 00000000 ____D C:\Rem-VBSqt
2017-02-08 20:58 - 2017-02-09 15:11 - 00000000 ____D C:\FRST
2017-02-08 19:42 - 2017-02-08 19:43 - 00097856 _____ C:\TDSSKiller.3.1.0.12_08.02.2017_19.42.06_log.txt
2017-02-08 19:18 - 2017-02-08 21:48 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2017-02-08 19:17 - 2017-02-08 19:17 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Rootkit
2017-02-08 17:17 - 2017-02-09 01:41 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2017-02-08 13:10 - 2017-02-08 13:10 - 00133056 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvStreaming.exe
2017-02-08 13:10 - 2017-02-08 13:10 - 00125216 _____ C:\WINDOWS\system32\vulkaninfo.exe
2017-02-08 13:10 - 2017-02-08 13:10 - 00110880 _____ C:\WINDOWS\SysWOW64\vulkaninfo.exe
2017-02-08 13:10 - 2017-02-08 13:10 - 00000000 ____D C:\Program Files (x86)\VulkanRT
2017-02-08 13:10 - 2016-09-09 19:25 - 00269600 _____ C:\WINDOWS\SysWOW64\vulkan-1.dll
2017-02-08 13:10 - 2016-09-09 19:25 - 00261920 _____ C:\WINDOWS\system32\vulkan-1.dll
2017-02-08 13:09 - 2017-02-08 13:11 - 00000000 ____D C:\WINDOWS\LastGood.Tmp
2017-02-07 00:53 - 2017-02-08 13:41 - 00000000 ____D C:\Users\*****\AppData\Local\Stud.io
2017-02-07 00:53 - 2017-02-07 00:53 - 00000851 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Stud.io.lnk
2017-02-07 00:53 - 2017-02-07 00:53 - 00000839 _____ C:\Users\Public\Desktop\Stud.io.lnk
2017-02-07 00:51 - 2017-02-07 00:53 - 00000000 ____D C:\Program Files\Stud.io
2017-02-02 12:33 - 2017-02-02 12:33 - 06656980 _____ C:\Users\*****\Desktop\*****.pdf
2017-02-01 01:02 - 2017-02-01 01:02 - 00000132 _____ C:\Users\*****\AppData\Roaming\*****
2017-01-29 17:49 - 2017-01-29 17:49 - 02469815 _____ C:\Users\*****\Desktop\*****.pdf
2017-01-28 16:05 - 2017-01-28 16:05 - 00001116 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 12.lnk
2017-01-25 23:37 - 2017-01-28 01:07 - 00013527 _____ C:\Users\*****\Desktop\*****.xlsx
2017-01-25 12:32 - 2017-01-25 12:32 - 00142848 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe
2017-01-25 12:32 - 2017-01-25 12:32 - 00120320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe
2017-01-23 15:19 - 2017-01-23 15:19 - 00533403 _____ C:\Users\*****\Desktop\*****.pdf
2017-01-23 15:15 - 2017-01-23 15:15 - 00245732 _____ C:\Users\*****\Desktop\*****.pdf
2017-01-13 09:26 - 2017-01-13 01:34 - 01255936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AzureSettingSyncProvider.dll
2017-01-13 09:26 - 2017-01-13 01:34 - 00553984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptui.dll
2017-01-13 09:26 - 2017-01-13 01:34 - 00167424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinSCard.dll
2017-01-13 09:26 - 2017-01-13 01:33 - 07469056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2017-01-13 09:26 - 2017-01-13 01:33 - 00237056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SyncSettings.dll
2017-01-13 09:26 - 2017-01-13 01:33 - 00136544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mqmigplugin.dll
2017-01-13 09:25 - 2017-01-13 01:34 - 20969928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2017-01-13 09:25 - 2017-01-13 01:34 - 19417600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2017-01-13 09:25 - 2017-01-13 01:34 - 19413504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2017-01-13 09:25 - 2017-01-13 01:34 - 13869056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2017-01-13 09:25 - 2017-01-13 01:34 - 06044160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2017-01-13 09:25 - 2017-01-13 01:34 - 05398016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aclui.dll
2017-01-13 09:25 - 2017-01-13 01:34 - 02206496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2vdec.dll
2017-01-13 09:25 - 2017-01-13 01:34 - 01883648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll
2017-01-13 09:25 - 2017-01-13 01:34 - 01631232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Resources.dll
2017-01-13 09:25 - 2017-01-13 01:34 - 01155072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVP9DEC.dll
2017-01-13 09:25 - 2017-01-13 01:34 - 00866816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Cred.dll
2017-01-13 09:25 - 2017-01-13 01:34 - 00822784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll
2017-01-13 09:25 - 2017-01-13 01:34 - 00755712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2017-01-13 09:25 - 2017-01-13 01:34 - 00557568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StoreAgent.dll
2017-01-13 09:25 - 2017-01-13 01:34 - 00484584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2017-01-13 09:25 - 2017-01-13 01:34 - 00382784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll
2017-01-13 09:25 - 2017-01-13 01:34 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.BlockedShutdown.dll
2017-01-13 09:25 - 2017-01-13 01:34 - 00263472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Storage.ApplicationData.dll
2017-01-13 09:25 - 2017-01-13 01:34 - 00253952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.BioFeedback.dll
2017-01-13 09:25 - 2017-01-13 01:34 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgentUserBroker.exe
2017-01-13 09:25 - 2017-01-13 01:34 - 00218976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\offlinesam.dll
2017-01-13 09:25 - 2017-01-13 01:34 - 00213504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.CredDialogController.dll
2017-01-13 09:25 - 2017-01-13 01:34 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\indexeddbserver.dll
2017-01-13 09:25 - 2017-01-13 01:34 - 00180224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgent.exe
2017-01-13 09:25 - 2017-01-13 01:34 - 00074752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\updatepolicy.dll
2017-01-13 09:25 - 2017-01-13 01:33 - 07626752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2017-01-13 09:25 - 2017-01-13 01:33 - 06474752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mspaint.exe
2017-01-13 09:25 - 2017-01-13 01:33 - 04612608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2017-01-13 09:25 - 2017-01-13 01:33 - 03892864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2017-01-13 09:25 - 2017-01-13 01:33 - 02998272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2017-01-13 09:25 - 2017-01-13 01:33 - 02748416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpcore.dll
2017-01-13 09:25 - 2017-01-13 01:33 - 01852720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll
2017-01-13 09:25 - 2017-01-13 01:33 - 01557808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmde.dll
2017-01-13 09:25 - 2017-01-13 01:33 - 01360464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetsrc.dll
2017-01-13 09:25 - 2017-01-13 01:33 - 01300480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVPXENC.dll
2017-01-13 09:25 - 2017-01-13 01:33 - 01277344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll
2017-01-13 09:25 - 2017-01-13 01:33 - 01201872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll
2017-01-13 09:25 - 2017-01-13 01:33 - 00980832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetcore.dll
2017-01-13 09:25 - 2017-01-13 01:33 - 00712192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2017-01-13 09:25 - 2017-01-13 01:33 - 00640000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MCRecvSrc.dll
2017-01-13 09:25 - 2017-01-13 01:33 - 00497152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LogonController.dll
2017-01-13 09:25 - 2017-01-13 01:33 - 00318976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpencom.dll
2017-01-13 09:25 - 2017-01-13 01:33 - 00231936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.LockScreen.dll
2017-01-13 09:25 - 2017-01-13 01:33 - 00231424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CloudBackupSettings.dll
2017-01-13 09:25 - 2017-01-13 01:33 - 00076984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\remoteaudioendpoint.dll
2017-01-13 09:25 - 2017-01-13 01:33 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LaunchWinApp.exe
2017-01-13 09:25 - 2017-01-13 01:32 - 05061120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll
2017-01-13 09:25 - 2017-01-13 01:32 - 03733504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_47.dll
2017-01-13 09:25 - 2017-01-13 01:32 - 01469792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppVEntSubsystems32.dll
2017-01-13 09:25 - 2017-01-13 01:32 - 00886272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aadtb.dll
2017-01-13 09:25 - 2017-01-13 01:32 - 00860672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll
2017-01-13 09:25 - 2017-01-13 01:32 - 00806400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3D12.dll
2017-01-13 09:25 - 2017-01-13 01:32 - 00509792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe
2017-01-13 09:25 - 2017-01-13 01:32 - 00341344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2017-01-13 09:25 - 2017-01-13 01:32 - 00147968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32k.sys
2017-01-13 09:25 - 2017-01-13 01:32 - 00104448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.UI.Logon.ProxyStub.dll
2017-01-13 09:19 - 2017-01-13 01:34 - 22224480 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2017-01-13 09:19 - 2017-01-13 01:34 - 08075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2017-01-13 09:19 - 2017-01-13 01:34 - 03134976 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcore.dll
2017-01-13 09:19 - 2017-01-13 01:34 - 02317824 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2017-01-13 09:19 - 2017-01-13 01:34 - 01600632 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2017-01-13 09:19 - 2017-01-13 01:34 - 01121280 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadtb.dll
2017-01-13 09:19 - 2017-01-13 01:34 - 00932864 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2017-01-13 09:19 - 2017-01-13 01:34 - 00869888 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2017-01-13 09:19 - 2017-01-13 01:34 - 00673792 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe
2017-01-13 09:19 - 2017-01-13 01:34 - 00404832 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2017-01-13 09:19 - 2017-01-13 01:34 - 00391168 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll
2017-01-13 09:19 - 2017-01-13 01:34 - 00360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpencom.dll
2017-01-13 09:19 - 2017-01-13 01:34 - 00319288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wow64.dll
2017-01-13 09:19 - 2017-01-13 01:34 - 00201728 _____ (Microsoft Corporation) C:\WINDOWS\system32\ScDeviceEnum.dll
2017-01-13 09:19 - 2017-01-13 01:34 - 00193536 _____ (Microsoft Corporation) C:\WINDOWS\system32\certprop.dll
2017-01-13 09:19 - 2017-01-13 01:34 - 00090112 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatepolicy.dll
2017-01-13 09:19 - 2017-01-13 01:33 - 09131008 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2017-01-13 09:19 - 2017-01-13 01:33 - 08129536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2017-01-13 09:19 - 2017-01-13 01:33 - 04749312 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2017-01-13 09:19 - 2017-01-13 01:33 - 03616768 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2017-01-13 09:19 - 2017-01-13 01:33 - 02691072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll
2017-01-13 09:19 - 2017-01-13 01:33 - 02009600 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRHInproc.dll
2017-01-13 09:19 - 2017-01-13 01:33 - 01908224 _____ (Microsoft Corporation) C:\WINDOWS\system32\AzureSettingSyncProvider.dll
2017-01-13 09:19 - 2017-01-13 01:33 - 01694712 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmde.dll
2017-01-13 09:19 - 2017-01-13 01:33 - 01513472 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2017-01-13 09:19 - 2017-01-13 01:33 - 01062912 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll
2017-01-13 09:19 - 2017-01-13 01:33 - 01002496 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRH.dll
2017-01-13 09:19 - 2017-01-13 01:33 - 00837632 _____ (Microsoft Corporation) C:\WINDOWS\system32\wbiosrvc.dll
2017-01-13 09:19 - 2017-01-13 01:33 - 00748544 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll
2017-01-13 09:19 - 2017-01-13 01:33 - 00584544 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
2017-01-13 09:19 - 2017-01-13 01:33 - 00539648 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll
2017-01-13 09:19 - 2017-01-13 01:33 - 00425984 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadcloudap.dll
2017-01-13 09:19 - 2017-01-13 01:33 - 00418304 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BlockedShutdown.dll
2017-01-13 09:19 - 2017-01-13 01:33 - 00368640 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneBackupHandler.dll
2017-01-13 09:19 - 2017-01-13 01:33 - 00363520 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BioFeedback.dll
2017-01-13 09:19 - 2017-01-13 01:33 - 00352768 _____ (Microsoft Corporation) C:\WINDOWS\system32\cloudAP.dll
2017-01-13 09:19 - 2017-01-13 01:33 - 00328008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Storage.ApplicationData.dll
2017-01-13 09:19 - 2017-01-13 01:33 - 00310784 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncSettings.dll
2017-01-13 09:19 - 2017-01-13 01:33 - 00290816 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatehandlers.dll
2017-01-13 09:19 - 2017-01-13 01:33 - 00289792 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeveloperOptionsSettingsHandlers.dll
2017-01-13 09:19 - 2017-01-13 01:33 - 00260608 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgentUserBroker.exe
2017-01-13 09:19 - 2017-01-13 01:33 - 00211968 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgent.exe
2017-01-13 09:19 - 2017-01-13 01:33 - 00206848 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2017-01-13 09:19 - 2017-01-13 01:33 - 00147456 _____ (Microsoft Corporation) C:\WINDOWS\system32\winsrv.dll
2017-01-13 09:19 - 2017-01-13 01:33 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Shell.dll
2017-01-13 09:19 - 2017-01-13 01:33 - 00043008 _____ (Microsoft Corporation) C:\WINDOWS\system32\LaunchWinApp.exe
2017-01-13 09:18 - 2017-01-13 01:34 - 17188864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2017-01-13 09:18 - 2017-01-13 01:34 - 06285312 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2017-01-13 09:18 - 2017-01-13 01:34 - 05611008 _____ (Microsoft Corporation) C:\WINDOWS\system32\d2d1.dll
2017-01-13 09:18 - 2017-01-13 01:34 - 04474368 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_47.dll
2017-01-13 09:18 - 2017-01-13 01:34 - 04130440 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2017-01-13 09:18 - 2017-01-13 01:34 - 01988560 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll
2017-01-13 09:18 - 2017-01-13 01:34 - 01702392 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfasfsrcsnk.dll
2017-01-13 09:18 - 2017-01-13 01:34 - 01631232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.dll
2017-01-13 09:18 - 2017-01-13 01:34 - 01490432 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2017-01-13 09:18 - 2017-01-13 01:34 - 01454504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetsrc.dll
2017-01-13 09:18 - 2017-01-13 01:34 - 01300600 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll
2017-01-13 09:18 - 2017-01-13 01:34 - 01071736 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetcore.dll
2017-01-13 09:18 - 2017-01-13 01:34 - 01005568 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3D12.dll
2017-01-13 09:18 - 2017-01-13 01:34 - 00936960 _____ (Microsoft Corporation) C:\WINDOWS\system32\MCRecvSrc.dll
2017-01-13 09:18 - 2017-01-13 01:34 - 00883712 _____ (Microsoft Corporation) C:\WINDOWS\system32\samsrv.dll
2017-01-13 09:18 - 2017-01-13 01:34 - 00624048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2017-01-13 09:18 - 2017-01-13 01:34 - 00600576 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptui.dll
2017-01-13 09:18 - 2017-01-13 01:34 - 00245600 _____ (Microsoft Corporation) C:\WINDOWS\system32\offlinesam.dll
2017-01-13 09:18 - 2017-01-13 01:34 - 00236544 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSCard.dll
2017-01-13 09:18 - 2017-01-13 01:34 - 00136032 _____ (Microsoft Corporation) C:\WINDOWS\system32\ImplatSetup.dll
2017-01-13 09:18 - 2017-01-13 01:33 - 23678464 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2017-01-13 09:18 - 2017-01-13 01:33 - 22563840 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2017-01-13 09:18 - 2017-01-13 01:33 - 07816032 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2017-01-13 09:18 - 2017-01-13 01:33 - 06664192 _____ (Microsoft Corporation) C:\WINDOWS\system32\mspaint.exe
2017-01-13 09:18 - 2017-01-13 01:33 - 04149248 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2017-01-13 09:18 - 2017-01-13 01:33 - 02482280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2vdec.dll
2017-01-13 09:18 - 2017-01-13 01:33 - 01231872 _____ (Microsoft Corporation) C:\WINDOWS\system32\dosvc.dll
2017-01-13 09:18 - 2017-01-13 01:33 - 00947712 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVP9DEC.dll
2017-01-13 09:18 - 2017-01-13 01:33 - 00462336 _____ (Microsoft Corporation) C:\WINDOWS\system32\fhsettingsprovider.dll
2017-01-13 09:18 - 2017-01-13 01:33 - 00440320 _____ (Microsoft Corporation) C:\WINDOWS\system32\fhcfg.dll
2017-01-13 09:18 - 2017-01-13 01:33 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\system32\domgmt.dll
2017-01-13 09:18 - 2017-01-13 01:33 - 00261632 _____ (Microsoft Corporation) C:\WINDOWS\system32\indexeddbserver.dll
2017-01-13 09:18 - 2017-01-13 01:33 - 00257024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.CredDialogController.dll
2017-01-13 09:18 - 2017-01-13 01:33 - 00223744 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2017-01-13 09:18 - 2017-01-13 01:33 - 00208896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.UI.Logon.ProxyStub.dll
2017-01-13 09:18 - 2017-01-13 01:33 - 00153952 _____ (Microsoft Corporation) C:\WINDOWS\system32\mqcmiplugin.dll
2017-01-13 09:18 - 2017-01-13 01:33 - 00092512 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2017-01-13 09:18 - 2017-01-13 01:32 - 01292288 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVPXENC.dll
2017-01-13 09:18 - 2017-01-13 01:32 - 00707584 _____ (Microsoft Corporation) C:\WINDOWS\system32\LogonController.dll
2017-01-13 09:18 - 2017-01-13 01:32 - 00349184 _____ (Microsoft Corporation) C:\WINDOWS\system32\provengine.dll
2017-01-13 09:18 - 2017-01-13 01:32 - 00266752 _____ (Microsoft Corporation) C:\WINDOWS\system32\ConsoleLogon.dll
2017-01-13 09:18 - 2017-01-13 01:32 - 00241504 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHost.dll
2017-01-13 09:18 - 2017-01-13 01:32 - 00234496 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCore.dll
2017-01-13 09:18 - 2017-01-13 01:32 - 00119808 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCsp.dll
2017-01-13 09:18 - 2017-01-13 01:32 - 00083968 _____ (Microsoft Corporation) C:\WINDOWS\system32\ProvPluginEng.dll
2017-01-13 09:17 - 2017-01-13 01:34 - 01235296 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2017-01-13 09:17 - 2017-01-13 01:34 - 00324608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.LockScreen.dll
2017-01-13 09:17 - 2017-01-13 01:33 - 05511680 _____ (Microsoft Corporation) C:\WINDOWS\system32\aclui.dll
2017-01-13 09:17 - 2017-01-13 01:33 - 02275840 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2017-01-13 09:17 - 2017-01-13 01:33 - 02169184 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystems64.dll
2017-01-13 09:17 - 2017-01-13 01:33 - 01692672 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2017-01-13 09:17 - 2017-01-13 01:33 - 01669984 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVIntegration.dll
2017-01-13 09:17 - 2017-01-13 01:33 - 01400160 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystemController.dll
2017-01-13 09:17 - 2017-01-13 01:33 - 01356864 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipUp.exe
2017-01-13 09:17 - 2017-01-13 01:33 - 01054048 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVPolicy.dll
2017-01-13 09:17 - 2017-01-13 01:33 - 00992096 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVManifest.dll
2017-01-13 09:17 - 2017-01-13 01:33 - 00942080 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2017-01-13 09:17 - 2017-01-13 01:33 - 00822624 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVClient.exe
2017-01-13 09:17 - 2017-01-13 01:33 - 00813408 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntStreamingManager.dll
2017-01-13 09:17 - 2017-01-13 01:33 - 00779616 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVReporting.dll
2017-01-13 09:17 - 2017-01-13 01:33 - 00752992 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVOrchestration.dll
2017-01-13 09:17 - 2017-01-13 01:33 - 00715104 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys
2017-01-13 09:17 - 2017-01-13 01:33 - 00704352 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntVirtualization.dll
2017-01-13 09:17 - 2017-01-13 01:33 - 00696160 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVPublishing.dll
2017-01-13 09:17 - 2017-01-13 01:33 - 00590960 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2017-01-13 09:17 - 2017-01-13 01:33 - 00571744 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVCatalog.dll
2017-01-13 09:17 - 2017-01-13 01:33 - 00534096 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2017-01-13 09:17 - 2017-01-13 01:33 - 00513376 _____ (Microsoft Corporation) C:\WINDOWS\system32\TransportDSA.dll
2017-01-13 09:17 - 2017-01-13 01:33 - 00455520 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe
2017-01-13 09:17 - 2017-01-13 01:33 - 00418952 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2017-01-13 09:17 - 2017-01-13 01:33 - 00406368 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVScripting.dll
2017-01-13 09:17 - 2017-01-13 01:33 - 00337920 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2017-01-13 09:17 - 2017-01-13 01:33 - 00335712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pci.sys
2017-01-13 09:17 - 2017-01-13 01:33 - 00295424 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudBackupSettings.dll
2017-01-13 09:17 - 2017-01-13 01:33 - 00241504 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVShNotify.exe
2017-01-13 09:17 - 2017-01-13 01:33 - 00190816 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVDllSurrogate.exe
2017-01-13 09:17 - 2017-01-13 01:33 - 00089416 _____ (Microsoft Corporation) C:\WINDOWS\system32\remoteaudioendpoint.dll
2017-01-12 23:18 - 2017-01-12 23:18 - 03800860 _____ C:\Users\*****\Desktop\*****.epub
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2017-02-09 15:11 - 2016-08-11 14:13 - 00074676 _____ C:\WINDOWS\system32\Drivers\fvstore.dat
2017-02-09 15:11 - 2011-06-27 09:49 - 00000000 ____D C:\Users\*****\Desktop\Programme
2017-02-09 15:08 - 2013-02-24 21:39 - 00163486 _____ C:\Users\*****\Documents\*****.kdbx
2017-02-09 15:06 - 2016-09-11 14:38 - 00000000 ____D C:\ProgramData\NVIDIA
2017-02-09 15:06 - 2016-08-10 19:29 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-02-09 15:06 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\AppReadiness
2017-02-09 15:06 - 2012-04-27 08:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-02-09 02:29 - 2016-07-16 07:04 - 00262144 _____ C:\WINDOWS\system32\config\BBI
2017-02-09 02:29 - 2016-05-28 22:57 - 00062644 _____ C:\WINDOWS\system32\BMXStateBkp-{00000009-00000000-00000002-00001102-00000005-00211102}.rfx
2017-02-09 02:29 - 2016-05-28 22:57 - 00062644 _____ C:\WINDOWS\system32\BMXState-{00000009-00000000-00000002-00001102-00000005-00211102}.rfx
2017-02-09 02:29 - 2016-05-28 22:57 - 00000788 _____ C:\WINDOWS\system32\DVCState-{00000009-00000000-00000002-00001102-00000005-00211102}.rfx
2017-02-09 02:29 - 2011-06-27 13:24 - 01474832 _____ C:\WINDOWS\system32\Drivers\sfi.dat
2017-02-08 23:39 - 2016-08-10 19:17 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2017-02-08 22:02 - 2016-08-10 19:19 - 08051814 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-02-08 22:02 - 2016-07-16 23:51 - 04096550 _____ C:\WINDOWS\system32\perfh007.dat
2017-02-08 22:02 - 2016-07-16 23:51 - 01153686 _____ C:\WINDOWS\system32\perfc007.dat
2017-02-08 20:15 - 2011-06-27 13:04 - 00000000 ____D C:\Users\*****\AppData\Roaming\vlc
2017-02-08 19:18 - 2015-01-31 02:16 - 00109272 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2017-02-08 19:16 - 2015-01-31 02:16 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2017-02-08 13:41 - 2012-06-08 01:02 - 03937280 ___SH C:\Users\*****\Desktop\Thumbs.db
2017-02-08 13:11 - 2016-08-10 19:18 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2017-02-08 13:11 - 2016-07-16 12:45 - 00000000 ____D C:\WINDOWS\INF
2017-02-08 13:11 - 2014-02-16 02:42 - 00000000 ____D C:\Temp
2017-02-08 13:11 - 2012-02-15 21:27 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2017-02-08 13:10 - 2016-11-29 16:01 - 00001951 _____ C:\WINDOWS\NvContainerRecovery.bat
2017-02-08 13:10 - 2016-09-09 19:25 - 00110880 _____ C:\WINDOWS\SysWOW64\vulkaninfo-1-1-0-26-0.exe
2017-02-08 13:10 - 2016-09-09 19:24 - 00125216 _____ C:\WINDOWS\system32\vulkaninfo-1-1-0-26-0.exe
2017-02-08 13:09 - 2017-01-04 15:21 - 34719288 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvoglv64.dll
2017-02-08 13:09 - 2017-01-04 15:21 - 28211768 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvoglv32.dll
2017-02-08 13:09 - 2017-01-04 15:20 - 00951224 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvIFR64.dll
2017-02-08 13:09 - 2017-01-04 15:20 - 00903096 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvIFR.dll
2017-02-08 13:09 - 2017-01-04 15:20 - 00448560 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvIFROpenGL.dll
2017-02-08 13:09 - 2017-01-04 15:20 - 00397240 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvIFROpenGL.dll
2017-02-08 13:09 - 2017-01-04 15:19 - 01964600 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispco6437653.dll
2017-02-08 13:09 - 2017-01-04 15:19 - 01600056 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispgenco6437653.dll
2017-02-08 13:09 - 2017-01-04 15:19 - 01047088 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvFBC64.dll
2017-02-08 13:09 - 2017-01-04 15:19 - 00985136 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvFBC.dll
2017-02-08 13:09 - 2017-01-04 15:19 - 00054720 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvhdap64.dll
2017-02-08 13:09 - 2017-01-04 15:18 - 40132536 _____ C:\WINDOWS\system32\nvcompiler.dll
2017-02-08 13:09 - 2017-01-04 15:18 - 35231160 _____ C:\WINDOWS\SysWOW64\nvcompiler.dll
2017-02-08 13:09 - 2017-01-04 15:18 - 02957240 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuvid.dll
2017-02-08 13:09 - 2017-01-04 15:18 - 02594744 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuvid.dll
2017-02-08 13:09 - 2017-01-04 15:18 - 00394800 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvDecMFTMjpeg.dll
2017-02-08 13:09 - 2017-01-04 15:18 - 00355768 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvDecMFTMjpeg.dll
2017-02-08 13:09 - 2017-01-04 15:03 - 11016832 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvptxJitCompiler.dll
2017-02-08 13:09 - 2017-01-04 15:03 - 10907184 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvopencl.dll
2017-02-08 13:09 - 2017-01-04 15:03 - 09247528 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvopencl.dll
2017-02-08 13:09 - 2017-01-04 15:03 - 09000152 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvptxJitCompiler.dll
2017-02-08 13:09 - 2017-01-04 15:02 - 10453336 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuda.dll
2017-02-08 13:09 - 2017-01-04 15:02 - 08846832 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuda.dll
2017-02-08 13:09 - 2017-01-04 15:02 - 03513632 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvapi.dll
2017-02-08 13:09 - 2017-01-04 15:02 - 00818496 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvEncMFTH264.dll
2017-02-08 13:09 - 2017-01-04 15:02 - 00817472 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvEncMFThevc.dll
2017-02-08 13:09 - 2017-01-04 15:02 - 00698728 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvfatbinaryLoader.dll
2017-02-08 13:09 - 2017-01-04 15:02 - 00658400 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvEncMFTH264.dll
2017-02-08 13:09 - 2017-01-04 15:02 - 00657048 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvEncMFThevc.dll
2017-02-08 13:09 - 2017-01-04 15:02 - 00631992 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvmcumd.dll
2017-02-08 13:09 - 2017-01-04 15:02 - 00586968 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvfatbinaryLoader.dll
2017-02-08 13:09 - 2017-01-04 15:02 - 00407240 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvEncodeAPI64.dll
2017-02-08 13:09 - 2017-01-04 15:02 - 00338960 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvEncodeAPI.dll
2017-02-08 13:09 - 2016-11-29 15:59 - 03977632 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvapi64.dll
2017-02-08 13:09 - 2016-11-29 15:59 - 01604160 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvhdagenco6420103.dll
2017-02-08 13:09 - 2016-11-29 15:59 - 00221640 _____ (NVIDIA Corporation) C:\WINDOWS\system32\Drivers\nvhda64v.sys
2017-02-08 12:03 - 2013-02-24 19:00 - 00000000 ____D C:\Users\*****\AppData\Roaming\KeePass
2017-02-08 11:52 - 2016-07-16 12:47 - 00000000 ___HD C:\Program Files\WindowsApps
2017-02-07 12:45 - 2016-08-10 19:21 - 00000000 ____D C:\Users\*****
2017-02-05 20:59 - 2011-07-03 16:42 - 00000000 ____D C:\Users\*****\Desktop\Spiele
2017-02-03 17:27 - 2011-06-29 21:59 - 00000000 ____D C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2017-02-02 16:32 - 2011-06-26 23:56 - 00102664 _____ C:\Users\*****\AppData\Local\GDIPFONTCACHEV1.DAT
2017-02-01 01:01 - 2012-06-15 11:36 - 00000132 _____ C:\Users\*****\AppData\Roaming\*****
2017-01-29 10:51 - 2016-08-10 19:17 - 04933400 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2017-01-28 16:06 - 2014-09-29 21:23 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2017-01-28 16:05 - 2014-09-29 21:40 - 00000000 ____D C:\Users\*****\AppData\Roaming\TeamViewer
2017-01-26 19:33 - 2017-01-02 15:59 - 00000000 ____D C:\Users\*****\Desktop\*****
2017-01-26 18:09 - 2011-07-02 07:33 - 00000000 ____D C:\Users\*****\AppData\Local\CrashDumps
2017-01-25 15:05 - 2016-07-16 12:36 - 00000000 ____D C:\WINDOWS\CbsTemp
2017-01-21 18:10 - 2014-12-14 17:14 - 00000000 ____D C:\Users\*****\Documents\ProfileCache
2017-01-21 18:10 - 2011-08-19 19:02 - 00000000 ____D C:\Users\*****\AppData\Local\Ubisoft Game Launcher
2017-01-21 17:59 - 2014-12-14 17:14 - 00000000 ____D C:\Users\*****\Documents\*****
2017-01-20 15:56 - 2016-11-29 15:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSI
2017-01-20 15:55 - 2016-11-29 15:42 - 00000000 ____D C:\Program Files (x86)\MSI
2017-01-20 15:55 - 2016-11-29 15:42 - 00000000 ____D C:\MSI
2017-01-19 22:05 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\rescache
2017-01-19 21:12 - 2011-07-02 19:01 - 00000432 _____ C:\WINDOWS\BRWMARK.INI
2017-01-19 17:41 - 2011-07-03 13:01 - 00000000 ___RD C:\Users\*****\Documents\*****
2017-01-15 10:19 - 2016-08-10 19:33 - 00000000 __RHD C:\Users\Public\AccountPictures
2017-01-15 01:19 - 2016-07-16 12:47 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2017-01-15 01:19 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2017-01-15 01:19 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\oobe
2017-01-15 01:19 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\ShellExperiences
2017-01-15 01:19 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\Provisioning
2017-01-15 01:19 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\PolicyDefinitions
2017-01-14 18:17 - 2015-05-19 00:08 - 00000000 ____D C:\Users\*****\Documents\*****
2017-01-14 17:31 - 2016-12-20 19:06 - 00000000 ____D C:\Users\*****\AppData\Local\*****
2017-01-14 00:13 - 2016-11-29 00:50 - 00534264 _____ C:\WINDOWS\system32\Drivers\EasyAntiCheat.sys
2017-01-13 15:01 - 2016-12-28 17:23 - 00000000 ____D C:\Users\*****\AppData\Roaming\*****
2017-01-11 21:02 - 2013-08-14 21:45 - 00000000 ____D C:\WINDOWS\system32\MRT
2017-01-11 21:00 - 2016-07-16 12:49 - 00835576 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2017-01-11 21:00 - 2016-07-16 12:49 - 00177656 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2017-01-11 21:00 - 2011-06-26 23:33 - 135657872 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2017-02-01 01:02 - 2017-02-01 01:02 - 0000132 _____ () C:\Users\*****\AppData\Roaming\*****
2012-06-15 11:36 - 2017-02-01 01:01 - 0000132 _____ () C:\Users\*****\AppData\Roaming\*****
2016-06-03 15:33 - 2016-06-04 20:59 - 0000132 _____ () C:\Users\*****\AppData\Roaming\*****
2011-12-12 06:50 - 2011-12-12 06:50 - 0099384 _____ () C:\Users\*****\AppData\Roaming\inst.exe
2011-12-12 06:50 - 2011-12-12 06:50 - 0007859 _____ () C:\Users\*****\AppData\Roaming\pcouffin.cat
2011-12-12 06:50 - 2011-12-12 06:50 - 0001167 _____ () C:\Users\*****\AppData\Roaming\pcouffin.inf
2011-12-12 06:50 - 2011-12-12 06:50 - 0000055 _____ () C:\Users\*****\AppData\Roaming\pcouffin.log
2011-12-12 06:50 - 2011-12-12 06:50 - 0082816 _____ (VSO Software) C:\Users\*****\AppData\Roaming\pcouffin.sys
2011-12-12 06:47 - 2011-12-12 06:50 - 0001057 _____ () C:\Users\*****\AppData\Roaming\vso_ts_preview.xml
2013-04-20 19:03 - 2013-04-21 12:52 - 0001456 _____ () C:\Users\*****\AppData\Local\*****
2013-01-20 21:45 - 2013-01-20 21:45 - 0003584 _____ () C:\Users\*****\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-07-30 22:09 - 2014-07-30 22:09 - 0044220 _____ () C:\Users\*****\AppData\Local\RAContactHistory.xml
2014-12-06 23:41 - 2014-12-06 23:41 - 0000734 _____ () C:\Users\*****\AppData\Local\recently-used.xbel
2011-06-27 09:55 - 2016-07-25 23:19 - 0007641 _____ () C:\Users\*****\AppData\Local\Resmon.ResmonCfg
2011-08-17 13:02 - 2011-09-03 20:32 - 0000082 _____ () C:\Users\*****\AppData\Local\X-Plane Installer.prf
2011-08-17 11:10 - 2011-08-17 11:10 - 0000015 _____ () C:\Users\*****\AppData\Local\x-plane_install.txt
2011-07-03 15:13 - 2011-05-04 15:13 - 0000032 ____R () C:\ProgramData\hash.dat
Dateien, die verschoben oder gelöscht werden sollten:
====================
C:\ProgramData\hash.dat
==================== Bamital & volsnap ======================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert
C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert
C:\WINDOWS\explorer.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert
C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert
C:\WINDOWS\system32\services.exe => Datei ist digital signiert
C:\WINDOWS\system32\User32.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert
C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert
C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert
C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2017-02-08 13:09
==================== Ende von FRST.txt ============================
Geändert von Shepherd (09.02.2017 um 16:28 Uhr) Grund: R |
|
09.02.2017, 16:21
| #2 |
| | Windows 10: mögliche Infektion durch USB-Stick (Manuel.doc/Forbix.A?) Addition, Teil 1 (mit '*****' teilweise anonymisiert)
__________________Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 05-02-2017
durchgeführt von ***** (09-02-2017 15:12:13)
Gestartet von C:\Users\*****\Desktop\Programme
Windows 10 Pro Version 1607 (X64) (2016-08-10 18:33:12)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Administrator (S-1-5-21-2015921152-1024863377-2374061687-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-2015921152-1024863377-2374061687-503 - Limited - Disabled)
Gast (S-1-5-21-2015921152-1024863377-2374061687-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2015921152-1024863377-2374061687-1013 - Limited - Enabled)
***** (S-1-5-21-2015921152-1024863377-2374061687-1000 - Administrator - Enabled) => C:\Users\*****
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: COMODO Antivirus (Enabled - Up to date) {D0CC7563-ABD2-DEBE-138E-FDD553335AF2}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Comodo Defense+ (Enabled - Up to date) {6BAD9487-8DE8-D130-293E-C6A728B4104F}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: COMODO Firewall (Enabled) {E8F7F446-E1BD-DFE6-38D1-54E0ADE01D89}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
7-Zip 16.00 (x64) (HKLM\...\7-Zip) (Version: 16.00 - Igor Pavlov)
Adobe Reader XI (11.0.17) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.17 - Adobe Systems Incorporated)
Aeria Ignite (HKLM-x32\...\Aeria Ignite 1.13.3296) (Version: 1.13.3296 - Aeria Games & Entertainment)
Aeria Ignite (HKLM-x32\...\Aeria Ignite) (Version: 1.13.3296 - Aeria Games & Entertainment)
Aeria Ignite (x32 Version: 1.13.3296 - Aeria Games & Entertainment) Hidden
Akamai NetSession Interface (HKU\S-1-5-21-2015921152-1024863377-2374061687-1000\...\Akamai) (Version: - Akamai Technologies, Inc)
Ansel (Version: 376.09 - NVIDIA Corporation) Hidden
Apple Application Support (32-Bit) (HKLM-x32\...\{D4B07658-F443-4445-A261-E643996E139D}) (Version: 4.3.2 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{A6B0442B-E159-444B-B49D-6B9AC531EAE3}) (Version: 4.3.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{2E4AF2A6-50EA-4260-9BA4-5E582D11879A}) (Version: 9.3.0.15 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{56EC47AA-5813-4FF6-8E75-544026FBEA83}) (Version: 2.2.0.150 - Apple Inc.)
ArgusMonitor (HKLM-x32\...\ArgusMonitor) (Version: - )
Asmedia ASM104x USB 3.0 Host Controller Driver (HKLM-x32\...\{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}) (Version: 1.12.5.0 - Asmedia Technology)
Audacity 2.0.5 (HKLM-x32\...\Audacity_is1) (Version: 2.0.5 - Audacity Team)
Avidemux 2.6 (32-bit) (HKLM-x32\...\Avidemux 2.6) (Version: 2.6.3.8518 - )
Bandicam (HKLM-x32\...\Bandicam) (Version: 1.8.6.321 - Bandisoft.com)
Bandisoft MPEG-1 Decoder (HKLM-x32\...\BandiMPEG1) (Version: - Bandisoft.com)
Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
Bluetooth Win7 Suite (64) (HKLM\...\{230D1595-57DA-4933-8C4E-375797EBB7E1}) (Version: 7.2.0.40 - Atheros Communications)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
Brother MFL-Pro Suite DCP-7030 (HKLM-x32\...\{46E1B1F2-A279-4356-9B17-029F9CC72EAE}) (Version: 1.0.1.0 - Brother Industries, Ltd.)
Cisco AnyConnect Secure Mobility Client (HKLM-x32\...\Cisco AnyConnect Secure Mobility Client) (Version: 4.1.08005 - Cisco Systems, Inc.)
Cisco AnyConnect Secure Mobility Client (x32 Version: 4.1.08005 - Cisco Systems, Inc.) Hidden
Citavi 5 (HKLM-x32\...\{7EB278FB-0C3C-445E-8665-4A6CDD9B794E}) (Version: 5.3.1.0 - Swiss Academic Software)
COMODO Internet Security (HKLM\...\{FD8E178D-8B4E-42DA-B434-EFF270329B1C}) (Version: 5.5.64714.1383 - COMODO Security Solutions Inc.)
Creative ALchemy (HKLM-x32\...\ALchemy) (Version: 1.45 - Creative Technology Limited)
Creative Audio-Systemsteuerung (HKLM-x32\...\AudioCS) (Version: 3.00 - Creative Technology Limited)
Creative AutoMode Switcher (HKLM-x32\...\Creative AutoMode Switcher) (Version: 1.00 - Creative Technology Limited)
Creative Konsole Starter (HKLM-x32\...\Console Launcher) (Version: 2.61 - Creative Technology Limited)
Creative Sound Blaster Properties x64 Edition (HKLM-x32\...\Creative Sound Blaster Properties x64 Edition) (Version: 1.03 - Creative Technology Limited)
Crusader Kings II (HKLM-x32\...\Steam App 203770) (Version: - Paradox Development Studio)
CrystalDiskInfo 5.6.2 (HKLM-x32\...\CrystalDiskInfo_is1) (Version: 5.6.2 - Crystal Dew World)
CrystalDiskMark 3.0.3b (HKLM\...\CrystalDiskMark_is1) (Version: 3.0.3b - Crystal Dew World)
Debugging Tools for Windows (x64) (HKLM\...\{7F2E5C3B-DBDF-469D-AD8D-F686D3B71176}) (Version: 6.11.1.404 - Microsoft Corporation)
Diablo III (HKLM-x32\...\Diablo III) (Version: - Blizzard Entertainment)
Driver Sweeper Version 3.2.0 (HKLM-x32\...\{5A67D2EA-FB70-4033-A6F3-606AD85B2015}_is1) (Version: 3.2.0 - Phyxion.net)
Dropbox (HKU\S-1-5-21-2015921152-1024863377-2374061687-1000\...\Dropbox) (Version: 2.4.10 - Dropbox, Inc.)
Dual-Core Optimizer (HKLM-x32\...\{9FD6F1A8-5550-46AF-8509-271DF0E768B5}) (Version: 1.1.4.0169 - AMD)
DVD Shrink 3.2 deutsch (DeCSS-frei) (HKLM-x32\...\DVD Shrink DE_is1) (Version: - DVD Shrink)
DVDStyler v1.8.4 (HKLM-x32\...\DVDStyler_is1) (Version: - )
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 17.6.20762 - Landesfinanzdirektion Thüringen)
Eraser 6.2.0.2970 (HKLM\...\{58F37E51-2A83-49F3-9117-6005C63CF399}) (Version: 6.2.2970 - The Eraser Project)
Extended Asian Language font pack for Adobe Reader XI (HKLM-x32\...\{AC76BA86-7AD7-2530-0000-A00000000004}) (Version: 11.0.0 - Adobe Systems Incorporated)
Futuremark SystemInfo (HKLM-x32\...\{BEE64C14-BEF1-4610-8A68-A16EAA47B882}) (Version: 4.2.0 - Futuremark Corporation)
Game of Thrones - A Telltale Games Series (HKLM\...\Steam App 330840) (Version: - Telltale Games)
Google Earth (HKLM-x32\...\{28E82311-8616-11E1-BEB0-B8AC6F97B88E}) (Version: 6.2.2.6613 - Google)
Google Earth (HKLM-x32\...\{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}) (Version: 6.1.0.5001 - Google)
Gpg4win (2.2.2) (HKLM-x32\...\GPG4Win) (Version: 2.2.2 - The Gpg4win Project)
Grand Theft Auto V (HKLM-x32\...\Steam App 271590) (Version: - Rockstar North)
Hearthstone (HKLM-x32\...\Hearthstone) (Version: - Blizzard Entertainment)
ICQ7.6 (HKLM-x32\...\{7644E42D-B096-457F-8B5B-901238FC81AE}) (Version: 7.6 - ICQ)
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
Inkscape 0.48.5 (HKU\S-1-5-21-2015921152-1024863377-2374061687-1000\...\Inkscape) (Version: 0.48.5 - )
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.6.0.1002 - Intel Corporation)
iTunes (HKLM\...\{955524E7-79EB-4CA9-BA4D-FD2DF587651B}) (Version: 12.4.3.1 - Apple Inc.)
Java 8 Update 101 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F64180101F0}) (Version: 8.0.1010.13 - Oracle Corporation)
Java 8 Update 101 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180101F0}) (Version: 8.0.1010.13 - Oracle Corporation)
JavaFX 2.2.7 (HKLM-x32\...\{1111706F-666A-4037-7777-227328764D10}) (Version: 2.2.7 - Oracle Corporation)
KeePass Password Safe 2.33 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: 2.33 - Dominik Reichl)
Kinect for Windows Speech Recognition Language Pack (de-DE) (HKLM-x32\...\{898AA67F-99B8-4C7F-9611-B11F98EF6E78}) (Version: 11.0.7413.611 - Microsoft Corporation)
Lautstärkefenster (HKLM-x32\...\Creative Volume Panel) (Version: 2.21 - Creative Technology Limited)
LAV Filters 0.67 (HKLM-x32\...\lavfilters_is1) (Version: 0.67 - Hendrik Leppkes)
LEGO Digital Designer (HKLM-x32\...\New LEGO Digital Designer) (Version: - LEGO A/S)
LG Tool Kit (HKLM-x32\...\{6179550A-3E7C-499E-BCC9-9E8113E0A285}) (Version: 10.01.0712.01 - )
LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.1.0.374 - LogMeIn, Inc.)
LogMeIn Hamachi (x32 Version: 2.1.0.374 - LogMeIn, Inc.) Hidden
Malwarebytes Anti-Malware Version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
marvell 91xx driver (HKLM-x32\...\MagniDriver) (Version: 1.0.0.1051 - Marvell)
MediaCoder 2011 (HKLM-x32\...\MediaCoder) (Version: 2011 - Broad Intelligence)
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}) (Version: 3.5.92.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Server Speech Platform Runtime (x64) (HKLM\...\{3B433087-E62E-4BF5-97F9-4AF6E1C2409C}) (Version: 11.0.7400.345 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50901.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{e6e75766-da0f-4ba2-9788-6ea593ce702d}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24210 (HKLM-x32\...\{f144e08f-9cbe-4f09-9a8c-f2b858b7ee7f}) (Version: 14.0.24210.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24210 (HKLM-x32\...\{23658c02-145e-483d-ba6b-1eb82c580529}) (Version: 14.0.24210.0 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
Microsoft XNA Framework Redistributable 3.1 (HKLM-x32\...\{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}) (Version: 3.1.10527.0 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 Refresh (HKLM-x32\...\{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}) (Version: 4.0.30901.0 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.2.173.0 - Microsoft Corporation)
MKVToolNix 7.2.0 (64bit) (HKLM-x32\...\MKVToolNix) (Version: 7.2.0 - Moritz Bunkus)
Mozilla Firefox 42.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 42.0 (x86 de)) (Version: 42.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 45.7.1.6246 - Mozilla)
Mozilla Thunderbird 45.7.1 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 45.7.1 (x86 de)) (Version: 45.7.1 - Mozilla)
MSI Afterburner 4.2.0 (HKLM-x32\...\Afterburner) (Version: 4.2.0 - MSI Co., LTD)
MSI DragonEye (HKLM\...\{7116875E-F251-4C33-AB3F-37DE05B15595}_is1) (Version: 0.0.2.3 - MSI)
MSI Gaming APP (HKLM-x32\...\{E0229316-E73B-484B-B9E0-45098AB38D8C}}_is1) (Version: 6.0.0.08 - MSI)
MSI Kombustor 3.5.0 (HKLM\...\{9598DA62-2AE8-426D-9C86-BEA96AC6721E}_is1) (Version: - MSI Co., LTD)
MSI Live Update 6 (HKLM-x32\...\{4F46CF54-47D2-41F4-B230-B0954C544420}}_is1) (Version: 6.2.0.06 - MSI)
MSIRegister (HKLM-x32\...\{80B995A4-3A86-4690-98A6-563F1A788835}_is1) (Version: 2.0.0.05 - MSI)
NAM Essentials r132 (HKU\S-1-5-21-2015921152-1024863377-2374061687-1000\...\NAM Essentials) (Version: r132 - Das NAM Team)
Network Addon Mod Version 30 mit Essentials r132 (HKU\S-1-5-21-2015921152-1024863377-2374061687-1000\...\Network Addon Mod) (Version: Version 30 mit Essentials r132 - Das NAM Team)
Notepad++ (32-bit x86) (HKLM-x32\...\Notepad++) (Version: 7.1 - Notepad++ Team)
NVIDIA 3D Vision Controller-Treiber 369.04 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 369.04 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 376.53 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 376.53 - NVIDIA Corporation)
NVIDIA Grafiktreiber 376.53 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 376.53 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.34.17 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.34.17 - NVIDIA Corporation)
NVIDIA Photoshop Plug-ins 64 bit (HKLM-x32\...\{5E386C5B-CDE7-435A-B5C9-EC73A1B0553A}) (Version: 8.50 - )
NVIDIA PhysX-Systemsoftware 9.16.0318 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.16.0318 - NVIDIA Corporation)
OpenAL (HKLM-x32\...\OpenAL) (Version: - )
Origin (HKLM-x32\...\Origin) (Version: 10.3.3.1921 - Electronic Arts, Inc.)
paint.net (HKLM\...\{6AC1101E-7561-43C9-BEEA-4AB1D220D8FF}) (Version: 4.0.13 - dotPDN LLC)
PDF Architect (HKLM-x32\...\{064A929A-4DE8-40CF-A901-BD40C14E4D25}) (Version: 1.1.83.9982 - pdfforge GmbH)
PDF Settings CS5 (x32 Version: 10.0 - Adobe Systems Incorporated) Hidden
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.2 - pdfforge)
Pixum Fotobuch (HKLM-x32\...\Pixum Fotobuch) (Version: - )
ProtectDisc Driver, Version 11 (HKLM-x32\...\ProtectDisc Driver 11) (Version: 11.0.0.14 - ProtectDisc Software GmbH)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.991 - Even Balance, Inc.)
QuickTime 7 (HKLM-x32\...\{627FFC10-CE0A-497F-BA2B-208CAC638010}) (Version: 7.77.80.95 - Apple Inc.)
Rapture3D 2.4.8 Game (HKLM-x32\...\{D2FCA41E-AC01-4DCD-B3A7-DC9E32363065}}_is1) (Version: - Blue Ripple Sound)
Reader for PC (HKLM-x32\...\{71FB3127-E6B2-4058-ACEE-99813554FAB6}) (Version: 2.2.00.11270 - Sony Corporation)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.46.610.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6410 - Realtek Semiconductor Corp.)
Sandboxie 5.12 (64-bit) (HKLM\...\Sandboxie) (Version: 5.12 - Sandboxie Holdings, LLC)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
StreamTransport version: 1.1.6.2 (HKLM-x32\...\{FA0BBB87-91A1-4BFD-9005-EB058BBA0E14}_is1) (Version: - )
Stud.io version 1.0 (HKLM-x32\...\{0C6551B3-9628-4380-ADE4-E75C618757C8}_is1) (Version: 1.0 - BrickLink Corporation)
System Requirements Lab for Intel (HKLM-x32\...\{CD41B576-4787-4D5C-95EE-24A4ABD89CD3}) (Version: 4.4.24.0 - Husdawg, LLC)
Team Fortress 2 (HKLM-x32\...\Steam App 440) (Version: - Valve)
TeamSpeak 3 Client (HKU\S-1-5-21-2015921152-1024863377-2374061687-1000\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
TeamViewer 12 (HKLM-x32\...\TeamViewer) (Version: 12.0.72365 - TeamViewer)
The Witcher 2: Assassins of Kings Enhanced Edition (HKLM-x32\...\Steam App 20920) (Version: - CD Projekt RED)
The Witcher 3: Wild Hunt (HKLM-x32\...\Steam App 292030) (Version: - CD PROJEKT RED)
The Witcher: Enhanced Edition (HKLM-x32\...\Steam App 20900) (Version: - CD Projekt RED)
THX-Einrichtungskonsole (HKLM-x32\...\THX_Console_Unicode) (Version: - )
Ubisoft Game Launcher (HKLM-x32\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT)
UnderCoverXP 1.23 (HKLM-x32\...\UnderCoverXP_is1) (Version: - Wicked & Wild Inc.)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
Uplay (HKLM-x32\...\Uplay) (Version: 4.9 - Ubisoft)
Vivaldi (HKU\S-1-5-21-2015921152-1024863377-2374061687-1000\...\Vivaldi) (Version: 1.6.689.40 - Vivaldi)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.4 - VideoLAN)
Vulkan Run Time Libraries 1.0.26.0 (HKLM\...\VulkanRT1.0.26.0) (Version: 1.0.26.0 - LunarG, Inc.)
WATCH_DOGS2 (HKLM-x32\...\Uplay Install 2688) (Version: - Ubisoft)
WinDirStat 1.1.2 (HKU\S-1-5-21-2015921152-1024863377-2374061687-1000\...\WinDirStat) (Version: - )
Windows 10-Upgrade-Assistent (HKLM-x32\...\{D5C69738-B486-402E-85AC-2456D98A64E4}) (Version: 1.4.9200.17349 - Microsoft Corporation)
Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
WinPcap 4.1.2 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.2001 - CACE Technologies)
WinRAR 5.00 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.00.0 - win.rar GmbH)
Wireshark 1.6.2 (HKLM-x32\...\Wireshark) (Version: 1.6.2 - The Wireshark developer community, hxxp://www.wireshark.org)
World of Tanks v.0.7.3 (HKLM-x32\...\{1EAC1D02-C6AC-4FA6-9A44-96258C37C812}_is1) (Version: - Wargaming.net)
World of Warships (HKU\S-1-5-21-2015921152-1024863377-2374061687-1000\...\{1EAC1D02-C6AC-4FA6-9A44-96258C37C814eu}_is1) (Version: - Wargaming.net)
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
CustomCLSID: HKU\S-1-5-21-2015921152-1024863377-2374061687-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\*****\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2015921152-1024863377-2374061687-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2015921152-1024863377-2374061687-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2015921152-1024863377-2374061687-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2015921152-1024863377-2374061687-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\*****\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {04114635-7A86-4B5E-934B-AFBDEA603E8C} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {0A377339-8317-4189-AC80-DC5C12300F3F} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => C:\WINDOWS\ehome\ehrec.exe
Task: {0E8381E6-DC68-4BAC-B086-D194DA6B7DF1} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {10211BEB-E875-48FA-97F9-E8B3C45FBDF7} - System32\Tasks\{49F87FD7-DD40-473A-A27C-7E4272826A97} => pcalua.exe -a I:\directx\dxsetup.exe -d I:\directx
Task: {19964BDC-9CE8-492B-9B6E-3A17AB57FAC8} - System32\Tasks\{4782647D-8440-4CED-BC50-BE9DC45C46FF} => D:\*****\HDAT2.EXE
Task: {217B0963-BBB9-4863-B7D0-D975E5292188} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {2790BA56-59A0-4708-B12C-DBBF91F7C846} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\WINDOWS\ehome\ehrec.exe
Task: {279DCACB-C8D5-4A81-B5D8-99F51FDCC15B} - System32\Tasks\{414DEB36-2FFE-445F-81B1-3192184B805A} => C:\Program Files (x86)\PatchCleaner\PatchCleaner.exe
Task: {2B4DD1C3-98FD-4608-80F4-8F5E9FA8D69F} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-05-13] (Microsoft Corporation)
Task: {2C0E13E4-75C9-46BC-B2E2-C527F48FA450} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {374B7C1D-2578-4995-A8D5-1AE92294BA7C} - System32\Tasks\{77851059-C1E5-4294-99C6-EA8D1EE46DD8} => pcalua.exe -a I:\directx\dxsetup.exe -d I:\directx
Task: {37C82956-A662-4979-8B9E-E348DC7AC969} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe
Task: {3A0186A9-9C2E-4E6D-8A95-5BD576187CCA} - System32\Tasks\COMODO\COMODO Cache Builder {0FB77674-7905-4F34-A362-C5A9A26F8CF9} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2016-09-27] (COMODO)
Task: {3D9CECB2-C0DC-4ECA-AD80-A87EC353B53B} - System32\Tasks\COMODO\COMODO Autostart {D5EFF3B3-E126-4AF6-BCE9-852A72129E10} => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [2016-09-27] (COMODO)
Task: {41C7DCEC-30AD-4029-9A36-DFDB4B169293} - System32\Tasks\COMODO\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2016-09-27] (COMODO)
Task: {4B733FC0-2632-4614-B2DD-20180CD6009C} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {5A7E8F44-EA68-4F46-9BC2-AF8104561463} - System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2016-11-29] (NVIDIA Corporation)
Task: {60783B84-FCA6-4A33-8D34-54317FC554A5} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2013-05-13] (Microsoft)
Task: {626F28E0-CDC8-4793-98F9-33BD239AA05B} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {650E7B4A-FACE-46FB-9780-44D5E7A600C4} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Keine Datei <==== ACHTUNG
Task: {65D89C1F-857B-44AA-A8B7-31B065406973} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {672BE71A-9A3F-4DEC-9425-4F2932BE5895} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Keine Datei <==== ACHTUNG
Task: {6C8D9E81-A9EC-4715-89DA-AC17707EFDF2} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {71624055-6F7A-4591-93A8-614C1646FD0B} - System32\Tasks\COMODO\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2016-09-27] (COMODO)
Task: {7855BC81-845D-45D8-801E-F566ADC60EE0} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Keine Datei <==== ACHTUNG
Task: {7867BCC6-AAC7-4C3A-9E58-A110978ADBAE} - System32\Tasks\SidebarExecute => C:\Program Files (x86)\Windows Sidebar\sidebar.exe
Task: {7D321272-831E-40EC-83AE-986F959C2E48} - System32\Tasks\{2C526940-E332-47DE-91D3-AF7D41B7D8DF} => D:\Witcher_2_Patcher_1.2.exe
Task: {7DB21B72-51A3-458D-9388-66D5AE51EE1F} - System32\Tasks\{31DDBD37-5DB7-4030-8064-10B0CAA806C3} => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [2016-09-27] (COMODO)
Task: {7F253496-D1D2-40EE-84E4-491CEE455E96} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\WINDOWS\ehome\mcupdate.exe
Task: {8091081E-6243-422F-B8FB-742A66BB1B82} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-05-13] (Microsoft Corporation)
Task: {8AB6929D-0DC2-4DDB-BA33-3B16770B8F12} - System32\Tasks\{B0C1793F-B55C-46DC-BA46-0CF64A7D475D} => pcalua.exe -a "J:\*****\Team Fortress 2\Disk_1\steambackup.exe" -d "J:\*****\Team Fortress 2\Disk_1"
Task: {9981C47D-A820-460F-9607-1E6E8BDB2D4B} - System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmMon.exe [2016-11-29] (NVIDIA Corporation)
Task: {9C076740-4004-40B2-8A9C-A5F971E12838} - System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2016-11-29] (NVIDIA Corporation)
Task: {9C3F9728-A0CB-492C-8D41-E9F6D398EEDC} - System32\Tasks\{C9C3E946-8C2D-4590-AD1C-8670D5D4E9EA} => pcalua.exe -a D:\*****\PID_W7PCAPP_US_2_11_01.exe -d D:\*****
Task: {9C427157-31FE-45CA-9A02-5F77FDFF2B26} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\WINDOWS\ehome\MCUpdate.exe
Task: {9ED1FF36-5AD6-4A1E-A156-662549A014A4} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Keine Datei <==== ACHTUNG
Task: {A365EBA0-70DE-46A1-880D-191502131FA3} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {A495CB49-76D9-42D9-B027-A940F8FFA1A7} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {B61F2803-B501-40D5-9381-1169D9C1B470} - System32\Tasks\{1EE65B08-9A5C-4B7C-AF66-EF161FD0E88B} => pcalua.exe -a C:\Windows\UniFish3.exe -c C:\*****\RollerCoaster Tycoon.log
Task: {B81A7BE2-C908-435A-9E03-BFC4A268EE54} - System32\Tasks\{FF598937-CD8E-4246-BE78-78595B03BAC6} => pcalua.exe -a "J:\*****\Counter-Strike Source\Disk_1\steambackup.exe" -d "J:\*****\Counter-Strike Source\Disk_1"
Task: {BAB6633B-5E98-48A1-8CBF-3A734A0DDB49} - System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [2016-11-29] (NVIDIA Corporation)
Task: {BBA1CACA-887C-4C35-94B2-9FB589B39AF0} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {BD175E0A-70C2-469E-85ED-1BA9108644DC} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-05-13] (Microsoft Corporation)
Task: {BF10B26A-C0BC-4A9E-A34E-4F20F0C4712D} - System32\Tasks\{87CF5248-9412-42A5-BB50-912BB311859D} => pcalua.exe -a I:\setup.exe -d I:\
Task: {C010EA3F-B322-4188-9E9F-E8E6A3785361} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {C784D4A9-34B1-4F08-840C-A21447A05F77} - \Microsoft\Windows\Setup\gwx\rundetector -> Keine Datei <==== ACHTUNG
Task: {C80819A0-3A31-48D9-A9F6-D8BA0F9B195C} - System32\Tasks\MSIOSDx64_Host => C:\Program Files (x86)\MSI\Gaming APP\OSD\x64\MsiGamingOSD_x64.exe [2016-11-29] (Micro-Star INT'L CO., LTD.)
Task: {CDAA201A-A2EC-4CA0-9C52-A160B4DADE17} - System32\Tasks\{7C754236-3614-4367-9162-462813104163} => D:\*****\Sacred 2 - Fallen Angel\system\sacred2.exe [2010-01-31] (Ascaron Entertainment GmbH)
Task: {CFE70060-728D-4757-B8AE-BBAFEB6D109D} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\WINDOWS\ehome\mcupdate.exe
Task: {D08CB934-50AA-43E6-888A-A751E396BB17} - System32\Tasks\MSISW_Host => C:\WINDOWS\SysWoW64\muachost.exe [2016-11-29] (MSI)
Task: {D303C336-D61E-4BF5-95D8-C83550F2E486} - System32\Tasks\{905A5DDE-EB64-4A3E-93D1-DD82D6CD6C24} => pcalua.exe -a C:\Users\*****\Desktop\hijackthis.exe -d C:\Users\*****\Desktop
Task: {DD4C2ED4-1071-44CB-A013-CD01BD9BD7D8} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {DDEC5962-C834-46FE-B199-C47019E60C1E} - System32\Tasks\{8E345BD2-8831-461F-ACEB-A7797A7C06D2} => pcalua.exe -a "D:*****\PAX MASTER PCI XFI Driver Suite V1.50\AudCon\setup.exe" -d "D:*****\PAX MASTER PCI XFI Driver Suite V1.50\AudCon"
Task: {DFE74A1A-B588-4C23-8297-B198704BB044} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {E03202AC-A36E-4312-99F0-2AC1CFB37D6B} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime -> Keine Datei <==== ACHTUNG
Task: {E2895E86-0B8F-46B4-97FF-4FE0A2F9DB2D} - System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe [2016-11-29] (NVIDIA Corporation)
Task: {E72D57EC-E4D5-4D1C-B8CD-BD10CD26D9FA} - System32\Tasks\{C5DF6B01-B17E-4351-9FCA-E6540EE4046D} => pcalua.exe -a D:\Steam\steam.exe -c steam://uninstall/214870
Task: {EB8CCBDF-7D51-4778-BE3E-930BF81FE201} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {EC97CECE-06CE-4154-847C-C9B4A98BA9E9} - System32\Tasks\MSIOSDx86_Host => C:\Program Files (x86)\MSI\Gaming APP\OSD\x86\MsiGamingOSD_x86.exe [2016-11-29] (Micro-Star INT'L CO., LTD.)
Task: {ECD33248-C584-48BC-A130-D3E5523E1F28} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Keine Datei <==== ACHTUNG
Task: {EFBF366C-C40B-4D57-BFC5-853CEFB11D0B} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-08-07] (Adobe Systems Incorporated)
Task: {F18244BA-A3DE-4979-8FEB-6D91E5D7F13F} - System32\Tasks\COMODO\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2016-09-27] (COMODO)
Task: {F1F1BDD7-E619-46D2-9181-5185F5728649} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {F98FDC54-1AAC-42E4-A61D-0D93E1C024A5} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-05-13] (Microsoft Corporation)
Task: {FB7D1C4A-9341-4197-BE51-F8F20DD20647} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime -> Keine Datei <==== ACHTUNG
Task: {FBB3B1BD-A10B-441C-A6F8-A3C6F33825E5} - System32\Tasks\{59437351-3032-49CE-9A0A-AECBD9109B61} => D:*****\HDAT2.EXE
Task: {FC6DDF94-7E31-4629-8899-C6CD08529BAA} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {FEAA8E76-9B62-4FA7-8EF1-E896CD219D52} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\WINDOWS\ehome\ehPrivJob.exe
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
==================== Verknüpfungen =============================
(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2016-07-16 12:42 - 2016-07-16 12:42 - 00231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2016-12-15 17:24 - 2016-12-15 17:24 - 02681200 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2011-10-21 10:20 - 2016-03-16 11:25 - 00073912 _____ () C:\Program Files\COMODO\COMODO Internet Security\scanners\smart.cav
2016-07-05 14:23 - 2016-07-05 14:23 - 00092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2016-07-05 14:23 - 2016-07-05 14:23 - 01354040 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2014-09-03 12:07 - 2014-09-03 12:07 - 00216576 _____ () C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
2010-12-02 03:15 - 2010-12-02 03:15 - 00915584 ____R () C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe
2010-11-03 10:30 - 2010-11-03 10:30 - 00918144 ____R () C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe
2011-07-13 18:26 - 2013-03-30 19:25 - 00076888 _____ () C:\WINDOWS\SysWoW64\PnkBstrA.exe
2016-11-29 16:01 - 2016-12-29 13:44 - 00134712 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2016-12-15 17:24 - 2016-12-15 17:24 - 02681200 _____ () C:\WINDOWS\SYSTEM32\CoreUIComponents.dll
2016-08-10 19:38 - 2016-08-10 19:38 - 00959168 _____ () C:\Users\*****\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64\ClientTelemetry.dll
2016-09-15 21:52 - 2016-09-15 21:52 - 00134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
2017-01-13 09:19 - 2017-01-13 01:34 - 00474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll
2017-01-13 09:18 - 2017-01-13 01:33 - 09760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2017-01-13 09:18 - 2017-01-13 01:33 - 01401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-01-13 09:18 - 2017-01-13 01:33 - 00757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
2017-01-13 09:18 - 2017-01-13 01:33 - 02424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2017-01-13 09:18 - 2017-01-13 01:33 - 04853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2016-11-29 15:42 - 2016-11-29 15:42 - 00187392 _____ () C:\Program Files (x86)\MSI\Gaming APP\OSD\x64\D3D11FontDraw.dll
2012-11-19 08:33 - 2012-11-19 08:33 - 00070264 _____ () C:\WINDOWS\SYSTEM32\bdmpega64.acm
2015-11-03 11:21 - 2015-11-03 11:21 - 00063376 _____ () C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\zlib1.dll
2014-09-03 11:53 - 2014-09-03 11:53 - 00221184 _____ () C:\Program Files (x86)\GNU\GnuPG\libksba-8.dll
2014-09-03 11:41 - 2014-09-03 11:41 - 00050176 _____ () C:\Program Files (x86)\GNU\GnuPG\libw32pth-0.dll
2014-09-03 11:53 - 2014-09-03 11:53 - 00069632 _____ () C:\Program Files (x86)\GNU\GnuPG\libassuan-0.dll
2014-09-03 11:56 - 2014-09-03 11:56 - 00742400 _____ () C:\Program Files (x86)\GNU\GnuPG\libgcrypt-20.dll
2014-09-03 11:48 - 2014-09-03 11:48 - 00038400 _____ () C:\Program Files (x86)\GNU\GnuPG\libgpg-error-0.dll
2011-06-27 03:12 - 2017-02-09 15:06 - 00023552 _____ () C:\Program Files (x86)\ASUS\AXSP\1.00.13\PEbiosinterface32.dll
2011-06-27 03:12 - 2010-06-29 03:58 - 00104448 ____R () C:\Program Files (x86)\ASUS\AXSP\1.00.13\ATKEX.dll
2017-01-20 15:55 - 2017-01-20 15:55 - 00160256 _____ () C:\Program Files (x86)\MSI\Live Update\unrar.dll
2016-09-15 08:52 - 2017-01-06 10:03 - 02493440 _____ () C:\Program Files (x86)\Origin\libGLESv2.dll
2013-03-12 17:10 - 2017-02-05 00:12 - 00668960 _____ () D:\Steam\SDL2.dll
2014-12-02 21:56 - 2016-10-06 22:47 - 04969248 _____ () D:\Steam\v8.dll
2014-07-07 15:28 - 2017-02-05 00:12 - 02464544 _____ () D:\Steam\video.dll
2014-12-02 21:56 - 2016-09-01 02:02 - 01563936 _____ () D:\Steam\icui18n.dll
2014-12-02 21:56 - 2016-09-01 02:02 - 01195296 _____ () D:\Steam\icuuc.dll
2014-08-21 23:13 - 2016-01-27 08:49 - 02549760 _____ () D:\Steam\libavcodec-56.dll
2014-08-21 23:13 - 2016-01-27 08:49 - 00491008 _____ () D:\Steam\libavformat-56.dll
2014-08-21 23:13 - 2016-01-27 08:49 - 00332800 _____ () D:\Steam\libavresample-2.dll
2014-08-21 23:13 - 2016-01-27 08:49 - 00442880 _____ () D:\Steam\libavutil-54.dll
2014-08-21 23:13 - 2016-01-27 08:49 - 00485888 _____ () D:\Steam\libswscale-3.dll
2011-07-13 12:06 - 2017-02-03 21:47 - 00838432 _____ () D:\Steam\bin\chromehtml.DLL
2016-02-19 13:33 - 2016-07-04 23:17 - 00266560 _____ () D:\Steam\openvr_api.dll
2016-08-10 23:19 - 2006-06-09 14:20 - 00003072 _____ () C:\WINDOWS\system32\CTXFIGER.DLL
2016-11-29 15:42 - 2016-11-29 15:42 - 00163328 _____ () C:\Program Files (x86)\MSI\Gaming APP\OSD\x86\D3D11FontDraw.dll
2016-11-01 08:05 - 2017-01-30 22:41 - 68875552 _____ () D:\Steam\bin\cef\cef.win7\libcef.dll
2011-06-27 12:47 - 2017-02-05 00:12 - 00383776 _____ () D:\Steam\steam.dll
2016-12-15 18:12 - 2016-12-15 18:12 - 00172544 _____ () C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\IsdiInterop\21f0bb7cf53b00e208e9f60fac1cef1d\IsdiInterop.ni.dll
2011-06-26 23:49 - 2011-05-20 09:05 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2014-09-16 09:21 - 2014-09-16 09:21 - 00204800 _____ () C:\Program Files (x86)\Notepad++\plugins\ComparePlugin.dll
2016-10-16 02:19 - 2016-10-16 02:19 - 00021680 _____ () C:\Program Files (x86)\Notepad++\plugins\NppExport.dll
2015-05-15 15:24 - 2015-05-15 15:24 - 02873856 _____ () C:\Program Files (x86)\Notepad++\plugins\NppFTP.dll
2016-08-10 19:38 - 2016-08-10 19:38 - 00679624 _____ () C:\Users\*****\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\ClientTelemetry.dll
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
AlternateDataStreams: C:\WINDOWS\acpimof.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\explorer.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\NvContainerRecovery.bat:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\splwow64.exe:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\aadcloudap.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\aadtb.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\AboveLockAppHost.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\AccountsRt.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\aclui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\acmigration.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ACPBackgroundManagerPolicy.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ActionCenter.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ActionCenterCPL.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ActivationManager.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\actxprxy.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\AddressParser.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\adsmsext.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\aeinv.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\aepic.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\aitstatic.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-core-file-l1-2-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-core-file-l2-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-core-localization-l1-2-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-core-processthreads-l1-1-1.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-core-synch-l1-2-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-core-timezone-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-core-xstate-l2-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-conio-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-convert-l1-1-0.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-environment-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-filesystem-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-heap-l1-1-0.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-locale-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-math-l1-1-0.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-multibyte-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-private-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-process-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-runtime-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-stdio-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-string-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-time-l1-1-0.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\api-ms-win-crt-utility-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\AppCapture.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\AppContracts.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\appinfo.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\AppointmentActivation.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\AppointmentApis.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\appraiser.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\AppReadiness.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\apprepapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\apprepsync.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\AppVCatalog.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\AppVClient.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\AppVDllSurrogate.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\AppVEntStreamingManager.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\AppVEntSubsystemController.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\AppVEntSubsystems64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\AppVEntVirtualization.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\AppVIntegration.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\AppVManifest.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\AppVOrchestration.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\AppVPolicy.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\AppVPublishing.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\AppVReporting.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\AppVScripting.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\AppVShNotify.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\appwiz.cpl:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\AppXApplicabilityBlob.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\AppXDeploymentClient.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\AppXDeploymentServer.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\AppxPackaging.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\asycfilt.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\atmfd.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\atmlib.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\AudioEndpointBuilder.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\AudioEng.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\AUDIOKSE.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\AudioSes.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\audiosrv.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\AudioSrvPolicyManager.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\AuthBroker.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\authui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\autoplay.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\AzureSettingSyncProvider.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\baaupdate.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\BackgroundMediaPolicy.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\BarcodeProvisioningPlugin.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\bcastdvr.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\BcastDVRHelper.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\bcdedit.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\bcrypt.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\bdechangepin.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\bdesvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\bdeui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\bdeunlock.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\BingMaps.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\BingOnlineServices.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\bisrv.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\BitLockerDeviceEncryption.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\biwinrt.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\BluetoothApis.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\BootMenuUX.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\bootux.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\browserbroker.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\BrUsi09a.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\BrWia09b.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\BthRadioMedia.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\CastLaunch.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\CbtBackgroundManagerPolicy.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\cdd.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\cdp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\cdpsvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\cdpusersvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\centel.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\CertEnroll.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\certprop.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Chakra.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Chakradiag.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Chakrathunk.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\chartv.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ChatApis.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ci.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\ClipboardServer.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ClipUp.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\cloudAP.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\CloudBackupSettings.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\CloudExperienceHost.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\CloudExperienceHostBroker.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\CloudExperienceHostCommon.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\CloudExperienceHostUser.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\CloudStorageWizard.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\clusapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\cmifw.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\cmintegrator.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\cngkeyhelper.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\combase.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\comdlg32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\CompatTelRunner.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\comsvcs.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ConsoleLogon.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ContactActivation.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ContactApis.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\container.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ContentDeliveryManager.Utilities.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\CoreMessaging.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\CoreUIComponents.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\CPFilters.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\CredProvDataModel.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\credprovhost.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\credprovs.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\credprovslegacy.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\crypt32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\cryptngc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\CryptoWinRT.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\cryptui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\cscui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\csrsrv.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ctasio64.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\CtCoInst.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\ctdpxy64.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\CtDvInst.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\CTMLFX64.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\ctosur64.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\ctpxst64.exe:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\cttele64.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\CtxfiRes.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\C_G18030.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\c_GSM7.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\C_IS2022.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\d2d1.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\d3d10warp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\d3d11.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\D3D12.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\d3d9.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\D3DCompiler_47.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\dab.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\dafBth.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\dafpos.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\das.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\dasHost.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DataExchange.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DataSenseHandlers.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\daxexec.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\dbgeng.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DbgModel.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ddraw.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\delegatorprovider.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DeveloperOptionsSettingsHandlers.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\devenum.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\deviceaccess.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\deviceassociation.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DeviceCensus.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DeviceCenter.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DeviceEnroller.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DeviceFlows.DataModel.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DevicePairing.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DevicePairingFolder.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DeviceReactivation.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\devinv.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\dhcpcore6.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\diagtrack.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\dialclient.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\dialserver.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\discan.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Display.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DisplayManager.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\dlnashext.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\dmcertinst.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\dmenrollengine.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DMRServer.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\dns-sd.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\dnsapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DolbyDecMFT.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\domgmt.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\dosvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\dpapisrv.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\drvstore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DscCore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DscCoreConfProv.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\dsreg.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\dsregcmd.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\dwmapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\dwmcore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\DWrite.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\dxgi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\dxmasf.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\dxtrans.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\EAMProgressHandler.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\eapp3hst.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\eappcfg.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\eappgnui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\eapphost.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\eappprxy.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\easwrt.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\edgehtml.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\EditBufferTestHook.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\EditionUpgradeHelper.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\EditionUpgradeManagerObj.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\EDPCleanup.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\efsext.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\efswrt.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\EmailApis.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\encapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\EncDec.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\energy.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\EnterpriseAppMgmtSvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\enterprisecsps.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\EnterpriseModernAppMgmtCSP.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ErrorDetails.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ErrorDetailsUpdate.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\esent.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\esentutl.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\evr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ExplorerFrame.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ExSMime.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ExtrasXmlParser.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\facecredentialprovider.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Family.Authentication.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Family.Client.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Family.SyncEngine.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ffbroker.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\fhcfg.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\fhcpl.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\fhsettingsprovider.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\FintekIcon1.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\FlightSettings.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\FntCache.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\fontdrvhost.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\fontext.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\FontProvider.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\FrameServer.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\FSClient.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\fveapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\fveapibase.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\fvecpl.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\fvenotify.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\fveprompt.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\fveui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\fvewiz.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\GamePanel.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\gameux.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\gdi32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\gdi32full.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\GdiPlus.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\GEARAspi64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\generaltel.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\GenValObj.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Geolocation.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\GlobCollationHost.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\gpsvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\hal.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\hevcdecoder.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\hgcpl.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\HttpsDataSource.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\hvax64.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\hvix64.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\hvloader.efi:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\hvloader.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\icsvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\icsvcext.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\IdCtrls.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ie4uinit.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ieapfltr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\iedkcs32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ieetwcollector.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ieetwcollectorres.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ieetwproxystub.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ieframe.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\iepeers.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ieproxy.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\iernonce.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\iertutil.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\iesetup.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\imapi2.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ImplatSetup.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\indexeddbserver.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\inetcomm.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\inetcpl.cpl:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\input.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\InputLocaleManager.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\InputService.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\InstallAgent.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\InstallAgentUserBroker.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\invagent.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\iphlpsvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ipnathlp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\iscsiwmi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\JpMapControl.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\jscript9.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\jscript9diag.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\jsproxy.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\kdhvcom.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\kerberos.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\KernelBase.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\KnobsCore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\KnobsCsp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\LaunchWinApp.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\LicenseManager.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\LicenseManagerSvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ListSvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\localspl.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\LocationFramework.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\LockAppBroker.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\LockAppHost.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\LogonController.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\lpremove.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\LsaIso.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\lsasrv.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\lsass.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\lsm.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\manage-bde.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MapConfiguration.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MapControlCore.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\MapControlStringsRes.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MapGeocoder.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MapRouter.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MapsBtSvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MapsBtSvcProxy.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\MapsCSP.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MapsStore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mapstoasttask.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mapsupdatetask.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MbaeApiPublic.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mbsmsapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MCRecvSrc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MDEServer.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MDMAppInstaller.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mdmregistration.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MediaFoundation.DefaultPerceptionProvider.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mf.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mfasfsrcsnk.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mfaudiocnv.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MFCaptureEngine.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mfcore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mfksproxy.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MFMediaEngine.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mfmkvsrcsnk.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mfmp4srcsnk.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mfmpeg2srcsnk.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mfnetcore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mfnetsrc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mfplat.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MFPlay.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mfpmp.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mfps.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mfreadwrite.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mfsensorgroup.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mfsrcsnk.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\mfsvr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Microsoft-Windows-MapControls.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Microsoft-Windows-MosHost.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Microsoft-Windows-MosTrace.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\microsoft-windows-system-events.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\migisol.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MiracastReceiver.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mispace.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\modernexecserver.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mos.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\moshost.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MosHostClient.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\moshostcore.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\MosResource.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MosStorage.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mprapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mprddm.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mprdim.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\mqcmiplugin.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MrmCoreR.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MRT.exe:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\MSAC3ENC.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MSAJApi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MSAudDecMFT.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\msctf.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\msdtcprx.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\msdtctm.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\msdtcuiu.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\msdxm.ocx:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\msfeeds.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\msftedit.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mshtml.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\mshtmled.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mshtmlmedia.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\msi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\msinfo32.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\msmpeg2vdec.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mspaint.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MsSpellCheckingFacility.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mssprxy.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mssrch.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mstsc.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\mstscax.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\msv1_0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MSVidCtl.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MSVideoDSP.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MSVP9DEC.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\msvproc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MSVPXENC.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\msxml6.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\msxml6r.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MusNotification.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\MusUpdateHandlers.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nativemap.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\NaturalLanguage6.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ncsi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\NetCfgNotifyObjectHost.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\netiougc.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\netplwiz.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\NetSetupApi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\NetSetupEngine.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\NetSetupShim.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\NetSetupSvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\netshell.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nettrace.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\NetworkBindingEngineMigPlugin.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\NetworkCollectionAgent.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\NetworkDesktopSettings.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\NetworkMobileSettings.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\NetworkUXBroker.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\NFCProvisioningPlugin.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\NfcRadioMedia.dll:$CmdTcID [32]
AlternateDataStreams: C:\WINDOWS\system32\ngccredprov.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\NgcCtnr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\NgcCtnrGidsHandler.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ngcsvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nlasvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\NlsData0009.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\NlsLexicons0009.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nltest.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\NMAA.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\NmaDirect.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\NotificationController.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\NPSM.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nshwfp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ntdll.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ntoskrnl.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ntshrui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nvapi64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nvaudcap64v.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nvcompiler.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nvcuda.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nvcuvid.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nvDecMFTMjpeg.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nvdispco6434752.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nvdispco6435012.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nvdispco6435286.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nvdispco6435382.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nvdispco6435560.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nvdispco6437609.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nvdispco6437653.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nvdispgenco6434752.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nvdispgenco6435012.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nvdispgenco6435286.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\nvdispgenco6435382.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nvdispgenco6435560.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nvdispgenco6437609.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nvdispgenco6437653.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nvEncMFTH264.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\nvEncMFThevc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nvEncodeAPI64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nvfatbinaryLoader.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\NvFBC64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nvhdagenco6420103.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nvhdap64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\NvIFR64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\NvIFROpenGL.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nvmcumd.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nvoglv64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nvopencl.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\nvptxJitCompiler.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\odbcconf.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\offlinelsa.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\offlinesam.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\offreg.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ole32.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\oleaut32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\OnDemandConnRouteHelper.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\OneBackupHandler.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\OneDriveSettingSyncProvider.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\OpenAL32.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\OpenCL.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\pcasvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\pdh.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\PhoneProviders.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\PhoneService.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\PhoneServiceRes.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Phoneutil.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\PhoneutilRes.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\pidgenx.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\PimIndexMaintenance.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\PlayToDevice.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\PlayToManager.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\PlayToReceiver.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\pnidui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\policymanager.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\poqexec.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\POSyncServices.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\powercfg.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\powertracker.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\PrintWSDAHost.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\prm0009.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\profsvc.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\provdatastore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\provengine.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\provhandlers.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\provisioningcsp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\provops.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ProvPluginEng.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ProvSysprep.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\provtool.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\PsmServiceExtHost.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\puiobj.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\pwcreator.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\pwrshplugin.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\qedit.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\qmgr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rasapi32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rascustom.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rasmans.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rdpcore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rdpcorets.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rdpencom.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rdpinit.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rdpshell.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rdpudd.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\RDXService.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\RDXTaskFactory.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ReAgent.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\ReAgentc.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\regplib.exe:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\RelPost.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\remoteaudioendpoint.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\RemoteNaturalLanguage.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\RemovableMediaProvisioningPlugin.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ReportingCSP.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\reseteng.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ResetEngine.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ResetEngine.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\resutils.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\RjvMDMConfig.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\RMapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rpcrt4.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\rshx32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\RTMediaFrame.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\RTWorkQ.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\samlib.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\samsrv.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\sbe.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ScDeviceEnum.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\schannel.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Search.ProtocolHandler.MAPI2.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\SearchFilterHost.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SearchFolder.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SearchIndexer.exe:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\SearchProtocolHost.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SecConfig.efi:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\securekernel.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\sendmail.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Sens.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SensorDataService.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SensorsApi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SensorService.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\services.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SessEnv.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\SettingsHandlers_Bluetooth.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SettingsHandlers_Flights.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SettingsHandlers_nt.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SettingsHandlers_StorageSense.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SettingsHandlers_WorkAccess.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SettingSync.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SettingSyncCore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SettingSyncHost.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SettingSyncPolicy.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\setupugc.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SharedStartModel.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ShareHost.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\shdocvw.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\shell32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\shutdownux.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\skci.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\slc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\slcext.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\smartscreen.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\smphost.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SndVolSSO.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SpaceAgent.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SpaceControl.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\spaceman.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SpeechPal.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\spoolsv.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\sppc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\sppcext.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\sppnp.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\sppobjs.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\sppsvc.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\sppwinob.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\spwmp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SRH.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SRHInproc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\sspicli.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\stobject.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\StorageUsage.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\storagewmi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\storagewmi_passthru.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\StoreAgent.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\StorSvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\StructuredQuery.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\sud.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SyncCenter.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SyncSettings.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SysResetErr.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\systemreset.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SystemSettings.DeviceEncryptionHandlers.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SystemSettings.UserAccountsHandlers.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SystemSettingsAdminFlows.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\SystemSettingsThresholdAdminFlowUI.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\taskbarcpl.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\tcpipcfg.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\tdh.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\TextInputFramework.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\themecpl.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\timedate.cpl:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\TokenBroker.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\TpmCoreProvisioning.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\TpmTasks.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\tquery.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\TransportDSA.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\tsmf.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\TSpkg.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\tspubwmi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\TSWorkspace.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\twinapi.appcore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\twinapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\twinui.appcore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\twinui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\twinui.pcshell.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\tzautoupdate.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\tzres.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\ubpm.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\UDAAPO64.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\UDAPLD64.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\UIAnimation.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\UIAutomationCore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\UIRibbonRes.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\umpoext.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\unimdm.tsp:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\updatehandlers.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\updatepolicy.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\uReFS.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\urlmon.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\usbaaplrc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\usbmon.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\user32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\usercpl.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\UserDataAccessRes.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\UserDataLanguageUtil.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\UserDataPlatformHelperUtil.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\UserDataTimeUtil.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\UserDataTypeHelperUtil.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\UserDeviceRegistration.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\UserDeviceRegistration.Ngc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\usermgr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\UserMgrProxy.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\usocore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\UtcResources.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\vbscript.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\VCardParser.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\VEStoreEventHandlers.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\vmrdvcore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\vpnike.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\VPNv2CSP.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\vulkaninfo-1-1-0-26-0.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\vulkaninfo.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\w32time.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wbiosrvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wc_storage.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WebcamUi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\webio.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wer.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\weretw.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wevtsvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wfdprov.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WiFiConfigSP.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wificonnapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wifinetworkmanager.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wifiprofilessettinghandler.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wifitask.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\win32k.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\win32kbase.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\win32kfull.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\win32spl.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\win32u.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WinBioDataModel.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WinBioDataModelOOBE.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wincorlib.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Windows.AccountsControl.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.ApplicationModel.Background.SystemEventsBroker.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.ApplicationModel.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.ApplicationModel.LockScreen.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.ApplicationModel.Wallet.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Cortana.Desktop.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Data.Pdf.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.AllJoyn.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Bluetooth.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.HumanInterfaceDevice.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.LowLevel.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Midi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Perception.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Picker.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.PointOfService.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Printers.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Radios.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Scanners.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Sensors.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.SerialCommunication.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.SmartCards.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.SmartCards.Phone.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.Usb.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.WiFi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Devices.WiFiDirect.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Energy.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Gaming.Input.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Gaming.XboxLive.Storage.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Globalization.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Graphics.Printing.3D.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Graphics.Printing.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Internal.Bluetooth.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Internal.Management.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Internal.UI.Logon.ProxyStub.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Management.Provisioning.ProxyStub.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.Audio.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.BackgroundMediaPlayback.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.Devices.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.Editing.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.FaceAnalysis.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.Import.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.MediaControl.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.Ocr.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.Playback.BackgroundMediaPlayer.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.Playback.MediaPlayer.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.Speech.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.Speech.UXRes.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Media.Streaming.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Networking.BackgroundTransfer.BackgroundManagerPolicy.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Networking.BackgroundTransfer.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Networking.Connectivity.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Networking.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Networking.HostName.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Networking.ServiceDiscovery.Dnssd.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Networking.Vpn.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Perception.Stub.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Security.Authentication.Identity.Provider.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Security.Authentication.OnlineId.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Shell.Search.UriHandler.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.StateRepository.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.StateRepositoryBroker.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.StateRepositoryClient.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Storage.ApplicationData.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\windows.storage.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.System.UserDeviceAssociation.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.BioFeedback.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.BlockedShutdown.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.Core.TextInput.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.Cred.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.CredDialogController.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.Immersive.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.Input.Inking.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.Logon.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.Search.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.Shell.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.Xaml.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.Xaml.InkControls.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.Xaml.Maps.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.Xaml.Phone.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.UI.Xaml.Resources.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Web.Diagnostics.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Web.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Windows.Web.Http.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WindowsCodecs.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\winhttp.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\wininet.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wininetlui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\winload.efi:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\winload.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\winlogon.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\winmde.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\winresume.efi:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\winresume.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WinSCard.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\winsrv.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wintrust.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WinTypes.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wkssvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wlanapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wlancfg.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wlanhlp.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\WlanMediaManager.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wlanmsm.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wlansec.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wlansvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wlansvcpal.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wlidsvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wmp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WMPDMC.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wmpdxm.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wmpeffects.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wmploc.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wmpmde.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wmpps.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wmpshell.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WordBreakers.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wow64.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WpAXHolder.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WpcRefreshTask.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WpcTok.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WpcWebFilter.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wpnapps.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wpncore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wpninprc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wpnprv.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wpx.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wrap_oal.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\ws2_32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wscapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wscinterop.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wscsvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wscui.cpl:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wsecedit.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WSManHTTPConfig.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WsmSvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wsp_fs.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wsp_health.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wsp_sr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wu.upgrade.ps.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wuapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wuauclt.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wuaueng.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wups.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wups2.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wuuhext.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WWAHost.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\WWanAPI.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wwanconn.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wwanmm.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wwanprotdim.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\wwansvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\XamlTileRender.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\XblAuthManager.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\xpsrchvw.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\zipfldr.dll:$CmdTcID [64]
|
|
09.02.2017, 16:22
| #3 |
| | Windows 10: mögliche Infektion durch USB-Stick (Manuel.doc/Forbix.A?) Addition, Teil 2 (mit '*****' teilweise anonymisiert)
__________________Code:
ATTFilter AlternateDataStreams: C:\WINDOWS\SysWOW64\a3d.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\aadtb.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\AboveLockAppHost.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ac3api.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\aclui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ActionCenterCPL.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ActivationManager.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\actxprxy.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\AddCat.exe:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\AddressParser.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\adsmsext.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-core-file-l1-2-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-core-file-l2-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-core-localization-l1-2-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-core-synch-l1-2-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-core-xstate-l2-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-math-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-private-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-process-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-string-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-time-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\AppCapture.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\AppContracts.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\AppointmentActivation.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\AppointmentApis.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\apprepapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\apprepsync.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\AppSetup.exe:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\AppVEntSubsystems32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\appwiz.cpl:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\AppxPackaging.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\asycfilt.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\atmfd.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\atmlib.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\AUDIOKSE.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\AudioSes.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\AuthBroker.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\AuthExt.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\authui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\autoplay.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\AzureSettingSyncProvider.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\BackgroundMediaPolicy.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\bcastdvr.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\BcastDVRHelper.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\bcrypt.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\BingMaps.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\BingOnlineServices.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\biwinrt.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\BluetoothApis.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\BrDctF2.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\BrDctF2L.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\BrDctF2S.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\BRLM03A.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\BRLMW03A.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\BROSNMP.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\BRRBTOOL.EXE:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\BRTCPCON.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\cdp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\CertEnroll.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Chakra.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Chakradiag.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Chakrathunk.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\chartv.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ChatApis.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ClipboardServer.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\CloudBackupSettings.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\CloudExperienceHostCommon.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\CloudExperienceHostUser.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\CloudStorageWizard.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\clusapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\cmifw.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\cngkeyhelper.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\combase.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\comctl32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\comdlg32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\comsvcs.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ConfigureExpandedStorage.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ContactActivation.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ContactApis.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\container.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\CoreMessaging.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\CoreUIComponents.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\CPFilters.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\CredProvDataModel.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\credprovhost.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\credprovs.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\credprovslegacy.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\crypt32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\cryptngc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\CryptoWinRT.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\cryptui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Ct20xspi.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ctasio.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ctdproxy.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ctemupia.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\CTMLFX32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ctosuser.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ctpxst32.exe:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\cttele32.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\CTxfiBtn.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Ctxfihlp.exe:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\CTxfiReg.exe:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\CtxfiRes.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\CTxfispi.exe:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\CTxfiSpk.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ct_oal.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\C_G18030.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\c_GSM7.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\C_IS2022.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\d2d1.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\d3d10warp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\d3d11.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\D3D12.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\d3d8.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\d3d9.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\D3DCompiler_47.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\DataExchange.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\daxexec.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\dbgeng.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\DbgModel.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ddraw.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\delegatorprovider.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\devenum.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\deviceassociation.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\DeviceFlows.DataModel.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\DevicePairing.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\devreg.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\dhcpcore6.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\dialclient.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\DisplayManager.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\dlnashext.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\dmenrollengine.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\dns-sd.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\dnsapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\DolbyDecMFT.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\drvstore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\DscCoreConfProv.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\dsreg.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\dtdump.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\dwmapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\dwmcore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\DWrite.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\dxgi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\dxmasf.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\dxtrans.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\eapp3hst.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\eappcfg.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\eappgnui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\eapphost.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\eappprxy.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\EasyAntiCheat.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\eaxac3.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\edgehtml.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\EditBufferTestHook.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\efsext.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\efswrt.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\EmailApis.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\encapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\enlocstr.exe:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ErrorDetails.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ErrorDetailsUpdate.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\esent.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\esentutl.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\evr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\explorer.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ExplorerFrame.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ExSMime.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ExtrasXmlParser.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\findnetprinters.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\FlashPlayerApp.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\fontdrvhost.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\fontext.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\FSClient.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\GamePanel.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\gameux.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\gdi32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\gdi32full.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\GdiPlus.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\GEARAspi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Geolocation.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\GlobCollationHost.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\hevcdecoder.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\hgcpl.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ieapfltr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\iedkcs32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ieetwproxystub.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ieframe.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\iepeers.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ieproxy.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\iernonce.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\iertutil.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\iesetup.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\imapi2.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\indexeddbserver.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\inetcomm.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\inetcpl.cpl:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\input.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\InputLocaleManager.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\InputService.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\InstallAgent.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\InstallAgentUserBroker.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\iscsiwmi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\JpMapControl.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\jscript9.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\jscript9diag.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\jsproxy.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\kerberos.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\KernelBase.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\killapps.exe:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\LaunchWinApp.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\LicenseManager.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\LicenseManagerApi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\LockAppBroker.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\LockAppHost.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\LogonController.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\MapConfiguration.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\MapControlCore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\MapControlStringsRes.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\MapGeocoder.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\MapRouter.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\MapsBtSvc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\MbaeApiPublic.dll:$CmdTcID [32]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mbsmsapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\MCRecvSrc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mdmregistration.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mf.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mfaudiocnv.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mfcore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mfksproxy.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\MFMediaEngine.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mfmkvsrcsnk.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mfnetcore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mfnetsrc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mfplat.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\MFPlay.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mfpmp.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mfps.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mfreadwrite.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mfsensorgroup.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mfsrcsnk.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mfsvr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Microsoft-Windows-MapControls.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Microsoft-Windows-MosHost.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Microsoft-Windows-MosTrace.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\migisol.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\MiracastReceiver.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mispace.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mos.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\MosHostClient.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\MosResource.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\MosStorage.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mprapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mprddm.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mprdim.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mqmigplugin.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\MrmCoreR.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\MSAC3ENC.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\MSAJApi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msctf.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msdtcprx.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msdtcuiu.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msdxm.ocx:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msfeeds.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msftedit.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mshtml.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mshtmled.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mshtmlmedia.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msinfo32.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msmpeg2vdec.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mspaint.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mssrch.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mstsc.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mstscax.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msv1_0.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\MSVidCtl.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\MSVP9DEC.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msvproc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\MSVPXENC.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msxml6.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\msxml6r.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\mtxclu.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\muachost.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\NaturalLanguage6.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\NetCfgNotifyObjectHost.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\netiougc.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\NetSetupApi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\NetSetupEngine.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\NetSetupShim.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\netshell.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\NetworkCollectionAgent.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ngccredprov.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsData0009.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\NlsLexicons0009.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\NMAA.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\NmaDirect.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\NPSM.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\nshwfp.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\NSSearch.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ntdll.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ntshrui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\nvapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\nvaudcap32v.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\nvcompiler.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\nvcuda.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\nvcuvid.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\nvDecMFTMjpeg.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\nvEncMFTH264.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\nvEncMFThevc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\nvEncodeAPI.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\nvfatbinaryLoader.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\NvFBC.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\NvIFR.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\NvIFROpenGL.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\nvoglv32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\nvopencl.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\nvptxJitCompiler.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\nvStreaming.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\oalinst.exe:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\odbcconf.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\offlinelsa.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\offlinesam.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\offreg.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ole32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\oleacc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\oleaut32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\olepro32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\OneDriveSettingSyncProvider.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\OpenAL32.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\OpenCL.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\pdh.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Phoneutil.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\PhoneutilRes.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\piaproxy.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\pidgenx.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\PlayToDevice.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\PlayToManager.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\PlayToReceiver.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\PnkBstrB.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\PnkBstrB.xtr:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\policymanager.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\poqexec.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\POSyncServices.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\powercfg.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\PrintDialogs.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\pwrshplugin.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\qdvd.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\rasapi32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\rdpcore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\rdpencom.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ReAgent.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ReAgentc.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\remoteaudioendpoint.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\RemoteNaturalLanguage.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\resutils.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\rpcrt4.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\RTMediaFrame.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\RTWorkQ.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\samlib.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\schannel.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Search.ProtocolHandler.MAPI2.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\SearchFolder.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\SearchIndexer.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\SearchProtocolHost.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\sendmail.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\SessEnv.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\SettingSync.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\SettingSyncCore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\SettingSyncHost.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\SettingSyncPolicy.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\setupugc.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\sfman32.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\sfms32.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ShareHost.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\shell32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\slc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\slcext.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\smphost.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\SndVolSSO.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\sppc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\sppcext.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\spwmp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\sspicli.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\stobject.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\storagewmi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\storagewmi_passthru.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\StoreAgent.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\sud.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\SyncSettings.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\systemcpl.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\tcpipcfg.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\tdh.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\TempSignedLicenseExchangeTask.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\TextInputFramework.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\themecpl.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\TokenBroker.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\TpmCoreProvisioning.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\tquery.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\tsmf.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\TSpkg.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\twinapi.appcore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\twinapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\twinui.appcore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\twinui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\tzres.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\UDAAIM64.exe:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\UDAAPO32.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\UIAnimation.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\UIAutomationCore.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\UIRibbonRes.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\unimdm.tsp:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\updatepolicy.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\uReFS.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\urlmon.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\user32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\usercpl.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\UserDataAccessRes.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\UserDataAccountApis.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\UserDataLanguageUtil.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\UserDataPlatformHelperUtil.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\UserDataTimeUtil.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\UserDataTypeHelperUtil.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\UserDeviceRegistration.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\UserDeviceRegistration.Ngc.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\UserMgrProxy.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\vbscript.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\VCardParser.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\vulkaninfo-1-1-0-26-0.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\vulkaninfo.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\WebcamUi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\webio.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wer.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\weretw.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wfdprov.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\win32k.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\win32kfull.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\win32u.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wincorlib.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.AccountsControl.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Background.SystemEventsBroker.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Core.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.ApplicationModel.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.ApplicationModel.LockScreen.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Wallet.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.AllJoyn.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Bluetooth.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.HumanInterfaceDevice.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.LowLevel.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Midi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Perception.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Picker.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.PointOfService.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Radios.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Scanners.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Sensors.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.SerialCommunication.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.SmartCards.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.Usb.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.WiFi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Devices.WiFiDirect.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Energy.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Gaming.Input.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Gaming.XboxLive.Storage.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Globalization.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Graphics.Printing.3D.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Graphics.Printing.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Internal.Bluetooth.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Internal.Management.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Internal.UI.Logon.ProxyStub.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.Audio.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.BackgroundMediaPlayback.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.Editing.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.FaceAnalysis.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.Import.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.Ocr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.Playback.BackgroundMediaPlayer.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.Playback.MediaPlayer.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.Speech.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.Speech.UXRes.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Media.Streaming.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Networking.BackgroundTransfer.BackgroundManagerPolicy.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Networking.BackgroundTransfer.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Networking.Connectivity.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Networking.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Networking.HostName.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Networking.ServiceDiscovery.Dnssd.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Perception.Stub.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Identity.Provider.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Security.Authentication.OnlineId.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Shell.Search.UriHandler.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.StateRepository.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.StateRepositoryClient.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Storage.ApplicationData.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\windows.storage.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.System.UserDeviceAssociation.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.BioFeedback.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.BlockedShutdown.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.Core.TextInput.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.Cred.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.CredDialogController.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.Immersive.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.Input.Inking.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.Search.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.Xaml.InkControls.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Maps.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Phone.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Resources.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Web.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\Windows.Web.Http.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\WindowsCodecs.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\winhttp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wininet.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wininetlui.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\winmde.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\WinRtTracing.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\WinSCard.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wintrust.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\WinTypes.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wlanapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wlancfg.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wlanhlp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wmp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\WMPDMC.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wmpdxm.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wmpeffects.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wmploc.DLL:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wmpmde.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wmpshell.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\WordBreakers.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\WpcWebFilter.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wpnapps.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wrap_oal.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\ws2_32.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wscapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wscinterop.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wscui.cpl:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wsecedit.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\WSManHTTPConfig.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\WsmSvc.dll:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wsp_fs.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wsp_health.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wsp_sr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\wuapi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\WwaApi.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\WWAHost.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\WWanAPI.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\xolehlp.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\xpsrchvw.exe:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\SysWOW64\zipfldr.dll:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\afd.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\ahcache.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\AppVStrm.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\bowser.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\capimg.sys:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\Classpnp.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\clfs.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\ClipSp.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\cmimcext.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\cng.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\crashdmp.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\CT20XUT.sys:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\ctac32k.sys:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\ctaud2k.sys:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\CTEXFIFX.sys:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\CTHWIUT.sys:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\ctoss2k.sys:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\ctprxy2k.sys:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\ctsfm2k.sys:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\dam.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\dfsc.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\dumpsd.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\dxgkrnl.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\dxgmms1.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\dxgmms2.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\EhStorTcgDrv.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\emupia2k.sys:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\fastfat.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\fvevol.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\FWPKCLNT.SYS:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\ha20x2k.sys:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\hidclass.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\hidparse.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\hidusb.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\http.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\hvservice.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\I2cHkBurn.sys:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\iorate.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\kbdhid.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\ksecdd.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\ksecpkg.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\mbam.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\MegaSas2i.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\modem.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\mrxdav.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\mrxsmb.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\mrxsmb10.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\mrxsmb20.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\mwac.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\ndis.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\ntfs.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\nvhda64v.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\nvvad64v.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\partmgr.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\pci.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\pdc.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\pfmodnt.sys:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\rdbss.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\sdbus.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\spaceport.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\srv.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\srv2.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\srvnet.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\storahci.sys:$CmdTcID [130]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\stornvme.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\storport.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\tcpip.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\tm.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\tpm.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\usbaapl64.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\usbscan.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\vhdmp.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\vpci.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\vpnva64-6.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\wcifs.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\WdiWiFi.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\winhvr.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\wof.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\xboxgip.sys:$CmdTcID [64]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\xinputhid.sys:$CmdTcID [64]
AlternateDataStreams: C:\Users\*****\Desktop\*****.pdf:$CmdZnID [26]
... Desktopdateien anonymisiert ...
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
IE trusted site: HKU\S-1-5-21-2015921152-1024863377-2374061687-1000\...\aeriagames.com -> hxxps://aeriagames.com
==================== Hosts Inhalt: ===============================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2009-07-14 03:34 - 2015-06-17 07:53 - 00000890 ____A C:\WINDOWS\system32\Drivers\etc\hosts
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-2015921152-1024863377-2374061687-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\*****\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\startupfolder: C:^Users^*****^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk => C:\Windows\pss\Dropbox.lnk.Startup
MSCONFIG\startupreg: Acronis Scheduler2 Service => "C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe"
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Aeria Ignite => "C:\Program Files (x86)\Aeria Games\Ignite\aeriaignite.exe" silent
MSCONFIG\startupreg: Akamai NetSession Interface => "C:\Users\*****\AppData\Local\Akamai\netsession_win.exe"
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: Argus Monitor => "C:\Program Files (x86)\ArgusMonitor\ArgusMonitor.exe"
MSCONFIG\startupreg: AthBtTray => "C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe"
MSCONFIG\startupreg: AtherosBtStack => "C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe"
MSCONFIG\startupreg: BrMfcWnd => C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
MSCONFIG\startupreg: Cisco AnyConnect Secure Mobility Agent for Windows => "C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe" -minimized
MSCONFIG\startupreg: ControlCenter3 => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe /autorun
MSCONFIG\startupreg: Eraser => "C:\PROGRA~1\Eraser\Eraser.exe" --atRestart
MSCONFIG\startupreg: IAStorIcon => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
MSCONFIG\startupreg: ICQ => "C:\Program Files (x86)\ICQ7.6\ICQ.exe" silent loginmode=4
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: KeePass 2 PreLoad => "C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe" --preload
MSCONFIG\startupreg: LGODDFU => blrun
MSCONFIG\startupreg: LogMeIn Hamachi Ui => "C:\Program Files (x86)\Hamachi\hamachi-2-ui.exe" --auto-start
MSCONFIG\startupreg: Pando Media Booster => C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: Reader Application Helper => C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe
MSCONFIG\startupreg: RTHDVCPL => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
MSCONFIG\startupreg: SandboxieControl => "C:\Program Files\Sandboxie\SbieCtrl.exe"
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: SwitchBoard => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
MSCONFIG\startupreg: TrueImageMonitor.exe => "C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe"
HKLM\...\StartupApproved\StartupFolder: => "errorlog.txt"
HKLM\...\StartupApproved\Run: => "RTHDVCPL"
HKLM\...\StartupApproved\Run: => "RtHDVBg_DTS"
HKLM\...\StartupApproved\Run: => "Eraser"
HKLM\...\StartupApproved\Run: => "iTunesHelper"
HKLM\...\StartupApproved\Run32: => "amd_dc_opt"
HKLM\...\StartupApproved\Run32: => "Cisco AnyConnect Secure Mobility Agent for Windows"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "KeePass 2 PreLoad"
HKLM\...\StartupApproved\Run32: => "QuickTime Task"
HKLM\...\StartupApproved\Run32: => "Live Update"
HKLM\...\StartupApproved\Run32: => "MSIRegister"
HKU\S-1-5-21-2015921152-1024863377-2374061687-1000\...\StartupApproved\Run: => "SandboxieControl"
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [vm-monitoring-nb-session] => LPort=139
FirewallRules: [MSMQ-In-TCP] => %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-Out-TCP] => %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-In-UDP] => %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-Out-UDP] => %systemroot%\system32\mqsvc.exe
FirewallRules: [WCF-NetTcpActivator-In-TCP-64bit] => LPort=808
FirewallRules: [{EC1A399D-E0C7-4C14-B73E-BD8DFD8E225C}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{9F165AC4-CE0D-4BD4-AFA4-C48EC326844A}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{06AD52E1-644E-444A-89DF-DF2880E992D0}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{EAC232FF-ABC2-4F67-919C-F79E4EE61353}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{ED11B615-66C6-4ECF-89FE-CDC4527D8F5D}] => D:\Steam\bin\steamwebhelper.exe
FirewallRules: [{BF33A779-1B8F-4715-A29F-8BA44B584861}] => D:\Steam\bin\steamwebhelper.exe
FirewallRules: [{855C8B40-0F9D-4409-872B-F641F5076E54}] => C:\Users\*****\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{1A5AC093-B793-4AE2-861D-6225B04B2B3D}] => C:\Users\*****\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{DD8FB768-AF53-49D9-AA8E-33093BEB5B65}] => C:\program files\java\jre7\bin\javaw.exe
FirewallRules: [{1D708D56-49C2-4099-BD76-7625D6437290}] => C:\program files\java\jre7\bin\javaw.exe
FirewallRules: [UDP Query User{DAC25987-7ACB-486E-8AB4-A2BFD6881D0C}C:\program files\java\jre7\bin\javaw.exe] => C:\program files\java\jre7\bin\javaw.exe
FirewallRules: [TCP Query User{F2F1066A-E0D9-4A0C-ABA9-D97F9740F6CC}C:\program files\java\jre7\bin\javaw.exe] => C:\program files\java\jre7\bin\javaw.exe
FirewallRules: [{6AA1D6A8-47E9-448E-AF88-1744BF3EB738}] => C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\SonarHost.exe
FirewallRules: [{10D09402-0CBA-4181-9A0B-5094BFA29CAF}] => C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\SonarHost.exe
FirewallRules: [{A4B2F467-0B34-4D2C-8F98-F4FC59651255}] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{C6EA20FD-B34C-48B0-BACB-3627DAA7EA14}] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{4D6EE3EC-823D-4E45-B4A0-0DF7D6A245CA}] => C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{FD34F4A1-C159-4338-973E-02F5665C3E3B}] => C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{124CE16D-12FB-4697-BDB2-9FB91754284B}] => C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{38AEC102-ACD4-44D1-8364-AC8E670CCF92}] => C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{2410C9AB-7F6F-433C-8FAE-8462529E6120}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{3C20DE43-0CE9-4F8C-A33A-17B25285F759}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{6FD9A86C-14EF-41B2-B271-60D3B9C16A93}] => C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{AFC46DB2-795D-4699-A2E8-F8E7D1EBB080}] => C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{275D648E-3AE3-4312-BDB4-A91191A1F21A}] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
FirewallRules: [{842D33A9-A203-4E1F-BB70-B37F1D1808F5}] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
FirewallRules: [{EA7CE460-9499-4B31-8889-F54947C03FB1}] => C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.0\SonarHost.exe
FirewallRules: [{09ADE37B-A848-4A95-B7CC-6E976EED1B91}] => C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.0\SonarHost.exe
FirewallRules: [{6007C9BD-108A-4297-A11B-90A256340EF6}] => C:\Program Files (x86)\ICQ7.6\ICQ.exe
FirewallRules: [{0C1FBD74-052E-499C-82DD-4F0F8E15DE69}] => C:\Program Files (x86)\ICQ7.6\ICQ.exe
FirewallRules: [{F12547B8-21E1-4414-9E9F-6B10088C637E}] => C:\Program Files (x86)\ICQ7.6\ICQ.exe
FirewallRules: [{84BEB98A-86C9-4434-9239-2733AE44928D}] => C:\Program Files (x86)\ICQ7.6\ICQ.exe
FirewallRules: [{CD5E7F66-90F8-490F-A40B-A89D5C4C7B08}] => C:\Program Files (x86)\BlastShark\hellgate\BlastShark.exe
FirewallRules: [{0366A116-1A66-4270-AFA8-1DF09EABA467}] => C:\Program Files (x86)\BlastShark\hellgate\BlastShark.exe
FirewallRules: [{3017DB33-978F-438C-951D-D4DB8D18E306}] => D:\Steam\Steam.exe
FirewallRules: [{7B36FC24-4134-4545-8368-40D179B2DD7D}] => D:\Steam\Steam.exe
FirewallRules: [TCP Query User{AA552D76-2A55-4AFB-8385-E3BFE7F8F08C}D:\*****\world of warships\wowslauncher.exe] => D:\*****\world of warships\wowslauncher.exe
FirewallRules: [UDP Query User{FAAF4DBC-0566-4A17-90FC-F7FE4F84CF85}D:\*****\world of warships\wowslauncher.exe] => D:\*****\world of warships\wowslauncher.exe
FirewallRules: [{4CA901BD-C0EF-474F-BCA2-5BF5CB0B7B73}] => E:\*****\World of Warships\WoWSLauncher.exe
FirewallRules: [{1C5C6359-D551-49F6-A3A9-24D99DB1B411}] => E:\*****\World of Warships\WoWSLauncher.exe
FirewallRules: [{6326F75A-785C-4E66-A85F-B8BDEEF6A608}] => E:\*****\World of Warships\worldofwarships.exe
FirewallRules: [{5210F60F-D2C4-4E7E-A6FD-594E1AFC3A29}] => E:\*****\World of Warships\worldofwarships.exe
FirewallRules: [TCP Query User{94BDA4D0-3386-4E68-AACC-F44EF920C288}C:\program files\java\jre1.8.0_101\bin\javaw.exe] => C:\program files\java\jre1.8.0_101\bin\javaw.exe
FirewallRules: [UDP Query User{7E27F1FC-327D-4B02-AB6C-C267CC90F22C}C:\program files\java\jre1.8.0_101\bin\javaw.exe] => C:\program files\java\jre1.8.0_101\bin\javaw.exe
FirewallRules: [TCP Query User{D07BCB59-5841-4C4C-A1A7-A10A6B59DC7F}C:\users\*****\appdata\local\vivaldi\application\vivaldi.exe] => C:\users\*****\appdata\local\vivaldi\application\vivaldi.exe
FirewallRules: [UDP Query User{222C52F6-9244-4D0A-A7D2-4DE8D10A8FDD}C:\users\*****\appdata\local\vivaldi\application\vivaldi.exe] => C:\users\*****\appdata\local\vivaldi\application\vivaldi.exe
FirewallRules: [TCP Query User{330C194E-B12B-42E2-B249-30A5182782C7}C:\program files\moneymanagerex\bin\mmex.exe] => C:\program files\moneymanagerex\bin\mmex.exe
FirewallRules: [UDP Query User{F4B7D3A7-8E5A-421C-9BC2-C0C62587F6E5}C:\program files\moneymanagerex\bin\mmex.exe] => C:\program files\moneymanagerex\bin\mmex.exe
FirewallRules: [{728761BB-6AB0-4CE5-B7F6-7DC9BF1A2945}] => C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{513BE14D-3664-402F-A88B-566A51C51096}] => C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{FEF7C48E-1831-4D3E-863D-20889453021C}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{9A71A27B-B7D7-48E1-8091-24A1BABF71D1}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{9070A542-BFBB-4B44-8A46-B77F5A2FEBAA}] => C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{9A39D3EE-E43A-4982-B19C-787655B5C8DE}] => D:\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{01CD987C-9223-483F-9568-641A283C87DB}] => D:\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{C79CA30C-A954-4C84-8D68-0E797F3297E6}] => E:\*****\WATCH_DOGS2\bin\WatchDogs2.exe
FirewallRules: [{60B4AB63-5DF7-4DDE-B4F6-DC7BBFA5D2EF}] => E:\*****\WATCH_DOGS2\bin\WatchDogs2.exe
FirewallRules: [{A8E0BE01-03FC-47EA-995C-2C5106D5D4AF}] => LPort=26789
FirewallRules: [{C3D40D45-A74E-40B3-A01B-41179C7A343E}] => C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{777E9733-3F2E-43D0-B07A-D4F47B74D586}] => C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{983401F4-275D-46D8-9A44-005DFAD219AA}] => C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{41B7BC34-176F-4769-81CD-01DB4F91E865}] => C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
==================== Wiederherstellungspunkte =========================
ACHTUNG: Systemwiederherstellung ist deaktiviert
==================== Fehlerhafte Geräte im Gerätemanager =============
Name: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Description: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: vpnva
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (02/09/2017 02:29:05 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: *****)
Description: Bei der Aktivierung der App „Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy!App“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (02/08/2017 09:55:49 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Local Hostname *****.local already in use; will try *****-2.local instead
Error: (02/08/2017 09:55:49 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: ProbeCount 0; will deregister 4 *****.local. Addr 192.168.178.20
Error: (02/08/2017 09:55:49 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from 192.168.178.20:5353 16 *****.local. AAAA 2001:4DD1:4883:0000:ED27:540A:2DEF:4B92
Error: (02/07/2017 12:45:22 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: *****)
Description: Bei der Aktivierung der App „Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy!App“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (02/07/2017 02:05:40 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: *****)
Description: Bei der Aktivierung der App „Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy!App“ ist folgender Fehler aufgetreten: -2144927141. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (02/07/2017 01:29:19 AM) (Source: SideBySide) (EventID: 75) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "c:\program files (x86)\driver sweeper\backup\15-06-03-15-18-33\creative - sound\directories\creative1583644294\audio device selection unicode\CTAudSeu.exe". Fehler in Manifest- oder Richtliniendatei "c:\program files (x86)\driver sweeper\backup\15-06-03-15-18-33\creative - sound\directories\creative1583644294\audio device selection unicode\CTAudSeu.exe" in Zeile 2.
Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig.
Error: (02/07/2017 01:29:19 AM) (Source: SideBySide) (EventID: 75) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "c:\program files (x86)\driver sweeper\backup\13-07-18-16-52-48\creative - sound\directories\creative794238135\audio device selection unicode\CTAudSeu.exe". Fehler in Manifest- oder Richtliniendatei "c:\program files (x86)\driver sweeper\backup\13-07-18-16-52-48\creative - sound\directories\creative794238135\audio device selection unicode\CTAudSeu.exe" in Zeile 2.
Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig.
Error: (02/07/2017 01:29:19 AM) (Source: SideBySide) (EventID: 75) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "c:\program files (x86)\driver sweeper\backup\12-09-09-18-37-27\creative - sound\directories\creative1329767395\audio device selection unicode\CTAudSeu.exe". Fehler in Manifest- oder Richtliniendatei "c:\program files (x86)\driver sweeper\backup\12-09-09-18-37-27\creative - sound\directories\creative1329767395\audio device selection unicode\CTAudSeu.exe" in Zeile 2.
Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig.
Error: (02/07/2017 12:58:41 AM) (Source: SideBySide) (EventID: 75) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "c:\program files (x86)\driver sweeper\backup\15-06-03-15-18-33\creative - sound\directories\creative1583644294\audio device selection unicode\CTAudSeu.exe". Fehler in Manifest- oder Richtliniendatei "c:\program files (x86)\driver sweeper\backup\15-06-03-15-18-33\creative - sound\directories\creative1583644294\audio device selection unicode\CTAudSeu.exe" in Zeile 2.
Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig.
Systemfehler:
=============
Error: (02/09/2017 03:06:28 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "NetTcpActivator" ist vom Dienst "NetTcpPortSharing" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
Error: (02/09/2017 03:06:28 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "HomeGroupListener" wurde mit dem folgenden dienstspezifischen Fehler beendet:
%%2147944153 = In der Endpunktzuordnung sind keine weiteren Endpunkte verfügbar.
Error: (02/09/2017 02:29:05 AM) (Source: DCOM) (EventID: 10010) (User: *****)
Description: Der Server "App.AppXwdz8g2fxr36xz0tdtagygnvemf85s7gg.mca" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (02/08/2017 09:55:47 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "NetTcpActivator" ist vom Dienst "NetTcpPortSharing" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
Error: (02/08/2017 09:55:47 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "HomeGroupListener" wurde mit dem folgenden dienstspezifischen Fehler beendet:
%%2147944153 = In der Endpunktzuordnung sind keine weiteren Endpunkte verfügbar.
Error: (02/08/2017 11:45:44 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "NetTcpActivator" ist vom Dienst "NetTcpPortSharing" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
Error: (02/08/2017 11:45:43 AM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "HomeGroupListener" wurde mit dem folgenden dienstspezifischen Fehler beendet:
%%2147944153 = In der Endpunktzuordnung sind keine weiteren Endpunkte verfügbar.
Error: (02/07/2017 12:45:22 PM) (Source: DCOM) (EventID: 10010) (User: *****)
Description: Der Server "App.AppXwdz8g2fxr36xz0tdtagygnvemf85s7gg.mca" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (02/07/2017 09:17:56 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen für "Anwendungsspezifisch" wird dem Benutzer "NT-AUTORITÄT\SYSTEM" (SID: S-1-5-18) unter der Adresse "LocalHost (unter Verwendung von LRPC)" keine Berechtigung vom Typ "Lokal Aktivierung" für die COM-Serveranwendung mit der CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
und der APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
im Anwendungscontainer "Nicht verfügbar" (SID: Nicht verfügbar) gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungstool für Komponentendienste geändert werden.
Error: (02/07/2017 09:02:57 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "NetTcpActivator" ist vom Dienst "NetTcpPortSharing" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
CodeIntegrity:
===================================
==================== Speicherinformationen ===========================
Prozessor: *****
Prozentuale Nutzung des RAM: *****
Installierter physikalischer RAM: ***** MB
Verfügbarer physikalischer RAM: ***** MB
Summe virtueller Speicher: ***** MB
Verfügbarer virtueller Speicher: ***** MB
==================== Laufwerke ================================
Drive c: () (Fixed) (Total:***** GB) (Free:***** GB) NTFS ==>[Laufwerk mit Startkomponenten (eingeholt von BCD)]
Drive d: () (Fixed) (Total:***** GB) (Free:***** GB) NTFS
Drive e: () (Fixed) (Total:***** GB) (Free:***** GB) NTFS
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: ***** GB) (Disk ID: *****)
Partition 1: (Not Active) - (Size=***** GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=***** GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: ***** GB) (Disk ID: *****)
Partition 1: (Active) - (Size=***** GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=***** MB) - (Type=27)
==================== Ende von Addition.txt ============================
|
|
21.02.2017, 11:55
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Windows 10: mögliche Infektion durch USB-Stick (Manuel.doc/Forbix.A?) Dein Thread wurde nicht bearbeitet, weil du dir selbst geantwortet hast, wir bearbeiten primär nur unbeantwortete Themen - brauchst du noch Hilfe?
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
21.02.2017, 15:03
| #5 |
| | Windows 10: mögliche Infektion durch USB-Stick (Manuel.doc/Forbix.A?) Hallo cosinus, ohne spitzfindig sein zu wollen: Meine Frage im Eingangspost lautete: "Ist nicht doch etwas durchgekommen? Wurde eine Backdoor installiert? Da ich das System produktiv nutze und beruflich darauf angewiesen bin, wäre es nett, hier professionelle Hilfe zu bekommen. Soweit ich das mit meinem Kenntnissstand erkennen kann, wurde das Schlimmste noch einmal verhindert - aber ich möchte auf Nummer sicher gehen." (Herv. ergänzt) Insofern wäre es schön, wenn jemand mit mehr Expertise über die geposteten Logs schauen könnte bzw. ggf. weitere Infos zum Schädling liefern kann. Konkrete Probleme (merkwürdiges Verhalten etc.) am Rechner liegen nicht vor, aber an anderer Stelle liest man ja hier im Forum, dass das kein Indikator für eine Sauberkeit des Systems sei. Besten Dank! |
|
21.02.2017, 15:19
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 10: mögliche Infektion durch USB-Stick (Manuel.doc/Forbix.A?) Ich hab deine Postings schon gelesen. Dennoch wirst du wohl sicherlich verstehen können, dass ich nach knapp zwei Wochen erstmal wissen will, ob du überhaupt noch Hilfe willst/brauchst. Wer beruflich auf sowas dringend angewiesen ist, wird nämlich normalerweise einen Vor-Ort-Service beauftragen oder seine Kollegen aus der Abteilung EDV kontaktieren. Beachte unsere Regeln bzgl gewerblich genutzter Rechner. => http://www.trojaner-board.de/108422-...-anfragen.html
__________________ --> Windows 10: mögliche Infektion durch USB-Stick (Manuel.doc/Forbix.A?) |
|
21.02.2017, 15:19
| #7 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 10: mögliche Infektion durch USB-Stick (Manuel.doc/Forbix.A?) Ich hab deine Postings schon gelesen. Dennoch wirst du wohl sicherlich verstehen können, dass ich nach knapp zwei Wochen erstmal wissen will, ob du überhaupt noch Hilfe willst/brauchst. Wer beruflich auf sowas dringend angewiesen ist, wird nämlich normalerweise einen Vor-Ort-Service beauftragen oder seine Kollegen aus der Abteilung EDV kontaktieren. Beachte unsere Regeln bzgl gewerblich genutzter Rechner. => http://www.trojaner-board.de/108422-...-anfragen.html
__________________ Logfiles bitte immer in CODE-Tags posten |
|
21.02.2017, 15:20
| #8 |
| | Windows 10: mögliche Infektion durch USB-Stick (Manuel.doc/Forbix.A?) Klar, kann ich nachvollziehen. Bzgl. gewerblich genutztem Rechner: Das ist mein privater Rechner, der jedoch auch für berufliche Zwecke (zuhause) genutzt wird. Also nichts gewerbliches, kein Uni-Rechner o.Ä. |
|
21.02.2017, 15:29
| #9 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 10: mögliche Infektion durch USB-Stick (Manuel.doc/Forbix.A?) 1. Schritt: Malwarebytes Anti-Rootkit (MBAR) Downloade dir bitte  Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers 2. Schritt: Kaspersky TDSS-Killer Downloade dir bitte  TDSSKiller.exe und speichere diese Datei auf dem Desktop
 Lesestoff:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit. Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
21.02.2017, 17:40
| #10 |
| | Windows 10: mögliche Infektion durch USB-Stick (Manuel.doc/Forbix.A?) Scans wie angegeben durchgeführt; anbei die Logs: MBAR: Code:
ATTFilter Malwarebytes Anti-Rootkit BETA 1.9.3.1001
www.malwarebytes.org
Database version:
main: v2017.02.21.05
rootkit: v2017.02.15.01
Windows 10 x64 NTFS
Internet Explorer 11.576.14393.0
****** :: ****** [administrator]
21.02.2017 16:40:16
mbar-log-2017-02-21 (16-40-16).txt
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 453459
Time elapsed: 43 minute(s), 17 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
Physical Sectors Detected: 0
(No malicious items detected)
(end)
Code:
ATTFilter 17:31:15.0074 0x1cf4 TDSS rootkit removing tool 3.1.0.12 Nov 7 2016 07:10:01
17:31:17.0563 0x1cf4 ============================================================
17:31:17.0563 0x1cf4 Current date / time: 2017/02/21 17:31:17.0563
17:31:17.0563 0x1cf4 SystemInfo:
17:31:17.0564 0x1cf4
17:31:17.0564 0x1cf4 OS Version: 10.0.14393 ServicePack: 0.0
17:31:17.0564 0x1cf4 Product type: Workstation
17:31:17.0564 0x1cf4 ComputerName: *****
17:31:17.0564 0x1cf4 UserName: *****
17:31:17.0564 0x1cf4 Windows directory: C:\WINDOWS
17:31:17.0564 0x1cf4 System windows directory: C:\WINDOWS
17:31:17.0564 0x1cf4 Running under WOW64
17:31:17.0564 0x1cf4 Processor architecture: Intel x64
17:31:17.0564 0x1cf4 Number of processors: 8
17:31:17.0564 0x1cf4 Page size: 0x1000
17:31:17.0564 0x1cf4 Boot type: Normal boot
17:31:17.0564 0x1cf4 CodeIntegrityOptions = 0x00000001
17:31:17.0564 0x1cf4 ============================================================
17:31:17.0623 0x1cf4 KLMD registered as C:\WINDOWS\system32\drivers\35592823.sys
17:31:17.0623 0x1cf4 KLMD ARK init status: drvProperties = 0xFFF00, osBuild = 14393.693, osProperties = 0x19
17:31:18.0179 0x1cf4 ============================================================
17:31:18.0411 0x1cf4 Initialize success
17:31:18.0411 0x1cf4 ============================================================
17:31:38.0198 0x15e4 ============================================================
17:31:38.0198 0x15e4 Scan started
17:31:38.0198 0x15e4 Mode: Manual; SigCheck; TDLFS;
17:31:38.0198 0x15e4 ============================================================
17:31:38.0198 0x15e4 KSN ping started
17:31:38.0258 0x15e4 KSN ping finished: true
17:31:40.0049 0x15e4 ================ Scan system memory ========================
17:31:40.0049 0x15e4 System memory - ok
17:31:40.0049 0x15e4 ================ Scan services =============================
17:31:40.0087 0x15e4 1394ohci - ok
17:31:40.0089 0x15e4 3ware - ok
17:31:40.0095 0x15e4 [ A3769020F7E8A70FD3E824C050F33306, BAAB18DD28C753EC90E9552BD5FFC316AD8815505A7998BCE51D21448B373D86 ] acedrv11 C:\Windows\system32\drivers\acedrv11.sys
17:31:40.0139 0x15e4 acedrv11 - ok
17:31:40.0150 0x15e4 ACPI - ok
17:31:40.0152 0x15e4 AcpiDev - ok
17:31:40.0154 0x15e4 acpiex - ok
17:31:40.0156 0x15e4 acpipagr - ok
17:31:40.0158 0x15e4 AcpiPmi - ok
17:31:40.0160 0x15e4 acpitime - ok
17:31:40.0165 0x15e4 [ AAA8E68E685DB1B68747E3DF68F96368, 1A5BE239B2D0C6F727303A98CFFC91070B6A05ECD6B9CD05AB326AC1910ECEBF ] acsock C:\WINDOWS\system32\DRIVERS\acsock64.sys
17:31:40.0177 0x15e4 acsock - ok
17:31:40.0185 0x15e4 [ 68E7DEA59FDEF410BAF29FDB5B7A6EEF, B808FCF0C30B465A1330E47947B84FC722A3B4C46260E261C54B1EED725A288F ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
17:31:40.0194 0x15e4 AdobeARMservice - ok
17:31:40.0198 0x15e4 ADP80XX - ok
17:31:40.0201 0x15e4 AFD - ok
17:31:40.0204 0x15e4 ahcache - ok
17:31:40.0206 0x15e4 AJRouter - ok
17:31:40.0208 0x15e4 ALG - ok
17:31:40.0211 0x15e4 AmdK8 - ok
17:31:40.0213 0x15e4 AmdPPM - ok
17:31:40.0216 0x15e4 amdsata - ok
17:31:40.0218 0x15e4 amdsbs - ok
17:31:40.0221 0x15e4 amdxata - ok
17:31:40.0224 0x15e4 AppHostSvc - ok
17:31:40.0225 0x15e4 AppID - ok
17:31:40.0228 0x15e4 AppIDSvc - ok
17:31:40.0231 0x15e4 Appinfo - ok
17:31:40.0239 0x15e4 [ 3B3774C868868257533EC7E715BB6D53, 4AF1DADCEDBD80BE6EDEC696DF59E65B51D31E33F4C84413CA03C7BD959FF4E5 ] Apple Mobile Device Service C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
17:31:40.0248 0x15e4 Apple Mobile Device Service - ok
17:31:40.0251 0x15e4 applockerfltr - ok
17:31:40.0253 0x15e4 AppMgmt - ok
17:31:40.0256 0x15e4 AppReadiness - ok
17:31:40.0258 0x15e4 AppVClient - ok
17:31:40.0260 0x15e4 AppvStrm - ok
17:31:40.0263 0x15e4 AppvVemgr - ok
17:31:40.0265 0x15e4 AppvVfs - ok
17:31:40.0268 0x15e4 AppXSvc - ok
17:31:40.0270 0x15e4 arcsas - ok
17:31:40.0292 0x15e4 [ 5A994C4D363F865F7BC1727F93D37E8E, 1C6D7ACF9B4980CC68190FEA54B1C9FC65701AED1F27EFA84402307DC9239968 ] ArgusMonitor C:\WINDOWS\syswow64\drivers\ArgusMonitor.sys
17:31:40.0303 0x15e4 ArgusMonitor - ok
17:31:40.0321 0x15e4 [ FB03A917C1294D3E6D671F24722E1BA3, C4E2C236E5086F0A7D5E20E426EA7A86B4A38797610188C79151201AD27C0DF4 ] asComSvc C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe
17:31:40.0342 0x15e4 asComSvc - ok
17:31:40.0359 0x15e4 [ A63173897EA1A73A75D0E65036DE5B15, 07A83172B525DFC895056612F542420F4DF3C6192624C5B3141C726501163912 ] asHmComSvc C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe
17:31:40.0380 0x15e4 asHmComSvc - ok
17:31:40.0383 0x15e4 [ FEF9DD9EA587F8886ADE43C1BEFBDAFE, DDE6F28B3F7F2ABBEE59D4864435108791631E9CB4CDFB1F178E5AA9859956D8 ] AsIO C:\WINDOWS\syswow64\drivers\AsIO.sys
17:31:40.0390 0x15e4 AsIO - ok
17:31:40.0401 0x15e4 aspnet_state - ok
17:31:40.0404 0x15e4 AsyncMac - ok
17:31:40.0407 0x15e4 atapi - ok
17:31:40.0411 0x15e4 [ C34B28D6285EAD94B3A2FABA84E90DA5, 82E69CBDEB9B0D6A2056AE6227A21C4CDB3050B384D69FA879607F3363ABBFD1 ] AtherosSvc C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
17:31:40.0422 0x15e4 AtherosSvc - detected UnsignedFile.Multi.Generic ( 1 )
17:31:40.0463 0x15e4 Detect skipped due to KSN trusted
17:31:40.0463 0x15e4 AtherosSvc - ok
17:31:40.0471 0x15e4 [ FC0E8778C000291CAF60EB88C011E931, 09BCCA3DE01021AEF76DFB46F01D21BA6FF409E816FA7547E5C3DFBF3A615ED2 ] atksgt C:\WINDOWS\system32\DRIVERS\atksgt.sys
17:31:40.0484 0x15e4 atksgt - ok
17:31:40.0487 0x15e4 AudioEndpointBuilder - ok
17:31:40.0489 0x15e4 Audiosrv - ok
17:31:40.0492 0x15e4 AxInstSV - ok
17:31:40.0494 0x15e4 b06bdrv - ok
17:31:40.0496 0x15e4 BasicDisplay - ok
17:31:40.0499 0x15e4 BasicRender - ok
17:31:40.0502 0x15e4 bcmfn - ok
17:31:40.0506 0x15e4 bcmfn2 - ok
17:31:40.0508 0x15e4 BDESVC - ok
17:31:40.0510 0x15e4 Beep - ok
17:31:40.0512 0x15e4 BFE - ok
17:31:40.0514 0x15e4 BITS - ok
17:31:40.0525 0x15e4 [ B5C2F92EE1106DFE7BB1CCE4D35B6037, E399C390687589194D8AAD385055F0CFA7D52AD9E837D8FF95008B8EB2B34E50 ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
17:31:40.0538 0x15e4 Bonjour Service - ok
17:31:40.0541 0x15e4 bowser - ok
17:31:40.0544 0x15e4 BrokerInfrastructure - ok
17:31:40.0546 0x15e4 Browser - ok
17:31:40.0549 0x15e4 [ 2D0446336D9DB55A742B999EC16ADF15, FBF57CBDCFE4146176ABBD7ACF04240048403143DD380E10AE63B10BA5D4F311 ] BTATH_BUS C:\WINDOWS\System32\drivers\btath_bus.sys
17:31:40.0556 0x15e4 BTATH_BUS - ok
17:31:40.0559 0x15e4 BthAvrcpTg - ok
17:31:40.0561 0x15e4 BthHFEnum - ok
17:31:40.0563 0x15e4 bthhfhid - ok
17:31:40.0565 0x15e4 BthHFSrv - ok
17:31:40.0569 0x15e4 BTHMODEM - ok
17:31:40.0572 0x15e4 bthserv - ok
17:31:40.0575 0x15e4 buttonconverter - ok
17:31:40.0577 0x15e4 CapImg - ok
17:31:40.0579 0x15e4 cdfs - ok
17:31:40.0581 0x15e4 CDPSvc - ok
17:31:40.0585 0x15e4 CDPUserSvc - ok
17:31:40.0589 0x15e4 cdrom - ok
17:31:40.0592 0x15e4 CertPropSvc - ok
17:31:40.0594 0x15e4 cht4iscsi - ok
17:31:40.0596 0x15e4 cht4vbd - ok
17:31:40.0598 0x15e4 circlass - ok
17:31:40.0601 0x15e4 CLFS - ok
17:31:40.0603 0x15e4 ClipSVC - ok
17:31:40.0606 0x15e4 clreg - ok
17:31:40.0612 0x15e4 CmBatt - ok
17:31:40.0705 0x15e4 [ C206F35A1D0B32B6A65BE2B5D7049B84, BAFE47BE23CB99EE93FAA311B57222E0D7A2B086C0941691995AE3100C52ED6E ] cmdAgent C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
17:31:40.0805 0x15e4 cmdAgent - ok
17:31:40.0813 0x15e4 [ AEF3EA5CDE86309C77D76D2B297C5B78, FAF5CD2B6E7C9CBF57C9257A665AA58A77035243DB02F65B14CEB71DA3B386C4 ] cmderd C:\WINDOWS\system32\DRIVERS\cmderd.sys
17:31:40.0822 0x15e4 cmderd - ok
17:31:40.0838 0x15e4 [ 49A1E016F04231C735C5036E6C74952E, 0ABFAC8DC4962F75894B20C1129C84579DF920BE06694D7BD026698F94604F09 ] cmdGuard C:\WINDOWS\system32\DRIVERS\cmdguard.sys
17:31:40.0863 0x15e4 cmdGuard - ok
17:31:40.0866 0x15e4 [ 3F57B85DEBE2DAC2C6F8F8A3F7FDB963, 703DC27AB9C43AC5AC4A4F0A34FE54C85A9181C33CC905479516EF06277DD184 ] cmdHlp C:\WINDOWS\system32\DRIVERS\cmdhlp.sys
17:31:40.0876 0x15e4 cmdHlp - ok
17:31:40.0913 0x15e4 [ BB82B9D06353F78E4F1DDF04A25F1CC7, 55FD0B3C8187B65C75488B8D86A48E5C47B620AA6426786B28DD21BE9728A6AE ] cmdvirth C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe
17:31:40.0961 0x15e4 cmdvirth - ok
17:31:40.0964 0x15e4 CNG - ok
17:31:40.0966 0x15e4 cnghwassist - ok
17:31:40.0981 0x15e4 CompositeBus - ok
17:31:40.0983 0x15e4 COMSysApp - ok
17:31:40.0986 0x15e4 condrv - ok
17:31:40.0989 0x15e4 CoreMessagingRegistrar - ok
17:31:40.0993 0x15e4 [ C0EAD9F8AB83D41FF07303C75589C2B8, C89CAC39BCD2FA2DCC56D7EE84FF66127BCECCAE400E119FE41BF4C4D769504B ] Creative Audio Engine Licensing Service C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
17:31:41.0005 0x15e4 Creative Audio Engine Licensing Service - detected UnsignedFile.Multi.Generic ( 1 )
17:31:41.0047 0x15e4 Detect skipped due to KSN trusted
17:31:41.0047 0x15e4 Creative Audio Engine Licensing Service - ok
17:31:41.0050 0x15e4 CryptSvc - ok
17:31:41.0052 0x15e4 CSC - ok
17:31:41.0056 0x15e4 CscService - ok
17:31:41.0062 0x15e4 [ 6D8E4E90585A460EB0115C694BD3BB00, A014D8F4C254B1F7147A27D00A52561F3B7360EBDB4618BECCBCD7CC8649C8F8 ] CT20XUT C:\WINDOWS\system32\drivers\CT20XUT.SYS
17:31:41.0074 0x15e4 CT20XUT - ok
17:31:41.0081 0x15e4 [ 6D8E4E90585A460EB0115C694BD3BB00, A014D8F4C254B1F7147A27D00A52561F3B7360EBDB4618BECCBCD7CC8649C8F8 ] CT20XUT.SYS C:\WINDOWS\System32\drivers\CT20XUT.SYS
17:31:41.0091 0x15e4 CT20XUT.SYS - ok
17:31:41.0103 0x15e4 [ BC4677BC34C62F76FDE3A59141EB0C04, 9E135EC8A274BC5FBA7020F39583E6F47BA0F64D1326C9F8A73D96DAFE550AA8 ] ctac32k C:\WINDOWS\system32\drivers\ctac32k.sys
17:31:41.0122 0x15e4 ctac32k - ok
17:31:41.0135 0x15e4 [ DB679DCEF3D56B9BDF48851E4F8A9F23, 3182721F01A981C3A8EBF297690CB74CF6E3C94206D240E983F9B6317A4143D6 ] ctaud2k C:\WINDOWS\system32\drivers\ctaud2k.sys
17:31:41.0156 0x15e4 ctaud2k - ok
17:31:41.0164 0x15e4 [ 5CE3D0E1D1B3832EE052CFC442EEE0FA, 6B9DB2C350140ED547C7A96DB0EAD812E8987176B312C79AF52FC9B23EEEB8C4 ] CTAudSvcService C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
17:31:41.0177 0x15e4 CTAudSvcService - detected UnsignedFile.Multi.Generic ( 1 )
17:31:41.0219 0x15e4 Detect skipped due to KSN trusted
17:31:41.0219 0x15e4 CTAudSvcService - ok
17:31:41.0244 0x15e4 [ 74970AC366DEB6E1CA4DFB6A47CB8338, 083ACE4B457DCC8E191F430BF98F8D145B5135BB868FBE01644F3A7D5F8E8F1C ] CTEXFIFX C:\WINDOWS\system32\drivers\CTEXFIFX.SYS
17:31:41.0277 0x15e4 CTEXFIFX - ok
17:31:41.0302 0x15e4 [ 74970AC366DEB6E1CA4DFB6A47CB8338, 083ACE4B457DCC8E191F430BF98F8D145B5135BB868FBE01644F3A7D5F8E8F1C ] CTEXFIFX.SYS C:\WINDOWS\System32\drivers\CTEXFIFX.SYS
17:31:41.0331 0x15e4 CTEXFIFX.SYS - ok
17:31:41.0336 0x15e4 [ 3B858FEF65CAAB47E1B0E7457CF04248, C6B1B864F18B5E998470202C824AC534689515F37DDB3DF0CA81DE93DB65A3FA ] CTHWIUT C:\WINDOWS\system32\drivers\CTHWIUT.SYS
17:31:41.0345 0x15e4 CTHWIUT - ok
17:31:41.0349 0x15e4 [ 3B858FEF65CAAB47E1B0E7457CF04248, C6B1B864F18B5E998470202C824AC534689515F37DDB3DF0CA81DE93DB65A3FA ] CTHWIUT.SYS C:\WINDOWS\System32\drivers\CTHWIUT.SYS
17:31:41.0357 0x15e4 CTHWIUT.SYS - ok
17:31:41.0360 0x15e4 [ D77ED4CB7FE2CED09978676BFA17CBEC, B6712DF40BD32B61E3CC172E95DC6DCAB34138B416CE890B73D0F3FA280B8B73 ] ctprxy2k C:\WINDOWS\system32\drivers\ctprxy2k.sys
17:31:41.0368 0x15e4 ctprxy2k - ok
17:31:41.0374 0x15e4 [ 45A3CA3723B370E0B537284DE5550F5C, CBC882E2431E7C315A29BBC13F0C06BAF021C839AEB872144FA69F98F848EADF ] ctsfm2k C:\WINDOWS\system32\drivers\ctsfm2k.sys
17:31:41.0385 0x15e4 ctsfm2k - ok
17:31:41.0388 0x15e4 dam - ok
17:31:41.0392 0x15e4 DcomLaunch - ok
17:31:41.0394 0x15e4 DcpSvc - ok
17:31:41.0396 0x15e4 defragsvc - ok
17:31:41.0398 0x15e4 DeviceAssociationService - ok
17:31:41.0400 0x15e4 DeviceInstall - ok
17:31:41.0403 0x15e4 DevQueryBroker - ok
17:31:41.0406 0x15e4 Dfsc - ok
17:31:41.0409 0x15e4 Dhcp - ok
17:31:41.0412 0x15e4 diagnosticshub.standardcollector.service - ok
17:31:41.0414 0x15e4 DiagTrack - ok
17:31:41.0422 0x15e4 [ 2A312D761AE650B1BF1296733E872AAC, A05BB3B3BF2DA68599E593BB4367774A74141DE327092C77BCDA3C0F36C8D6AD ] DirMngr C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
17:31:41.0433 0x15e4 DirMngr - detected UnsignedFile.Multi.Generic ( 1 )
17:31:41.0475 0x15e4 Detect skipped due to KSN trusted
17:31:41.0475 0x15e4 DirMngr - ok
17:31:41.0478 0x15e4 disk - ok
17:31:41.0480 0x15e4 DmEnrollmentSvc - ok
17:31:41.0482 0x15e4 dmvsc - ok
17:31:41.0485 0x15e4 dmwappushservice - ok
17:31:41.0488 0x15e4 Dnscache - ok
17:31:41.0491 0x15e4 dot3svc - ok
17:31:41.0493 0x15e4 DPS - ok
17:31:41.0495 0x15e4 drmkaud - ok
17:31:41.0498 0x15e4 DsmSvc - ok
17:31:41.0500 0x15e4 DsSvc - ok
17:31:41.0505 0x15e4 [ 44BB65B1D3827043978FC8E11CA7C0B4, 9198D43F853DE25CB704CC208F41E649727356E122C7451C411DD49542A5A582 ] DTSAudioService C:\Program Files\Realtek\Audio\HDA\DTSAudioService64.exe
17:31:41.0515 0x15e4 DTSAudioService - ok
17:31:41.0517 0x15e4 DXGKrnl - ok
17:31:41.0520 0x15e4 EapHost - ok
17:31:41.0522 0x15e4 EasyAntiCheat - ok
17:31:41.0524 0x15e4 ebdrv - ok
17:31:41.0526 0x15e4 EFS - ok
17:31:41.0529 0x15e4 EhStorClass - ok
17:31:41.0532 0x15e4 EhStorTcgDrv - ok
17:31:41.0553 0x15e4 [ 903302B9F63CC4AC570329BAB79300FC, 5F8526349063DEA5A4D50284ADB358CFD17A5373148974F6A1E6DC2C305456B4 ] ElfoService C:\Program Files (x86)\ElsterFormular Update Service\bin\ElfoService.exe
17:31:41.0635 0x15e4 ElfoService - ok
17:31:41.0640 0x15e4 embeddedmode - ok
17:31:41.0644 0x15e4 [ C66FE7442B47F933084943BBA16FDB10, DE9BD12A44FD31842303A0D34BC0A300D6C13E523BB4BA23074739AE07E93DCE ] emupia C:\WINDOWS\system32\drivers\emupia2k.sys
17:31:41.0653 0x15e4 emupia - ok
17:31:41.0656 0x15e4 EntAppSvc - ok
17:31:41.0658 0x15e4 ErrDev - ok
17:31:41.0662 0x15e4 EventSystem - ok
17:31:41.0665 0x15e4 exfat - ok
17:31:41.0667 0x15e4 fastfat - ok
17:31:41.0670 0x15e4 Fax - ok
17:31:41.0673 0x15e4 fdc - ok
17:31:41.0675 0x15e4 fdPHost - ok
17:31:41.0677 0x15e4 FDResPub - ok
17:31:41.0679 0x15e4 fhsvc - ok
17:31:41.0682 0x15e4 FileCrypt - ok
17:31:41.0685 0x15e4 FileInfo - ok
17:31:41.0687 0x15e4 Filetrace - ok
17:31:41.0690 0x15e4 flpydisk - ok
17:31:41.0691 0x15e4 FltMgr - ok
17:31:41.0694 0x15e4 FontCache - ok
17:31:41.0697 0x15e4 FontCache3.0.0.0 - ok
17:31:41.0700 0x15e4 FrameServer - ok
17:31:41.0702 0x15e4 FsDepends - ok
17:31:41.0704 0x15e4 Fs_Rec - ok
17:31:41.0709 0x15e4 [ A33BCF3FAB19DB7D0B501036722F311B, F0356BCF6457E04214D9BAF7E77B3D1CDC53DF829FEF36EF59AB47A52E96DFAD ] Futuremark SystemInfo Service C:\Program Files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe
17:31:41.0760 0x15e4 Futuremark SystemInfo Service - ok
17:31:41.0763 0x15e4 fvevol - ok
17:31:41.0767 0x15e4 [ FFF0F0492B78CD0607D95E1819D05C4F, 5F6B6EE32BF62F394E02DB4BB00138B57FDCE02E73E63F1F3C623B85CDBE1072 ] GamingApp_Service C:\Program Files (x86)\MSI\Gaming APP\GamingApp_Service.exe
17:31:41.0774 0x15e4 GamingApp_Service - ok
17:31:41.0808 0x15e4 [ 4716347F3BE7BFE99DF197D1407E8966, 513CBE08992E172D7759442D272B5CF00411589BC601861AE71A9791B3A72EE0 ] GamingHotkey_Service C:\Program Files (x86)\MSI\Gaming APP\GamingHotkey_Service.exe
17:31:41.0846 0x15e4 GamingHotkey_Service - ok
17:31:41.0850 0x15e4 [ 8E98D21EE06192492A5671A6144D092F, B8F656B34D361EA5AFB47F3A67AB2221580DADA59C8CD0CB83181E4AD8B562B4 ] GEARAspiWDM C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
17:31:41.0858 0x15e4 GEARAspiWDM - ok
17:31:41.0861 0x15e4 gencounter - ok
17:31:41.0863 0x15e4 genericusbfn - ok
17:31:41.0864 0x15e4 GPCIDrv - ok
17:31:41.0867 0x15e4 GPIOClx0101 - ok
17:31:41.0869 0x15e4 gpsvc - ok
17:31:41.0872 0x15e4 GpuEnergyDrv - ok
17:31:41.0899 0x15e4 [ F48E1E9289B88B9EFA070E9FACFC8D26, AF93DD0A74ED299F849922889A7EC87A9E1E46EACDEE0B5368381667EDEB1181 ] ha20x2k C:\WINDOWS\system32\drivers\ha20x2k.sys
17:31:41.0936 0x15e4 ha20x2k - ok
17:31:41.0941 0x15e4 [ 1E6438D4EA6E1174A3B3B1EDC4DE660B, F9995CFEC7BBFE10B06EEE04CA6B49658275C43096E57747BFF9C2C31A0F9011 ] hamachi C:\WINDOWS\system32\DRIVERS\hamachi.sys
17:31:41.0950 0x15e4 hamachi - ok
17:31:41.0991 0x15e4 [ B1E3F445943F06E36DC079AF28D0F86B, 14A38DD6D46DA62796F08FC5C8D78DE1A9B687A7BC17321544AA090BFCDC2701 ] Hamachi2Svc C:\Program Files (x86)\Hamachi\hamachi-2.exe
17:31:42.0044 0x15e4 Hamachi2Svc - ok
17:31:42.0049 0x15e4 HDAudBus - ok
17:31:42.0052 0x15e4 HidBatt - ok
17:31:42.0056 0x15e4 HidBth - ok
17:31:42.0059 0x15e4 hidi2c - ok
17:31:42.0061 0x15e4 hidinterrupt - ok
17:31:42.0063 0x15e4 HidIr - ok
17:31:42.0066 0x15e4 hidserv - ok
17:31:42.0068 0x15e4 HidUsb - ok
17:31:42.0071 0x15e4 HomeGroupListener - ok
17:31:42.0073 0x15e4 HomeGroupProvider - ok
17:31:42.0076 0x15e4 HpSAMD - ok
17:31:42.0078 0x15e4 HTTP - ok
17:31:42.0080 0x15e4 HvHost - ok
17:31:42.0083 0x15e4 hvservice - ok
17:31:42.0085 0x15e4 hwpolicy - ok
17:31:42.0088 0x15e4 hyperkbd - ok
17:31:42.0091 0x15e4 [ 38C20EBB2621A86A5E9729EDA8F0F126, C362BF6523A16E4C9B040CD87511EF1E72788FB3B58F2FA23CD0A524CBD51140 ] I2cHkBurn C:\WINDOWS\system32\drivers\I2cHkBurn.sys
17:31:42.0099 0x15e4 I2cHkBurn - ok
17:31:42.0102 0x15e4 i8042prt - ok
17:31:42.0106 0x15e4 iagpio - ok
17:31:42.0108 0x15e4 iai2c - ok
17:31:42.0110 0x15e4 iaLPSS2i_GPIO2 - ok
17:31:42.0113 0x15e4 iaLPSS2i_I2C - ok
17:31:42.0115 0x15e4 iaLPSSi_GPIO - ok
17:31:42.0118 0x15e4 iaLPSSi_I2C - ok
17:31:42.0128 0x15e4 [ 2FDAEC4B02729C48C0FD1B0B4695995B, 87331D91FA3A23257B9913067B7B16D08710408070795B638058DBF728BBB288 ] iaStor C:\WINDOWS\system32\drivers\iaStor.sys
17:31:42.0145 0x15e4 iaStor - ok
17:31:42.0148 0x15e4 iaStorAV - ok
17:31:42.0151 0x15e4 [ D41861E56E7552C13674D7F147A02464, A361AE723FEEFD8D34D259F667ED14EEEC3B8ED6458522AC5D50C08E281B298B ] IAStorDataMgrSvc C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
17:31:42.0158 0x15e4 IAStorDataMgrSvc - ok
17:31:42.0160 0x15e4 iaStorV - ok
17:31:42.0163 0x15e4 ibbus - ok
17:31:42.0165 0x15e4 icssvc - ok
17:31:42.0169 0x15e4 [ DAF66902F08796F9C694901660E5A64A, F4A4764DED05980426BAB54AAF040BC27A39C80315F5161E8D0B4C7F694BD8E6 ] IDriverT C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
17:31:42.0221 0x15e4 IDriverT - detected UnsignedFile.Multi.Generic ( 1 )
17:31:42.0261 0x15e4 Detect skipped due to KSN trusted
17:31:42.0261 0x15e4 IDriverT - ok
17:31:42.0265 0x15e4 IEEtwCollectorService - ok
17:31:42.0267 0x15e4 IKEEXT - ok
17:31:42.0270 0x15e4 IndirectKmd - ok
17:31:42.0277 0x15e4 [ 5ED55AAAAADA751CD91BA453C1BCC0C5, 0772E0BAD247FC98071C965A954E7707909FDABF5EADA603E27CB1C1FA778A6F ] inspect C:\WINDOWS\system32\DRIVERS\inspect.sys
17:31:42.0288 0x15e4 inspect - ok
17:31:42.0338 0x15e4 [ 028E40182A6F0374978C755F85B9F07C, 747B5B4E56076A77C7936B71CE20FD413A1869ACF9E4218A1B8EF8D4E8C82A3B ] IntcAzAudAddService C:\WINDOWS\system32\drivers\RTKVHD64.sys
17:31:42.0400 0x15e4 IntcAzAudAddService - ok
17:31:42.0406 0x15e4 intelide - ok
17:31:42.0409 0x15e4 intelpep - ok
17:31:42.0411 0x15e4 intelppm - ok
17:31:42.0414 0x15e4 iorate - ok
17:31:42.0416 0x15e4 IpFilterDriver - ok
17:31:42.0418 0x15e4 iphlpsvc - ok
17:31:42.0421 0x15e4 IPMIDRV - ok
17:31:42.0423 0x15e4 IPNAT - ok
17:31:42.0435 0x15e4 [ EECB45F889E99174DA56FBDF37962D25, 12B407C45C9D0396FF3B5B118A863CBDEE0867034AE365F4CF5A8F66A4DB2003 ] iPod Service C:\Program Files\iPod\bin\iPodService.exe
17:31:42.0456 0x15e4 iPod Service - ok
17:31:42.0460 0x15e4 irda - ok
17:31:42.0462 0x15e4 IRENUM - ok
17:31:42.0465 0x15e4 irmon - ok
17:31:42.0467 0x15e4 isapnp - ok
17:31:42.0469 0x15e4 iScsiPrt - ok
17:31:42.0472 0x15e4 kbdclass - ok
17:31:42.0475 0x15e4 kbdhid - ok
17:31:42.0477 0x15e4 kdnic - ok
17:31:42.0479 0x15e4 KeyIso - ok
17:31:42.0482 0x15e4 KSecDD - ok
17:31:42.0484 0x15e4 KSecPkg - ok
17:31:42.0486 0x15e4 ksthunk - ok
17:31:42.0490 0x15e4 KtmRm - ok
17:31:42.0492 0x15e4 LanmanServer - ok
17:31:42.0495 0x15e4 LanmanWorkstation - ok
17:31:42.0498 0x15e4 lfsvc - ok
17:31:42.0500 0x15e4 LicenseManager - ok
17:31:42.0503 0x15e4 [ 156AB2E56DC3CA0B582E3362E07CDED7, 7B03929273861690DC42E4C686E655BE5A1C60136AE5E739D7E62306AFD4AB9A ] lirsgt C:\WINDOWS\system32\DRIVERS\lirsgt.sys
17:31:42.0512 0x15e4 lirsgt - ok
17:31:42.0514 0x15e4 lltdio - ok
17:31:42.0517 0x15e4 lltdsvc - ok
17:31:42.0519 0x15e4 lmhosts - ok
17:31:42.0523 0x15e4 LSI_SAS - ok
17:31:42.0525 0x15e4 LSI_SAS2i - ok
17:31:42.0528 0x15e4 LSI_SAS3i - ok
17:31:42.0530 0x15e4 LSI_SSS - ok
17:31:42.0532 0x15e4 LSM - ok
17:31:42.0535 0x15e4 luafv - ok
17:31:42.0538 0x15e4 MapsBroker - ok
17:31:42.0541 0x15e4 megasas - ok
17:31:42.0543 0x15e4 megasas2i - ok
17:31:42.0545 0x15e4 megasr - ok
17:31:42.0548 0x15e4 [ A6518DCC42F7A6E999BB3BEA8FD87567, 8A9AE992F93F37E0723761EA271A7E1AA8172702C471041A17324474FC96B9BC ] MEIx64 C:\WINDOWS\System32\drivers\HECIx64.sys
17:31:42.0556 0x15e4 MEIx64 - ok
17:31:42.0559 0x15e4 MessagingService - ok
17:31:42.0563 0x15e4 mlx4_bus - ok
17:31:42.0565 0x15e4 MMCSS - ok
17:31:42.0567 0x15e4 Modem - ok
17:31:42.0570 0x15e4 monitor - ok
17:31:42.0572 0x15e4 mouclass - ok
17:31:42.0575 0x15e4 mouhid - ok
17:31:42.0577 0x15e4 mountmgr - ok
17:31:42.0581 0x15e4 [ 17C3D8D5E65AE57B5E94B969433C0F99, 389F235A540CE1D55903F86C9045CAFC95B93E8EF0C3369D048D67B1106DE6E5 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
17:31:42.0596 0x15e4 MozillaMaintenance - ok
17:31:42.0599 0x15e4 mpsdrv - ok
17:31:42.0602 0x15e4 MpsSvc - ok
17:31:42.0604 0x15e4 MQAC - ok
17:31:42.0606 0x15e4 MRxDAV - ok
17:31:42.0609 0x15e4 mrxsmb - ok
17:31:42.0611 0x15e4 mrxsmb10 - ok
17:31:42.0613 0x15e4 mrxsmb20 - ok
17:31:42.0616 0x15e4 MsBridge - ok
17:31:42.0619 0x15e4 MSDTC - ok
17:31:42.0623 0x15e4 Msfs - ok
17:31:42.0626 0x15e4 msgpiowin32 - ok
17:31:42.0628 0x15e4 mshidkmdf - ok
17:31:42.0630 0x15e4 mshidumdf - ok
17:31:42.0632 0x15e4 MSICDSetup - ok
17:31:42.0637 0x15e4 [ 764362D808EC58BF2D072A3863D865EB, 6C3F385C61B3A8A214D13D5EDEAEF92B7A0C24EABA4C00FE5199B77FACE522A3 ] MSIREGISTER_MR C:\MSI\MSIRegister\MSIRegisterService.exe
17:31:42.0646 0x15e4 MSIREGISTER_MR - ok
17:31:42.0648 0x15e4 msisadrv - ok
17:31:42.0651 0x15e4 MSiSCSI - ok
17:31:42.0654 0x15e4 msiserver - ok
17:31:42.0658 0x15e4 [ 73907C500D91BD23651570CBA301CFA7, 853BDF0C79899D861890BF0BB7E445D025CE54963544DD565A18CE3A7AD69381 ] MSI_ActiveX_Service C:\Program Files (x86)\MSI\MSI OC Kit\ActiveX_Service\MSI_ActiveX_Service.exe
17:31:42.0665 0x15e4 MSI_ActiveX_Service - ok
17:31:42.0701 0x15e4 [ 0F410B80D02BF73AC5EB22D8422B4DE5, 3F2F19F01E5426B00B4E525C37DB69276E984EF5A7D0C116A59DA1498162D786 ] MSI_LiveUpdate_Service C:\Program Files (x86)\MSI\Live Update\MSI_LiveUpdate_Service.exe
17:31:42.0743 0x15e4 MSI_LiveUpdate_Service - ok
17:31:42.0747 0x15e4 MSKSSRV - ok
17:31:42.0750 0x15e4 MsLldp - ok
17:31:42.0752 0x15e4 MSMQ - ok
17:31:42.0754 0x15e4 MSPCLOCK - ok
17:31:42.0756 0x15e4 MSPQM - ok
17:31:42.0758 0x15e4 MsRPC - ok
17:31:42.0762 0x15e4 MsSecFlt - ok
17:31:42.0764 0x15e4 mssmbios - ok
17:31:42.0766 0x15e4 MSTEE - ok
17:31:42.0769 0x15e4 MTConfig - ok
17:31:42.0772 0x15e4 Mup - ok
17:31:42.0780 0x15e4 [ 38B4C95E821528FB91DF16A78E04450F, 8ADDF63088293923B497E1AFF86C189669B973F43153FEE2370EA32860D71AD7 ] mv91xx C:\WINDOWS\system32\drivers\mv91xx.sys
17:31:42.0791 0x15e4 mv91xx - ok
17:31:42.0794 0x15e4 mvumis - ok
17:31:42.0797 0x15e4 NativeWifiP - ok
17:31:42.0800 0x15e4 NcaSvc - ok
17:31:42.0802 0x15e4 NcbService - ok
17:31:42.0804 0x15e4 NcdAutoSetup - ok
17:31:42.0807 0x15e4 ndfltr - ok
17:31:42.0810 0x15e4 NDIS - ok
17:31:42.0812 0x15e4 NdisCap - ok
17:31:42.0815 0x15e4 NdisImPlatform - ok
17:31:42.0817 0x15e4 NdisTapi - ok
17:31:42.0819 0x15e4 Ndisuio - ok
17:31:42.0822 0x15e4 NdisVirtualBus - ok
17:31:42.0824 0x15e4 NdisWan - ok
17:31:42.0826 0x15e4 ndiswanlegacy - ok
17:31:42.0829 0x15e4 ndproxy - ok
17:31:42.0831 0x15e4 Ndu - ok
17:31:42.0834 0x15e4 NetAdapterCx - ok
17:31:42.0836 0x15e4 NetBIOS - ok
17:31:42.0840 0x15e4 NetBT - ok
17:31:42.0842 0x15e4 Netlogon - ok
17:31:42.0845 0x15e4 Netman - ok
17:31:42.0853 0x15e4 NetMsmqActivator - ok
17:31:42.0855 0x15e4 NetPipeActivator - ok
17:31:42.0859 0x15e4 netprofm - ok
17:31:42.0861 0x15e4 NetSetupSvc - ok
17:31:42.0863 0x15e4 NetTcpActivator - ok
17:31:42.0865 0x15e4 NetTcpPortSharing - ok
17:31:42.0870 0x15e4 NgcCtnrSvc - ok
17:31:42.0872 0x15e4 NgcSvc - ok
17:31:42.0875 0x15e4 NlaSvc - ok
17:31:42.0878 0x15e4 [ 351533ACC2A069B94E80BBFC177E8FDF, 54B2749E0496ECC94CE65657627762B485CBC825767BAEDDAD0D2598820FFB9E ] NPF C:\WINDOWS\system32\drivers\npf.sys
17:31:42.0888 0x15e4 NPF - ok
17:31:42.0891 0x15e4 Npfs - ok
17:31:42.0894 0x15e4 npsvctrig - ok
17:31:42.0896 0x15e4 nsi - ok
17:31:42.0898 0x15e4 nsiproxy - ok
17:31:42.0902 0x15e4 NTFS - ok
17:31:42.0903 0x15e4 NTIOLib_1_0_C - ok
17:31:42.0907 0x15e4 Null - ok
17:31:42.0915 0x15e4 [ 302A57479E9A2A95CE723521A7ED1BD0, CEF8E26DBCA2E840ED32378193127FDC321828D28941AE42C5AA800613A85E91 ] NVHDA C:\WINDOWS\system32\drivers\nvhda64v.sys
17:31:42.0927 0x15e4 NVHDA - ok
17:31:43.0170 0x15e4 [ E0854DA823FBC14F750BFD46E690F60F, BAACD13006B7EA377BC57CA502D342097E327486957F905DD720C870C1B4C67C ] nvlddmkm C:\WINDOWS\System32\DriverStore\FileRepository\nv_dispiwu.inf_amd64_b67dc924fff8de6d\nvlddmkm.sys
17:31:43.0423 0x15e4 nvlddmkm - ok
17:31:43.0436 0x15e4 nvraid - ok
17:31:43.0439 0x15e4 nvstor - ok
17:31:43.0442 0x15e4 [ F37FE6B15A987AEEC08EEF531F2FAED7, CC768E7DE80C7A8CB2392F9BC528212B8A3A35A30A222ED0B0B959051E6F8065 ] nvvad_WaveExtensible C:\WINDOWS\system32\drivers\nvvad64v.sys
17:31:43.0453 0x15e4 nvvad_WaveExtensible - ok
17:31:43.0463 0x15e4 [ 785F487A64950F3CB8E9F16253BA3B7B, 02445344BD214370A6D48B1CA04921D8EFCB13E676B5648266DD0E076C0822B6 ] odserv C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
17:31:43.0488 0x15e4 odserv - ok
17:31:43.0491 0x15e4 OneSyncSvc - ok
17:31:43.0528 0x15e4 [ AD851D818F399DD946A9C17AB2156F22, 4A541E7A3A3164581BFB9080DE0976E18F6DD00E39458EBBCBD3B2445708BEB5 ] Origin Client Service C:\Program Files (x86)\Origin\OriginClientService.exe
17:31:43.0636 0x15e4 Origin Client Service - ok
17:31:43.0672 0x15e4 [ 788363C87EBD90AC1EAD2DC5A9A40759, B565663B459414C5C9F81451D9A127D62CDF605BC2A9E686F74A2E4FD44A9B43 ] Origin Web Helper Service C:\Program Files (x86)\Origin\OriginWebHelperService.exe
17:31:43.0713 0x15e4 Origin Web Helper Service - ok
17:31:43.0719 0x15e4 [ 5A432A042DAE460ABE7199B758E8606C, 6E5D1F477D290905BE27CEBF9572BAC6B05FFEF2FAD901D3C8E11F665F8B9A71 ] ose C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
17:31:43.0734 0x15e4 ose - ok
17:31:43.0739 0x15e4 [ 0901EF0F25D269BD7FB18882D3B1AD34, 0719C716882F31D8BECE7CCA1ACDA63D7A989B6D7198E29EFB4D021354B84BD5 ] ossrv C:\WINDOWS\system32\drivers\ctoss2k.sys
17:31:43.0750 0x15e4 ossrv - ok
17:31:43.0754 0x15e4 p2pimsvc - ok
17:31:43.0757 0x15e4 p2psvc - ok
17:31:43.0759 0x15e4 Parport - ok
17:31:43.0762 0x15e4 partmgr - ok
17:31:43.0765 0x15e4 PcaSvc - ok
17:31:43.0767 0x15e4 pci - ok
17:31:43.0770 0x15e4 pciide - ok
17:31:43.0772 0x15e4 pcmcia - ok
17:31:43.0775 0x15e4 pcw - ok
17:31:43.0778 0x15e4 pdc - ok
17:31:43.0801 0x15e4 [ 20372BE109FEE1C37E2D5216680DB9EB, 2C3737FB3C6BCF81D0A7293667412DDEA649A8AEA40B7ADCFCB9893E8B3C4AF3 ] PDF Architect Helper Service C:\Program Files (x86)\PDF Architect\HelperService.exe
17:31:43.0828 0x15e4 PDF Architect Helper Service - ok
17:31:43.0845 0x15e4 [ B90A279073A815A4AA2C45A09EE004FA, 9EA27630C47F5FF99CBBE513C113F3ED01FABA0D59B9D9637764027BCC6EA24A ] PDF Architect Service C:\Program Files (x86)\PDF Architect\ConversionService.exe
17:31:43.0865 0x15e4 PDF Architect Service - ok
17:31:43.0868 0x15e4 PEAUTH - ok
17:31:43.0871 0x15e4 PeerDistSvc - ok
17:31:43.0874 0x15e4 percsas2i - ok
17:31:43.0877 0x15e4 percsas3i - ok
17:31:43.0895 0x15e4 PerfHost - ok
17:31:43.0902 0x15e4 PhoneSvc - ok
17:31:43.0904 0x15e4 PimIndexMaintenanceSvc - ok
17:31:43.0908 0x15e4 pla - ok
17:31:43.0911 0x15e4 PlugPlay - ok
17:31:43.0914 0x15e4 PnkBstrA - ok
17:31:43.0916 0x15e4 PNRPAutoReg - ok
17:31:43.0919 0x15e4 PNRPsvc - ok
17:31:43.0921 0x15e4 PolicyAgent - ok
17:31:43.0925 0x15e4 Power - ok
17:31:43.0928 0x15e4 PptpMiniport - ok
17:31:43.0994 0x15e4 [ 7196D3C2E2E3129814C8DAB91F9A7D1E, 6763E4BF8E846B597E78778E520F5BADC95608BAA4EA0AC84971384B5D976DD7 ] PrintNotify C:\WINDOWS\system32\spool\drivers\x64\3\PrintConfig.dll
17:31:44.0103 0x15e4 PrintNotify - ok
17:31:44.0108 0x15e4 Processor - ok
17:31:44.0112 0x15e4 ProfSvc - ok
17:31:44.0114 0x15e4 Psched - ok
17:31:44.0118 0x15e4 QWAVE - ok
17:31:44.0121 0x15e4 QWAVEdrv - ok
17:31:44.0124 0x15e4 RasAcd - ok
17:31:44.0127 0x15e4 RasAgileVpn - ok
17:31:44.0130 0x15e4 RasAuto - ok
17:31:44.0133 0x15e4 Rasl2tp - ok
17:31:44.0137 0x15e4 RasMan - ok
17:31:44.0140 0x15e4 RasPppoe - ok
17:31:44.0143 0x15e4 RasSstp - ok
17:31:44.0145 0x15e4 rdbss - ok
17:31:44.0150 0x15e4 rdpbus - ok
17:31:44.0153 0x15e4 RDPDR - ok
17:31:44.0159 0x15e4 RdpVideoMiniport - ok
17:31:44.0161 0x15e4 rdyboost - ok
17:31:44.0164 0x15e4 ReFSv1 - ok
17:31:44.0169 0x15e4 RemoteAccess - ok
17:31:44.0172 0x15e4 RemoteRegistry - ok
17:31:44.0176 0x15e4 RetailDemo - ok
17:31:44.0180 0x15e4 RmSvc - ok
17:31:44.0185 0x15e4 [ B60F58F175DE20A6739194E85B035178, 6E66D6041AF0B69896E4556F9FF3A3AA70CF4B09FFBE68E14E60313C5E3FFDDB ] rpcapd C:\Program Files (x86)\WinPcap\rpcapd.exe
17:31:44.0224 0x15e4 rpcapd - ok
17:31:44.0227 0x15e4 RpcEptMapper - ok
17:31:44.0230 0x15e4 RpcLocator - ok
17:31:44.0233 0x15e4 RpcSs - ok
17:31:44.0235 0x15e4 rspndr - ok
17:31:44.0238 0x15e4 rt640x64 - ok
17:31:44.0241 0x15e4 s3cap - ok
17:31:44.0244 0x15e4 SamSs - ok
17:31:44.0250 0x15e4 [ ECADB026023BF6E200A552E4EA700F47, 3BE40D99EF0229EC69E584D2351806F77A523EF362CC5094066DC4B9F7EB002A ] SbieDrv C:\Program Files\Sandboxie\SbieDrv.sys
17:31:44.0262 0x15e4 SbieDrv - ok
17:31:44.0268 0x15e4 [ 6E78D6CA33ECE9C7F0A7B0775198BA4D, 81F07C1D64FD66BFC0DC817045175EBA2096EC38D5D57584D114283DFA5899F4 ] SbieSvc C:\Program Files\Sandboxie\SbieSvc.exe
17:31:44.0278 0x15e4 SbieSvc - ok
17:31:44.0281 0x15e4 sbp2port - ok
17:31:44.0284 0x15e4 SCardSvr - ok
17:31:44.0287 0x15e4 ScDeviceEnum - ok
17:31:44.0290 0x15e4 scfilter - ok
17:31:44.0292 0x15e4 Schedule - ok
17:31:44.0498 0x15e4 scmbus - ok
17:31:44.0501 0x15e4 scmdisk0101 - ok
17:31:44.0504 0x15e4 SCPolicySvc - ok
17:31:44.0507 0x15e4 sdbus - ok
17:31:44.0510 0x15e4 SDRSVC - ok
17:31:44.0512 0x15e4 sdstor - ok
17:31:44.0515 0x15e4 seclogon - ok
17:31:44.0518 0x15e4 SENS - ok
17:31:44.0520 0x15e4 Sense - ok
17:31:44.0524 0x15e4 SensorDataService - ok
17:31:44.0528 0x15e4 SensorService - ok
17:31:44.0530 0x15e4 SensrSvc - ok
17:31:44.0533 0x15e4 SerCx - ok
17:31:44.0535 0x15e4 SerCx2 - ok
17:31:44.0539 0x15e4 Serenum - ok
17:31:44.0541 0x15e4 Serial - ok
17:31:44.0544 0x15e4 sermouse - ok
17:31:44.0551 0x15e4 SessionEnv - ok
17:31:44.0556 0x15e4 sfloppy - ok
17:31:44.0559 0x15e4 SharedAccess - ok
17:31:44.0562 0x15e4 ShellHWDetection - ok
17:31:44.0565 0x15e4 shpamsvc - ok
17:31:44.0568 0x15e4 SiSRaid2 - ok
17:31:44.0572 0x15e4 SiSRaid4 - ok
17:31:44.0808 0x15e4 smphost - ok
17:31:44.0812 0x15e4 SmsRouter - ok
17:31:44.0817 0x15e4 SNMPTRAP - ok
17:31:44.0821 0x15e4 [ 3BB48F7E33C2B76184DDF233000C09CD, D1AAE5B0425047CA0C2D376D3E59324D35A90DF9074CD442DFD0ED6E434D3C84 ] Sony SCSI Helper Service C:\Program Files (x86)\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe
17:31:44.0857 0x15e4 Sony SCSI Helper Service - detected UnsignedFile.Multi.Generic ( 1 )
17:31:44.0898 0x15e4 Detect skipped due to KSN trusted
17:31:44.0898 0x15e4 Sony SCSI Helper Service - ok
17:31:44.0901 0x15e4 spaceport - ok
17:31:44.0904 0x15e4 SpbCx - ok
17:31:44.0907 0x15e4 Spooler - ok
17:31:44.0910 0x15e4 sppsvc - ok
17:31:44.0913 0x15e4 srv - ok
17:31:44.0915 0x15e4 srv2 - ok
17:31:44.0918 0x15e4 srvnet - ok
17:31:44.0920 0x15e4 SSDPSRV - ok
17:31:44.0925 0x15e4 SstpSvc - ok
17:31:44.0928 0x15e4 StateRepository - ok
17:31:44.0955 0x15e4 [ 97CC32B472DC8AADD902DDD121B6E697, AA10E19CD0E3D9F26EEF6BC7D2ED7D8F94B13595495A5B0F277D53E5B26870F2 ] Steam Client Service C:\Program Files (x86)\Common Files\Steam\SteamService.exe
17:31:44.0985 0x15e4 Steam Client Service - ok
17:31:44.0990 0x15e4 stexstor - ok
17:31:44.0992 0x15e4 stisvc - ok
17:31:44.0995 0x15e4 storahci - ok
17:31:44.0997 0x15e4 storflt - ok
17:31:45.0000 0x15e4 stornvme - ok
17:31:45.0003 0x15e4 storqosflt - ok
17:31:45.0006 0x15e4 StorSvc - ok
17:31:45.0009 0x15e4 storufs - ok
17:31:45.0012 0x15e4 storvsc - ok
17:31:45.0014 0x15e4 svsvc - ok
17:31:45.0017 0x15e4 swenum - ok
17:31:45.0029 0x15e4 [ F577910A133A592234EBAAD3F3AFA258, 36F514740EE2D2B2F7ABFFFA13D575233EC4CE774EB58BF889C09930FEF1F443 ] SwitchBoard C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
17:31:45.0062 0x15e4 SwitchBoard - detected UnsignedFile.Multi.Generic ( 1 )
17:31:45.0104 0x15e4 Detect skipped due to KSN trusted
17:31:45.0104 0x15e4 SwitchBoard - ok
17:31:45.0107 0x15e4 swprv - ok
17:31:45.0110 0x15e4 Synth3dVsc - ok
17:31:45.0113 0x15e4 SysMain - ok
17:31:45.0115 0x15e4 SystemEventsBroker - ok
17:31:45.0119 0x15e4 TabletInputService - ok
17:31:45.0123 0x15e4 [ D0B07EED9DDEC5C69521C689B7BF455F, A9F1C76FBF833E25A8470116A9BB7F7121A86138B31B54C098F1E22C11109044 ] tap0901 C:\WINDOWS\system32\DRIVERS\tap0901.sys
17:31:45.0132 0x15e4 tap0901 - detected UnsignedFile.Multi.Generic ( 1 )
17:31:45.0187 0x15e4 Detect skipped due to KSN trusted
17:31:45.0187 0x15e4 tap0901 - ok
17:31:45.0191 0x15e4 [ F33FDC72298DF4BF9813A55D21F4EB31, 34AADF5115CA1B275FEF4238B420FE424F0E1D0FFD1606B24A0D594D7305CF1F ] taphss C:\WINDOWS\system32\DRIVERS\taphss.sys
17:31:45.0201 0x15e4 taphss - ok
17:31:45.0205 0x15e4 TapiSrv - ok
17:31:45.0207 0x15e4 Tcpip - ok
17:31:45.0210 0x15e4 Tcpip6 - ok
17:31:45.0215 0x15e4 tcpipreg - ok
17:31:45.0240 0x15e4 [ 99527D49EE0A96FC25537C61B270A372, 519E23F86EC86349F92C4A88DBD19C097AEE0A6E152776B32B45D293ED14946B ] tdrpman273 C:\WINDOWS\system32\DRIVERS\tdrpm273.sys
17:31:45.0272 0x15e4 tdrpman273 - ok
17:31:45.0276 0x15e4 tdx - ok
17:31:45.0446 0x15e4 [ 44449A0EB8EBD8DCBC3ED4BB62BA3A5F, 168197015D1E5ED71775250084C224A1100E0F989A6D1CC4102004E5AAD74F3A ] TeamViewer C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
17:31:45.0664 0x15e4 TeamViewer - ok
17:31:45.0674 0x15e4 terminpt - ok
17:31:45.0677 0x15e4 TermService - ok
17:31:45.0680 0x15e4 Themes - ok
17:31:45.0683 0x15e4 TieringEngineService - ok
17:31:45.0686 0x15e4 tiledatamodelsvc - ok
17:31:45.0689 0x15e4 TimeBrokerSvc - ok
17:31:45.0692 0x15e4 TPM - ok
17:31:45.0694 0x15e4 TrkWks - ok
17:31:45.0697 0x15e4 TrustedInstaller - ok
17:31:45.0701 0x15e4 tsusbflt - ok
17:31:45.0704 0x15e4 TsUsbGD - ok
17:31:45.0707 0x15e4 tsusbhub - ok
17:31:45.0710 0x15e4 tunnel - ok
17:31:45.0713 0x15e4 tzautoupdate - ok
17:31:45.0716 0x15e4 UASPStor - ok
17:31:45.0718 0x15e4 UcmCx0101 - ok
17:31:45.0721 0x15e4 UcmTcpciCx0101 - ok
17:31:45.0724 0x15e4 UcmUcsi - ok
17:31:45.0727 0x15e4 Ucx01000 - ok
17:31:45.0730 0x15e4 UdeCx - ok
17:31:45.0733 0x15e4 udfs - ok
17:31:45.0736 0x15e4 UEFI - ok
17:31:45.0738 0x15e4 UevAgentDriver - ok
17:31:45.0741 0x15e4 UevAgentService - ok
17:31:45.0745 0x15e4 Ufx01000 - ok
17:31:45.0748 0x15e4 UfxChipidea - ok
17:31:45.0751 0x15e4 ufxsynopsys - ok
17:31:45.0757 0x15e4 UI0Detect - ok
17:31:45.0760 0x15e4 umbus - ok
17:31:45.0763 0x15e4 UmPass - ok
17:31:45.0767 0x15e4 UmRdpService - ok
17:31:45.0770 0x15e4 UnistoreSvc - ok
17:31:45.0774 0x15e4 upnphost - ok
17:31:45.0777 0x15e4 UrsChipidea - ok
17:31:45.0780 0x15e4 UrsCx01000 - ok
17:31:45.0783 0x15e4 UrsSynopsys - ok
17:31:45.0786 0x15e4 [ F957092C63CD71D85903CA0D8370F473, 4DEC2FC20329F248135DA24CB6694FD972DCCE8B1BBEA8D872FDE41939E96AAF ] USBAAPL64 C:\WINDOWS\System32\Drivers\usbaapl64.sys
17:31:45.0807 0x15e4 USBAAPL64 - ok
17:31:45.0809 0x15e4 usbccgp - ok
17:31:45.0812 0x15e4 usbcir - ok
17:31:45.0815 0x15e4 usbehci - ok
17:31:45.0818 0x15e4 usbhub - ok
17:31:45.0820 0x15e4 USBHUB3 - ok
17:31:45.0823 0x15e4 usbohci - ok
17:31:45.0826 0x15e4 usbprint - ok
17:31:45.0830 0x15e4 [ 2EC7B2C8123236B1233A77281D378DF7, D97DB59C9CAE2B8B33C707E8CEA7A65BF88712842CC715D270F7432A99D21BB6 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys
17:31:45.0845 0x15e4 usbscan - ok
17:31:45.0848 0x15e4 usbser - ok
17:31:45.0851 0x15e4 USBSTOR - ok
17:31:45.0853 0x15e4 usbuhci - ok
17:31:45.0856 0x15e4 USBXHCI - ok
17:31:45.0860 0x15e4 UserDataSvc - ok
17:31:45.0864 0x15e4 UserManager - ok
17:31:45.0867 0x15e4 UsoSvc - ok
17:31:45.0869 0x15e4 VaultSvc - ok
17:31:45.0872 0x15e4 vdrvroot - ok
17:31:45.0875 0x15e4 vds - ok
17:31:45.0878 0x15e4 VerifierExt - ok
17:31:45.0881 0x15e4 vhdmp - ok
17:31:45.0883 0x15e4 vhf - ok
17:31:45.0886 0x15e4 vmbus - ok
17:31:45.0889 0x15e4 VMBusHID - ok
17:31:45.0892 0x15e4 vmgid - ok
17:31:45.0895 0x15e4 vmicguestinterface - ok
17:31:45.0897 0x15e4 vmicheartbeat - ok
17:31:45.0900 0x15e4 vmickvpexchange - ok
17:31:45.0903 0x15e4 vmicrdv - ok
17:31:45.0905 0x15e4 vmicshutdown - ok
17:31:45.0908 0x15e4 vmictimesync - ok
17:31:45.0911 0x15e4 vmicvmsession - ok
17:31:45.0914 0x15e4 vmicvss - ok
17:31:45.0917 0x15e4 volmgr - ok
17:31:45.0920 0x15e4 volmgrx - ok
17:31:45.0924 0x15e4 volsnap - ok
17:31:45.0927 0x15e4 volume - ok
17:31:45.0930 0x15e4 vpci - ok
17:31:45.0942 0x15e4 [ F3EC4EC08EC0C3F7023F0C662107CA7B, FC043142B4634E2AEA258690317B9892E8E1FDDF443846D6A2E4F4BDF2AD0056 ] vpnagent C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
17:31:45.0957 0x15e4 vpnagent - ok
17:31:45.0961 0x15e4 [ 0F42C39016F82F345C0F2DB2D5B90EB4, 2E957E72BB8D0293F61FA7385BA9400DF7759E1E3D35FE24F3877A6460988F4D ] vpnva C:\WINDOWS\System32\drivers\vpnva64-6.sys
17:31:45.0973 0x15e4 vpnva - ok
17:31:45.0976 0x15e4 vsmraid - ok
17:31:45.0979 0x15e4 VSS - ok
17:31:45.0982 0x15e4 VSTXRAID - ok
17:31:45.0985 0x15e4 vwifibus - ok
17:31:45.0988 0x15e4 vwififlt - ok
17:31:45.0991 0x15e4 W32Time - ok
17:31:45.0994 0x15e4 w3logsvc - ok
17:31:45.0996 0x15e4 WacomPen - ok
17:31:45.0999 0x15e4 WalletService - ok
17:31:46.0002 0x15e4 wanarp - ok
17:31:46.0005 0x15e4 wanarpv6 - ok
17:31:46.0008 0x15e4 WAS - ok
17:31:46.0011 0x15e4 wbengine - ok
17:31:46.0014 0x15e4 WbioSrvc - ok
17:31:46.0017 0x15e4 wcifs - ok
17:31:46.0020 0x15e4 Wcmsvc - ok
17:31:46.0025 0x15e4 wcncsvc - ok
17:31:46.0027 0x15e4 wcnfs - ok
17:31:46.0031 0x15e4 WdBoot - ok
17:31:46.0034 0x15e4 Wdf01000 - ok
17:31:46.0037 0x15e4 WdFilter - ok
17:31:46.0040 0x15e4 WdiServiceHost - ok
17:31:46.0043 0x15e4 WdiSystemHost - ok
17:31:46.0045 0x15e4 wdiwifi - ok
17:31:46.0048 0x15e4 WdNisDrv - ok
17:31:46.0050 0x15e4 WdNisSvc - ok
17:31:46.0054 0x15e4 WebClient - ok
17:31:46.0057 0x15e4 Wecsvc - ok
17:31:46.0060 0x15e4 WEPHOSTSVC - ok
17:31:46.0063 0x15e4 wercplsupport - ok
17:31:46.0065 0x15e4 WerSvc - ok
17:31:46.0068 0x15e4 WFPLWFS - ok
17:31:46.0072 0x15e4 WiaRpc - ok
17:31:46.0075 0x15e4 WIMMount - ok
17:31:46.0077 0x15e4 WinDefend - ok
17:31:46.0083 0x15e4 WindowsTrustedRT - ok
17:31:46.0086 0x15e4 WindowsTrustedRTProxy - ok
17:31:46.0089 0x15e4 WinHttpAutoProxySvc - ok
17:31:46.0092 0x15e4 WinMad - ok
17:31:46.0098 0x15e4 Winmgmt - ok
17:31:46.0101 0x15e4 WinRM - ok
17:31:46.0107 0x15e4 WINUSB - ok
17:31:46.0109 0x15e4 WinVerbs - ok
17:31:46.0112 0x15e4 wisvc - ok
17:31:46.0115 0x15e4 WlanSvc - ok
17:31:46.0118 0x15e4 wlidsvc - ok
17:31:46.0121 0x15e4 WmiAcpi - ok
17:31:46.0125 0x15e4 wmiApSrv - ok
17:31:46.0128 0x15e4 WMPNetworkSvc - ok
17:31:46.0131 0x15e4 Wof - ok
17:31:46.0136 0x15e4 workfolderssvc - ok
17:31:46.0141 0x15e4 WPDBusEnum - ok
17:31:46.0144 0x15e4 WpdUpFltr - ok
17:31:46.0147 0x15e4 WpnService - ok
17:31:46.0150 0x15e4 WpnUserService - ok
17:31:46.0155 0x15e4 ws2ifsl - ok
17:31:46.0159 0x15e4 wscsvc - ok
17:31:46.0161 0x15e4 WSearch - ok
17:31:46.0166 0x15e4 wuauserv - ok
17:31:46.0169 0x15e4 WudfPf - ok
17:31:46.0172 0x15e4 WUDFRd - ok
17:31:46.0175 0x15e4 wudfsvc - ok
17:31:46.0178 0x15e4 WUDFWpdFs - ok
17:31:46.0181 0x15e4 WUDFWpdMtp - ok
17:31:46.0185 0x15e4 WwanSvc - ok
17:31:46.0188 0x15e4 XblAuthManager - ok
17:31:46.0191 0x15e4 XblGameSave - ok
17:31:46.0194 0x15e4 xboxgip - ok
17:31:46.0197 0x15e4 XboxNetApiSvc - ok
17:31:46.0200 0x15e4 [ 65343781331B6AE59E01C4C337682DE4, 738D00277B9137BF3D7C427E41B7835AF41388CF6C04D494CA4525F96CF7F0CC ] xhunter1 C:\WINDOWS\xhunter1.sys
17:31:46.0210 0x15e4 xhunter1 - ok
17:31:46.0213 0x15e4 xinputhid - ok
17:31:46.0215 0x15e4 ================ Scan global ===============================
17:31:46.0225 0x15e4 [ Global ] - ok
17:31:46.0226 0x15e4 ================ Scan MBR ==================================
***** (alles ok)
17:31:46.0341 0x15e4 ================ Scan VBR ==================================
***** (alles ok)
17:31:46.0348 0x15e4 ================ Scan generic autorun ======================
17:31:46.0540 0x15e4 [ 8667556E9A094E935212693AD05098E3, 86732B42130EA18D3CA2B38A7120A2EFE7D52689ABD50AE59A6968316450111F ] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
17:31:46.0798 0x15e4 RTHDVCPL - ok
17:31:46.0882 0x15e4 [ 0BE126224273ACB0925C07B30A0E4209, CFFFCA6E70B1818438157209A99B573D06F8FC9F773F8EF3DE4A997A1992F25A ] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
17:31:46.0934 0x15e4 RtHDVBg_DTS - ok
17:31:46.0954 0x15e4 [ B73E8CF29007982C778D52319006C04F, BF26199F668A61F94EC8E4E5B67F244A40BE8A69FBFB9CF852CFB332EC9D5AAD ] C:\Program Files\Eraser\Eraser.exe
17:31:47.0021 0x15e4 Eraser - ok
17:31:47.0027 0x15e4 [ ADEA393B2B49EB25578702F4F5525E93, 8F0AB94BEA3751C566CBFF2F9A29495CCAC029DE3721107BBA892A418FD70581 ] C:\Program Files\iTunes\iTunesHelper.exe
17:31:47.0039 0x15e4 iTunesHelper - ok
17:31:47.0043 0x15e4 [ EBC0E8C0A4DDA2C32A7D5863462A321A, 2F410138DB66D0219254339F1F098E401CEDAA032596F1F67BC54F394256FC68 ] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe
17:31:47.0052 0x15e4 amd_dc_opt - detected UnsignedFile.Multi.Generic ( 1 )
17:31:47.0094 0x15e4 Detect skipped due to KSN trusted
17:31:47.0094 0x15e4 amd_dc_opt - ok
17:31:47.0113 0x15e4 OneDriveSetup - ok
17:31:47.0114 0x15e4 OneDriveSetup - ok
17:31:47.0240 0x15e4 [ 037EC5376C27B7C9EF04329D171CB0FE, 7D58366DD65600331FDD3291313D9FC7D0EDE6CB74C8E4C7A61C0BCFED75343D ] D:\Steam\steam.exe
17:31:47.0292 0x15e4 Steam - ok
17:31:47.0310 0x15e4 [ E97E971FB9FE4C0A72CB89B8063A4468, 5F45822818D90D3CDD97F6E705C309FD9161F7C55AAA6EFC44976F129D6B0D38 ] C:\Program Files\Sandboxie\SbieCtrl.exe
17:31:47.0337 0x15e4 SandboxieControl - ok
17:31:47.0338 0x15e4 Waiting for KSN requests completion. In queue: 80
17:31:48.0353 0x15e4 AV detected via SS2: COMODO Antivirus, C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe ( 8.4.0.5165 ), 0x61000 ( enabled : updated )
17:31:48.0356 0x15e4 AV detected via SS2: Windows Defender, C:\Program Files\Windows Defender\MSASCui.exe ( 4.10.14393.187 ), 0x60100 ( disabled : updated )
17:31:48.0357 0x15e4 FW detected via SS2: COMODO Firewall, C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe ( 8.4.0.5165 ), 0x61010 ( enabled )
17:31:48.0428 0x15e4 ============================================================
17:31:48.0428 0x15e4 Scan finished
17:31:48.0428 0x15e4 ============================================================
17:31:48.0434 0x09c4 Detected object count: 1
17:31:48.0434 0x09c4 Actual detected object count: 1
17:32:15.0456 0x09c4 slb ( UnsignedFile.Multi.Generic ) - skipped by user
17:32:15.0456 0x09c4 slb ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:32:17.0555 0x1704 Deinitialize success
|
|
22.02.2017, 10:57
| #11 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 10: mögliche Infektion durch USB-Stick (Manuel.doc/Forbix.A?) Ich würde dir dringend empfehlen, COMODO zu deinstallieren und nie wieder zu verwenden. Was die da mit den Alternate Data Streams treiben ist echt nicht mehr schön. Zudem wurde noch nie eine andere Firewall als die Windows-Firewall empfohlen, 3rd Pary Firewallsoftware die dirkt auf dem Windows-Rechner installiert wird ist immer kontraproduktiv und belastet das System. Wenn wir hier durch sind gibt es Empfehlungen zu besserer AV-Software.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
01.03.2017, 10:17
| #12 |
| | Windows 10: mögliche Infektion durch USB-Stick (Manuel.doc/Forbix.A?) Hallo cosinus, die Empfehlung habe ich zur Kenntnis genommen. Wie geht es nun weiter? |
|
01.03.2017, 10:29
| #13 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 10: mögliche Infektion durch USB-Stick (Manuel.doc/Forbix.A?) Adware/Junkware/Toolbars entfernen Alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop! Virenscanner jetzt vor dem Einsatz dieser Tools bitte komplett deaktivieren! 1. Schritt: adwCleaner Downloade Dir bitte  AdwCleaner auf deinen Desktop.
2. Schritt: JRT - Junkware Removal Tool Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
01.03.2017, 11:26
| #14 |
| | Windows 10: mögliche Infektion durch USB-Stick (Manuel.doc/Forbix.A?) adwCleaner-Log: Code:
ATTFilter # AdwCleaner v6.043 - Bericht erstellt am 01/03/2017 um 11:13:04
# Aktualisiert am 27/01/2017 von Malwarebytes
# Datenbank : 2017-02-28.2 [Lokal]
# Betriebssystem : Windows 10 Pro (X64)
# Benutzername : *****
# Gestartet von : C:\Users\*****\Desktop\AdwCleaner_6.043.exe
# Modus: Löschen
# Unterstützung : https://www.malwarebytes.com/support
***** [ Dienste ] *****
***** [ Ordner ] *****
[-] Ordner gelöscht: C:\Users\*****\AppData\Local\28050
***** [ Dateien ] *****
[-] Datei gelöscht: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\*****.default\foxydeal.sqlite
***** [ DLL ] *****
***** [ WMI ] *****
***** [ Verknüpfungen ] *****
***** [ Aufgabenplanung ] *****
***** [ Registrierungsdatenbank ] *****
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\CLSID\{25A3A431-30BB-47C8-AD6A-E1063801134F}
[-] Schlüssel gelöscht: HKLM\SOFTWARE\Classes\TypeLib\{E69D4A59-73DE-4E38-9FB3-740EC4D9060D}
[-] Schlüssel gelöscht: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25A3A431-30BB-47C8-AD6A-E1063801134F}
[-] Schlüssel gelöscht: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
[-] Schlüssel gelöscht: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{25A3A431-30BB-47C8-AD6A-E1063801134F}
[-] Schlüssel gelöscht: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
[-] Wert gelöscht: HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{25A3A431-30BB-47C8-AD6A-E1063801134F}]
[-] Schlüssel gelöscht: HKU\S-1-5-21-2015921152-1024863377-2374061687-1000\Software\Conduit
[-] Schlüssel gelöscht: HKU\S-1-5-21-2015921152-1024863377-2374061687-1000\Software\YahooPartnerToolbar
[#] Schlüssel mit Neustart gelöscht: HKCU\Software\Conduit
[#] Schlüssel mit Neustart gelöscht: HKCU\Software\YahooPartnerToolbar
[#] Schlüssel mit Neustart gelöscht: [x64] HKCU\Software\Conduit
[#] Schlüssel mit Neustart gelöscht: [x64] HKCU\Software\YahooPartnerToolbar
[-] Schlüssel gelöscht: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\castplatform.com
[-] Schlüssel gelöscht: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\cdn.castplatform.com
[#] Schlüssel mit Neustart gelöscht: [x64] HKCU\Software\Microsoft\Internet Explorer\DOMStorage\castplatform.com
[#] Schlüssel mit Neustart gelöscht: [x64] HKCU\Software\Microsoft\Internet Explorer\DOMStorage\cdn.castplatform.com
***** [ Browser ] *****
[-] Firefox Einstellungen bereinigt: "extensions.browserprotect.searchProviderExceptions" - "hxxp://en.wikipedia.org/wiki/Special:Search;hxxp://search.yahoo.com/search;hxxp://www.amazon.com/exec/obidos/external-search/;hxxp://www.answers.com/main/ntquery;hxxp://search.creativecommons.org/;hxxp://rover.ebay.com/rover/1/711-47294-18009-3/4;hxxp://www.google.com/search;hxxp://www.youtube.com/*;hxxps://encrypted.google.com/search;hxxp://www.bing.com/search?q={searchTerms}&form=OSDSRC;hxxp://www.ask.com/web?q={searchTerms}&qsrc=145&o=ffx;hxxp://addon.100searchengines.com/texis/open/search?q={searchTerms};hxxp://www.imdb.com/find?q={searchTerms};hxxp://qrobe.it/search/?q={searchTerms};hxxp://www.google.com/search;hxxp://www.google.com/search"
*************************
:: "Tracing" Schlüssel gelöscht
:: Winsock Einstellungen zurückgesetzt
:: Proxy Einstellungen zurückgesetzt
:: Internet Explorer Richtlinien gelöscht
:: Chrome Richtlinien gelöscht
*************************
C:\AdwCleaner\AdwCleaner[C0].txt - [3544 Bytes] - [01/03/2017 11:13:04]
C:\AdwCleaner\AdwCleaner[S0].txt - [3209 Bytes] - [01/03/2017 11:12:36]
########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [3836 Bytes] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.1 (02.11.2017)
Operating System: Windows 10 Pro x64
Ran by ***** on 01.03.2017 at 11:15:34,63
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
File System: 3
Successfully deleted: C:\Users\*****\AppData\Roaming\pdfforge (Folder)
Successfully deleted: C:\Users\*****\AppData\Roaming\system (Folder)
Successfully deleted: C:\Users\*****\AppData\Roaming\wyupdate au (Folder)
Registry: 4
Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\Main\\Start Page (Registry Value)
Successfully deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3A2D5EBA-F86D-4BD3-A177-019765996711} (Registry Key)
Successfully deleted: HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3A2D5EBA-F86D-4BD3-A177-019765996711} (Registry Key)
Successfully deleted: HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page (Registry Value)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 01.03.2017 at 11:21:00,32
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
01.03.2017, 11:29
| #15 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 10: mögliche Infektion durch USB-Stick (Manuel.doc/Forbix.A?) Wir haben leider noch ne ältere Anleitung vom adwCleaner, bitte nochmal ausführen und so einstellen: 
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu Windows 10: mögliche Infektion durch USB-Stick (Manuel.doc/Forbix.A?) |
| .dll, administrator, adobe, backdoor, blockiert, bonjour, converter, defender, desktop, explorer, firefox, internet, launch, mozilla, nvidia, prozesse, realtek, registry, scan, security, services.exe, sicherheit, software, system, ublock, ublock origin, windows, wurm |
Linear-Darstellung
