Hallo,

habe mir heute anscheinend den Websearch Virus eingefangen. Ich habe schon Malwarebyte (Logdatei anbei) und Adware Cleaner (finde keine Log Datei) laufen lassen, habe aber kein gutes Gefühl. Könnt ihr euch das bitte einmal anschauen und überprüfen.

Da offensichtlich meine Logs zuviele Zeichen enthalten, wurde ich aufgefordert, diese als Archiv anzuhängen.

Vielen Dank und LG
Manuela

Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.
Ich kann auf Arbeit keine Anhänge öffnen, danke.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

• Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
• Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
• Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
• Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Hallo,

sry... musste das FRST jetzt auch teilen, weil für ein Post zu lange... also hier:

Teil 1

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-06-2014
Ran by Manuela (administrator) on ELA2014 on 04-06-2014 15:24:33
Running from H:\MyOwnDATA\Downloads
Platform: Windows 8.1 (Update 1) (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\NETGEAR\WNDA4100\Service\RaRegistry.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\NETGEAR\WNDA4100\Service\RaRegistry64.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe
(NETGEAR) C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20498_x64__8wekyb3d8bbwe\livecomm.exe
(Microsoft Corporation) C:\Windows\SysWOW64\WWAHost.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6548112 2012-06-14] (Realtek Semiconductor)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-12-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Nikon Message Center 2] => C:\Program Files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe [571392 2011-10-30] (Nikon Corporation)
HKU\S-1-5-21-2466271035-3364438158-1365813384-1001\...\Run: [HydraVisionDesktopManager] => C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [389120 2013-12-06] (AMD)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NETGEAR WNDA4100 Genie.lnk
ShortcutTarget: NETGEAR WNDA4100 Genie.lnk -> C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE (NETGEAR)
Startup: C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-AT
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.at.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xE6FEE80D076ACF01
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=protegere
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Tcpip\Parameters: [DhcpNameServer] 195.34.133.21 212.186.211.21

FireFox:
========
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.4 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 - H:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions:  - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: 卡巴斯基網址顧問 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com [2014-05-07]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: 虛擬鍵盤 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-05-07]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: 惡意網站攔截器 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com [2014-05-07]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Chặn quảng cáo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com [2014-05-07]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com [2014-05-07]

Chrome: 
=======
CHR HomePage: https://www.google.at/
CHR StartupUrls: "https://www.google.at/"
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\gcswf32.dll No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll No File
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Extension: (YouTube) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-07]
CHR Extension: (Adblock Plus) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-05-07]
CHR Extension: (Anna Sui) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjohejgigkmiclpgnilojffhiohcglib [2014-06-04]
CHR Extension: (Google-Suche) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-07]
CHR Extension: (Clear Cache) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\cppjkneekbjaeellbfkmgnhonkkjfpdn [2014-05-07]
CHR Extension: (Modul zur Link-Untersuchung) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj [2014-05-07]
CHR Extension: (Sicherer Zahlungsverkehr) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh [2014-05-07]
CHR Extension: (SearchPreview) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\hcjdanpjacpeeppdjkppebobilhaglfo [2014-05-07]
CHR Extension: (Modul zum Sperren von gefährlichen Webseiten) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\hghkgaeecgjhjkannahfamoehjmkjail [2014-05-07]
CHR Extension: (Chrome to Mobile) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\idknbmbdnapjicclomlijcgfpikmndhd [2014-05-07]
CHR Extension: (Virtual Keyboard) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh [2014-05-07]
CHR Extension: (Google Wallet) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-07]
CHR Extension: (Google Mail) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-07]
CHR Extension: (Anti-Banner) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman [2014-05-07]
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\urladvisor.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\online_banking_chrome.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\content_blocker_chrome.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\ab.crx [2013-10-17]

==================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-12-06] (Advanced Micro Devices, Inc.)
R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2013-10-17] (Kaspersky Lab ZAO)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 RalinkRegistryWriter; C:\Program Files (x86)\NETGEAR\WNDA4100\Service\RaRegistry.exe [377088 2012-09-04] (Ralink Technology, Corp.)
R2 RalinkRegistryWriter64; C:\Program Files (x86)\NETGEAR\WNDA4100\Service\RaRegistry64.exe [455424 2012-09-04] (Ralink Technology, Corp.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

S0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra)
S0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [21160 2012-09-23] (Advanced Micro Devices, Inc.)
R2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59648 2013-09-19] (Advanced Micro Devices)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [222720 2013-09-24] (Advanced Micro Devices)
S3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-13] (Windows (R) Win 7 DDK provider)
S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 hitmanpro37; C:\Windows\system32\drivers\hitmanpro37.sys [32512 2014-06-04] ()
S3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation)
S3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation)
S0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-10] (Intel Corporation)
R0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2014-03-18] (Microsoft Corporation)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2014-05-07] (Kaspersky Lab ZAO)
S0 klelam; C:\Windows\System32\DRIVERS\klelam.sys [29792 2014-05-07] (Kaspersky Lab)
U5 klflt; C:\Windows\System32\Drivers\klflt.sys [115296 2014-05-07] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [625760 2014-05-07] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\system32\DRIVERS\klim6.sys [30304 2013-10-17] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\system32\DRIVERS\klkbdflt.sys [29280 2014-05-07] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\system32\DRIVERS\klmouflt.sys [29280 2013-10-17] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\system32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 klwfp; C:\Windows\system32\DRIVERS\klwfp.sys [65120 2014-05-07] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\system32\DRIVERS\kneps.sys [178272 2014-05-07] (Kaspersky Lab ZAO)
S0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-06-04] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2014-05-12] (Malwarebytes Corporation)
R3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation)
S3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation)
S3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924504 2014-03-18] (Microsoft Corporation)
S3 RtlWlanu; C:\Windows\system32\DRIVERS\rtwlanu.sys [1975000 2013-07-31] (Realtek Semiconductor Corporation                           )
S3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2014-03-18] (Microsoft Corporation)
S0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2014-03-18] (Microsoft Corporation)
S3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation)
S3 usbrndis6; C:\Windows\system32\DRIVERS\usb80236.sys [20992 2013-08-22] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation)
R0 Wof; C:\Windows\System32\Drivers\Wof.sys [157016 2014-03-13] (Microsoft Corporation)
S3 NPF; \SystemRoot\system32\DRIVERS\npf.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-04 15:16 - 2014-06-04 15:24 - 00000000 ____D () C:\FRST
2014-06-04 15:15 - 2014-06-04 15:15 - 00000000 _____ () C:\Users\Manuela\defogger_reenable
2014-06-04 15:01 - 2014-06-04 15:01 - 00032512 _____ () C:\Windows\system32\Drivers\hitmanpro37.sys
2014-06-04 15:01 - 2014-06-04 15:01 - 00000426 _____ () C:\Windows\system32\.crusader
2014-06-04 14:58 - 2014-06-04 15:01 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-06-04 14:56 - 2014-06-04 14:56 - 00000616 _____ () C:\Users\Manuela\Desktop\JRT.txt
2014-06-04 14:48 - 2014-06-04 14:48 - 00000000 ____D () C:\Windows\ERUNT
2014-06-04 14:41 - 2014-06-04 14:41 - 00000000 ____D () C:\AdwCleaner
2014-06-04 14:11 - 2014-06-04 15:09 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-04 14:10 - 2014-06-04 14:10 - 00001121 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-04 14:10 - 2014-06-04 14:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-04 14:10 - 2014-06-04 14:10 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-04 14:10 - 2014-06-04 14:10 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-06-04 14:10 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-06-04 14:10 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-06-04 14:10 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-06-04 11:20 - 2014-06-04 11:20 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Xilisoft
2014-05-27 13:46 - 2014-05-27 13:46 - 00000000 ____D () C:\Windows\LastGood.Tmp
2014-05-27 13:45 - 2013-07-26 09:07 - 00827096 _____ (Realtek ) C:\Windows\system32\Drivers\Rt630x64.sys
2014-05-27 13:45 - 2013-07-26 09:07 - 00074456 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RtNicProp64.dll
2014-05-27 11:54 - 2014-05-27 11:54 - 00002086 _____ () C:\Users\Public\Desktop\NETGEAR WNDA4100 Genie.lnk
2014-05-27 11:54 - 2014-05-27 11:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NETGEAR WNDA4100 Genie
2014-05-27 11:54 - 2014-05-27 11:54 - 00000000 ____D () C:\Program Files (x86)\NETGEAR
2014-05-27 11:54 - 2014-05-27 11:54 - 00000000 ____D () C:\Program Files (x86)\Cisco
2014-05-27 11:54 - 2012-09-04 13:34 - 02403392 _____ (Ralink Technology, Corp.) C:\Windows\system32\RaCertMgr.dll
2014-05-27 11:54 - 2012-09-04 13:34 - 01121856 _____ (Ralink Technology, Corp.) C:\Windows\system32\RaIHV.dll
2014-05-27 11:54 - 2012-09-04 13:34 - 00128864 _____ (Ralink Technology, Corp.) C:\Windows\system32\RaExtUI.dll
2014-05-27 11:31 - 2014-05-27 11:33 - 00000000 ____D () C:\Users\Manuela\Desktop\ReportMaker
2014-05-26 11:11 - 2014-05-26 11:11 - 00000000 ____D () C:\Users\Manuela\AppData\Local\NETGEAR
2014-05-26 11:11 - 2014-05-26 11:11 - 00000000 ____D () C:\ProgramData\NETGEAR
2014-05-26 11:11 - 2012-10-22 14:50 - 00008192 _____ () C:\Windows\system32\Drivers\rt2870.bin
2014-05-15 10:37 - 2014-06-04 15:09 - 00000000 __RDO () C:\Users\Manuela\OneDrive
2014-05-15 09:41 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-15 09:41 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-15 09:41 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-15 09:41 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-15 09:41 - 2014-04-11 12:03 - 00555736 _____ (Microsoft Corporation) C:\Windows\system32\twinapi.appcore.dll
2014-05-15 09:41 - 2014-04-11 12:03 - 00054776 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-05-15 09:41 - 2014-04-11 10:25 - 00419928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinapi.appcore.dll
2014-05-15 09:41 - 2014-04-11 08:04 - 00056320 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-05-15 09:41 - 2014-04-11 07:53 - 00079872 _____ (Microsoft Corporation) C:\Windows\system32\WSReset.exe
2014-05-15 09:41 - 2014-04-11 07:22 - 00025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-05-15 09:41 - 2014-04-11 05:54 - 00201728 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2014-05-15 09:41 - 2014-04-11 05:36 - 11792384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2014-05-15 09:41 - 2014-04-11 05:24 - 13288960 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
2014-05-15 09:41 - 2014-04-11 05:06 - 00031232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-05-15 09:41 - 2014-04-11 05:05 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-05-15 09:41 - 2014-04-11 05:05 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-05-15 09:41 - 2014-04-11 05:02 - 00249344 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-05-15 09:41 - 2014-04-11 05:02 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-05-15 09:41 - 2014-04-11 05:01 - 00137728 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-05-15 09:41 - 2014-04-11 05:00 - 00080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-05-15 09:41 - 2014-04-11 04:59 - 00666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-05-15 09:41 - 2014-04-11 04:57 - 00190976 _____ (Microsoft Corporation) C:\Windows\system32\storewuauth.dll
2014-05-15 09:41 - 2014-04-11 04:56 - 00381440 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll
2014-05-15 09:41 - 2014-04-11 04:55 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-05-15 09:41 - 2014-04-11 04:53 - 00827392 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-05-15 09:41 - 2014-04-11 04:52 - 03464192 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-05-15 09:41 - 2014-04-11 04:46 - 01705472 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-05-15 09:41 - 2014-04-11 04:36 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.appcore.dll
2014-05-15 09:41 - 2014-04-11 04:34 - 00754688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-05-15 09:41 - 2014-04-11 04:29 - 01054208 _____ (Microsoft Corporation) C:\Windows\system32\twinui.appcore.dll
2014-05-15 09:41 - 2014-04-11 04:25 - 00921088 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-05-15 09:41 - 2014-04-09 00:46 - 00086688 _____ (Microsoft Corporation) C:\Windows\system32\mrt_map.dll
2014-05-15 09:41 - 2014-04-09 00:46 - 00028320 _____ (Microsoft Corporation) C:\Windows\system32\mrt100.dll
2014-05-15 09:41 - 2014-04-08 20:54 - 00080032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mrt_map.dll
2014-05-15 09:41 - 2014-04-08 20:54 - 00026784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mrt100.dll
2014-05-15 09:41 - 2014-03-27 11:12 - 21225584 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-15 09:41 - 2014-03-27 09:48 - 18679728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-15 09:41 - 2014-03-24 04:30 - 00257880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdFilter.sys
2014-05-15 09:41 - 2014-03-24 04:30 - 00123224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdNisDrv.sys
2014-05-15 09:41 - 2014-03-24 04:27 - 00035856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdBoot.sys
2014-05-15 09:41 - 2014-03-13 09:42 - 00308224 _____ (Microsoft Corporation) C:\Windows\system32\wusa.exe
2014-05-15 09:41 - 2014-03-13 08:51 - 00305152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wusa.exe
2014-05-13 18:46 - 2014-05-13 18:46 - 00000965 _____ () C:\Users\Public\Desktop\World of Warcraft.lnk
2014-05-13 18:46 - 2014-05-13 18:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft
2014-05-13 18:36 - 2014-05-13 20:19 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Battle.net
2014-05-13 18:36 - 2014-05-13 18:58 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Battle.net
2014-05-13 18:36 - 2014-05-13 18:36 - 00000841 _____ () C:\Users\Public\Desktop\Battle.net.lnk
2014-05-13 18:36 - 2014-05-13 18:36 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Blizzard Entertainment
2014-05-13 18:36 - 2014-05-13 18:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net
2014-05-13 18:36 - 2014-05-13 18:36 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment
2014-05-13 18:34 - 2014-05-13 18:34 - 00000000 ____D () C:\ProgramData\Battle.net
2014-05-11 13:04 - 2014-05-12 01:02 - 00000000 ____D () C:\Users\Manuela\AppData\Local\PasswordSafe
2014-05-11 13:01 - 2014-05-11 13:01 - 00001049 _____ () C:\Users\Manuela\Desktop\Password Safe.lnk
2014-05-11 13:01 - 2014-05-11 13:01 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Password Safe
2014-05-11 13:01 - 2014-05-11 13:01 - 00000000 ____D () C:\Program Files (x86)\Password Safe
2014-05-11 11:30 - 2014-06-04 11:19 - 00000000 ____D () C:\Program Files (x86)\MSECache
2014-05-09 16:18 - 2014-05-09 16:18 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Awesomium
2014-05-09 15:45 - 2014-05-09 15:45 - 00000000 ____D () C:\ProgramData\Elder Scrolls Online
2014-05-09 14:44 - 2014-05-09 14:44 - 00001060 _____ () C:\Users\Manuela\Desktop\The Elder Scrolls Online.lnk
2014-05-09 14:44 - 2014-05-09 14:44 - 00000000 ____D () C:\Windows\jre
2014-05-09 14:44 - 2014-05-09 14:44 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\The Elder Scrolls Online
2014-05-09 14:01 - 2014-05-09 14:44 - 00000000 ___HD () C:\Program Files (x86)\Zero G Registry
2014-05-09 13:59 - 2014-05-09 13:59 - 00000000 ___HD () C:\Users\Manuela\InstallAnywhere
2014-05-09 13:41 - 2014-05-09 13:41 - 00000890 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2014-05-09 13:41 - 2014-05-09 13:41 - 00000000 ____D () C:\Program Files\VideoLAN
2014-05-09 09:51 - 2014-05-26 17:41 - 00000000 ____D () C:\ProgramData\Nikon
2014-05-08 19:20 - 2014-05-08 19:20 - 00001301 _____ () C:\Users\Public\Desktop\FINAL FANTASY XIV - A Realm Reborn.lnk
2014-05-08 18:59 - 2014-05-08 18:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SQUARE ENIX
2014-05-08 18:57 - 2014-05-08 18:57 - 00000000 ____D () C:\Windows\SysWOW64\XPSViewer
2014-05-08 18:57 - 2014-05-08 18:57 - 00000000 ____D () C:\Program Files\Reference Assemblies
2014-05-08 18:57 - 2014-05-08 18:57 - 00000000 ____D () C:\Program Files\MSBuild
2014-05-08 18:57 - 2014-05-08 18:57 - 00000000 ____D () C:\Program Files (x86)\Reference Assemblies
2014-05-08 18:57 - 2014-05-08 18:57 - 00000000 ____D () C:\Program Files (x86)\MSBuild
2014-05-08 18:56 - 2014-05-08 18:56 - 00010085 _____ () C:\Windows\DirectX.log
2014-05-08 18:56 - 2013-08-03 06:48 - 01166520 _____ (Microsoft Corporation) C:\Windows\system32\PresentationNative_v0300.dll
2014-05-08 18:56 - 2013-08-03 06:48 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2014-05-08 18:56 - 2013-08-03 06:48 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-05-08 18:56 - 2013-08-03 06:41 - 00778936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationNative_v0300.dll
2014-05-08 18:56 - 2013-08-03 06:41 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2014-05-08 18:56 - 2013-08-03 06:41 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-05-08 18:56 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll
2014-05-08 18:56 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2014-05-08 18:56 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll
2014-05-08 18:56 - 2010-06-02 04:55 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_7.dll
2014-05-08 18:56 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2014-05-08 18:56 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll
2014-05-08 18:56 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2014-05-08 18:56 - 2010-05-26 11:41 - 02401112 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_43.dll
2014-05-08 18:56 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll
2014-05-08 18:56 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_43.dll
2014-05-08 18:56 - 2010-05-26 11:41 - 01907552 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll
2014-05-08 18:56 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll
2014-05-08 18:56 - 2010-05-26 11:41 - 00511328 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_43.dll
2014-05-08 18:56 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_43.dll
2014-05-08 18:56 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll
2014-05-08 18:56 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll
2014-05-08 18:56 - 2010-02-04 10:01 - 00530776 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_6.dll
2014-05-08 18:56 - 2010-02-04 10:01 - 00528216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_6.dll
2014-05-08 18:56 - 2010-02-04 10:01 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_6.dll
2014-05-08 18:56 - 2010-02-04 10:01 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_6.dll
2014-05-08 18:56 - 2010-02-04 10:01 - 00078680 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_4.dll
2014-05-08 18:56 - 2010-02-04 10:01 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_4.dll
2014-05-08 18:56 - 2010-02-04 10:01 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_7.dll
2014-05-08 18:56 - 2010-02-04 10:01 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_7.dll
2014-05-08 18:56 - 2009-09-04 17:44 - 00517960 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_5.dll
2014-05-08 18:56 - 2009-09-04 17:44 - 00515416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_5.dll
2014-05-08 18:56 - 2009-09-04 17:44 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_5.dll
2014-05-08 18:56 - 2009-09-04 17:44 - 00176968 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_5.dll
2014-05-08 18:56 - 2009-09-04 17:44 - 00073544 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_3.dll
2014-05-08 18:56 - 2009-09-04 17:44 - 00069464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_3.dll
2014-05-08 18:56 - 2009-09-04 17:29 - 05554512 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_42.dll
2014-05-08 18:56 - 2009-09-04 17:29 - 05501792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_42.dll
2014-05-08 18:56 - 2009-09-04 17:29 - 02582888 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_42.dll
2014-05-08 18:56 - 2009-09-04 17:29 - 02475352 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_42.dll
2014-05-08 18:56 - 2009-09-04 17:29 - 01974616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_42.dll
2014-05-08 18:56 - 2009-09-04 17:29 - 01892184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_42.dll
2014-05-08 18:56 - 2009-09-04 17:29 - 00523088 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll
2014-05-08 18:56 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_42.dll
2014-05-08 18:56 - 2009-09-04 17:29 - 00285024 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_42.dll
2014-05-08 18:56 - 2009-09-04 17:29 - 00235344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_42.dll
2014-05-08 18:56 - 2009-03-16 14:18 - 00521560 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_4.dll
2014-05-08 18:56 - 2009-03-16 14:18 - 00517448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_4.dll
2014-05-08 18:56 - 2009-03-16 14:18 - 00235352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_4.dll
2014-05-08 18:56 - 2009-03-16 14:18 - 00174936 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_4.dll
2014-05-08 18:56 - 2009-03-16 14:18 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_6.dll
2014-05-08 18:56 - 2009-03-16 14:18 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_6.dll
2014-05-08 18:56 - 2009-03-09 15:27 - 05425496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_41.dll
2014-05-08 18:56 - 2009-03-09 15:27 - 04178264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_41.dll
2014-05-08 18:56 - 2009-03-09 15:27 - 02430312 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_41.dll
2014-05-08 18:56 - 2009-03-09 15:27 - 01846632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_41.dll
2014-05-08 18:56 - 2009-03-09 15:27 - 00520544 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_41.dll
2014-05-08 18:56 - 2009-03-09 15:27 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_41.dll
2014-05-08 18:56 - 2008-10-27 10:04 - 00518480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_3.dll
2014-05-08 18:56 - 2008-10-27 10:04 - 00514384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_3.dll
2014-05-08 18:56 - 2008-10-27 10:04 - 00235856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_3.dll
2014-05-08 18:56 - 2008-10-27 10:04 - 00175440 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_3.dll
2014-05-08 18:56 - 2008-10-27 10:04 - 00074576 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_2.dll
2014-05-08 18:56 - 2008-10-27 10:04 - 00070992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_2.dll
2014-05-08 18:56 - 2008-10-27 10:04 - 00025936 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_5.dll
2014-05-08 18:56 - 2008-10-27 10:04 - 00023376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_5.dll
2014-05-08 18:56 - 2008-10-15 06:22 - 05631312 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_40.dll
2014-05-08 18:56 - 2008-10-15 06:22 - 04379984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_40.dll
2014-05-08 18:56 - 2008-10-15 06:22 - 02605920 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_40.dll
2014-05-08 18:56 - 2008-10-15 06:22 - 02036576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_40.dll
2014-05-08 18:56 - 2008-10-15 06:22 - 00519000 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_40.dll
2014-05-08 18:56 - 2008-10-15 06:22 - 00452440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_40.dll
2014-05-08 18:56 - 2008-07-31 10:41 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_2.dll
2014-05-08 18:56 - 2008-07-31 10:41 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_2.dll
2014-05-08 18:56 - 2008-07-31 10:41 - 00072200 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_1.dll
2014-05-08 18:56 - 2008-07-31 10:41 - 00068616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_1.dll
2014-05-08 18:56 - 2008-07-31 10:40 - 00513544 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_2.dll
2014-05-08 18:56 - 2008-07-31 10:40 - 00509448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_2.dll
2014-05-08 18:56 - 2008-07-10 11:01 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_39.dll
2014-05-08 18:56 - 2008-07-10 11:00 - 04992520 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_39.dll
2014-05-08 18:56 - 2008-07-10 11:00 - 03851784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll
2014-05-08 18:56 - 2008-07-10 11:00 - 01942552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_39.dll
2014-05-08 18:56 - 2008-07-10 11:00 - 01493528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_39.dll
2014-05-08 18:56 - 2008-07-10 11:00 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_39.dll
2014-05-08 18:56 - 2008-05-30 14:19 - 00511496 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_1.dll
2014-05-08 18:56 - 2008-05-30 14:19 - 00507400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_1.dll
2014-05-08 18:56 - 2008-05-30 14:18 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_1.dll
2014-05-08 18:56 - 2008-05-30 14:18 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_1.dll
2014-05-08 18:56 - 2008-05-30 14:17 - 00068104 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_0.dll
2014-05-08 18:56 - 2008-05-30 14:17 - 00065032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_0.dll
2014-05-08 18:56 - 2008-05-30 14:17 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_4.dll
2014-05-08 18:56 - 2008-05-30 14:16 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_4.dll
2014-05-08 18:56 - 2008-05-30 14:11 - 04991496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_38.dll
2014-05-08 18:56 - 2008-05-30 14:11 - 03850760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_38.dll
2014-05-08 18:56 - 2008-05-30 14:11 - 01941528 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_38.dll
2014-05-08 18:56 - 2008-05-30 14:11 - 01491992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_38.dll
2014-05-08 18:56 - 2008-05-30 14:11 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_38.dll
2014-05-08 18:56 - 2008-05-30 14:11 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_38.dll
2014-05-08 18:56 - 2008-03-05 16:04 - 00489480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_0.dll
2014-05-08 18:56 - 2008-03-05 16:03 - 00479752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_0.dll
2014-05-08 18:56 - 2008-03-05 16:03 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_0.dll
2014-05-08 18:56 - 2008-03-05 16:03 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_0.dll
2014-05-08 18:56 - 2008-03-05 16:00 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_3.dll
2014-05-08 18:56 - 2008-03-05 16:00 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_3.dll
2014-05-08 18:56 - 2008-03-05 15:56 - 04910088 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_37.dll
2014-05-08 18:56 - 2008-03-05 15:56 - 03786760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_37.dll
2014-05-08 18:56 - 2008-03-05 15:56 - 01860120 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_37.dll
2014-05-08 18:56 - 2008-03-05 15:56 - 01420824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_37.dll
2014-05-08 18:56 - 2008-02-05 23:07 - 00529424 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_37.dll
2014-05-08 18:56 - 2008-02-05 23:07 - 00462864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_37.dll
2014-05-08 18:56 - 2007-10-22 03:40 - 00411656 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_10.dll
2014-05-08 18:56 - 2007-10-22 03:39 - 00267272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_10.dll
2014-05-08 18:56 - 2007-10-22 03:37 - 00021000 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_2.dll
2014-05-08 18:56 - 2007-10-22 03:37 - 00017928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_2.dll
2014-05-08 18:56 - 2007-10-12 15:14 - 05081608 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_36.dll
2014-05-08 18:56 - 2007-10-12 15:14 - 03734536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_36.dll
2014-05-08 18:56 - 2007-10-12 15:14 - 02006552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_36.dll
2014-05-08 18:56 - 2007-10-12 15:14 - 01374232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_36.dll
2014-05-08 18:56 - 2007-10-02 09:56 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_36.dll
2014-05-08 18:56 - 2007-10-02 09:56 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_36.dll
2014-05-08 18:56 - 2007-07-20 00:57 - 00411496 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_9.dll
2014-05-08 18:56 - 2007-07-20 00:57 - 00267112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_9.dll
2014-05-08 18:56 - 2007-07-19 18:14 - 05073256 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_35.dll
2014-05-08 18:56 - 2007-07-19 18:14 - 03727720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_35.dll
2014-05-08 18:56 - 2007-07-19 18:14 - 01985904 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_35.dll
2014-05-08 18:56 - 2007-07-19 18:14 - 01358192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_35.dll
2014-05-08 18:56 - 2007-07-19 18:14 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_35.dll
2014-05-08 18:56 - 2007-07-19 18:14 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_35.dll
2014-05-08 18:56 - 2007-06-20 20:49 - 00409960 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_8.dll
2014-05-08 18:56 - 2007-06-20 20:46 - 00266088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_8.dll
2014-05-08 18:56 - 2007-05-16 16:45 - 04496232 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_34.dll
2014-05-08 18:56 - 2007-05-16 16:45 - 03497832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_34.dll
2014-05-08 18:56 - 2007-05-16 16:45 - 01401200 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_34.dll
2014-05-08 18:56 - 2007-05-16 16:45 - 01124720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_34.dll
2014-05-08 18:56 - 2007-05-16 16:45 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_34.dll
2014-05-08 18:56 - 2007-05-16 16:45 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_34.dll
2014-05-08 18:56 - 2007-04-04 18:55 - 00403304 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_7.dll
2014-05-08 18:56 - 2007-04-04 18:55 - 00261480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_7.dll
2014-05-08 18:56 - 2007-04-04 18:54 - 00107368 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_3.dll
2014-05-08 18:56 - 2007-04-04 18:53 - 00081768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_3.dll
2014-05-08 18:56 - 2007-03-15 16:57 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_33.dll
2014-05-08 18:56 - 2007-03-15 16:57 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_33.dll
2014-05-08 18:56 - 2007-03-12 16:42 - 04494184 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_33.dll
2014-05-08 18:56 - 2007-03-12 16:42 - 03495784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_33.dll
2014-05-08 18:56 - 2007-03-12 16:42 - 01400176 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_33.dll
2014-05-08 18:56 - 2007-03-12 16:42 - 01123696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_33.dll
2014-05-08 18:56 - 2007-03-05 12:42 - 00017688 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_1.dll
2014-05-08 18:56 - 2007-03-05 12:42 - 00015128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_1.dll
2014-05-08 18:56 - 2007-01-24 15:27 - 00393576 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_6.dll
2014-05-08 18:56 - 2007-01-24 15:27 - 00255848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_6.dll
2014-05-08 18:56 - 2006-12-08 12:02 - 00251672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_5.dll
2014-05-08 18:56 - 2006-12-08 12:00 - 00390424 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_5.dll
2014-05-08 18:56 - 2006-11-29 13:06 - 04398360 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_32.dll
2014-05-08 18:56 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_32.dll
2014-05-08 18:56 - 2006-11-29 13:06 - 00469264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10.dll
2014-05-08 18:56 - 2006-11-29 13:06 - 00440080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10.dll
2014-05-08 18:56 - 2006-09-28 16:05 - 03977496 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_31.dll
2014-05-08 18:56 - 2006-09-28 16:05 - 02414360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_31.dll
2014-05-08 18:56 - 2006-09-28 16:05 - 00237848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_4.dll
2014-05-08 18:56 - 2006-09-28 16:04 - 00364824 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_4.dll
2014-05-08 18:56 - 2006-07-28 09:31 - 00083736 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_2.dll
2014-05-08 18:56 - 2006-07-28 09:30 - 00363288 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_3.dll
2014-05-08 18:56 - 2006-07-28 09:30 - 00236824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_3.dll
2014-05-08 18:56 - 2006-07-28 09:30 - 00062744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_2.dll
2014-05-08 18:56 - 2006-05-31 07:24 - 00230168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_2.dll
2014-05-08 18:56 - 2006-05-31 07:22 - 00354072 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_2.dll
2014-05-08 18:56 - 2006-03-31 12:41 - 03927248 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_30.dll
2014-05-08 18:56 - 2006-03-31 12:40 - 02388176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_30.dll
2014-05-08 18:56 - 2006-03-31 12:40 - 00352464 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_1.dll
2014-05-08 18:56 - 2006-03-31 12:39 - 00229584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_1.dll
2014-05-08 18:56 - 2006-03-31 12:39 - 00083664 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_1.dll
2014-05-08 18:56 - 2006-03-31 12:39 - 00062672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_1.dll
2014-05-08 18:56 - 2006-02-03 08:43 - 03830992 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_29.dll
2014-05-08 18:56 - 2006-02-03 08:43 - 02332368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_29.dll
2014-05-08 18:56 - 2006-02-03 08:42 - 00355536 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_0.dll
2014-05-08 18:56 - 2006-02-03 08:42 - 00230096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_0.dll
2014-05-08 18:56 - 2006-02-03 08:41 - 00016592 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_0.dll
2014-05-08 18:56 - 2006-02-03 08:41 - 00014032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_0.dll
2014-05-08 18:56 - 2005-12-05 18:09 - 03815120 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_28.dll
2014-05-08 18:56 - 2005-12-05 18:09 - 02323664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_28.dll
2014-05-08 18:56 - 2005-07-22 19:59 - 03807440 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_27.dll
2014-05-08 18:56 - 2005-07-22 19:59 - 02319568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_27.dll
2014-05-08 18:56 - 2005-05-26 15:34 - 03767504 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_26.dll
2014-05-08 18:56 - 2005-05-26 15:34 - 02297552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_26.dll
2014-05-08 18:56 - 2005-03-18 17:19 - 03823312 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_25.dll
2014-05-08 18:56 - 2005-03-18 17:19 - 02337488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_25.dll
2014-05-08 18:56 - 2005-02-05 19:45 - 03544272 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_24.dll
2014-05-08 18:56 - 2005-02-05 19:45 - 02222800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_24.dll
2014-05-08 12:02 - 2014-06-02 21:02 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\TS3Client
2014-05-08 12:02 - 2014-05-08 12:02 - 00000881 _____ () C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2014-05-08 12:02 - 2014-05-08 12:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
2014-05-08 08:23 - 2014-05-08 08:24 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Nikon
2014-05-08 08:23 - 2014-05-08 08:23 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Nikon
2014-05-08 08:21 - 2014-05-08 08:21 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2014-05-08 08:15 - 2014-05-08 08:15 - 00002077 _____ () C:\Users\Public\Desktop\Panorama Maker 6.lnk
2014-05-08 08:15 - 2014-05-08 08:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ArcSoft Panorama Maker 6
2014-05-08 08:15 - 2014-05-08 08:15 - 00000000 ____D () C:\Program Files (x86)\ArcSoft
2014-05-08 08:14 - 2014-05-08 08:14 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\ArcSoft
2014-05-08 08:13 - 2014-06-04 13:52 - 00000020 ____H () C:\ProgramData\PKP_DLev.DAT
2014-05-08 08:13 - 2014-06-04 13:52 - 00000020 ____H () C:\ProgramData\PKP_DLet.DAT
2014-05-08 08:13 - 2014-05-27 11:53 - 00000000 ____D () C:\Windows\Downloaded Installations
2014-05-08 08:13 - 2014-05-08 08:13 - 00106496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ATL71.DLL
2014-05-08 08:13 - 2014-05-08 08:13 - 00002072 _____ () C:\Users\Public\Desktop\ViewNX 2.lnk
2014-05-08 08:13 - 2014-05-08 08:13 - 00000268 ___RH () C:\Users\Manuela\AppData\Roaming\Stingers
2014-05-08 08:13 - 2014-05-08 08:13 - 00000268 ___RH () C:\Users\Manuela\AppData\Roaming\StatusSheet
2014-05-08 08:13 - 2014-05-08 08:13 - 00000268 ___RH () C:\Users\Manuela\AppData\Roaming\Static Library
2014-05-08 08:13 - 2014-05-08 08:13 - 00000268 ___RH () C:\ProgramData\Super Strings
2014-05-08 08:13 - 2014-05-08 08:13 - 00000268 ___RH () C:\ProgramData\Strings
2014-05-08 08:13 - 2014-05-08 08:13 - 00000268 ___RH () C:\ProgramData\String Ensemble
2014-05-08 08:13 - 2014-05-08 08:13 - 00000020 ____H () C:\ProgramData\PKP_DLes.DAT
2014-05-08 08:13 - 2014-05-08 08:13 - 00000012 ___RH () C:\ProgramData\Track Settings
2014-05-08 08:13 - 2014-05-08 08:13 - 00000012 ___RH () C:\ProgramData\Textures
2014-05-08 08:13 - 2014-05-08 08:13 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Downloaded Installations
2014-05-08 08:13 - 2014-05-08 08:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ViewNX 2
2014-05-08 08:13 - 2014-05-08 08:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nikon Message Center 2
2014-05-08 08:13 - 2014-05-08 08:13 - 00000000 ____D () C:\ProgramData\54F3DE4E-B7BA-4EBD-8B3B-385D272CC583
2014-05-08 08:13 - 2014-05-08 08:13 - 00000000 ____D () C:\Program Files\Nikon
2014-05-08 08:13 - 2014-05-08 08:13 - 00000000 ____D () C:\Program Files\Common Files\Nikon
2014-05-08 08:13 - 2014-05-08 08:13 - 00000000 ____D () C:\Program Files (x86)\Nikon
2014-05-08 08:12 - 2014-05-08 08:13 - 00000012 ___RH () C:\ProgramData\Techno Kit
2014-05-08 08:12 - 2014-05-08 08:13 - 00000000 ____D () C:\ProgramData\Ultima_T15
2014-05-08 08:12 - 2014-05-08 08:13 - 00000000 ____D () C:\ProgramData\EnterNHelp
2014-05-08 08:12 - 2014-05-08 08:12 - 00000268 ___RH () C:\Users\Manuela\AppData\Roaming\Synth Textures
2014-05-08 08:12 - 2014-05-08 08:12 - 00000020 ____H () C:\ProgramData\PKP_DLeo.DAT
2014-05-08 08:12 - 2014-05-08 08:12 - 00000012 ___RH () C:\ProgramData\deskjet
2014-05-08 08:11 - 2014-05-08 08:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Link to Nikon
2014-05-08 00:02 - 2014-05-08 00:02 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
2014-05-07 22:21 - 2014-05-07 22:21 - 00122480 _____ () C:\Users\Manuela\AppData\Local\GDIPFONTCACHEV1.DAT
2014-05-07 21:33 - 2014-05-07 21:33 - 00007177 _____ () C:\Windows\system32\lvcoinst.log
2014-05-07 21:33 - 2014-05-07 21:33 - 00000000 ____D () C:\Program Files\Common Files\logishrd
2014-05-07 21:22 - 2007-01-19 18:24 - 00025312 _____ (Windows (R) Codename Longhorn DDK provider) C:\Windows\system32\Drivers\SCMNdisP.sys
2014-05-07 21:21 - 2014-05-07 21:21 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_bcmwlhigh664_01009.Wdf
2014-05-07 21:21 - 2014-05-07 21:21 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\InstallShield
2014-05-07 17:14 - 2014-05-07 17:14 - 00000000 __SHD () C:\Users\Manuela\AppData\Local\EmieUserList
2014-05-07 17:14 - 2014-05-07 17:14 - 00000000 __SHD () C:\Users\Manuela\AppData\Local\EmieSiteList
2014-05-07 17:13 - 2014-05-07 17:13 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Adobe
2014-05-07 15:27 - 2014-05-07 15:35 - 00002353 _____ () C:\Users\Manuela\Desktop\Sicherer Zahlungsverkehr.lnk
2014-05-07 15:27 - 2014-05-07 15:27 - 00001348 _____ () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security.lnk
2014-05-07 15:15 - 2014-06-04 15:12 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-05-07 15:15 - 2014-05-07 15:31 - 00625760 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-05-07 15:15 - 2014-05-07 15:31 - 00115296 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2014-05-07 15:15 - 2014-05-07 15:15 - 00001143 _____ () C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
2014-05-07 15:15 - 2014-05-07 15:15 - 00000000 ____D () C:\Program Files (x86)\Kaspersky Lab
2014-05-07 15:15 - 2013-05-06 09:13 - 00110176 _____ (Kaspersky Lab ZAO) C:\Windows\system32\klfphc.dll
2014-05-07 14:24 - 2014-05-07 14:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-05-07 14:23 - 2014-05-07 14:23 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-05-07 14:23 - 2014-05-07 14:23 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-05-07 14:07 - 2014-05-07 14:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Live Add-in
2014-05-07 14:04 - 2014-05-07 14:04 - 00000000 ____D () C:\Users\Default\AppData\Local\Microsoft Help
2014-05-07 14:04 - 2014-05-07 14:04 - 00000000 ____D () C:\Users\Default User\AppData\Local\Microsoft Help
2014-05-07 14:01 - 2014-05-07 14:01 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_LocationProvider_01_11_00.Wdf
2014-05-07 13:59 - 2014-05-07 14:00 - 00000000 ____D () C:\Users\Manuela\Desktop\MS Office
2014-05-07 13:56 - 2014-05-09 13:45 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\vlc
2014-05-07 13:56 - 2014-05-07 13:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-05-07 13:52 - 2014-05-07 13:52 - 00002655 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Neues Microsoft Office-Dokument.lnk
2014-05-07 13:52 - 2014-05-07 13:52 - 00002655 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Microsoft Office-Dokument öffnen.lnk
2014-05-07 13:52 - 2014-05-07 13:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2014-05-07 13:51 - 2014-05-07 13:53 - 00000000 ____D () C:\Program Files (x86)\Microsoft Works
2014-05-07 13:51 - 2014-05-07 13:51 - 00000000 ____D () C:\Windows\PCHEALTH
2014-05-07 13:51 - 2014-05-07 13:51 - 00000000 ____D () C:\Program Files (x86)\Microsoft Visual Studio
2014-05-07 13:50 - 2014-05-07 13:50 - 00000000 ____D () C:\Program Files\Microsoft Office
2014-05-07 13:49 - 2014-05-15 09:43 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-07 13:49 - 2014-05-07 14:05 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
2014-05-07 13:49 - 2014-05-07 13:49 - 00000000 __RHD () C:\MSOCache
2014-05-07 13:49 - 2014-05-07 13:49 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Microsoft Help
2014-05-07 13:41 - 2014-05-07 13:41 - 00001006 _____ () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TextPad.lnk
2014-05-07 13:41 - 2014-05-07 13:41 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Helios
2014-05-07 13:41 - 2014-05-07 13:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TextPad
2014-05-07 13:41 - 2014-05-07 13:41 - 00000000 ____D () C:\Program Files (x86)\TextPad 6
2014-05-07 13:39 - 2014-05-07 13:39 - 00001968 _____ () C:\Users\Public\Desktop\CDBurnerXP.lnk
2014-05-07 13:39 - 2014-05-07 13:39 - 00001918 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2014-05-07 13:39 - 2014-05-07 13:39 - 00001017 _____ () C:\Users\Public\Desktop\IrfanView.lnk
2014-05-07 13:39 - 2014-05-07 13:39 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\IrfanView
2014-05-07 13:39 - 2014-05-07 13:39 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Canneverbe Limited
2014-05-07 13:39 - 2014-05-07 13:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IrfanView
2014-05-07 13:39 - 2014-05-07 13:39 - 00000000 ____D () C:\ProgramData\Canneverbe Limited
2014-05-07 13:39 - 2014-05-07 13:39 - 00000000 ____D () C:\Program Files (x86)\IrfanView
2014-05-07 13:39 - 2014-05-07 13:39 - 00000000 ____D () C:\Program Files (x86)\CDBurnerXP
2014-05-07 13:32 - 2014-05-24 09:14 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-05-07 13:32 - 2014-05-07 17:17 - 00000000 ____D () C:\ProgramData\Adobe
2014-05-07 13:32 - 2014-05-07 13:32 - 00002042 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2014-05-07 13:32 - 2014-05-07 13:32 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-05-07 13:28 - 2014-05-07 13:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
2014-05-07 13:06 - 2014-05-07 13:06 - 00003554 _____ () C:\Windows\System32\Tasks\CreateChoiceProcessTask
2014-05-07 13:06 - 2013-08-22 08:57 - 00002143 ___RS () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Browser Choice.lnk
2014-05-07 13:03 - 2014-05-07 13:03 - 00000000 ___RD () C:\Windows\BrowserChoice
2014-05-07 13:02 - 2014-05-15 09:43 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-07 13:02 - 2014-05-15 09:42 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-07 13:02 - 2014-01-19 09:38 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-05-07 13:01 - 2014-05-07 12:20 - 00000000 ____D () C:\Windows\Panther
2014-05-07 13:01 - 2014-03-20 06:19 - 01291200 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-05-07 13:01 - 2014-03-20 05:41 - 02013016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-05-07 13:01 - 2014-03-20 05:41 - 00376152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\clfs.sys
2014-05-07 13:01 - 2014-03-20 05:40 - 01112536 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-07 13:01 - 2014-03-20 03:29 - 04268544 _____ (Microsoft Corporation) C:\Windows\system32\SyncEngine.dll
2014-05-07 13:01 - 2014-03-20 02:53 - 00950784 _____ (Microsoft Corporation) C:\Windows\system32\ReAgent.dll
2014-05-07 13:01 - 2014-03-20 02:48 - 00201216 _____ (Microsoft Corporation) C:\Windows\system32\ReInfo.dll
2014-05-07 13:01 - 2014-03-20 01:55 - 01036288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-05-07 13:01 - 2014-03-20 01:39 - 00800256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ReAgent.dll
2014-05-07 13:01 - 2014-03-20 01:36 - 00172544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ReInfo.dll
2014-05-07 13:01 - 2014-03-19 09:13 - 00836096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-05-07 13:01 - 2014-03-19 07:57 - 00621568 _____ (Microsoft Corporation) C:\Windows\system32\MDMAgent.exe
2014-05-07 13:01 - 2014-03-19 07:50 - 00079360 _____ (Microsoft Corporation) C:\Windows\system32\w32tm.exe
2014-05-07 13:01 - 2014-03-19 07:31 - 01656832 _____ (Microsoft Corporation) C:\Windows\system32\GdiPlus.dll
2014-05-07 13:01 - 2014-03-19 07:20 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\w32tm.exe
2014-05-07 13:01 - 2014-03-19 07:08 - 01351168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\GdiPlus.dll
2014-05-07 13:01 - 2014-03-19 06:41 - 00721408 _____ (Microsoft Corporation) C:\Windows\system32\SkyDriveTelemetry.dll
2014-05-07 13:01 - 2014-03-19 06:17 - 00872448 _____ (Microsoft Corporation) C:\Windows\system32\SkyDrive.exe
2014-05-07 13:01 - 2014-03-13 14:35 - 00157016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wof.sys
2014-05-07 13:01 - 2014-03-12 15:45 - 00387210 _____ () C:\Windows\system32\ApnDatabase.xml
2014-05-07 13:01 - 2014-03-11 17:18 - 01015808 _____ (Microsoft Corporation) C:\Windows\system32\aclui.dll
2014-05-07 13:01 - 2014-03-11 16:28 - 00887296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aclui.dll
2014-05-07 13:01 - 2014-03-11 14:42 - 02641920 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-05-07 13:01 - 2014-03-11 14:35 - 02317824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-05-07 13:01 - 2014-03-08 22:47 - 00565536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2014-05-07 13:01 - 2014-03-08 22:47 - 00180056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-07 13:01 - 2014-03-08 22:40 - 00136024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wfplwfs.sys
2014-05-07 13:01 - 2014-03-08 22:38 - 01542768 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2014-05-07 13:01 - 2014-03-08 22:35 - 00467800 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\USBHUB3.SYS
2014-05-07 13:01 - 2014-03-08 22:35 - 00337752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Classpnp.sys
2014-05-07 13:01 - 2014-03-08 17:29 - 01339240 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-05-07 13:01 - 2014-03-08 17:29 - 00356848 _____ (Microsoft Corporation) C:\Windows\system32\dcomp.dll
2014-05-07 13:01 - 2014-03-08 13:34 - 01095488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2014-05-07 13:01 - 2014-03-08 11:34 - 00731648 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2014-05-07 13:01 - 2014-03-08 11:02 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\sxproxy.dll
2014-05-07 13:01 - 2014-03-08 10:44 - 00731648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2014-05-07 13:01 - 2014-03-08 10:33 - 00271872 _____ (Microsoft Corporation) C:\Windows\system32\spp.dll
2014-05-07 13:01 - 2014-03-08 10:25 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\SetNetworkLocation.dll
2014-05-07 13:01 - 2014-03-08 10:12 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sxproxy.dll
2014-05-07 13:01 - 2014-03-08 09:53 - 01843712 _____ (Microsoft Corporation) C:\Windows\system32\Display.dll
2014-05-07 13:01 - 2014-03-08 09:51 - 00334848 _____ (Microsoft Corporation) C:\Windows\system32\MDEServer.exe
2014-05-07 13:01 - 2014-03-08 09:47 - 00222720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spp.dll
2014-05-07 13:01 - 2014-03-08 09:12 - 01816576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Display.dll
2014-05-07 13:01 - 2014-03-08 09:09 - 01411584 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-07 13:01 - 2014-03-08 09:04 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\AppxAllUserStore.dll
2014-05-07 13:01 - 2014-03-08 09:03 - 00939520 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-07 13:01 - 2014-03-08 09:01 - 00827392 _____ (Microsoft Corporation) C:\Windows\system32\BFE.DLL
2014-05-07 13:01 - 2014-03-08 08:50 - 01066496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-05-07 13:01 - 2014-03-08 08:48 - 00252928 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentClient.dll
2014-05-07 13:01 - 2014-03-08 08:46 - 01063424 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2014-05-07 13:01 - 2014-03-08 08:41 - 00412672 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2014-05-07 13:01 - 2014-03-08 08:40 - 00139776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AppxAllUserStore.dll
2014-05-07 13:01 - 2014-03-08 08:37 - 00755712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-05-07 13:01 - 2014-03-08 08:31 - 00222720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dcomp.dll
2014-05-07 13:01 - 2014-03-08 08:30 - 00197632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AppXDeploymentClient.dll
2014-05-07 13:01 - 2014-03-08 08:25 - 00264192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2014-05-07 13:01 - 2014-03-08 08:09 - 00958464 _____ (Microsoft Corporation) C:\Windows\system32\MFMediaEngine.dll
2014-05-07 13:01 - 2014-03-08 08:04 - 00717312 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2014-05-07 13:01 - 2014-03-08 08:02 - 00801792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MFMediaEngine.dll
2014-05-07 13:01 - 2014-03-08 07:58 - 00567296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2014-05-07 13:01 - 2014-03-08 07:41 - 01306624 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentServer.dll
2014-05-07 13:01 - 2014-03-08 07:11 - 00924160 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentExtensions.dll
2014-05-07 13:01 - 2014-03-06 16:35 - 01466864 _____ (Microsoft Corporation) C:\Windows\system32\propsys.dll
2014-05-07 13:01 - 2014-03-06 16:34 - 02331000 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-05-07 13:01 - 2014-03-06 16:34 - 00113648 _____ (Microsoft Corporation) C:\Windows\system32\userenv.dll
2014-05-07 13:01 - 2014-03-06 14:53 - 02141912 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll
2014-05-07 13:01 - 2014-03-06 14:53 - 00518552 _____ (Microsoft Corporation) C:\Windows\system32\dxgi.dll
2014-05-07 13:01 - 2014-03-06 14:51 - 01557848 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-05-07 13:01 - 2014-03-06 14:51 - 00488280 _____ (Microsoft Corporation) C:\Windows\system32\netcfgx.dll
2014-05-07 13:01 - 2014-03-06 14:51 - 00379224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2014-05-07 13:01 - 2014-03-06 14:42 - 07425368 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-07 13:01 - 2014-03-06 14:40 - 00492256 _____ (Microsoft Corporation) C:\Windows\system32\mfsvr.dll
2014-05-07 13:01 - 2014-03-06 14:40 - 00467504 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2014-05-07 13:01 - 2014-03-06 14:40 - 00463264 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2014-05-07 13:01 - 2014-03-06 14:40 - 00364640 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2014-05-07 13:01 - 2014-03-06 14:40 - 00244888 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2014-05-07 13:01 - 2014-03-06 14:39 - 00212992 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2014-05-07 13:01 - 2014-03-06 13:20 - 01200296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\propsys.dll
2014-05-07 13:01 - 2014-03-06 13:19 - 00390488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netcfgx.dll
2014-05-07 13:01 - 2014-03-06 13:19 - 00094016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\userenv.dll
2014-05-07 13:01 - 2014-03-06 13:13 - 01779800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2014-05-07 13:01 - 2014-03-06 13:13 - 00406912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxgi.dll
2014-05-07 13:01 - 2014-03-06 12:46 - 01679128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2014-05-07 13:01 - 2014-03-06 12:35 - 00406512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2014-05-07 13:01 - 2014-03-06 12:35 - 00388408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfsvr.dll
2014-05-07 13:01 - 2014-03-06 12:35 - 00326024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2014-05-07 13:01 - 2014-03-06 12:35 - 00305768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2014-05-07 13:01 - 2014-03-06 11:29 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\wlanhlp.dll
2014-05-07 13:01 - 2014-03-06 11:24 - 00111616 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2014-05-07 13:01 - 2014-03-06 11:24 - 00079360 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\IPMIDrv.sys
2014-05-07 13:01 - 2014-03-06 11:24 - 00033280 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\hidusb.sys
2014-05-07 13:01 - 2014-03-06 11:22 - 00679424 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2014-05-07 13:01 - 2014-03-06 11:22 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2014-05-07 13:01 - 2014-03-06 11:22 - 00134144 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dfsc.sys
2014-05-07 13:01 - 2014-03-06 11:20 - 00443392 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\nwifi.sys
2014-05-07 13:01 - 2014-03-06 11:20 - 00402944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2014-05-07 13:01 - 2014-03-06 11:20 - 00245760 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2014-05-07 13:01 - 2014-03-06 11:19 - 00283648 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2014-05-07 13:01 - 2014-03-06 11:19 - 00115200 _____ (Microsoft Corporation) C:\Windows\system32\umpnpmgr.dll
2014-05-07 13:01 - 2014-03-06 11:19 - 00057856 _____ (Microsoft Corporation) C:\Windows\system32\drvcfg.exe
2014-05-07 13:01 - 2014-03-06 11:19 - 00049152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpipreg.sys
2014-05-07 13:01 - 2014-03-06 11:19 - 00040960 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Shell.Search.UriHandler.dll
2014-05-07 13:01 - 2014-03-06 11:08 - 00110592 _____ (Microsoft Corporation) C:\Windows\system32\drvinst.exe
2014-05-07 13:01 - 2014-03-06 11:08 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\l2gpstore.dll
2014-05-07 13:01 - 2014-03-06 10:41 - 00115200 _____ (Microsoft Corporation) C:\Windows\system32\DevPropMgr.dll
2014-05-07 13:01 - 2014-03-06 10:38 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2014-05-07 13:01 - 2014-03-06 10:37 - 00064512 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2014-05-07 13:01 - 2014-03-06 10:28 - 00011264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlanhlp.dll
2014-05-07 13:01 - 2014-03-06 10:20 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Shell.Search.UriHandler.dll
2014-05-07 13:01 - 2014-03-06 10:10 - 00058368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\l2gpstore.dll
2014-05-07 13:01 - 2014-03-06 10:09 - 00098816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drvinst.exe
2014-05-07 13:01 - 2014-03-06 10:00 - 00247296 _____ (Microsoft Corporation) C:\Windows\system32\SensorsApi.dll
2014-05-07 13:01 - 2014-03-06 09:47 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2014-05-07 13:01 - 2014-03-06 09:46 - 00085504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2014-05-07 13:01 - 2014-03-06 09:44 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2014-05-07 13:01 - 2014-03-06 09:22 - 16875520 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Xaml.dll
2014-05-07 13:01 - 2014-03-06 09:16 - 00171008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SensorsApi.dll
2014-05-07 13:01 - 2014-03-06 09:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2014-05-07 13:01 - 2014-03-06 09:02 - 00834560 _____ (Microsoft Corporation) C:\Windows\system32\netlogon.dll
2014-05-07 13:01 - 2014-03-06 08:59 - 12732416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Xaml.dll
2014-05-07 13:01 - 2014-03-06 08:57 - 00443904 _____ (Microsoft Corporation) C:\Windows\system32\wlansec.dll
2014-05-07 13:01 - 2014-03-06 08:51 - 02900992 _____ (Microsoft Corporation) C:\Windows\system32\msftedit.dll
2014-05-07 13:01 - 2014-03-06 08:39 - 02133504 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2014-05-07 13:01 - 2014-03-06 08:34 - 00201216 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll
2014-05-07 13:01 - 2014-03-06 08:32 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\wlanapi.dll
2014-05-07 13:01 - 2014-03-06 08:31 - 02479616 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2014-05-07 13:01 - 2014-03-06 08:29 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netlogon.dll
2014-05-07 13:01 - 2014-03-06 08:27 - 00274944 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2014-05-07 13:01 - 2014-03-06 08:24 - 00462336 _____ (Microsoft Corporation) C:\Windows\system32\wlangpui.dll
2014-05-07 13:01 - 2014-03-06 08:23 - 02270208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msftedit.dll
2014-05-07 13:01 - 2014-03-06 08:23 - 00186368 _____ (Microsoft Corporation) C:\Windows\system32\dafWfdProvider.dll
2014-05-07 13:01 - 2014-03-06 08:21 - 00370176 _____ (Microsoft Corporation) C:\Windows\system32\wlanmsm.dll
2014-05-07 13:01 - 2014-03-06 08:21 - 00291840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Devices.Sensors.dll
2014-05-07 13:01 - 2014-03-06 08:16 - 01527296 _____ (Microsoft Corporation) C:\Windows\system32\wlansvc.dll
2014-05-07 13:01 - 2014-03-06 08:16 - 00834048 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2014-05-07 13:01 - 2014-03-06 08:13 - 00298496 _____ (Microsoft Corporation) C:\Windows\system32\WSDMon.dll
2014-05-07 13:01 - 2014-03-06 08:13 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlanapi.dll
2014-05-07 13:01 - 2014-03-06 08:11 - 02030080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll
2014-05-07 13:01 - 2014-03-06 08:09 - 01764864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2014-05-07 13:01 - 2014-03-06 08:06 - 00386560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlangpui.dll
2014-05-07 13:01 - 2014-03-06 08:05 - 01230336 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Media.dll
2014-05-07 13:01 - 2014-03-06 08:04 - 00300544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlanmsm.dll
2014-05-07 13:01 - 2014-03-06 08:04 - 00226304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Devices.Sensors.dll
2014-05-07 13:01 - 2014-03-06 08:01 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Devices.Scanners.dll
2014-05-07 13:01 - 2014-03-06 07:54 - 01023488 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2014-05-07 13:01 - 2014-03-06 07:54 - 00888320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Media.dll
2014-05-07 13:01 - 2014-03-06 07:51 - 00151040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Devices.Scanners.dll
2014-05-07 13:01 - 2014-03-06 07:47 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\SessEnv.dll
2014-05-07 13:01 - 2014-03-06 07:42 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\SearchFolder.dll
2014-05-07 13:01 - 2014-03-06 07:42 - 00280576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SessEnv.dll
2014-05-07 13:01 - 2014-03-06 07:33 - 00839168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchFolder.dll
2014-05-07 13:01 - 2014-03-06 07:28 - 08653824 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Search.dll
2014-05-07 13:01 - 2014-03-06 07:27 - 05833728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Search.dll
2014-05-07 13:01 - 2014-03-06 07:21 - 05770752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-05-07 13:01 - 2014-03-06 07:20 - 06641152 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-05-07 13:01 - 2014-03-04 14:25 - 02373784 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2014-05-07 13:01 - 2014-03-04 14:15 - 02519384 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-05-07 13:01 - 2014-03-04 14:15 - 00428888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-05-07 13:01 - 2014-03-04 14:14 - 00360512 _____ (Microsoft Corporation) C:\Windows\system32\mfreadwrite.dll
2014-05-07 13:01 - 2014-03-04 13:16 - 02088160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
2014-05-07 13:01 - 2014-03-04 13:10 - 00355832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfreadwrite.dll
2014-05-07 13:01 - 2014-03-04 09:16 - 00655360 _____ (Microsoft Corporation) C:\Windows\system32\dnsapi.dll
2014-05-07 13:01 - 2014-03-04 09:13 - 00254464 _____ (Microsoft Corporation) C:\Windows\system32\dnsrslvr.dll
2014-05-07 13:01 - 2014-03-04 09:08 - 00299008 _____ (Microsoft Corporation) C:\Windows\system32\pdh.dll
2014-05-07 13:01 - 2014-03-04 09:00 - 00512000 _____ (Microsoft Corporation) C:\Windows\system32\wlidprov.dll
2014-05-07 13:01 - 2014-03-04 08:56 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RMapi.dll
2014-05-07 13:01 - 2014-03-04 08:50 - 00220160 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2014-05-07 13:01 - 2014-03-04 08:42 - 00494592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dnsapi.dll
2014-05-07 13:01 - 2014-03-04 08:39 - 00254976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pdh.dll
2014-05-07 13:01 - 2014-03-04 08:32 - 00356864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlidprov.dll
2014-05-07 13:01 - 2014-03-04 08:15 - 00542208 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Graphics.Printing.dll
2014-05-07 13:01 - 2014-03-04 08:05 - 00402432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Graphics.Printing.dll
2014-05-07 13:01 - 2014-03-04 08:03 - 00669696 _____ (Microsoft Corporation) C:\Windows\system32\rasapi32.dll
2014-05-07 13:01 - 2014-03-04 08:03 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\CredentialMigrationHandler.dll
2014-05-07 13:01 - 2014-03-04 07:54 - 00027136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CredentialMigrationHandler.dll
2014-05-07 13:01 - 2014-03-04 07:52 - 00605184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasapi32.dll
2014-05-07 13:01 - 2014-02-07 00:59 - 00425984 _____ (Microsoft Corporation) C:\Windows\system32\clusapi.dll
2014-05-07 13:01 - 2014-02-06 23:26 - 00313344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clusapi.dll
2014-05-07 13:01 - 2013-12-24 01:28 - 00262656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\LocationApi.dll
2014-05-07 13:01 - 2013-12-24 01:26 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\LocationApi.dll
2014-05-07 13:00 - 2014-02-06 13:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-07 13:00 - 2014-02-06 12:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-07 12:59 - 2014-03-11 15:21 - 00918528 _____ (Microsoft Corporation) C:\Windows\system32\MrmCoreR.dll
2014-05-07 12:59 - 2014-03-11 15:02 - 00629760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MrmCoreR.dll
2014-05-07 12:56 - 2014-05-07 12:56 - 00000000 ____D () C:\Program Files (x86)\TeamViewer
2014-05-07 12:55 - 2014-05-07 12:55 - 04610320 _____ (TeamViewer) C:\Users\Manuela\Desktop\Fernwartung.exe
2014-05-07 12:55 - 2014-05-07 12:55 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\TeamViewer
2014-05-07 12:55 - 2014-05-07 12:55 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Macromedia
2014-05-07 12:54 - 2014-05-07 12:54 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2014-05-07 12:54 - 2014-05-07 12:54 - 00000000 ____D () C:\ProgramData\ATI
2014-05-07 12:53 - 2014-05-07 12:53 - 00060993 _____ () C:\Windows\SysWOW64\CCCInstall_201405071253555882.log
2014-05-07 12:53 - 2014-05-07 12:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2014-05-07 12:53 - 2014-05-07 12:53 - 00000000 ____D () C:\Program Files\ATI Technologies
2014-05-07 12:53 - 2014-05-07 12:53 - 00000000 ____D () C:\Program Files (x86)\AMD AVT
2014-05-07 12:53 - 2013-12-06 23:38 - 00230912 _____ () C:\Windows\system32\clinfo.exe
2014-05-07 12:53 - 2013-09-24 16:54 - 00222720 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\AtihdWB6.sys
2014-05-07 12:53 - 2013-09-24 16:54 - 00141312 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\amdacpksl.sys
2014-05-07 12:53 - 2013-09-24 16:51 - 00110080 _____ (TODO: <Company name>) C:\Windows\system32\DelayAPO.dll
2014-05-07 12:52 - 2012-09-23 01:17 - 00021160 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\Drivers\amdkmafd.sys
2014-05-07 12:34 - 2014-05-07 12:34 - 00000000 ____D () C:\Users\Manuela\AppData\Local\AMD
2014-05-07 12:29 - 2014-05-07 12:30 - 00000189 _____ () C:\Windows\LAN.log
2014-05-07 12:28 - 2014-05-07 12:28 - 00000000 ____D () C:\Windows\SysWOW64\RTCOM
2014-05-07 12:28 - 2014-05-07 12:28 - 00000000 ____D () C:\Program Files\Realtek
2014-05-07 12:28 - 2012-06-14 20:10 - 04060560 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RTKVHD64.sys
2014-05-07 12:28 - 2012-06-13 16:44 - 00290813 _____ () C:\Windows\system32\Drivers\RTAIODAT.DAT
2014-05-07 12:28 - 2012-06-10 18:18 - 03615888 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkAPO64.dll
2014-05-07 12:28 - 2012-06-08 13:14 - 00584320 _____ (Sony Corporation) C:\Windows\system32\SFSS_APO.dll
2014-05-07 12:28 - 2012-06-08 12:44 - 00869520 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkApi64.dll
2014-05-07 12:28 - 2012-06-07 13:38 - 05096448 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoRes64.dat
2014-05-07 12:28 - 2012-06-03 11:37 - 02674320 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtPgEx64.dll
2014-05-07 12:28 - 2012-06-02 20:08 - 00105616 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoInstII64.dll
2014-05-07 12:28 - 2012-05-19 13:29 - 07163744 _____ (Dolby Laboratories) C:\Windows\system32\R4EEP64A.dll
2014-05-07 12:28 - 2012-05-19 13:29 - 00433504 _____ (Dolby Laboratories) C:\Windows\system32\R4EED64A.dll
2014-05-07 12:28 - 2012-05-19 13:29 - 00141152 _____ (Dolby Laboratories) C:\Windows\system32\R4EEL64A.dll
2014-05-07 12:28 - 2012-05-19 13:29 - 00123744 _____ (Dolby Laboratories) C:\Windows\system32\R4EEA64A.dll
2014-05-07 12:28 - 2012-05-19 13:29 - 00074592 _____ (Dolby Laboratories) C:\Windows\system32\R4EEG64A.dll
2014-05-07 12:28 - 2012-05-12 17:22 - 01262696 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTCOM64.dll
2014-05-07 12:28 - 2012-04-05 20:42 - 01345368 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioRealtek264.dll
2014-05-07 12:28 - 2012-02-23 21:45 - 02605400 _____ (Waves Audio Ltd.) C:\Windows\system32\WavesGUILib.dll
2014-05-07 12:28 - 2012-02-19 17:54 - 00396632 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVolumeSDAPO.dll
2014-05-07 12:28 - 2012-02-16 02:05 - 08363864 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioRealtek.dll
2014-05-07 12:28 - 2012-02-01 13:43 - 00836544 _____ (TOSHIBA Corporation) C:\Windows\system32\tadefxapo264.dll
2014-05-07 12:28 - 2012-01-12 12:20 - 00065944 _____ (TOSHIBA CORPORATION.) C:\Windows\system32\tepeqapo64.dll
2014-05-07 12:28 - 2011-12-22 17:32 - 00331880 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtlCPAPI64.dll
2014-05-07 12:28 - 2011-12-15 18:58 - 01560168 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTSnMg64.cpl
2014-05-07 12:28 - 2011-11-24 18:28 - 00014952 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCoLDR64.dll
2014-05-07 12:28 - 2011-09-04 16:21 - 00221024 _____ (Synopsys, Inc.) C:\Windows\system32\SFNHK64.dll
2014-05-07 12:28 - 2011-09-04 16:21 - 00081248 _____ (Synopsys, Inc.) C:\Windows\system32\SFCOM64.dll
2014-05-07 12:28 - 2011-09-04 16:21 - 00078688 _____ (Synopsys, Inc.) C:\Windows\system32\SFAPO64.dll
2014-05-07 12:28 - 2011-03-19 14:17 - 01361336 _____ (TOSHIBA Corporation) C:\Windows\system32\tosade.dll
2014-05-07 12:28 - 2011-03-09 19:11 - 00148416 _____ (TOSHIBA Corporation) C:\Windows\system32\tadefxapo.dll
2014-05-07 12:28 - 2010-11-10 09:31 - 00375128 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEP64A.dll
2014-05-07 12:28 - 2010-11-10 09:31 - 00310104 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DHT64.dll
2014-05-07 12:28 - 2010-11-10 09:31 - 00310104 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DAA64.dll
2014-05-07 12:28 - 2010-11-10 09:31 - 00204120 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEED64A.dll
2014-05-07 12:28 - 2010-11-10 09:31 - 00101208 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEL64A.dll
2014-05-07 12:28 - 2010-11-10 09:31 - 00078680 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEG64A.dll
2014-05-07 12:28 - 2010-11-05 20:30 - 00149608 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCfg64.dll
2014-05-07 12:28 - 2010-07-24 18:48 - 00074064 _____ (Virage Logic Corporation / Sonic Focus) C:\Windows\SysWOW64\SFCOM.dll
2014-05-07 12:28 - 2009-11-26 11:55 - 00518896 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSX64.dll
2014-05-07 12:28 - 2009-11-26 11:55 - 00211184 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSH64.dll
2014-05-07 12:28 - 2009-11-26 11:55 - 00198896 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSHP64.dll
2014-05-07 12:28 - 2009-11-26 11:55 - 00155888 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSWOW64.dll
2014-05-07 12:27 - 2014-05-27 13:45 - 00000000 ____D () C:\Program Files (x86)\Realtek
2014-05-07 12:27 - 2014-05-07 12:28 - 00002217 _____ () C:\RHDSetup.log
2014-05-07 12:27 - 2014-05-07 12:28 - 00000206 _____ () C:\Windows\audio.log
2014-05-07 12:27 - 2014-05-07 12:28 - 00000000 ___HD () C:\Program Files (x86)\Temp
2014-05-07 12:27 - 2012-05-27 20:06 - 01706640 ____R (Realtek Semiconductor Corp.) C:\Windows\RtlExUpd.dll
2014-05-07 12:27 - 2012-04-12 16:40 - 02533952 _____ (Fortemedia Corporation) C:\Windows\system32\FMAPO64.dll
2014-05-07 12:27 - 2012-04-05 20:42 - 01015640 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPOShell64.dll
2014-05-07 12:27 - 2012-03-10 13:47 - 00202336 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAC64.dll
2014-05-07 12:27 - 2012-03-10 13:47 - 00108640 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAR64.dll
2014-05-07 12:27 - 2012-01-26 00:30 - 00537456 _____ (DTS) C:\Windows\system32\DTSU2PLFX64.dll
2014-05-07 12:27 - 2012-01-26 00:30 - 00524656 _____ (DTS) C:\Windows\system32\DTSU2PGFX64.dll
2014-05-07 12:27 - 2012-01-26 00:30 - 00449392 _____ (DTS) C:\Windows\system32\DTSU2PREC64.dll
2014-05-07 12:27 - 2011-12-20 19:58 - 02131288 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioEQ.dll
2014-05-07 12:27 - 2011-08-25 19:00 - 00603984 _____ (Knowles Acoustics ) C:\Windows\system32\KAAPORT64.dll
2014-05-07 12:27 - 2011-06-02 11:42 - 01756264 _____ (DTS) C:\Windows\system32\DTSS2SpeakerDLL64.dll
2014-05-07 12:27 - 2011-06-02 11:42 - 01568360 _____ (DTS) C:\Windows\system32\DTSS2HeadphoneDLL64.dll
2014-05-07 12:27 - 2011-06-02 11:42 - 01486952 _____ (DTS) C:\Windows\system32\DTSBoostDLL64.dll
2014-05-07 12:27 - 2011-06-02 11:42 - 00728680 _____ (DTS) C:\Windows\system32\DTSBassEnhancementDLL64.dll
2014-05-07 12:27 - 2011-06-02 11:42 - 00712296 _____ (DTS) C:\Windows\system32\DTSSymmetryDLL64.dll
2014-05-07 12:27 - 2011-06-02 11:42 - 00693352 _____ (DTS) C:\Windows\system32\DTSVoiceClarityDLL64.dll
2014-05-07 12:27 - 2011-06-02 11:42 - 00491112 _____ (DTS) C:\Windows\system32\DTSNeoPCDLL64.dll
2014-05-07 12:27 - 2011-06-02 11:42 - 00432744 _____ (DTS) C:\Windows\system32\DTSLimiterDLL64.dll
2014-05-07 12:27 - 2011-06-02 11:42 - 00428648 _____ (DTS) C:\Windows\system32\DTSGainCompensatorDLL64.dll
2014-05-07 12:27 - 2011-06-02 11:42 - 00242792 _____ (DTS) C:\Windows\system32\DTSLFXAPO64.dll
2014-05-07 12:27 - 2011-06-02 11:42 - 00242792 _____ (DTS) C:\Windows\system32\DTSGFXAPO64.dll
2014-05-07 12:27 - 2011-06-02 11:42 - 00241768 _____ (DTS) C:\Windows\system32\DTSGFXAPONS64.dll
2014-05-07 12:27 - 2010-10-05 15:46 - 00341336 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO30.dll
2014-05-07 12:27 - 2010-09-29 11:34 - 00318808 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO20.dll
2014-05-07 12:26 - 2014-05-07 12:53 - 00000000 ____D () C:\Program Files (x86)\ATI Technologies
2014-05-07 12:26 - 2014-05-07 12:26 - 00059972 _____ () C:\Windows\SysWOW64\CCCInstall_201405071226012588.log
2014-05-07 12:26 - 2014-05-07 12:26 - 00000000 ____D () C:\Windows\AsusInstAll
2014-05-07 12:26 - 2014-05-07 12:26 - 00000000 ____D () C:\Program Files (x86)\AMD APP
2014-05-07 12:25 - 2014-06-04 15:14 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2466271035-3364438158-1365813384-1001
2014-05-07 12:25 - 2014-05-27 13:01 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-05-07 12:25 - 2014-05-07 12:25 - 00060817 _____ () C:\Windows\SysWOW64\CCCInstall_201405071225252375.log
2014-05-07 12:25 - 2014-05-07 12:25 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\ATI
2014-05-07 12:25 - 2014-05-07 12:25 - 00000000 ____D () C:\Users\Manuela\AppData\Local\ATI
2014-05-07 12:25 - 2014-05-07 12:25 - 00000000 ____D () C:\ProgramData\Package Cache
2014-05-07 12:25 - 2014-05-07 12:25 - 00000000 ____D () C:\ProgramData\AMD
2014-05-07 12:25 - 2014-05-07 12:25 - 00000000 ____D () C:\Program Files\ATI
2014-05-07 12:25 - 2012-06-20 00:07 - 00057000 ____R (Advanced Micro Devices) C:\Windows\system32\Drivers\usbfilter.sys
2014-05-07 12:24 - 2014-06-04 15:11 - 00002198 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-05-07 12:24 - 2014-06-04 15:09 - 00001126 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-07 12:24 - 2014-06-04 14:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-05-07 12:24 - 2014-06-04 14:34 - 00001130 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-07 12:24 - 2014-05-07 13:29 - 00004102 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-07 12:24 - 2014-05-07 13:29 - 00003866 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-05-07 12:24 - 2014-05-07 12:53 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Google
2014-05-07 12:24 - 2014-05-07 12:24 - 00000000 ____D () C:\Program Files\Common Files\ATI Technologies
2014-05-07 12:24 - 2014-05-07 12:24 - 00000000 ____D () C:\Program Files\AMD
2014-05-07 12:24 - 2014-05-07 12:24 - 00000000 ____D () C:\Program Files (x86)\Google
2014-05-07 12:24 - 2014-05-07 12:24 - 00000000 ____D () C:\AMD
2014-05-07 12:24 - 2014-05-07 12:24 - 00000000 _____ () C:\Windows\ativpsrm.bin
2014-05-07 12:23 - 2014-05-07 12:30 - 00040014 _____ () C:\Windows\Ascd_log.ini
2014-05-07 12:23 - 2014-05-07 12:23 - 00029380 _____ () C:\Windows\Ascd_tmp.ini
2014-05-07 12:23 - 2014-05-07 12:23 - 00001769 _____ () C:\Windows\Language_trs.ini
2014-05-07 12:23 - 2009-04-03 22:30 - 00010296 _____ () C:\Windows\SysWOW64\Drivers\ASUSHWIO.SYS
2014-05-07 12:23 - 2009-02-27 13:35 - 00049152 ____R () C:\Windows\DAOD.exe
2014-05-07 12:20 - 2014-06-04 15:24 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Temp
2014-05-07 12:20 - 2014-06-04 15:15 - 00000000 ____D () C:\Users\Manuela
2014-05-07 12:20 - 2014-06-04 14:42 - 01622246 _____ () C:\Windows\WindowsUpdate.log
2014-05-07 12:20 - 2014-06-04 14:41 - 00001014 _____ () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-05-07 12:20 - 2014-05-26 17:55 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Packages
2014-05-07 12:20 - 2014-05-15 09:44 - 00000000 ___RD () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-07 12:20 - 2014-05-15 09:44 - 00000000 ___RD () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-07 12:20 - 2014-05-07 17:13 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Adobe
2014-05-07 12:20 - 2014-05-07 12:20 - 00000020 ___SH () C:\Users\Manuela\ntuser.ini
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 _SHDL () C:\Users\Manuela\Vorlagen
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 _SHDL () C:\Users\Manuela\Startmenü
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 _SHDL () C:\Users\Manuela\Netzwerkumgebung
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 _SHDL () C:\Users\Manuela\Lokale Einstellungen
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 _SHDL () C:\Users\Manuela\Eigene Dateien
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 _SHDL () C:\Users\Manuela\Druckumgebung
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 _SHDL () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 _SHDL () C:\Users\Manuela\AppData\Local\Verlauf
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 _SHDL () C:\Users\Manuela\AppData\Local\Anwendungsdaten
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 _SHDL () C:\Users\Manuela\Anwendungsdaten
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 ____D () C:\Users\Manuela\AppData\Local\VirtualStore
2014-05-07 12:20 - 2014-03-18 12:31 - 00000000 ___RD () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-05-07 12:20 - 2014-03-18 12:31 - 00000000 ___RD () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-05-07 12:20 - 2014-03-18 12:11 - 00000369 _____ () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk
2014-05-07 12:20 - 2014-03-18 12:11 - 00000369 _____ () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk
2014-05-07 12:20 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-05-07 12:20 - 2013-08-22 17:36 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default\Vorlagen
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default\Startmenü
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default\Netzwerkumgebung
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default\Lokale Einstellungen
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default\Eigene Dateien
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default\Druckumgebung
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Verlauf
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Anwendungsdaten
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default\Anwendungsdaten
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Verlauf
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Anwendungsdaten
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Programme
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\ProgramData\Vorlagen
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\ProgramData\Startmenü
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\ProgramData\Microsoft\Windows\Start Menu\Programme
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\ProgramData\Dokumente
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\ProgramData\Anwendungsdaten
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Program Files\Gemeinsame Dateien
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Dokumente und Einstellungen
         

FRST Teil 2

==================== One Month Modified Files and Folders =======

2014-06-04 15:24 - 2014-06-04 15:16 - 00000000 ____D () C:\FRST
2014-06-04 15:24 - 2014-05-07 12:20 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Temp
2014-06-04 15:15 - 2014-06-04 15:15 - 00000000 _____ () C:\Users\Manuela\defogger_reenable
2014-06-04 15:15 - 2014-05-07 12:20 - 00000000 ____D () C:\Users\Manuela
2014-06-04 15:14 - 2014-05-07 12:25 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2466271035-3364438158-1365813384-1001
2014-06-04 15:13 - 2014-03-18 12:03 - 01776918 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-04 15:13 - 2014-03-18 11:25 - 00764340 _____ () C:\Windows\system32\perfh007.dat
2014-06-04 15:13 - 2014-03-18 11:25 - 00159160 _____ () C:\Windows\system32\perfc007.dat
2014-06-04 15:12 - 2014-05-07 15:15 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-06-04 15:11 - 2014-05-07 12:24 - 00002198 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-06-04 15:09 - 2014-06-04 14:11 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-04 15:09 - 2014-05-15 10:37 - 00000000 __RDO () C:\Users\Manuela\OneDrive
2014-06-04 15:09 - 2014-05-07 12:24 - 00001126 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-04 15:09 - 2014-03-18 03:50 - 00007398 _____ () C:\Windows\PFRO.log
2014-06-04 15:09 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\vpnplugins
2014-06-04 15:09 - 2013-08-22 16:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-04 15:01 - 2014-06-04 15:01 - 00032512 _____ () C:\Windows\system32\Drivers\hitmanpro37.sys
2014-06-04 15:01 - 2014-06-04 15:01 - 00000426 _____ () C:\Windows\system32\.crusader
2014-06-04 15:01 - 2014-06-04 14:58 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-06-04 15:00 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\sru
2014-06-04 14:56 - 2014-06-04 14:56 - 00000616 _____ () C:\Users\Manuela\Desktop\JRT.txt
2014-06-04 14:48 - 2014-06-04 14:48 - 00000000 ____D () C:\Windows\ERUNT
2014-06-04 14:42 - 2014-05-07 12:20 - 01622246 _____ () C:\Windows\WindowsUpdate.log
2014-06-04 14:41 - 2014-06-04 14:41 - 00000000 ____D () C:\AdwCleaner
2014-06-04 14:41 - 2014-05-07 12:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-06-04 14:41 - 2014-05-07 12:20 - 00001014 _____ () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-06-04 14:34 - 2014-05-07 12:24 - 00001130 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-04 14:18 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\Branding
2014-06-04 14:10 - 2014-06-04 14:10 - 00001121 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-04 14:10 - 2014-06-04 14:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-04 14:10 - 2014-06-04 14:10 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-04 14:10 - 2014-06-04 14:10 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-06-04 13:52 - 2014-05-08 08:13 - 00000020 ____H () C:\ProgramData\PKP_DLev.DAT
2014-06-04 13:52 - 2014-05-08 08:13 - 00000020 ____H () C:\ProgramData\PKP_DLet.DAT
2014-06-04 11:30 - 2013-08-22 15:25 - 00262144 ___SH () C:\Windows\system32\config\BBI
2014-06-04 11:20 - 2014-06-04 11:20 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Xilisoft
2014-06-04 11:19 - 2014-05-11 11:30 - 00000000 ____D () C:\Program Files (x86)\MSECache
2014-06-04 10:18 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\AppReadiness
2014-06-04 10:10 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\NDF
2014-06-02 21:02 - 2014-05-08 12:02 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\TS3Client
2014-05-27 13:46 - 2014-05-27 13:46 - 00000000 ____D () C:\Windows\LastGood.Tmp
2014-05-27 13:45 - 2014-05-07 12:27 - 00000000 ____D () C:\Program Files (x86)\Realtek
2014-05-27 13:01 - 2014-05-07 12:25 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-05-27 11:54 - 2014-05-27 11:54 - 00002086 _____ () C:\Users\Public\Desktop\NETGEAR WNDA4100 Genie.lnk
2014-05-27 11:54 - 2014-05-27 11:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NETGEAR WNDA4100 Genie
2014-05-27 11:54 - 2014-05-27 11:54 - 00000000 ____D () C:\Program Files (x86)\NETGEAR
2014-05-27 11:54 - 2014-05-27 11:54 - 00000000 ____D () C:\Program Files (x86)\Cisco
2014-05-27 11:54 - 2013-08-22 17:36 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp
2014-05-27 11:53 - 2014-05-08 08:13 - 00000000 ____D () C:\Windows\Downloaded Installations
2014-05-27 11:33 - 2014-05-27 11:31 - 00000000 ____D () C:\Users\Manuela\Desktop\ReportMaker
2014-05-26 17:55 - 2014-05-07 12:20 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Packages
2014-05-26 17:41 - 2014-05-09 09:51 - 00000000 ____D () C:\ProgramData\Nikon
2014-05-26 11:11 - 2014-05-26 11:11 - 00000000 ____D () C:\Users\Manuela\AppData\Local\NETGEAR
2014-05-26 11:11 - 2014-05-26 11:11 - 00000000 ____D () C:\ProgramData\NETGEAR
2014-05-26 10:03 - 2013-08-22 16:46 - 00046107 _____ () C:\Windows\setupact.log
2014-05-24 09:14 - 2014-05-07 13:32 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-05-16 16:14 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\rescache
2014-05-16 08:33 - 2013-08-22 17:36 - 00000000 ___RD () C:\Windows\ToastData
2014-05-16 08:33 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-05-16 08:33 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-05-16 08:33 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\WinStore
2014-05-16 08:33 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows Defender
2014-05-16 08:33 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
2014-05-15 09:59 - 2013-08-22 17:20 - 00000000 ____D () C:\Windows\CbsTemp
2014-05-15 09:58 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\SecureBootUpdates
2014-05-15 09:44 - 2014-05-07 12:20 - 00000000 ___RD () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-15 09:44 - 2014-05-07 12:20 - 00000000 ___RD () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-15 09:43 - 2014-05-07 13:49 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-15 09:43 - 2014-05-07 13:02 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-15 09:42 - 2014-05-07 13:02 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-15 09:42 - 2013-08-22 15:25 - 00262144 ___SH () C:\Windows\system32\config\ELAM
2014-05-13 20:19 - 2014-05-13 18:36 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Battle.net
2014-05-13 18:58 - 2014-05-13 18:36 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Battle.net
2014-05-13 18:46 - 2014-05-13 18:46 - 00000965 _____ () C:\Users\Public\Desktop\World of Warcraft.lnk
2014-05-13 18:46 - 2014-05-13 18:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft
2014-05-13 18:36 - 2014-05-13 18:36 - 00000841 _____ () C:\Users\Public\Desktop\Battle.net.lnk
2014-05-13 18:36 - 2014-05-13 18:36 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Blizzard Entertainment
2014-05-13 18:36 - 2014-05-13 18:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net
2014-05-13 18:36 - 2014-05-13 18:36 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment
2014-05-13 18:34 - 2014-05-13 18:34 - 00000000 ____D () C:\ProgramData\Battle.net
2014-05-12 07:26 - 2014-06-04 14:10 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-12 07:26 - 2014-06-04 14:10 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-12 07:25 - 2014-06-04 14:10 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-12 01:02 - 2014-05-11 13:04 - 00000000 ____D () C:\Users\Manuela\AppData\Local\PasswordSafe
2014-05-11 13:01 - 2014-05-11 13:01 - 00001049 _____ () C:\Users\Manuela\Desktop\Password Safe.lnk
2014-05-11 13:01 - 2014-05-11 13:01 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Password Safe
2014-05-11 13:01 - 2014-05-11 13:01 - 00000000 ____D () C:\Program Files (x86)\Password Safe
2014-05-09 16:18 - 2014-05-09 16:18 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Awesomium
2014-05-09 15:45 - 2014-05-09 15:45 - 00000000 ____D () C:\ProgramData\Elder Scrolls Online
2014-05-09 14:44 - 2014-05-09 14:44 - 00001060 _____ () C:\Users\Manuela\Desktop\The Elder Scrolls Online.lnk
2014-05-09 14:44 - 2014-05-09 14:44 - 00000000 ____D () C:\Windows\jre
2014-05-09 14:44 - 2014-05-09 14:44 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\The Elder Scrolls Online
2014-05-09 14:44 - 2014-05-09 14:01 - 00000000 ___HD () C:\Program Files (x86)\Zero G Registry
2014-05-09 13:59 - 2014-05-09 13:59 - 00000000 ___HD () C:\Users\Manuela\InstallAnywhere
2014-05-09 13:45 - 2014-05-07 13:56 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\vlc
2014-05-09 13:41 - 2014-05-09 13:41 - 00000890 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2014-05-09 13:41 - 2014-05-09 13:41 - 00000000 ____D () C:\Program Files\VideoLAN
2014-05-08 19:20 - 2014-05-08 19:20 - 00001301 _____ () C:\Users\Public\Desktop\FINAL FANTASY XIV - A Realm Reborn.lnk
2014-05-08 18:59 - 2014-05-08 18:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SQUARE ENIX
2014-05-08 18:57 - 2014-05-08 18:57 - 00000000 ____D () C:\Windows\SysWOW64\XPSViewer
2014-05-08 18:57 - 2014-05-08 18:57 - 00000000 ____D () C:\Program Files\Reference Assemblies
2014-05-08 18:57 - 2014-05-08 18:57 - 00000000 ____D () C:\Program Files\MSBuild
2014-05-08 18:57 - 2014-05-08 18:57 - 00000000 ____D () C:\Program Files (x86)\Reference Assemblies
2014-05-08 18:57 - 2014-05-08 18:57 - 00000000 ____D () C:\Program Files (x86)\MSBuild
2014-05-08 18:57 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\SysWOW64\MUI
2014-05-08 18:57 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\MUI
2014-05-08 18:56 - 2014-05-08 18:56 - 00010085 _____ () C:\Windows\DirectX.log
2014-05-08 12:02 - 2014-05-08 12:02 - 00000881 _____ () C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2014-05-08 12:02 - 2014-05-08 12:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
2014-05-08 08:24 - 2014-05-08 08:23 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Nikon
2014-05-08 08:23 - 2014-05-08 08:23 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Nikon
2014-05-08 08:21 - 2014-05-08 08:21 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2014-05-08 08:15 - 2014-05-08 08:15 - 00002077 _____ () C:\Users\Public\Desktop\Panorama Maker 6.lnk
2014-05-08 08:15 - 2014-05-08 08:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ArcSoft Panorama Maker 6
2014-05-08 08:15 - 2014-05-08 08:15 - 00000000 ____D () C:\Program Files (x86)\ArcSoft
2014-05-08 08:14 - 2014-05-08 08:14 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\ArcSoft
2014-05-08 08:13 - 2014-05-08 08:13 - 00106496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ATL71.DLL
2014-05-08 08:13 - 2014-05-08 08:13 - 00002072 _____ () C:\Users\Public\Desktop\ViewNX 2.lnk
2014-05-08 08:13 - 2014-05-08 08:13 - 00000268 ___RH () C:\Users\Manuela\AppData\Roaming\Stingers
2014-05-08 08:13 - 2014-05-08 08:13 - 00000268 ___RH () C:\Users\Manuela\AppData\Roaming\StatusSheet
2014-05-08 08:13 - 2014-05-08 08:13 - 00000268 ___RH () C:\Users\Manuela\AppData\Roaming\Static Library
2014-05-08 08:13 - 2014-05-08 08:13 - 00000268 ___RH () C:\ProgramData\Super Strings
2014-05-08 08:13 - 2014-05-08 08:13 - 00000268 ___RH () C:\ProgramData\Strings
2014-05-08 08:13 - 2014-05-08 08:13 - 00000268 ___RH () C:\ProgramData\String Ensemble
2014-05-08 08:13 - 2014-05-08 08:13 - 00000020 ____H () C:\ProgramData\PKP_DLes.DAT
2014-05-08 08:13 - 2014-05-08 08:13 - 00000012 ___RH () C:\ProgramData\Track Settings
2014-05-08 08:13 - 2014-05-08 08:13 - 00000012 ___RH () C:\ProgramData\Textures
2014-05-08 08:13 - 2014-05-08 08:13 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Downloaded Installations
2014-05-08 08:13 - 2014-05-08 08:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ViewNX 2
2014-05-08 08:13 - 2014-05-08 08:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nikon Message Center 2
2014-05-08 08:13 - 2014-05-08 08:13 - 00000000 ____D () C:\ProgramData\54F3DE4E-B7BA-4EBD-8B3B-385D272CC583
2014-05-08 08:13 - 2014-05-08 08:13 - 00000000 ____D () C:\Program Files\Nikon
2014-05-08 08:13 - 2014-05-08 08:13 - 00000000 ____D () C:\Program Files\Common Files\Nikon
2014-05-08 08:13 - 2014-05-08 08:13 - 00000000 ____D () C:\Program Files (x86)\Nikon
2014-05-08 08:13 - 2014-05-08 08:12 - 00000012 ___RH () C:\ProgramData\Techno Kit
2014-05-08 08:13 - 2014-05-08 08:12 - 00000000 ____D () C:\ProgramData\Ultima_T15
2014-05-08 08:13 - 2014-05-08 08:12 - 00000000 ____D () C:\ProgramData\EnterNHelp
2014-05-08 08:12 - 2014-05-08 08:12 - 00000268 ___RH () C:\Users\Manuela\AppData\Roaming\Synth Textures
2014-05-08 08:12 - 2014-05-08 08:12 - 00000020 ____H () C:\ProgramData\PKP_DLeo.DAT
2014-05-08 08:12 - 2014-05-08 08:12 - 00000012 ___RH () C:\ProgramData\deskjet
2014-05-08 08:12 - 2014-05-08 08:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Link to Nikon
2014-05-08 08:12 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2014-05-08 00:02 - 2014-05-08 00:02 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
2014-05-07 22:21 - 2014-05-07 22:21 - 00122480 _____ () C:\Users\Manuela\AppData\Local\GDIPFONTCACHEV1.DAT
2014-05-07 21:33 - 2014-05-07 21:33 - 00007177 _____ () C:\Windows\system32\lvcoinst.log
2014-05-07 21:33 - 2014-05-07 21:33 - 00000000 ____D () C:\Program Files\Common Files\logishrd
2014-05-07 21:21 - 2014-05-07 21:21 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_bcmwlhigh664_01009.Wdf
2014-05-07 21:21 - 2014-05-07 21:21 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\InstallShield
2014-05-07 17:17 - 2014-05-07 13:32 - 00000000 ____D () C:\ProgramData\Adobe
2014-05-07 17:14 - 2014-05-07 17:14 - 00000000 __SHD () C:\Users\Manuela\AppData\Local\EmieUserList
2014-05-07 17:14 - 2014-05-07 17:14 - 00000000 __SHD () C:\Users\Manuela\AppData\Local\EmieSiteList
2014-05-07 17:13 - 2014-05-07 17:13 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Adobe
2014-05-07 17:13 - 2014-05-07 12:20 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Adobe
2014-05-07 15:35 - 2014-05-07 15:27 - 00002353 _____ () C:\Users\Manuela\Desktop\Sicherer Zahlungsverkehr.lnk
2014-05-07 15:31 - 2014-05-07 15:15 - 00625760 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-05-07 15:31 - 2014-05-07 15:15 - 00115296 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2014-05-07 15:31 - 2013-10-17 15:47 - 00458336 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kl1.sys
2014-05-07 15:31 - 2013-10-17 15:47 - 00029280 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klkbdflt.sys
2014-05-07 15:31 - 2013-06-06 17:38 - 00178272 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kneps.sys
2014-05-07 15:31 - 2013-05-07 17:56 - 00065120 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klwfp.sys
2014-05-07 15:31 - 2012-07-27 18:38 - 00029792 _____ (Kaspersky Lab) C:\Windows\system32\Drivers\klelam.sys
2014-05-07 15:27 - 2014-05-07 15:27 - 00001348 _____ () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security.lnk
2014-05-07 15:15 - 2014-05-07 15:15 - 00001143 _____ () C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
2014-05-07 15:15 - 2014-05-07 15:15 - 00000000 ____D () C:\Program Files (x86)\Kaspersky Lab
2014-05-07 15:15 - 2013-08-22 17:36 - 00000000 ___HD () C:\Windows\ELAMBKUP
2014-05-07 14:35 - 2013-07-29 14:46 - 00000000 ____D () C:\Program Files (x86)\aida64extreme300
2014-05-07 14:24 - 2014-05-07 14:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-05-07 14:23 - 2014-05-07 14:23 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-05-07 14:23 - 2014-05-07 14:23 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-05-07 14:14 - 2013-08-22 16:44 - 00478696 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-05-07 14:07 - 2014-05-07 14:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Live Add-in
2014-05-07 14:05 - 2014-05-07 13:49 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
2014-05-07 14:04 - 2014-05-07 14:04 - 00000000 ____D () C:\Users\Default\AppData\Local\Microsoft Help
2014-05-07 14:04 - 2014-05-07 14:04 - 00000000 ____D () C:\Users\Default User\AppData\Local\Microsoft Help
2014-05-07 14:02 - 2013-08-22 15:25 - 00000167 _____ () C:\Windows\win.ini
2014-05-07 14:01 - 2014-05-07 14:01 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_LocationProvider_01_11_00.Wdf
2014-05-07 14:00 - 2014-05-07 13:59 - 00000000 ____D () C:\Users\Manuela\Desktop\MS Office
2014-05-07 13:56 - 2014-05-07 13:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-05-07 13:53 - 2014-05-07 13:51 - 00000000 ____D () C:\Program Files (x86)\Microsoft Works
2014-05-07 13:52 - 2014-05-07 13:52 - 00002655 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Neues Microsoft Office-Dokument.lnk
2014-05-07 13:52 - 2014-05-07 13:52 - 00002655 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Microsoft Office-Dokument öffnen.lnk
2014-05-07 13:52 - 2014-05-07 13:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2014-05-07 13:51 - 2014-05-07 13:51 - 00000000 ____D () C:\Windows\PCHEALTH
2014-05-07 13:51 - 2014-05-07 13:51 - 00000000 ____D () C:\Program Files (x86)\Microsoft Visual Studio
2014-05-07 13:51 - 2014-03-18 11:40 - 00000000 ____D () C:\Windows\ShellNew
2014-05-07 13:50 - 2014-05-07 13:50 - 00000000 ____D () C:\Program Files\Microsoft Office
2014-05-07 13:49 - 2014-05-07 13:49 - 00000000 __RHD () C:\MSOCache
2014-05-07 13:49 - 2014-05-07 13:49 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Microsoft Help
2014-05-07 13:41 - 2014-05-07 13:41 - 00001006 _____ () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TextPad.lnk
2014-05-07 13:41 - 2014-05-07 13:41 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Helios
2014-05-07 13:41 - 2014-05-07 13:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TextPad
2014-05-07 13:41 - 2014-05-07 13:41 - 00000000 ____D () C:\Program Files (x86)\TextPad 6
2014-05-07 13:39 - 2014-05-07 13:39 - 00001968 _____ () C:\Users\Public\Desktop\CDBurnerXP.lnk
2014-05-07 13:39 - 2014-05-07 13:39 - 00001918 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2014-05-07 13:39 - 2014-05-07 13:39 - 00001017 _____ () C:\Users\Public\Desktop\IrfanView.lnk
2014-05-07 13:39 - 2014-05-07 13:39 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\IrfanView
2014-05-07 13:39 - 2014-05-07 13:39 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Canneverbe Limited
2014-05-07 13:39 - 2014-05-07 13:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IrfanView
2014-05-07 13:39 - 2014-05-07 13:39 - 00000000 ____D () C:\ProgramData\Canneverbe Limited
2014-05-07 13:39 - 2014-05-07 13:39 - 00000000 ____D () C:\Program Files (x86)\IrfanView
2014-05-07 13:39 - 2014-05-07 13:39 - 00000000 ____D () C:\Program Files (x86)\CDBurnerXP
2014-05-07 13:32 - 2014-05-07 13:32 - 00002042 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2014-05-07 13:32 - 2014-05-07 13:32 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-05-07 13:29 - 2014-05-07 12:24 - 00004102 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-07 13:29 - 2014-05-07 12:24 - 00003866 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-05-07 13:28 - 2014-05-07 13:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
2014-05-07 13:06 - 2014-05-07 13:06 - 00003554 _____ () C:\Windows\System32\Tasks\CreateChoiceProcessTask
2014-05-07 13:05 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\setup
2014-05-07 13:03 - 2014-05-07 13:03 - 00000000 ___RD () C:\Windows\BrowserChoice
2014-05-07 13:01 - 2013-08-22 17:36 - 00262144 _____ () C:\Windows\system32\config\BCD-Template
2014-05-07 12:56 - 2014-05-07 12:56 - 00000000 ____D () C:\Program Files (x86)\TeamViewer
2014-05-07 12:55 - 2014-05-07 12:55 - 04610320 _____ (TeamViewer) C:\Users\Manuela\Desktop\Fernwartung.exe
2014-05-07 12:55 - 2014-05-07 12:55 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\TeamViewer
2014-05-07 12:55 - 2014-05-07 12:55 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Macromedia
2014-05-07 12:54 - 2014-05-07 12:54 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2014-05-07 12:54 - 2014-05-07 12:54 - 00000000 ____D () C:\ProgramData\ATI
2014-05-07 12:53 - 2014-05-07 12:53 - 00060993 _____ () C:\Windows\SysWOW64\CCCInstall_201405071253555882.log
2014-05-07 12:53 - 2014-05-07 12:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2014-05-07 12:53 - 2014-05-07 12:53 - 00000000 ____D () C:\Program Files\ATI Technologies
2014-05-07 12:53 - 2014-05-07 12:53 - 00000000 ____D () C:\Program Files (x86)\AMD AVT
2014-05-07 12:53 - 2014-05-07 12:26 - 00000000 ____D () C:\Program Files (x86)\ATI Technologies
2014-05-07 12:53 - 2014-05-07 12:24 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Google
2014-05-07 12:34 - 2014-05-07 12:34 - 00000000 ____D () C:\Users\Manuela\AppData\Local\AMD
2014-05-07 12:30 - 2014-05-07 12:29 - 00000189 _____ () C:\Windows\LAN.log
2014-05-07 12:30 - 2014-05-07 12:23 - 00040014 _____ () C:\Windows\Ascd_log.ini
2014-05-07 12:28 - 2014-05-07 12:28 - 00000000 ____D () C:\Windows\SysWOW64\RTCOM
2014-05-07 12:28 - 2014-05-07 12:28 - 00000000 ____D () C:\Program Files\Realtek
2014-05-07 12:28 - 2014-05-07 12:27 - 00002217 _____ () C:\RHDSetup.log
2014-05-07 12:28 - 2014-05-07 12:27 - 00000206 _____ () C:\Windows\audio.log
2014-05-07 12:28 - 2014-05-07 12:27 - 00000000 ___HD () C:\Program Files (x86)\Temp
2014-05-07 12:26 - 2014-05-07 12:26 - 00059972 _____ () C:\Windows\SysWOW64\CCCInstall_201405071226012588.log
2014-05-07 12:26 - 2014-05-07 12:26 - 00000000 ____D () C:\Windows\AsusInstAll
2014-05-07 12:26 - 2014-05-07 12:26 - 00000000 ____D () C:\Program Files (x86)\AMD APP
2014-05-07 12:25 - 2014-05-07 12:25 - 00060817 _____ () C:\Windows\SysWOW64\CCCInstall_201405071225252375.log
2014-05-07 12:25 - 2014-05-07 12:25 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\ATI
2014-05-07 12:25 - 2014-05-07 12:25 - 00000000 ____D () C:\Users\Manuela\AppData\Local\ATI
2014-05-07 12:25 - 2014-05-07 12:25 - 00000000 ____D () C:\ProgramData\Package Cache
2014-05-07 12:25 - 2014-05-07 12:25 - 00000000 ____D () C:\ProgramData\AMD
2014-05-07 12:25 - 2014-05-07 12:25 - 00000000 ____D () C:\Program Files\ATI
2014-05-07 12:24 - 2014-05-07 12:24 - 00000000 ____D () C:\Program Files\Common Files\ATI Technologies
2014-05-07 12:24 - 2014-05-07 12:24 - 00000000 ____D () C:\Program Files\AMD
2014-05-07 12:24 - 2014-05-07 12:24 - 00000000 ____D () C:\Program Files (x86)\Google
2014-05-07 12:24 - 2014-05-07 12:24 - 00000000 ____D () C:\AMD
2014-05-07 12:24 - 2014-05-07 12:24 - 00000000 _____ () C:\Windows\ativpsrm.bin
2014-05-07 12:24 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\restore
2014-05-07 12:23 - 2014-05-07 12:23 - 00029380 _____ () C:\Windows\Ascd_tmp.ini
2014-05-07 12:23 - 2014-05-07 12:23 - 00001769 _____ () C:\Windows\Language_trs.ini
2014-05-07 12:20 - 2014-05-07 13:01 - 00000000 ____D () C:\Windows\Panther
2014-05-07 12:20 - 2014-05-07 12:20 - 00000020 ___SH () C:\Users\Manuela\ntuser.ini
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 _SHDL () C:\Users\Manuela\Vorlagen
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 _SHDL () C:\Users\Manuela\Startmenü
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 _SHDL () C:\Users\Manuela\Netzwerkumgebung
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 _SHDL () C:\Users\Manuela\Lokale Einstellungen
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 _SHDL () C:\Users\Manuela\Eigene Dateien
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 _SHDL () C:\Users\Manuela\Druckumgebung
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 _SHDL () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 _SHDL () C:\Users\Manuela\AppData\Local\Verlauf
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 _SHDL () C:\Users\Manuela\AppData\Local\Anwendungsdaten
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 _SHDL () C:\Users\Manuela\Anwendungsdaten
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 ____D () C:\Users\Manuela\AppData\Local\VirtualStore
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default\Vorlagen
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default\Startmenü
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default\Netzwerkumgebung
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default\Lokale Einstellungen
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default\Eigene Dateien
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default\Druckumgebung
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Verlauf
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Anwendungsdaten
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default\Anwendungsdaten
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Verlauf
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Anwendungsdaten
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Programme
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\ProgramData\Vorlagen
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\ProgramData\Startmenü
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\ProgramData\Microsoft\Windows\Start Menu\Programme
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\ProgramData\Dokumente
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\ProgramData\Anwendungsdaten
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Program Files\Gemeinsame Dateien
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Dokumente und Einstellungen
2014-05-07 12:03 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows NT
2014-05-07 12:03 - 2013-08-22 15:36 - 00000000 __RHD () C:\Users\Default
2014-05-07 12:02 - 2013-08-22 17:37 - 00002664 _____ () C:\Windows\DtcInstall.log
2014-05-07 12:02 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\Recovery
2014-05-06 06:40 - 2014-05-15 09:41 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-06 05:25 - 2014-05-15 09:41 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-06 05:00 - 2014-05-15 09:41 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-06 04:10 - 2014-05-15 09:41 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

Files to move or delete:
====================
C:\ProgramData\PKP_DLeo.DAT
C:\ProgramData\PKP_DLes.DAT
C:\ProgramData\PKP_DLet.DAT
C:\ProgramData\PKP_DLev.DAT


Some content of TEMP:
====================
C:\Users\Manuela\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-06-02 12:08

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-06-2014
Ran by Manuela at 2014-06-04 15:24:56
Running from H:\MyOwnDATA\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}

==================== Installed Programs ======================

2007 Microsoft Office Suite Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
2007 Microsoft Office Suite Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Reader XI (11.0.07) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
AMD Accelerated Video Transcoding (Version: 13.20.100.31206 - Advanced Micro Devices, Inc.) Hidden
AMD APP SDK Runtime (Version: 10.0.938.2 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Control Center (x32 Version: 2013.1206.1603.28764 - Ihr Firmenname) Hidden
AMD Catalyst Install Manager (HKLM\...\{FD8FD2BD-A82D-C528-EDA0-A6635F47C19C}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
AMD Fuel (Version: 2013.1206.1603.28764 - Ihr Firmenname) Hidden
ArcSoft Panorama Maker 6 (HKLM-x32\...\{DABFD34E-BE68-4BC6-9254-5D7A7FF76B99}) (Version: 6.0.8.85 - ArcSoft)
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.3.4746 - CDBurnerXP)
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
FINAL FANTASY XIV - A Realm Reborn (HKLM-x32\...\{2B41E132-07DF-4925-A3D3-F2D1765CCDFE}) (Version: 1.0.0000 - SQUARE ENIX CO., LTD.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 35.0.1916.114 - Google Inc.)
Google Update Helper (x32 Version: 1.3.24.7 - Google Inc.) Hidden
HydraVision (x32 Version: 4.2.252.0 - Advanced Micro Devices, Inc.) Hidden
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.35 - Irfan Skiljan)
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{6F6873E3-5C92-4049-B511-231A138DD090}) (Version: 14.0.0.4651 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 14.0.0.4651 - Kaspersky Lab) Hidden
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme (HKLM-x32\...\{90120000-00B2-0407-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint Viewer 2007 (English) (HKLM-x32\...\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6425.1000 - Microsoft Corporation)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
NETGEAR WNDA4100 (x32 Version: 1.2.0.10 - NETGEAR) Hidden
NETGEAR WNDA4100 Genie (HKLM-x32\...\InstallShield_{422FB885-2E3D-4F0C-8C47-BF4336B5318B}) (Version: 1.2.0.10 - NETGEAR)
NETGEAR WNDA4100 Genie (x32 Version: 1.2.0.10 - NETGEAR) Hidden
Nikon Message Center 2 (HKLM-x32\...\{B014EE44-9197-4513-9613-71E6EB1B514E}) (Version: 2.1.0 - Nikon)
Nikon Movie Editor (HKLM-x32\...\{5CAD3393-EEC0-44CE-9F93-BCAA365B77FB}) (Version: 2.9.0 - Nikon)
Password Safe (HKLM-x32\...\Password Safe) (Version:  - )
Picture Control Utility x64 (HKLM\...\{11953C65-BB4E-4CA4-B0F0-2600A4B20040}) (Version: 1.5.0 - Nikon)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.19.726.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6657 - Realtek Semiconductor Corp.)
TeamSpeak 3 Client (HKLM-x32\...\TeamSpeak 3 Client) (Version: 3.0.14 - TeamSpeak Systems GmbH)
TextPad 6 (HKLM-x32\...\{3F04067F-0DA5-4F48-9A89-6FCFD2A9E040}) (Version: 6.2.2 - Helios)
The Elder Scrolls Online (HKLM-x32\...\The Elder Scrolls Online) (Version: 1.0.0.0 - Zenimax Online Studios)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2880505) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{2720451F-5D04-43EC-AB1F-26D948FD971B}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
ViewNX 2 (HKLM\...\{635BE602-BB9C-4C59-8CC5-93F9366E8A21}) (Version: 2.9.0 - Nikon)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
VLC media player 2.1.4 (HKLM\...\VLC media player) (Version: 2.1.4 - VideoLAN)
World of Warcraft (HKLM-x32\...\World of Warcraft) (Version:  - Blizzard Entertainment)

==================== Restore Points  =========================

15-05-2014 07:41:22 Windows Update
23-05-2014 10:12:24 Geplanter Prüfpunkt
26-05-2014 09:07:43 Entfernt NETGEAR WNA3100 wireless USB 2.0 adapter
27-05-2014 09:53:57 Installiert NETGEAR WNDA4100 Genie
04-06-2014 08:42:36 Geplanter Prüfpunkt

==================== Hosts content: ==========================

2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0424EF80-62E8-4D41-ACD6-3C47658D8BCE} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-05-07] (Google Inc.)
Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask
Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {188FF6F0-7D73-41B6-B262-65E1BD5F9F0A} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-05-07] (Google Inc.)
Task: {1DE0CA86-2FC0-42EE-B3E5-675AE49C6571} - System32\Tasks\Microsoft\Windows\DiskFootprint\Diagnostics
Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {2559CBD2-D54B-411A-84C9-E2A689E2115A} - System32\Tasks\Microsoft\Windows\DiskCleanup\SilentCleanup => C:\Windows\system32\cleanmgr.exe [2014-03-18] (Microsoft Corporation)
Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation)
Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation)
Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance
Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup
Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task
Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {7BB1EC61-3140-48A7-9245-3DD56ECC42BA} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Management
Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task
Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask
Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work
Task: {BD8DE8B9-9331-463F-9746-9F2BB62B0C3B} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start With Network => Sc.exe start wuauserv
Task: {C906E372-BAE7-4E16-9A67-BEFB2FE13F1E} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2014-05-15] (Microsoft Corporation)
Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask
Task: {D4F1838F-B2D1-4B45-AEF2-FB800DF0E0ED} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Validation
Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization
Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-12-06 16:06 - 2013-12-06 16:06 - 00214528 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.PerformanceTuning.dll
2013-07-26 05:59 - 2013-07-26 05:59 - 00814592 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dll
2013-07-26 05:59 - 2013-07-26 05:59 - 03650560 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Platform.dll
2013-12-06 16:06 - 2013-12-06 16:06 - 00127488 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2013-12-06 16:06 - 2013-12-06 16:06 - 00102400 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2013-06-17 12:35 - 2013-06-17 12:35 - 00478400 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\dblite.dll
2013-05-08 14:52 - 2013-05-08 14:52 - 01270464 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\kpcengine.2.3.dll
2013-01-09 10:09 - 2013-01-09 10:09 - 00118784 _____ () C:\Program Files (x86)\NETGEAR\WNDA4100\Ralink.dll
2014-05-23 13:40 - 2014-05-14 01:40 - 00716616 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\libglesv2.dll
2014-05-23 13:40 - 2014-05-14 01:40 - 00126280 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\libegl.dll
2014-05-23 13:40 - 2014-05-14 01:40 - 04217672 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\pdf.dll
2014-05-23 13:40 - 2014-05-14 01:40 - 00414536 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\ppGoogleNaClPluginChrome.dll
2014-05-23 13:40 - 2014-05-14 01:40 - 01732424 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\ffmpegsumo.dll
2014-05-23 13:40 - 2014-05-14 01:40 - 13695816 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\PepperFlash\pepflashplayer.dll
2009-02-26 13:46 - 2009-02-26 13:46 - 00064344 _____ () C:\Program Files (x86)\Microsoft Office\Office12\ADDINS\ColleagueImport.dll
2011-06-22 11:46 - 2011-06-22 11:46 - 00434016 _____ () C:\Program Files (x86)\Microsoft Office\Office12\ADDINS\UmOutlookAddin.dll
2013-07-10 18:07 - 2013-07-10 18:07 - 00756888 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\Users\Manuela\OneDrive:ms-properties

==================== Safe Mode (whitelisted) ===================


==================== EXE Association (whitelisted) =============


==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============
Error: (06/04/2014 03:01:51 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "HitmanPro 3.7 Crusader (Boot)" wurde mit dem folgenden dienstspezifischen Fehler beendet: 
%%0

Error: (06/04/2014 03:01:19 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "DeleteFlag" aufgrund folgenden Fehlers fehlgeschlagen: 
%%5


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2014-05-27 12:59:20.889
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-05-27 12:59:20.850
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-05-27 12:59:20.108
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-05-27 12:59:20.069
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-05-27 12:59:19.191
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-05-27 12:59:19.151
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-05-27 12:59:19.105
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-05-27 12:59:19.066
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-05-27 12:59:19.019
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-05-27 12:59:18.977
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Memory info =========================== 

Percentage of memory in use: 20%
Total physical RAM: 8140.97 MB
Available physical RAM: 6488.86 MB
Total Pagefile: 9420.97 MB
Available Pagefile: 7215.48 MB
Total Virtual: 131072 MB
Available Virtual: 131071.8 MB

==================== Drives ================================

Drive c: (SSD) (Fixed) (Total:111.45 GB) (Free:80.83 GB) NTFS
Drive h: (Festplatte) (Fixed) (Total:931.51 GB) (Free:847.46 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 112 GB) (Disk ID: EAD35650)
Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=111 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 7696710D)
Partition 1: (Not Active) - (Size=932 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

Auch GMER gibt es in 2 Teilen:

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-06-04 15:33:43
Windows 6.2.9200  x64 \Device\Harddisk0\DR0 -> \Device\00000029 KINGSTON_SV300S37A120G rev.521ABBF0 111,79GB
Running: Gmer-19357.exe; Driver: C:\Users\Manuela\AppData\Local\Temp\fwtdapob.sys


---- User code sections - GMER 2.1 ----

.text    C:\Windows\system32\atiesrxx.exe[992] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                                 00007ffcd8af169a 4 bytes [AF, D8, FC, 7F]
.text    C:\Windows\system32\atiesrxx.exe[992] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                                 00007ffcd8af16a2 4 bytes [AF, D8, FC, 7F]
.text    C:\Windows\system32\atiesrxx.exe[992] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118                                                    00007ffcd8af181a 4 bytes [AF, D8, FC, 7F]
.text    C:\Windows\system32\atiesrxx.exe[992] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142                                                    00007ffcd8af1832 4 bytes [AF, D8, FC, 7F]
.text    C:\Windows\system32\atieclxx.exe[440] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506                                                 00007ffcd8af169a 4 bytes [AF, D8, FC, 7F]
.text    C:\Windows\system32\atieclxx.exe[440] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514                                                 00007ffcd8af16a2 4 bytes [AF, D8, FC, 7F]
.text    C:\Windows\system32\atieclxx.exe[440] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118                                                    00007ffcd8af181a 4 bytes [AF, D8, FC, 7F]
.text    C:\Windows\system32\atieclxx.exe[440] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142                                                    00007ffcd8af1832 4 bytes [AF, D8, FC, 7F]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!RtlDefaultNpAcl + 772                          00007ffcda80293c 8 bytes {JMP 0xffffffffffffff8c}
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!WinSqmAddToAverageDWORD + 21                   00007ffcda802959 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!WinSqmSetIfMaxDWORD + 95                       00007ffcda8029c7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWriteEndScenario + 220                 00007ffcda802aac 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!WinSqmEndSession + 272                         00007ffcda802bc4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!WinSqmStartSession + 8                         00007ffcda803018 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!WinSqmStartSession + 940                       00007ffcda8033bc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWriteFull + 64                         00007ffcda803404 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWriteFull + 503                        00007ffcda8035bb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!WinSqmIsSessionDisabled + 792                  00007ffcda803fe0 8 bytes {JMP 0xffffffffffffffa9}
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!RtlVerifyVersionInfo + 835                     00007ffcda804933 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 336                        00007ffcda804bac 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 472                        00007ffcda804c34 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                          * 2
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!RtlGetNtProductType + 567                      00007ffcda80543f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!WinSqmAddToStream + 592                        00007ffcda8056b4 8 bytes {JMP 0xffffffffffffffa9}
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!WinSqmAddToStreamEx + 875                      00007ffcda805a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!WinSqmEventEnabled + 139                       00007ffcda805f8b 8 bytes {JMP 0xffffffffffffffd1}
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!WinSqmEventEnabled + 224                       00007ffcda805fe0 16 bytes {JMP 0xffffffffffffffcf}
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!WinSqmEventWrite + 119                         00007ffcda8060df 8 bytes {JMP 0xffffffffffffffac}
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWrite + 43                             00007ffcda806113 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWrite + 628                            00007ffcda80635c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                          * 3
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateBoundaryDescriptor + 584              00007ffcda806658 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!RtlAddSIDToBoundaryDescriptor + 8              00007ffcda806668 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!RtlAddSIDToBoundaryDescriptor + 519            00007ffcda806867 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteBoundaryDescriptor + 23               00007ffcda806887 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!A_SHAFinal + 300                               00007ffcda806bf0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!A_SHAInit + 44                                 00007ffcda806c24 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateServiceSid + 292                      00007ffcda809188 8 bytes {JMP 0xffffffffffffffdc}
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!RtlLengthRequiredSid + 20                      00007ffcda8091a4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!RtlLengthRequiredSid + 352                     00007ffcda8092f0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeSid + 35                          00007ffcda80931b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!RtlAddAce + 339                                00007ffcda80950b 8 bytes {JMP 0xffffffffffffffdc}
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!RtlNewSecurityObjectEx + 99                    00007ffcda809577 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!RtlIsValidProcessTrustLabelSid + 103           00007ffcda8095e7 8 bytes {JMP 0xffffffffffffffe6}
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!RtlIsValidProcessTrustLabelSid + 751           00007ffcda80986f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!RtlSidDominatesForTrust + 135                  00007ffcda809a67 8 bytes {JMP 0xffffffffffffffaa}
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateSecurityDescriptor + 43               00007ffcda80a7bf 8 bytes {JMP 0xfffffffffffffff5}
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!RtlSetDaclSecurityDescriptor + 104             00007ffcda80a8e8 8 bytes {JMP 0xffffffffffffffe5}
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!RtlAddMandatoryAce + 356                       00007ffcda80aa78 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!RtlMapGenericMask + 64                         00007ffcda80d270 8 bytes {JMP 0xffffffffffffffd0}
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!RtlOpenCurrentUser + 208                       00007ffcda80d39c 8 bytes {JMP 0xffffffffffffffa3}
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!RtlCheckTokenCapability + 952                  00007ffcda80d75c 8 bytes [F0, 69, F3, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!RtlAppendUnicodeToString + 167                 00007ffcda80e56b 8 bytes [D0, 69, F3, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!RtlLengthSidAsUnicodeString + 84               00007ffcda80e5c8 8 bytes {JMP 0xffffffffffffffdc}
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!RtlValidSecurityDescriptor + 243               00007ffcda80e6c3 8 bytes [B0, 69, F3, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!RtlAddAccessAllowedAce + 379                   00007ffcda80e847 8 bytes [A0, 69, F3, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                         00007ffcda88ac50 8 bytes {JMP QWORD [RIP-0x7c8ac]}
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                       00007ffcda88add0 8 bytes {JMP QWORD [RIP-0x7c86b]}
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                             00007ffcda88ae00 8 bytes {JMP QWORD [RIP-0x7db96]}
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                           00007ffcda88af20 8 bytes {JMP QWORD [RIP-0x7d7ca]}
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                               00007ffcda88afd0 8 bytes {JMP QWORD [RIP-0x7dc3a]}
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                               00007ffcda88b690 8 bytes {JMP QWORD [RIP-0x7ce4f]}
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                             00007ffcda88b990 8 bytes {JMP QWORD [RIP-0x7d2d3]}
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                             00007ffcda88c210 8 bytes {JMP QWORD [RIP-0x7dc4e]}
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 381                         0000000076f6137d 16 bytes {JMP 0xffffffffffffffd3}
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 386                         0000000076f61512 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49               0000000076f61551 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\system32\wow64cpu.dll!CpuSetStackPointer + 23                     0000000076f61577 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 516             0000000076f61784 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\system32\wow64cpu.dll!CpuThreadInit + 50                          0000000076f617c2 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23                     0000000076f617e7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68                         0000000076f61834 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 1                 0000000076f61841 24 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 513               0000000076f61a41 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                          * 2
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16               0000000076f62ae0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308           0000000076f62c1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2892] C:\Windows\system32\wow64cpu.dll!CpuProcessDebugEvent + 3                    0000000076f62c43 8 bytes [7C, 68, F3, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!RtlDefaultNpAcl + 772                    00007ffcda80293c 8 bytes {JMP 0xffffffffffffff8c}
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!WinSqmAddToAverageDWORD + 21             00007ffcda802959 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!WinSqmSetIfMaxDWORD + 95                 00007ffcda8029c7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWriteEndScenario + 220           00007ffcda802aac 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!WinSqmEndSession + 272                   00007ffcda802bc4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!WinSqmStartSession + 8                   00007ffcda803018 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!WinSqmStartSession + 940                 00007ffcda8033bc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWriteFull + 64                   00007ffcda803404 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWriteFull + 503                  00007ffcda8035bb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!WinSqmIsSessionDisabled + 792            00007ffcda803fe0 8 bytes {JMP 0xffffffffffffffa9}
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!RtlVerifyVersionInfo + 835               00007ffcda804933 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 336                  00007ffcda804bac 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 472                  00007ffcda804c34 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                          * 2
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!RtlGetNtProductType + 567                00007ffcda80543f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!WinSqmAddToStream + 592                  00007ffcda8056b4 8 bytes {JMP 0xffffffffffffffa9}
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!WinSqmAddToStreamEx + 875                00007ffcda805a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!WinSqmEventEnabled + 139                 00007ffcda805f8b 8 bytes {JMP 0xffffffffffffffd1}
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!WinSqmEventEnabled + 224                 00007ffcda805fe0 16 bytes {JMP 0xffffffffffffffcf}
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!WinSqmEventWrite + 119                   00007ffcda8060df 8 bytes {JMP 0xffffffffffffffac}
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWrite + 43                       00007ffcda806113 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWrite + 628                      00007ffcda80635c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                          * 3
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateBoundaryDescriptor + 584        00007ffcda806658 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!RtlAddSIDToBoundaryDescriptor + 8        00007ffcda806668 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!RtlAddSIDToBoundaryDescriptor + 519      00007ffcda806867 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteBoundaryDescriptor + 23         00007ffcda806887 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!A_SHAFinal + 300                         00007ffcda806bf0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!A_SHAInit + 44                           00007ffcda806c24 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateServiceSid + 292                00007ffcda809188 8 bytes {JMP 0xffffffffffffffdc}
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!RtlLengthRequiredSid + 20                00007ffcda8091a4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!RtlLengthRequiredSid + 352               00007ffcda8092f0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeSid + 35                    00007ffcda80931b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!RtlAddAce + 339                          00007ffcda80950b 8 bytes {JMP 0xffffffffffffffdc}
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!RtlNewSecurityObjectEx + 99              00007ffcda809577 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!RtlIsValidProcessTrustLabelSid + 103     00007ffcda8095e7 8 bytes {JMP 0xffffffffffffffe6}
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!RtlIsValidProcessTrustLabelSid + 751     00007ffcda80986f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!RtlSidDominatesForTrust + 135            00007ffcda809a67 8 bytes {JMP 0xffffffffffffffaa}
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateSecurityDescriptor + 43         00007ffcda80a7bf 8 bytes {JMP 0xfffffffffffffff5}
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!RtlSetDaclSecurityDescriptor + 104       00007ffcda80a8e8 8 bytes {JMP 0xffffffffffffffe5}
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!RtlAddMandatoryAce + 356                 00007ffcda80aa78 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!RtlMapGenericMask + 64                   00007ffcda80d270 8 bytes {JMP 0xffffffffffffffd0}
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!RtlOpenCurrentUser + 208                 00007ffcda80d39c 8 bytes {JMP 0xffffffffffffffa3}
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!RtlCheckTokenCapability + 952            00007ffcda80d75c 8 bytes [F0, 69, F8, 7F, 00, 00, 00, ...]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!RtlAppendUnicodeToString + 167           00007ffcda80e56b 8 bytes [D0, 69, F8, 7F, 00, 00, 00, ...]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!RtlLengthSidAsUnicodeString + 84         00007ffcda80e5c8 8 bytes {JMP 0xffffffffffffffdc}
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!RtlValidSecurityDescriptor + 243         00007ffcda80e6c3 8 bytes [B0, 69, F8, 7F, 00, 00, 00, ...]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!RtlAddAccessAllowedAce + 379             00007ffcda80e847 8 bytes [A0, 69, F8, 7F, 00, 00, 00, ...]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                   00007ffcda88ac50 8 bytes {JMP QWORD [RIP-0x7c8ac]}
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                 00007ffcda88add0 8 bytes {JMP QWORD [RIP-0x7c86b]}
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                       00007ffcda88ae00 8 bytes {JMP QWORD [RIP-0x7db96]}
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                     00007ffcda88af20 8 bytes {JMP QWORD [RIP-0x7d7ca]}
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                         00007ffcda88afd0 8 bytes {JMP QWORD [RIP-0x7dc3a]}
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                         00007ffcda88b690 8 bytes {JMP QWORD [RIP-0x7ce4f]}
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                       00007ffcda88b990 8 bytes {JMP QWORD [RIP-0x7d2d3]}
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                       00007ffcda88c210 8 bytes {JMP QWORD [RIP-0x7dc4e]}
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 381                   0000000076f6137d 16 bytes {JMP 0xffffffffffffffd3}
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 386                   0000000076f61512 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49         0000000076f61551 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\system32\wow64cpu.dll!CpuSetStackPointer + 23               0000000076f61577 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 516       0000000076f61784 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\system32\wow64cpu.dll!CpuThreadInit + 50                    0000000076f617c2 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23               0000000076f617e7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68                   0000000076f61834 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 1           0000000076f61841 24 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 513         0000000076f61a41 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                          * 2
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16         0000000076f62ae0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308     0000000076f62c1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[4216] C:\Windows\system32\wow64cpu.dll!CpuProcessDebugEvent + 3              0000000076f62c43 8 bytes [7C, 68, F8, 7F, 00, 00, 00, ...]
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!RtlDefaultNpAcl + 772                               00007ffcda80293c 8 bytes {JMP 0xffffffffffffff8c}
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!WinSqmAddToAverageDWORD + 21                        00007ffcda802959 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!WinSqmSetIfMaxDWORD + 95                            00007ffcda8029c7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWriteEndScenario + 220                      00007ffcda802aac 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!WinSqmEndSession + 272                              00007ffcda802bc4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!WinSqmStartSession + 8                              00007ffcda803018 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!WinSqmStartSession + 940                            00007ffcda8033bc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWriteFull + 64                              00007ffcda803404 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWriteFull + 503                             00007ffcda8035bb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!WinSqmIsSessionDisabled + 792                       00007ffcda803fe0 8 bytes {JMP 0xffffffffffffffa9}
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!RtlVerifyVersionInfo + 835                          00007ffcda804933 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 336                             00007ffcda804bac 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 472                             00007ffcda804c34 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                          * 2
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!RtlGetNtProductType + 567                           00007ffcda80543f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!WinSqmAddToStream + 592                             00007ffcda8056b4 8 bytes {JMP 0xffffffffffffffa9}
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!WinSqmAddToStreamEx + 875                           00007ffcda805a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!WinSqmEventEnabled + 139                            00007ffcda805f8b 8 bytes {JMP 0xffffffffffffffd1}
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!WinSqmEventEnabled + 224                            00007ffcda805fe0 16 bytes {JMP 0xffffffffffffffcf}
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!WinSqmEventWrite + 119                              00007ffcda8060df 8 bytes {JMP 0xffffffffffffffac}
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWrite + 43                                  00007ffcda806113 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWrite + 628                                 00007ffcda80635c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                          * 3
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateBoundaryDescriptor + 584                   00007ffcda806658 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!RtlAddSIDToBoundaryDescriptor + 8                   00007ffcda806668 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!RtlAddSIDToBoundaryDescriptor + 519                 00007ffcda806867 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteBoundaryDescriptor + 23                    00007ffcda806887 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!A_SHAFinal + 300                                    00007ffcda806bf0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!A_SHAInit + 44                                      00007ffcda806c24 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateServiceSid + 292                           00007ffcda809188 8 bytes {JMP 0xffffffffffffffdc}
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!RtlLengthRequiredSid + 20                           00007ffcda8091a4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!RtlLengthRequiredSid + 352                          00007ffcda8092f0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeSid + 35                               00007ffcda80931b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!RtlAddAce + 339                                     00007ffcda80950b 8 bytes {JMP 0xffffffffffffffdc}
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!RtlNewSecurityObjectEx + 99                         00007ffcda809577 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!RtlIsValidProcessTrustLabelSid + 103                00007ffcda8095e7 8 bytes {JMP 0xffffffffffffffe6}
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!RtlIsValidProcessTrustLabelSid + 751                00007ffcda80986f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!RtlSidDominatesForTrust + 135                       00007ffcda809a67 8 bytes {JMP 0xffffffffffffffaa}
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateSecurityDescriptor + 43                    00007ffcda80a7bf 8 bytes {JMP 0xfffffffffffffff5}
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!RtlSetDaclSecurityDescriptor + 104                  00007ffcda80a8e8 8 bytes {JMP 0xffffffffffffffe5}
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!RtlAddMandatoryAce + 356                            00007ffcda80aa78 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!RtlMapGenericMask + 64                              00007ffcda80d270 8 bytes {JMP 0xffffffffffffffd0}
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!RtlOpenCurrentUser + 208                            00007ffcda80d39c 8 bytes {JMP 0xffffffffffffffa3}
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!RtlCheckTokenCapability + 952                       00007ffcda80d75c 8 bytes [F0, 69, F8, 7F, 00, 00, 00, ...]
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!RtlAppendUnicodeToString + 167                      00007ffcda80e56b 8 bytes [D0, 69, F8, 7F, 00, 00, 00, ...]
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!RtlLengthSidAsUnicodeString + 84                    00007ffcda80e5c8 8 bytes {JMP 0xffffffffffffffdc}
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!RtlValidSecurityDescriptor + 243                    00007ffcda80e6c3 8 bytes [B0, 69, F8, 7F, 00, 00, 00, ...]
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!RtlAddAccessAllowedAce + 379                        00007ffcda80e847 8 bytes [A0, 69, F8, 7F, 00, 00, 00, ...]
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                              00007ffcda88ac50 8 bytes {JMP QWORD [RIP-0x7c8ac]}
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                            00007ffcda88add0 8 bytes {JMP QWORD [RIP-0x7c86b]}
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                  00007ffcda88ae00 8 bytes {JMP QWORD [RIP-0x7db96]}
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                00007ffcda88af20 8 bytes {JMP QWORD [RIP-0x7d7ca]}
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                    00007ffcda88afd0 8 bytes {JMP QWORD [RIP-0x7dc3a]}
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                    00007ffcda88b690 8 bytes {JMP QWORD [RIP-0x7ce4f]}
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                  00007ffcda88b990 8 bytes {JMP QWORD [RIP-0x7d2d3]}
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                  00007ffcda88c210 8 bytes {JMP QWORD [RIP-0x7dc4e]}
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 381                              0000000076f6137d 16 bytes {JMP 0xffffffffffffffd3}
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 386                              0000000076f61512 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49                    0000000076f61551 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\system32\wow64cpu.dll!CpuSetStackPointer + 23                          0000000076f61577 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 516                  0000000076f61784 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\system32\wow64cpu.dll!CpuThreadInit + 50                               0000000076f617c2 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23                          0000000076f617e7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68                              0000000076f61834 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 1                      0000000076f61841 24 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 513                    0000000076f61a41 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                          * 2
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16                    0000000076f62ae0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308                0000000076f62c1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE[5116] C:\Windows\system32\wow64cpu.dll!CpuProcessDebugEvent + 3                         0000000076f62c43 8 bytes [7C, 68, F8, 7F, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlDefaultNpAcl + 772                        00007ffcda80293c 8 bytes {JMP 0xffffffffffffff8c}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!WinSqmAddToAverageDWORD + 21                 00007ffcda802959 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!WinSqmSetIfMaxDWORD + 95                     00007ffcda8029c7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWriteEndScenario + 220               00007ffcda802aac 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!WinSqmEndSession + 272                       00007ffcda802bc4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!WinSqmStartSession + 8                       00007ffcda803018 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!WinSqmStartSession + 940                     00007ffcda8033bc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWriteFull + 64                       00007ffcda803404 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWriteFull + 503                      00007ffcda8035bb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!WinSqmIsSessionDisabled + 792                00007ffcda803fe0 8 bytes {JMP 0xffffffffffffffa9}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlVerifyVersionInfo + 835                   00007ffcda804933 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 336                      00007ffcda804bac 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 472                      00007ffcda804c34 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                          * 2
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlGetNtProductType + 567                    00007ffcda80543f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!WinSqmAddToStream + 592                      00007ffcda8056b4 8 bytes {JMP 0xffffffffffffffa9}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!WinSqmAddToStreamEx + 875                    00007ffcda805a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!WinSqmEventEnabled + 139                     00007ffcda805f8b 8 bytes {JMP 0xffffffffffffffd1}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!WinSqmEventEnabled + 224                     00007ffcda805fe0 16 bytes {JMP 0xffffffffffffffcf}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!WinSqmEventWrite + 119                       00007ffcda8060df 8 bytes {JMP 0xffffffffffffffac}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWrite + 43                           00007ffcda806113 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWrite + 628                          00007ffcda80635c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                          * 3
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateBoundaryDescriptor + 584            00007ffcda806658 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlAddSIDToBoundaryDescriptor + 8            00007ffcda806668 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlAddSIDToBoundaryDescriptor + 519          00007ffcda806867 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteBoundaryDescriptor + 23             00007ffcda806887 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!A_SHAFinal + 300                             00007ffcda806bf0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!A_SHAInit + 44                               00007ffcda806c24 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateServiceSid + 292                    00007ffcda809188 8 bytes {JMP 0xffffffffffffffdc}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlLengthRequiredSid + 20                    00007ffcda8091a4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlLengthRequiredSid + 352                   00007ffcda8092f0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeSid + 35                        00007ffcda80931b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlAddAce + 339                              00007ffcda80950b 8 bytes {JMP 0xffffffffffffffdc}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlNewSecurityObjectEx + 99                  00007ffcda809577 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlIsValidProcessTrustLabelSid + 103         00007ffcda8095e7 8 bytes {JMP 0xffffffffffffffe6}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlIsValidProcessTrustLabelSid + 751         00007ffcda80986f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlSidDominatesForTrust + 135                00007ffcda809a67 8 bytes {JMP 0xffffffffffffffaa}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateSecurityDescriptor + 43             00007ffcda80a7bf 8 bytes {JMP 0xfffffffffffffff5}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlSetDaclSecurityDescriptor + 104           00007ffcda80a8e8 8 bytes {JMP 0xffffffffffffffe5}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlAddMandatoryAce + 356                     00007ffcda80aa78 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlMapGenericMask + 64                       00007ffcda80d270 8 bytes {JMP 0xffffffffffffffd0}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlOpenCurrentUser + 208                     00007ffcda80d39c 8 bytes {JMP 0xffffffffffffffa3}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlCheckTokenCapability + 952                00007ffcda80d75c 8 bytes [F0, 69, 0D, FF, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlAppendUnicodeToString + 167               00007ffcda80e56b 8 bytes [D0, 69, 0D, FF, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlLengthSidAsUnicodeString + 84             00007ffcda80e5c8 8 bytes {JMP 0xffffffffffffffdc}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlValidSecurityDescriptor + 243             00007ffcda80e6c3 8 bytes [B0, 69, 0D, FF, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlAddAccessAllowedAce + 379                 00007ffcda80e847 8 bytes [A0, 69, 0D, FF, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                       00007ffcda88ac50 8 bytes {JMP QWORD [RIP-0x7c8ac]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                     00007ffcda88add0 8 bytes {JMP QWORD [RIP-0x7c86b]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                           00007ffcda88ae00 8 bytes {JMP QWORD [RIP-0x7db96]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                         00007ffcda88af20 8 bytes {JMP QWORD [RIP-0x7d7ca]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                             00007ffcda88afd0 8 bytes {JMP QWORD [RIP-0x7dc3a]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                             00007ffcda88b690 8 bytes {JMP QWORD [RIP-0x7ce4f]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                           00007ffcda88b990 8 bytes {JMP QWORD [RIP-0x7d2d3]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                           00007ffcda88c210 8 bytes {JMP QWORD [RIP-0x7dc4e]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 381                       0000000076f6137d 16 bytes {JMP 0xffffffffffffffd3}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 386                       0000000076f61512 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49             0000000076f61551 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\system32\wow64cpu.dll!CpuSetStackPointer + 23                   0000000076f61577 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 516           0000000076f61784 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\system32\wow64cpu.dll!CpuThreadInit + 50                        0000000076f617c2 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23                   0000000076f617e7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68                       0000000076f61834 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 1               0000000076f61841 24 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 513             0000000076f61a41 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                          * 2
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16             0000000076f62ae0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308         0000000076f62c1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4512] C:\Windows\system32\wow64cpu.dll!CpuProcessDebugEvent + 3                  0000000076f62c43 8 bytes [7C, 68, 0D, FF, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!RtlDefaultNpAcl + 772                        00007ffcda80293c 8 bytes {JMP 0xffffffffffffff8c}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!WinSqmAddToAverageDWORD + 21                 00007ffcda802959 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!WinSqmSetIfMaxDWORD + 95                     00007ffcda8029c7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWriteEndScenario + 220               00007ffcda802aac 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!WinSqmEndSession + 272                       00007ffcda802bc4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!WinSqmStartSession + 8                       00007ffcda803018 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!WinSqmStartSession + 940                     00007ffcda8033bc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWriteFull + 64                       00007ffcda803404 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWriteFull + 503                      00007ffcda8035bb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!WinSqmIsSessionDisabled + 792                00007ffcda803fe0 8 bytes {JMP 0xffffffffffffffa9}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!RtlVerifyVersionInfo + 835                   00007ffcda804933 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 336                      00007ffcda804bac 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 472                      00007ffcda804c34 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                          * 2
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!RtlGetNtProductType + 567                    00007ffcda80543f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!WinSqmAddToStream + 592                      00007ffcda8056b4 8 bytes {JMP 0xffffffffffffffa9}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!WinSqmAddToStreamEx + 875                    00007ffcda805a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!WinSqmEventEnabled + 139                     00007ffcda805f8b 8 bytes {JMP 0xffffffffffffffd1}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!WinSqmEventEnabled + 224                     00007ffcda805fe0 16 bytes {JMP 0xffffffffffffffcf}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!WinSqmEventWrite + 119                       00007ffcda8060df 8 bytes {JMP 0xffffffffffffffac}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWrite + 43                           00007ffcda806113 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWrite + 628                          00007ffcda80635c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                          * 3
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateBoundaryDescriptor + 584            00007ffcda806658 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!RtlAddSIDToBoundaryDescriptor + 8            00007ffcda806668 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!RtlAddSIDToBoundaryDescriptor + 519          00007ffcda806867 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteBoundaryDescriptor + 23             00007ffcda806887 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!A_SHAFinal + 300                             00007ffcda806bf0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!A_SHAInit + 44                               00007ffcda806c24 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateServiceSid + 292                    00007ffcda809188 8 bytes {JMP 0xffffffffffffffdc}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!RtlLengthRequiredSid + 20                    00007ffcda8091a4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!RtlLengthRequiredSid + 352                   00007ffcda8092f0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeSid + 35                        00007ffcda80931b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!RtlAddAce + 339                              00007ffcda80950b 8 bytes {JMP 0xffffffffffffffdc}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!RtlNewSecurityObjectEx + 99                  00007ffcda809577 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!RtlIsValidProcessTrustLabelSid + 103         00007ffcda8095e7 8 bytes {JMP 0xffffffffffffffe6}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!RtlIsValidProcessTrustLabelSid + 751         00007ffcda80986f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!RtlSidDominatesForTrust + 135                00007ffcda809a67 8 bytes {JMP 0xffffffffffffffaa}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateSecurityDescriptor + 43             00007ffcda80a7bf 8 bytes {JMP 0xfffffffffffffff5}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!RtlSetDaclSecurityDescriptor + 104           00007ffcda80a8e8 8 bytes {JMP 0xffffffffffffffe5}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!RtlAddMandatoryAce + 356                     00007ffcda80aa78 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!RtlMapGenericMask + 64                       00007ffcda80d270 8 bytes {JMP 0xffffffffffffffd0}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!RtlOpenCurrentUser + 208                     00007ffcda80d39c 8 bytes {JMP 0xffffffffffffffa3}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!RtlCheckTokenCapability + 952                00007ffcda80d75c 8 bytes [F0, 69, BA, FE, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!RtlAppendUnicodeToString + 167               00007ffcda80e56b 8 bytes [D0, 69, BA, FE, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!RtlLengthSidAsUnicodeString + 84             00007ffcda80e5c8 8 bytes {JMP 0xffffffffffffffdc}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!RtlValidSecurityDescriptor + 243             00007ffcda80e6c3 8 bytes [B0, 69, BA, FE, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!RtlAddAccessAllowedAce + 379                 00007ffcda80e847 8 bytes [A0, 69, BA, FE, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                       00007ffcda88ac50 8 bytes {JMP QWORD [RIP-0x7c8ac]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                     00007ffcda88add0 8 bytes {JMP QWORD [RIP-0x7c86b]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                           00007ffcda88ae00 8 bytes {JMP QWORD [RIP-0x7db96]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                         00007ffcda88af20 8 bytes {JMP QWORD [RIP-0x7d7ca]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                             00007ffcda88afd0 8 bytes {JMP QWORD [RIP-0x7dc3a]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                             00007ffcda88b690 8 bytes {JMP QWORD [RIP-0x7ce4f]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                           00007ffcda88b990 8 bytes {JMP QWORD [RIP-0x7d2d3]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                           00007ffcda88c210 8 bytes {JMP QWORD [RIP-0x7dc4e]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 381                       0000000076f6137d 16 bytes {JMP 0xffffffffffffffd3}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 386                       0000000076f61512 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49             0000000076f61551 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\system32\wow64cpu.dll!CpuSetStackPointer + 23                   0000000076f61577 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 516           0000000076f61784 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\system32\wow64cpu.dll!CpuThreadInit + 50                        0000000076f617c2 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23                   0000000076f617e7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68                       0000000076f61834 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 1               0000000076f61841 24 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 513             0000000076f61a41 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                          * 2
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16             0000000076f62ae0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308         0000000076f62c1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4208] C:\Windows\system32\wow64cpu.dll!CpuProcessDebugEvent + 3                  0000000076f62c43 8 bytes [7C, 68, BA, FE, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlDefaultNpAcl + 772                        00007ffcda80293c 8 bytes {JMP 0xffffffffffffff8c}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!WinSqmAddToAverageDWORD + 21                 00007ffcda802959 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!WinSqmSetIfMaxDWORD + 95                     00007ffcda8029c7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWriteEndScenario + 220               00007ffcda802aac 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!WinSqmEndSession + 272                       00007ffcda802bc4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!WinSqmStartSession + 8                       00007ffcda803018 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!WinSqmStartSession + 940                     00007ffcda8033bc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWriteFull + 64                       00007ffcda803404 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWriteFull + 503                      00007ffcda8035bb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!WinSqmIsSessionDisabled + 792                00007ffcda803fe0 8 bytes {JMP 0xffffffffffffffa9}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlVerifyVersionInfo + 835                   00007ffcda804933 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 336                      00007ffcda804bac 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 472                      00007ffcda804c34 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                          * 2
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlGetNtProductType + 567                    00007ffcda80543f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!WinSqmAddToStream + 592                      00007ffcda8056b4 8 bytes {JMP 0xffffffffffffffa9}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!WinSqmAddToStreamEx + 875                    00007ffcda805a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!WinSqmEventEnabled + 139                     00007ffcda805f8b 8 bytes {JMP 0xffffffffffffffd1}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!WinSqmEventEnabled + 224                     00007ffcda805fe0 16 bytes {JMP 0xffffffffffffffcf}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!WinSqmEventWrite + 119                       00007ffcda8060df 8 bytes {JMP 0xffffffffffffffac}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWrite + 43                           00007ffcda806113 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWrite + 628                          00007ffcda80635c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                          * 3
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateBoundaryDescriptor + 584            00007ffcda806658 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlAddSIDToBoundaryDescriptor + 8            00007ffcda806668 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlAddSIDToBoundaryDescriptor + 519          00007ffcda806867 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteBoundaryDescriptor + 23             00007ffcda806887 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!A_SHAFinal + 300                             00007ffcda806bf0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!A_SHAInit + 44                               00007ffcda806c24 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateServiceSid + 292                    00007ffcda809188 8 bytes {JMP 0xffffffffffffffdc}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlLengthRequiredSid + 20                    00007ffcda8091a4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlLengthRequiredSid + 352                   00007ffcda8092f0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeSid + 35                        00007ffcda80931b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlAddAce + 339                              00007ffcda80950b 8 bytes {JMP 0xffffffffffffffdc}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlNewSecurityObjectEx + 99                  00007ffcda809577 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlIsValidProcessTrustLabelSid + 103         00007ffcda8095e7 8 bytes {JMP 0xffffffffffffffe6}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlIsValidProcessTrustLabelSid + 751         00007ffcda80986f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlSidDominatesForTrust + 135                00007ffcda809a67 8 bytes {JMP 0xffffffffffffffaa}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateSecurityDescriptor + 43             00007ffcda80a7bf 8 bytes {JMP 0xfffffffffffffff5}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlSetDaclSecurityDescriptor + 104           00007ffcda80a8e8 8 bytes {JMP 0xffffffffffffffe5}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlAddMandatoryAce + 356                     00007ffcda80aa78 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlMapGenericMask + 64                       00007ffcda80d270 8 bytes {JMP 0xffffffffffffffd0}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlOpenCurrentUser + 208                     00007ffcda80d39c 8 bytes {JMP 0xffffffffffffffa3}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlCheckTokenCapability + 952                00007ffcda80d75c 8 bytes [F0, 69, 3E, FE, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlAppendUnicodeToString + 167               00007ffcda80e56b 8 bytes [D0, 69, 3E, FE, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlLengthSidAsUnicodeString + 84             00007ffcda80e5c8 8 bytes {JMP 0xffffffffffffffdc}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlValidSecurityDescriptor + 243             00007ffcda80e6c3 8 bytes [B0, 69, 3E, FE, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlAddAccessAllowedAce + 379                 00007ffcda80e847 8 bytes [A0, 69, 3E, FE, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                       00007ffcda88ac50 8 bytes {JMP QWORD [RIP-0x7c8ac]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                     00007ffcda88add0 8 bytes {JMP QWORD [RIP-0x7c86b]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                           00007ffcda88ae00 8 bytes {JMP QWORD [RIP-0x7db96]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                         00007ffcda88af20 8 bytes {JMP QWORD [RIP-0x7d7ca]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                             00007ffcda88afd0 8 bytes {JMP QWORD [RIP-0x7dc3a]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                             00007ffcda88b690 8 bytes {JMP QWORD [RIP-0x7ce4f]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                           00007ffcda88b990 8 bytes {JMP QWORD [RIP-0x7d2d3]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                           00007ffcda88c210 8 bytes {JMP QWORD [RIP-0x7dc4e]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 381                       0000000076f6137d 16 bytes {JMP 0xffffffffffffffd3}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 386                       0000000076f61512 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49             0000000076f61551 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\system32\wow64cpu.dll!CpuSetStackPointer + 23                   0000000076f61577 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 516           0000000076f61784 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\system32\wow64cpu.dll!CpuThreadInit + 50                        0000000076f617c2 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23                   0000000076f617e7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68                       0000000076f61834 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 1               0000000076f61841 24 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 513             0000000076f61a41 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                          * 2
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16             0000000076f62ae0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308         0000000076f62c1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5252] C:\Windows\system32\wow64cpu.dll!CpuProcessDebugEvent + 3                  0000000076f62c43 8 bytes [7C, 68, 3E, FE, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!RtlDefaultNpAcl + 772                        00007ffcda80293c 8 bytes {JMP 0xffffffffffffff8c}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!WinSqmAddToAverageDWORD + 21                 00007ffcda802959 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!WinSqmSetIfMaxDWORD + 95                     00007ffcda8029c7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWriteEndScenario + 220               00007ffcda802aac 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!WinSqmEndSession + 272                       00007ffcda802bc4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!WinSqmStartSession + 8                       00007ffcda803018 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!WinSqmStartSession + 940                     00007ffcda8033bc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWriteFull + 64                       00007ffcda803404 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWriteFull + 503                      00007ffcda8035bb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!WinSqmIsSessionDisabled + 792                00007ffcda803fe0 8 bytes {JMP 0xffffffffffffffa9}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!RtlVerifyVersionInfo + 835                   00007ffcda804933 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 336                      00007ffcda804bac 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 472                      00007ffcda804c34 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                          * 2
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!RtlGetNtProductType + 567                    00007ffcda80543f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!WinSqmAddToStream + 592                      00007ffcda8056b4 8 bytes {JMP 0xffffffffffffffa9}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!WinSqmAddToStreamEx + 875                    00007ffcda805a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!WinSqmEventEnabled + 139                     00007ffcda805f8b 8 bytes {JMP 0xffffffffffffffd1}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!WinSqmEventEnabled + 224                     00007ffcda805fe0 16 bytes {JMP 0xffffffffffffffcf}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!WinSqmEventWrite + 119                       00007ffcda8060df 8 bytes {JMP 0xffffffffffffffac}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWrite + 43                           00007ffcda806113 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWrite + 628                          00007ffcda80635c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                          * 3
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateBoundaryDescriptor + 584            00007ffcda806658 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!RtlAddSIDToBoundaryDescriptor + 8            00007ffcda806668 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!RtlAddSIDToBoundaryDescriptor + 519          00007ffcda806867 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteBoundaryDescriptor + 23             00007ffcda806887 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!A_SHAFinal + 300                             00007ffcda806bf0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!A_SHAInit + 44                               00007ffcda806c24 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateServiceSid + 292                    00007ffcda809188 8 bytes {JMP 0xffffffffffffffdc}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!RtlLengthRequiredSid + 20                    00007ffcda8091a4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!RtlLengthRequiredSid + 352                   00007ffcda8092f0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeSid + 35                        00007ffcda80931b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!RtlAddAce + 339                              00007ffcda80950b 8 bytes {JMP 0xffffffffffffffdc}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!RtlNewSecurityObjectEx + 99                  00007ffcda809577 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!RtlIsValidProcessTrustLabelSid + 103         00007ffcda8095e7 8 bytes {JMP 0xffffffffffffffe6}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!RtlIsValidProcessTrustLabelSid + 751         00007ffcda80986f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!RtlSidDominatesForTrust + 135                00007ffcda809a67 8 bytes {JMP 0xffffffffffffffaa}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateSecurityDescriptor + 43             00007ffcda80a7bf 8 bytes {JMP 0xfffffffffffffff5}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!RtlSetDaclSecurityDescriptor + 104           00007ffcda80a8e8 8 bytes {JMP 0xffffffffffffffe5}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!RtlAddMandatoryAce + 356                     00007ffcda80aa78 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!RtlMapGenericMask + 64                       00007ffcda80d270 8 bytes {JMP 0xffffffffffffffd0}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!RtlOpenCurrentUser + 208                     00007ffcda80d39c 8 bytes {JMP 0xffffffffffffffa3}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!RtlCheckTokenCapability + 952                00007ffcda80d75c 8 bytes [F0, 69, 18, FF, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!RtlAppendUnicodeToString + 167               00007ffcda80e56b 8 bytes [D0, 69, 18, FF, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!RtlLengthSidAsUnicodeString + 84             00007ffcda80e5c8 8 bytes {JMP 0xffffffffffffffdc}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!RtlValidSecurityDescriptor + 243             00007ffcda80e6c3 8 bytes [B0, 69, 18, FF, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!RtlAddAccessAllowedAce + 379                 00007ffcda80e847 8 bytes [A0, 69, 18, FF, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                       00007ffcda88ac50 8 bytes {JMP QWORD [RIP-0x7c8ac]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                     00007ffcda88add0 8 bytes {JMP QWORD [RIP-0x7c86b]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                           00007ffcda88ae00 8 bytes {JMP QWORD [RIP-0x7db96]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                         00007ffcda88af20 8 bytes {JMP QWORD [RIP-0x7d7ca]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                             00007ffcda88afd0 8 bytes {JMP QWORD [RIP-0x7dc3a]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                             00007ffcda88b690 8 bytes {JMP QWORD [RIP-0x7ce4f]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                           00007ffcda88b990 8 bytes {JMP QWORD [RIP-0x7d2d3]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                           00007ffcda88c210 8 bytes {JMP QWORD [RIP-0x7dc4e]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 381                       0000000076f6137d 16 bytes {JMP 0xffffffffffffffd3}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 386                       0000000076f61512 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49             0000000076f61551 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\system32\wow64cpu.dll!CpuSetStackPointer + 23                   0000000076f61577 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 516           0000000076f61784 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\system32\wow64cpu.dll!CpuThreadInit + 50                        0000000076f617c2 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23                   0000000076f617e7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68                       0000000076f61834 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 1               0000000076f61841 24 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 513             0000000076f61a41 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                          * 2
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16             0000000076f62ae0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308         0000000076f62c1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5472] C:\Windows\system32\wow64cpu.dll!CpuProcessDebugEvent + 3                  0000000076f62c43 8 bytes [7C, 68, 18, FF, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlDefaultNpAcl + 772                        00007ffcda80293c 8 bytes {JMP 0xffffffffffffff8c}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!WinSqmAddToAverageDWORD + 21                 00007ffcda802959 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!WinSqmSetIfMaxDWORD + 95                     00007ffcda8029c7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWriteEndScenario + 220               00007ffcda802aac 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!WinSqmEndSession + 272                       00007ffcda802bc4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!WinSqmStartSession + 8                       00007ffcda803018 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!WinSqmStartSession + 940                     00007ffcda8033bc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWriteFull + 64                       00007ffcda803404 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWriteFull + 503                      00007ffcda8035bb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!WinSqmIsSessionDisabled + 792                00007ffcda803fe0 8 bytes {JMP 0xffffffffffffffa9}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlVerifyVersionInfo + 835                   00007ffcda804933 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 336                      00007ffcda804bac 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 472                      00007ffcda804c34 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...
         

.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlGetNtProductType + 567                    00007ffcda80543f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!WinSqmAddToStream + 592                      00007ffcda8056b4 8 bytes {JMP 0xffffffffffffffa9}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!WinSqmAddToStreamEx + 875                    00007ffcda805a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!WinSqmEventEnabled + 139                     00007ffcda805f8b 8 bytes {JMP 0xffffffffffffffd1}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!WinSqmEventEnabled + 224                     00007ffcda805fe0 16 bytes {JMP 0xffffffffffffffcf}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!WinSqmEventWrite + 119                       00007ffcda8060df 8 bytes {JMP 0xffffffffffffffac}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWrite + 43                           00007ffcda806113 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWrite + 628                          00007ffcda80635c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                          * 3
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateBoundaryDescriptor + 584            00007ffcda806658 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlAddSIDToBoundaryDescriptor + 8            00007ffcda806668 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlAddSIDToBoundaryDescriptor + 519          00007ffcda806867 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteBoundaryDescriptor + 23             00007ffcda806887 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!A_SHAFinal + 300                             00007ffcda806bf0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!A_SHAInit + 44                               00007ffcda806c24 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateServiceSid + 292                    00007ffcda809188 8 bytes {JMP 0xffffffffffffffdc}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlLengthRequiredSid + 20                    00007ffcda8091a4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlLengthRequiredSid + 352                   00007ffcda8092f0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeSid + 35                        00007ffcda80931b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlAddAce + 339                              00007ffcda80950b 8 bytes {JMP 0xffffffffffffffdc}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlNewSecurityObjectEx + 99                  00007ffcda809577 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlIsValidProcessTrustLabelSid + 103         00007ffcda8095e7 8 bytes {JMP 0xffffffffffffffe6}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlIsValidProcessTrustLabelSid + 751         00007ffcda80986f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlSidDominatesForTrust + 135                00007ffcda809a67 8 bytes {JMP 0xffffffffffffffaa}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateSecurityDescriptor + 43             00007ffcda80a7bf 8 bytes {JMP 0xfffffffffffffff5}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlSetDaclSecurityDescriptor + 104           00007ffcda80a8e8 8 bytes {JMP 0xffffffffffffffe5}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlAddMandatoryAce + 356                     00007ffcda80aa78 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlMapGenericMask + 64                       00007ffcda80d270 8 bytes {JMP 0xffffffffffffffd0}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlOpenCurrentUser + 208                     00007ffcda80d39c 8 bytes {JMP 0xffffffffffffffa3}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlCheckTokenCapability + 952                00007ffcda80d75c 8 bytes [F0, 69, 68, FE, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlAppendUnicodeToString + 167               00007ffcda80e56b 8 bytes [D0, 69, 68, FE, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlLengthSidAsUnicodeString + 84             00007ffcda80e5c8 8 bytes {JMP 0xffffffffffffffdc}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlValidSecurityDescriptor + 243             00007ffcda80e6c3 8 bytes [B0, 69, 68, FE, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlAddAccessAllowedAce + 379                 00007ffcda80e847 8 bytes [A0, 69, 68, FE, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                       00007ffcda88ac50 8 bytes {JMP QWORD [RIP-0x7c8ac]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                     00007ffcda88add0 8 bytes {JMP QWORD [RIP-0x7c86b]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                           00007ffcda88ae00 8 bytes {JMP QWORD [RIP-0x7db96]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                         00007ffcda88af20 8 bytes {JMP QWORD [RIP-0x7d7ca]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                             00007ffcda88afd0 8 bytes {JMP QWORD [RIP-0x7dc3a]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                             00007ffcda88b690 8 bytes {JMP QWORD [RIP-0x7ce4f]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                           00007ffcda88b990 8 bytes {JMP QWORD [RIP-0x7d2d3]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                           00007ffcda88c210 8 bytes {JMP QWORD [RIP-0x7dc4e]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 381                       0000000076f6137d 16 bytes {JMP 0xffffffffffffffd3}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 386                       0000000076f61512 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49             0000000076f61551 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\system32\wow64cpu.dll!CpuSetStackPointer + 23                   0000000076f61577 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 516           0000000076f61784 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\system32\wow64cpu.dll!CpuThreadInit + 50                        0000000076f617c2 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23                   0000000076f617e7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68                       0000000076f61834 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 1               0000000076f61841 24 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 513             0000000076f61a41 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                          * 2
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16             0000000076f62ae0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308         0000000076f62c1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2988] C:\Windows\system32\wow64cpu.dll!CpuProcessDebugEvent + 3                  0000000076f62c43 8 bytes [7C, 68, 68, FE, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!RtlDefaultNpAcl + 772                        00007ffcda80293c 8 bytes {JMP 0xffffffffffffff8c}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!WinSqmAddToAverageDWORD + 21                 00007ffcda802959 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!WinSqmSetIfMaxDWORD + 95                     00007ffcda8029c7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWriteEndScenario + 220               00007ffcda802aac 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!WinSqmEndSession + 272                       00007ffcda802bc4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!WinSqmStartSession + 8                       00007ffcda803018 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!WinSqmStartSession + 940                     00007ffcda8033bc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWriteFull + 64                       00007ffcda803404 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWriteFull + 503                      00007ffcda8035bb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!WinSqmIsSessionDisabled + 792                00007ffcda803fe0 8 bytes {JMP 0xffffffffffffffa9}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!RtlVerifyVersionInfo + 835                   00007ffcda804933 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 336                      00007ffcda804bac 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 472                      00007ffcda804c34 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                          * 2
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!RtlGetNtProductType + 567                    00007ffcda80543f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!WinSqmAddToStream + 592                      00007ffcda8056b4 8 bytes {JMP 0xffffffffffffffa9}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!WinSqmAddToStreamEx + 875                    00007ffcda805a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!WinSqmEventEnabled + 139                     00007ffcda805f8b 8 bytes {JMP 0xffffffffffffffd1}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!WinSqmEventEnabled + 224                     00007ffcda805fe0 16 bytes {JMP 0xffffffffffffffcf}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!WinSqmEventWrite + 119                       00007ffcda8060df 8 bytes {JMP 0xffffffffffffffac}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWrite + 43                           00007ffcda806113 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWrite + 628                          00007ffcda80635c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                          * 3
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateBoundaryDescriptor + 584            00007ffcda806658 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!RtlAddSIDToBoundaryDescriptor + 8            00007ffcda806668 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!RtlAddSIDToBoundaryDescriptor + 519          00007ffcda806867 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteBoundaryDescriptor + 23             00007ffcda806887 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!A_SHAFinal + 300                             00007ffcda806bf0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!A_SHAInit + 44                               00007ffcda806c24 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateServiceSid + 292                    00007ffcda809188 8 bytes {JMP 0xffffffffffffffdc}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!RtlLengthRequiredSid + 20                    00007ffcda8091a4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!RtlLengthRequiredSid + 352                   00007ffcda8092f0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeSid + 35                        00007ffcda80931b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!RtlAddAce + 339                              00007ffcda80950b 8 bytes {JMP 0xffffffffffffffdc}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!RtlNewSecurityObjectEx + 99                  00007ffcda809577 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!RtlIsValidProcessTrustLabelSid + 103         00007ffcda8095e7 8 bytes {JMP 0xffffffffffffffe6}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!RtlIsValidProcessTrustLabelSid + 751         00007ffcda80986f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!RtlSidDominatesForTrust + 135                00007ffcda809a67 8 bytes {JMP 0xffffffffffffffaa}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateSecurityDescriptor + 43             00007ffcda80a7bf 8 bytes {JMP 0xfffffffffffffff5}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!RtlSetDaclSecurityDescriptor + 104           00007ffcda80a8e8 8 bytes {JMP 0xffffffffffffffe5}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!RtlAddMandatoryAce + 356                     00007ffcda80aa78 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!RtlMapGenericMask + 64                       00007ffcda80d270 8 bytes {JMP 0xffffffffffffffd0}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!RtlOpenCurrentUser + 208                     00007ffcda80d39c 8 bytes {JMP 0xffffffffffffffa3}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!RtlCheckTokenCapability + 952                00007ffcda80d75c 8 bytes [F0, 69, BC, FE, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!RtlAppendUnicodeToString + 167               00007ffcda80e56b 8 bytes [D0, 69, BC, FE, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!RtlLengthSidAsUnicodeString + 84             00007ffcda80e5c8 8 bytes {JMP 0xffffffffffffffdc}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!RtlValidSecurityDescriptor + 243             00007ffcda80e6c3 8 bytes [B0, 69, BC, FE, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!RtlAddAccessAllowedAce + 379                 00007ffcda80e847 8 bytes [A0, 69, BC, FE, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                       00007ffcda88ac50 8 bytes {JMP QWORD [RIP-0x7c8ac]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                     00007ffcda88add0 8 bytes {JMP QWORD [RIP-0x7c86b]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                           00007ffcda88ae00 8 bytes {JMP QWORD [RIP-0x7db96]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                         00007ffcda88af20 8 bytes {JMP QWORD [RIP-0x7d7ca]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                             00007ffcda88afd0 8 bytes {JMP QWORD [RIP-0x7dc3a]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                             00007ffcda88b690 8 bytes {JMP QWORD [RIP-0x7ce4f]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                           00007ffcda88b990 8 bytes {JMP QWORD [RIP-0x7d2d3]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                           00007ffcda88c210 8 bytes {JMP QWORD [RIP-0x7dc4e]}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 381                       0000000076f6137d 16 bytes {JMP 0xffffffffffffffd3}
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 386                       0000000076f61512 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49             0000000076f61551 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\system32\wow64cpu.dll!CpuSetStackPointer + 23                   0000000076f61577 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 516           0000000076f61784 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\system32\wow64cpu.dll!CpuThreadInit + 50                        0000000076f617c2 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23                   0000000076f617e7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68                       0000000076f61834 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 1               0000000076f61841 24 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 513             0000000076f61a41 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                          * 2
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16             0000000076f62ae0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308         0000000076f62c1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1824] C:\Windows\system32\wow64cpu.dll!CpuProcessDebugEvent + 3                  0000000076f62c43 8 bytes [7C, 68, BC, FE, 00, 00, 00, ...]
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlDefaultNpAcl + 772                                              00007ffcda80293c 8 bytes {JMP 0xffffffffffffff8c}
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!WinSqmAddToAverageDWORD + 21                                       00007ffcda802959 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!WinSqmSetIfMaxDWORD + 95                                           00007ffcda8029c7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWriteEndScenario + 220                                     00007ffcda802aac 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!WinSqmEndSession + 272                                             00007ffcda802bc4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!WinSqmStartSession + 8                                             00007ffcda803018 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!WinSqmStartSession + 940                                           00007ffcda8033bc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWriteFull + 64                                             00007ffcda803404 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWriteFull + 503                                            00007ffcda8035bb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!WinSqmIsSessionDisabled + 792                                      00007ffcda803fe0 8 bytes {JMP 0xffffffffffffffa9}
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlVerifyVersionInfo + 835                                         00007ffcda804933 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 336                                            00007ffcda804bac 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 472                                            00007ffcda804c34 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                          * 2
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlGetNtProductType + 567                                          00007ffcda80543f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!WinSqmAddToStream + 592                                            00007ffcda8056b4 8 bytes {JMP 0xffffffffffffffa9}
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!WinSqmAddToStreamEx + 875                                          00007ffcda805a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!WinSqmEventEnabled + 139                                           00007ffcda805f8b 8 bytes {JMP 0xffffffffffffffd1}
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!WinSqmEventEnabled + 224                                           00007ffcda805fe0 16 bytes {JMP 0xffffffffffffffcf}
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!WinSqmEventWrite + 119                                             00007ffcda8060df 8 bytes {JMP 0xffffffffffffffac}
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWrite + 43                                                 00007ffcda806113 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!EtwEventWrite + 628                                                00007ffcda80635c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                          * 3
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateBoundaryDescriptor + 584                                  00007ffcda806658 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlAddSIDToBoundaryDescriptor + 8                                  00007ffcda806668 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlAddSIDToBoundaryDescriptor + 519                                00007ffcda806867 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteBoundaryDescriptor + 23                                   00007ffcda806887 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!A_SHAFinal + 300                                                   00007ffcda806bf0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!A_SHAInit + 44                                                     00007ffcda806c24 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateServiceSid + 292                                          00007ffcda809188 8 bytes {JMP 0xffffffffffffffdc}
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlLengthRequiredSid + 20                                          00007ffcda8091a4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlLengthRequiredSid + 352                                         00007ffcda8092f0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeSid + 35                                              00007ffcda80931b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlAddAce + 339                                                    00007ffcda80950b 8 bytes {JMP 0xffffffffffffffdc}
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlNewSecurityObjectEx + 99                                        00007ffcda809577 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlIsValidProcessTrustLabelSid + 103                               00007ffcda8095e7 8 bytes {JMP 0xffffffffffffffe6}
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlIsValidProcessTrustLabelSid + 751                               00007ffcda80986f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlSidDominatesForTrust + 135                                      00007ffcda809a67 8 bytes {JMP 0xffffffffffffffaa}
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateSecurityDescriptor + 43                                   00007ffcda80a7bf 8 bytes {JMP 0xfffffffffffffff5}
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlSetDaclSecurityDescriptor + 104                                 00007ffcda80a8e8 8 bytes {JMP 0xffffffffffffffe5}
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlAddMandatoryAce + 356                                           00007ffcda80aa78 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlMapGenericMask + 64                                             00007ffcda80d270 8 bytes {JMP 0xffffffffffffffd0}
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlOpenCurrentUser + 208                                           00007ffcda80d39c 8 bytes {JMP 0xffffffffffffffa3}
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlCheckTokenCapability + 952                                      00007ffcda80d75c 8 bytes [F0, 69, F8, 7F, 00, 00, 00, ...]
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlAppendUnicodeToString + 167                                     00007ffcda80e56b 8 bytes [D0, 69, F8, 7F, 00, 00, 00, ...]
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlLengthSidAsUnicodeString + 84                                   00007ffcda80e5c8 8 bytes {JMP 0xffffffffffffffdc}
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlValidSecurityDescriptor + 243                                   00007ffcda80e6c3 8 bytes [B0, 69, F8, 7F, 00, 00, 00, ...]
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlAddAccessAllowedAce + 379                                       00007ffcda80e847 8 bytes [A0, 69, F8, 7F, 00, 00, 00, ...]
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                             00007ffcda88ac50 8 bytes {JMP QWORD [RIP-0x7c8ac]}
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                           00007ffcda88add0 8 bytes {JMP QWORD [RIP-0x7c86b]}
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                 00007ffcda88ae00 8 bytes {JMP QWORD [RIP-0x7db96]}
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                               00007ffcda88af20 8 bytes {JMP QWORD [RIP-0x7d7ca]}
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                   00007ffcda88afd0 8 bytes {JMP QWORD [RIP-0x7dc3a]}
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                   00007ffcda88b690 8 bytes {JMP QWORD [RIP-0x7ce4f]}
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                 00007ffcda88b990 8 bytes {JMP QWORD [RIP-0x7d2d3]}
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                 00007ffcda88c210 8 bytes {JMP QWORD [RIP-0x7dc4e]}
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 381                                             0000000076f6137d 16 bytes {JMP 0xffffffffffffffd3}
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 386                                             0000000076f61512 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49                                   0000000076f61551 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\system32\wow64cpu.dll!CpuSetStackPointer + 23                                         0000000076f61577 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 516                                 0000000076f61784 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\system32\wow64cpu.dll!CpuThreadInit + 50                                              0000000076f617c2 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23                                         0000000076f617e7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68                                             0000000076f61834 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 1                                     0000000076f61841 24 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 513                                   0000000076f61a41 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                          * 2
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16                                   0000000076f62ae0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308                               0000000076f62c1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    H:\MyOwnDATA\Downloads\Gmer-19357.exe[3152] C:\Windows\system32\wow64cpu.dll!CpuProcessDebugEvent + 3                                        0000000076f62c43 8 bytes [7C, 68, F8, 7F, 00, 00, 00, ...]

---- Threads - GMER 2.1 ----

Thread   C:\Windows\system32\csrss.exe [624:660]                                                                                                      fffff9600097ab90

---- Services - GMER 2.1 ----

Service  System32\drivers\lwhprwro.sys (*** hidden *** )                                                                                              [BOOT] dveep                                                                                          <-- ROOTKIT !!!

---- Registry - GMER 2.1 ----

Reg      HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData@SystemStartTime                                                                            0xCC 0xF8 0x83 0x24 ...
Reg      HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData@SystemLastStartTime                                                                        0x9C 0x5B 0xE5 0x75 ...
Reg      HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData@CMFStartTime                                                                               0xCC 0xF8 0x83 0x24 ...
Reg      HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData@CMFLastStartTime                                                                           0x9C 0x5B 0xE5 0x75 ...
Reg      HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData\BootLanguages@de-DE                                                                        27
Reg      HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Configuration\SAM027FH9XQ510841_14_07D8_4C^C01F616B3D1BC912645D898D1BC63733@Timestamp  0x14 0x5B 0x60 0x25 ...
Reg      HKLM\SYSTEM\CurrentControlSet\Control\Lsa@LsaPid                                                                                             664
Reg      HKLM\SYSTEM\CurrentControlSet\Control\Session Manager@PendingFileRenameOperations                                                            \??\C:\Users\Manuela\AppData\Local\Temp\nsi3232.exe??
Reg      HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Executive@UuidSequenceNumber                                                           3900008
Reg      HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel\RNG@RNGAuxiliarySeed                                                            -573082670
Reg      HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters@BootId                                            30
Reg      HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters@BaseTime                                          413652053
Reg      HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@POSTTime                                                                         12330
Reg      HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@FwPOSTTime                                                                       11549
Reg      HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server@InstanceID                                                                             a401bd25-6e46-4d22-8888-c5854f3
Reg      HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\WdiContextLog@FileCounter                                                               3
Reg      HKLM\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\Probe\{477b4c77-3ae9-48b3-8312-8a844ddef1e9}@LastProbeTime                        1401894118
Reg      HKLM\SYSTEM\CurrentControlSet\Services\dveep                                                                                                 
Reg      HKLM\SYSTEM\CurrentControlSet\Services\dveep@ImagePath                                                                                       System32\drivers\lwhprwro.sys
Reg      HKLM\SYSTEM\CurrentControlSet\Services\dveep@Start                                                                                           0
Reg      HKLM\SYSTEM\CurrentControlSet\Services\dveep@Type                                                                                            1
Reg      HKLM\SYSTEM\CurrentControlSet\Services\dveep@ErrorControl                                                                                    1
Reg      HKLM\SYSTEM\CurrentControlSet\Services\dveep@dwip                                                                                            \??\C:\Windows\vpnplugins\iopdcruo
Reg      HKLM\SYSTEM\CurrentControlSet\Services\dveep@eewnqag                                                                                         C:\Windows
Reg      HKLM\SYSTEM\CurrentControlSet\Services\dveep@kbbgm                                                                                           5922
Reg      HKLM\SYSTEM\CurrentControlSet\Services\dveep@Group                                                                                           System Reserved
Reg      HKLM\SYSTEM\CurrentControlSet\Services\dveep                                                                                                 
Reg      HKLM\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\Isatap\{48E98B5C-5955-4E94-A416-95F8EC91755B}@DefunctTimestamp                    0x68 0x1A 0x8F 0x53 ...
Reg      HKLM\SYSTEM\CurrentControlSet\Services\KLIF\Parameters@LastProcessedRevision                                                                 18131854
Reg      HKLM\SYSTEM\CurrentControlSet\Services\kneps@idsbase                                                                                         C:\ProgramData\Kaspersky Lab\AVP14.0.0\Bases\idsdrop.dat
Reg      HKLM\SYSTEM\CurrentControlSet\Services\kneps@idsto                                                                                           -1
Reg      HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch@Epoch                                                                              2878
Reg      HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch2@Epoch                                                                             683
Reg      HKLM\SYSTEM\CurrentControlSet\Services\srvnet\Parameters@MajorSequence                                                                       29
Reg      HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{1FD7A8A7-478C-4D9E-843E-DA36E0480BD3}@LeaseObtainedTime                  1401886917
Reg      HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{1FD7A8A7-478C-4D9E-843E-DA36E0480BD3}@T1                                 1402189317
Reg      HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{1FD7A8A7-478C-4D9E-843E-DA36E0480BD3}@T2                                 1402416117
Reg      HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{1FD7A8A7-478C-4D9E-843E-DA36E0480BD3}@LeaseTerminatesTime                1402491717
Reg      HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt\Parameters@ServiceDllUnloadOnStop                                                             0
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shutdown@CleanShutdown                                                               1
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@WindowsRequestBucketCounter                                           100
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@LastWindowsRequestBucketDrainTime                                     0xAB 0xBB 0x63 0x0F ...
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@LastWindowsLargeRequestBucketDrainTime                                0xAB 0xBB 0x63 0x0F ...
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@LastOtherRequestBucketDrainTime                                       0xAB 0xBB 0x63 0x0F ...
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@GlobalRequestBucketCounter                                            100
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@LastGlobalRequestBucketDrainTime                                      0xAB 0xBB 0x63 0x0F ...
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@RoamingSyncToken                                                      LM%3d63537484103730%3bID%3d574D632C0A764E8E!107%3bLR%3d63537481921963%3bEP%3d4%3bTD%3dTrue%3bSO%3d0
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\RegistrarData@LastRenewCollectionsInterest                                       0x6D 0xCB 0xAD 0x20 ...
Reg      HKCU\Software\Microsoft\Windows\Windows Error Reporting@LastRateLimitedDumpGenerationTime                                                    0xF9 0x83 0x27 0x44 ...

---- EOF - GMER 2.1 ----
         

Zum Schluss noch meine beide Malware-Logs, die ich selbst gemacht habe.

LG
Manuela

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 04.06.2014
Suchlauf-Zeit: 14:12:09
Logdatei: Malware_1.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.06.04.05
Rootkit Datenbank: v2014.06.02.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 8.1
CPU: x64
Dateisystem: NTFS
Benutzer: Manuela

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 266245
Verstrichene Zeit: 6 Min, 4 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 6
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, In Quarantäne, [274efe76b6c504325feeb7821ae833cd], 
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, In Quarantäne, [8aeb6f057a01fc3a749fce092ad951af], 
PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\WOW6432NODE\webssearchesSoftware, In Quarantäne, [3a3bb8bc78036ec8ffa0f4b435cdea16], 
PUP.Optional.Qone8, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, In Quarantäne, [2a4ba2d2bbc039fd62b1587f52b160a0], 
PUP.Optional.SimplyTech.A, HKU\S-1-5-21-2466271035-3364438158-1365813384-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\SIMPLYTECH\Toolbar, In Quarantäne, [3243561ea8d3231312739601b54d9769], 
PUP.Optional.Qone8, HKU\S-1-5-21-2466271035-3364438158-1365813384-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, In Quarantäne, [e68fe0942a51df5740d26572877c6799], 

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 12
PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND, C:\Program Files\Internet Explorer\iexplore.exe hxxp://istart.webssearches.com/?type=sc&ts=1401873921&from=slbnew&uid=KINGSTONXSV300S37A120G_50026B7743005842, Gut: (iexplore.exe), Schlecht: (C:\Program Files\Internet Explorer\iexplore.exe hxxp://istart.webssearches.com/?type=sc&ts=1401873921&from=slbnew&uid=KINGSTONXSV300S37A120G_50026B7743005842),Ersetzt,[5025bdb7fe7d68cedaff9ec09a6a42be]
PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://istart.webssearches.com/web/?type=ds&ts=1401873921&from=slbnew&uid=KINGSTONXSV300S37A120G_50026B7743005842&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/web/?type=ds&ts=1401873921&from=slbnew&uid=KINGSTONXSV300S37A120G_50026B7743005842&q={searchTerms}),Ersetzt,[a3d22252bdbec373537d2935a4602dd3]
PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://istart.webssearches.com/?type=hp&ts=1401873921&from=slbnew&uid=KINGSTONXSV300S37A120G_50026B7743005842, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/?type=hp&ts=1401873921&from=slbnew&uid=KINGSTONXSV300S37A120G_50026B7743005842),Ersetzt,[a3d2e4904338e551d1fdadb148bc7d83]
PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://istart.webssearches.com/?type=hp&ts=1401873921&from=slbnew&uid=KINGSTONXSV300S37A120G_50026B7743005842, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/?type=hp&ts=1401873921&from=slbnew&uid=KINGSTONXSV300S37A120G_50026B7743005842),Ersetzt,[01742d477cff39fd359de579ee16c43c]
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Ersetzt,[1b5ac8acbcbf65d1fe03c5a4986c0ef2]
PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND, C:\Program Files\Internet Explorer\iexplore.exe hxxp://istart.webssearches.com/?type=sc&ts=1401873921&from=slbnew&uid=KINGSTONXSV300S37A120G_50026B7743005842, Gut: (iexplore.exe), Schlecht: (C:\Program Files\Internet Explorer\iexplore.exe hxxp://istart.webssearches.com/?type=sc&ts=1401873921&from=slbnew&uid=KINGSTONXSV300S37A120G_50026B7743005842),Ersetzt,[3f36c8ac423946f09940a5b910f430d0]
PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://istart.webssearches.com/web/?type=ds&ts=1401873921&from=slbnew&uid=KINGSTONXSV300S37A120G_50026B7743005842&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/web/?type=ds&ts=1401873921&from=slbnew&uid=KINGSTONXSV300S37A120G_50026B7743005842&q={searchTerms}),Ersetzt,[77fe62122457ac8a7060e579c34149b7]
PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://istart.webssearches.com/?type=hp&ts=1401873921&from=slbnew&uid=KINGSTONXSV300S37A120G_50026B7743005842, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/?type=hp&ts=1401873921&from=slbnew&uid=KINGSTONXSV300S37A120G_50026B7743005842),Ersetzt,[a9cceb89bbc0d4628a44e67849bb7f81]
PUP.Optional.WebsSearches.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://istart.webssearches.com/?type=hp&ts=1401873921&from=slbnew&uid=KINGSTONXSV300S37A120G_50026B7743005842, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/?type=hp&ts=1401873921&from=slbnew&uid=KINGSTONXSV300S37A120G_50026B7743005842),Ersetzt,[4e27d4a0f883c274864c1648a064a858]
PUP.Optional.Qone8, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Ersetzt,[5b1a6113e9928ea8ca370960798b50b0]
PUP.Optional.WebsSearches.A, HKU\S-1-5-21-2466271035-3364438158-1365813384-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://istart.webssearches.com/?type=hp&ts=1401873921&from=slbnew&uid=KINGSTONXSV300S37A120G_50026B7743005842, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/?type=hp&ts=1401873921&from=slbnew&uid=KINGSTONXSV300S37A120G_50026B7743005842),Ersetzt,[1c59165ec6b5ff377a598ad4a0644fb1]
PUP.Optional.WebsSearches.A, HKU\S-1-5-21-2466271035-3364438158-1365813384-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://istart.webssearches.com/?type=hp&ts=1401873921&from=slbnew&uid=KINGSTONXSV300S37A120G_50026B7743005842, Gut: (www.google.com), Schlecht: (hxxp://istart.webssearches.com/?type=hp&ts=1401873921&from=slbnew&uid=KINGSTONXSV300S37A120G_50026B7743005842),Ersetzt,[c8ad0b69b5c6270f834ce37be321c13f]

Ordner: 4
PUP.Optional.Wajam.A, C:\Program Files (x86)\Wajam, In Quarantäne, [9ed7700465169d99f01de59c13ef31cf], 
PUP.Optional.Wajam.A, C:\Program Files (x86)\Wajam\Wajam Internet Enhancer, In Quarantäne, [9ed7700465169d99f01de59c13ef31cf], 
PUP.Optional.IePluginService.A, C:\ProgramData\IePluginService, In Quarantäne, [3e370470e398db5b33c80b78dd251fe1], 
PUP.Optional.WebsSearches.A, C:\Users\Manuela\AppData\Roaming\webssearches, In Quarantäne, [d89d720265160a2c08f8bbcd1ee4966a], 

Dateien: 10
PUP.Optional.Conduit.A, C:\Users\Manuela\AppData\Local\Temp\nsi3232.exe, Keine Aktion durch Benutzer, [443177fdbac1a98d2e67146f35cc8977], 
PUP.Optional.Conduit.A, C:\Users\Manuela\AppData\Local\Temp\nsf500F.exe, In Quarantäne, [e68f4232413a3105583d305349b8867a], 
PUP.Optional.Conduit.A, C:\Users\Manuela\AppData\Local\Temp\nsg52CF.exe, In Quarantäne, [96df413394e734023461dfa48b76b44c], 
PUP.Optional.Conduit.A, C:\Users\Manuela\AppData\Local\Temp\nsp34C4.exe, In Quarantäne, [98dd096be3988caa5540c0c344bd7987], 
PUP.Optional.Conduit.A, C:\Users\Manuela\AppData\Local\Temp\nszA379.exe, In Quarantäne, [c9ac5024e398c571266f5033c938fb05], 
PUP.Optional.SkyTech.A, C:\Users\Manuela\AppData\Local\Temp\405825328\405825328.zipDir\alilog.dll, In Quarantäne, [55202054304ba88e66b22d059e6258a8], 
PUP.Optional.IePluginService.A, C:\Users\Manuela\AppData\Local\Temp\405825328\405825328.zipDir\tmp\SupTab.exe, In Quarantäne, [d0a5a9cbb7c477bf10060553877a7090], 
PUP.Optional.WpManager, C:\Users\Manuela\AppData\Local\Temp\405825328\405825328.zipDir\tmp\wpm_v18.8.0.304.exe, In Quarantäne, [6d0878fcb7c4ae887a0070f2956c659b], 
PUP.Optional.Conduit.A, C:\Users\Manuela\AppData\Local\Temp\nscFBEF\SpSetup.exe, In Quarantäne, [94e12a4a3f3cef472b6a740f679a54ac], 
PUP.Optional.Wajam.A, C:\Program Files (x86)\Wajam\Wajam Internet Enhancer\WajamInternetEnhancerService.exe, In Quarantäne, [9ed7700465169d99f01de59c13ef31cf], 

Physische Sektoren: 0
(No malicious items detected)


(end)
         

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 04.06.2014
Suchlauf-Zeit: 15:03:10
Logdatei: Malware_2.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.06.04.05
Rootkit Datenbank: v2014.06.02.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 8.1
CPU: x64
Dateisystem: NTFS
Benutzer: Manuela

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 265954
Verstrichene Zeit: 5 Min, 11 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 0
(No malicious items detected)

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 1
PUP.Optional.Conduit.A, C:\Users\Manuela\AppData\Local\Temp\nsi3232.exe, In Quarantäne, [9bdadc98a3d8fc3a019410735ba634cc], 

Physische Sektoren: 0
(No malicious items detected)


(end)
         

Downloade Dir bitte Malwarebytes Anti-Malware

• Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
• Starte Malwarebytes' Anti-Malware (MBAM).
• Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
• Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
• Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
• Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
• Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
• Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

• Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
• Drücke eine beliebige Taste, um das Tool zu starten.
• Je nach System kann der Scan eine Weile dauern.
• Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
• Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Hi,

ich muss wieder in mehreren Teilen Posten (auch das FRST zerpflücken...).

LG Manuela

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 06.06.2014
Suchlauf-Zeit: 09:23:54
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.06.06.03
Rootkit Datenbank: v2014.06.02.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 8.1
CPU: x64
Dateisystem: NTFS
Benutzer: Manuela

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 271478
Verstrichene Zeit: 4 Min, 1 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 0
(No malicious items detected)

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 0
(No malicious items detected)

Physische Sektoren: 0
(No malicious items detected)


(end)
         

# AdwCleaner v3.212 - Bericht erstellt am 06/06/2014 um 09:31:24
# Aktualisiert 05/06/2014 von Xplode
# Betriebssystem : Windows 8.1  (64 bits)
# Benutzername : Manuela - ELA2014
# Gestartet von : H:\MyOwnDATA\Downloads\adwcleaner_3.212.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WajamInternetEnhancer_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WajamInternetEnhancer_RASMANCS

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17037


-\\ Google Chrome v35.0.1916.114

[ Datei : C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [3247 octets] - [04/06/2014 14:41:18]
AdwCleaner[R1].txt - [956 octets] - [04/06/2014 15:39:26]
AdwCleaner[R2].txt - [1130 octets] - [06/06/2014 09:30:34]
AdwCleaner[S0].txt - [2380 octets] - [04/06/2014 14:41:54]
AdwCleaner[S1].txt - [1052 octets] - [06/06/2014 09:31:24]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1112 octets] ##########
         

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 8.1 x64
Ran by Manuela on 06.06.2014 at  9:35:35,23
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 06.06.2014 at  9:41:15,11
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

FRST - Teil 1:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-06-2014
Ran by Manuela (administrator) on ELA2014 on 06-06-2014 09:41:54
Running from H:\MyOwnDATA\Downloads
Platform: Windows 8.1 (Update 1) (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\NETGEAR\WNDA4100\Service\RaRegistry.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\NETGEAR\WNDA4100\Service\RaRegistry64.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe
(NETGEAR) C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\WinStore\WSHost.exe
(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.17031_none_fa50b3979b1bcb4a\TiWorker.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6548112 2012-06-14] (Realtek Semiconductor)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-12-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Nikon Message Center 2] => C:\Program Files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe [571392 2011-10-30] (Nikon Corporation)
HKU\S-1-5-21-2466271035-3364438158-1365813384-1001\...\Run: [HydraVisionDesktopManager] => C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [389120 2013-12-06] (AMD)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NETGEAR WNDA4100 Genie.lnk
ShortcutTarget: NETGEAR WNDA4100 Genie.lnk -> C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE (NETGEAR)
Startup: C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-AT
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.at.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xE6FEE80D076ACF01
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=protegere
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Tcpip\Parameters: [DhcpNameServer] 195.34.133.21 212.186.211.21

FireFox:
========
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.4 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 - H:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions:  - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: 卡巴斯基網址顧問 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com [2014-05-07]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: 虛擬鍵盤 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-05-07]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: 惡意網站攔截器 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com [2014-05-07]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Chặn quảng cáo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com [2014-05-07]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com [2014-05-07]

Chrome: 
=======
CHR HomePage: https://www.google.at/
CHR StartupUrls: "https://www.google.at/"
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\gcswf32.dll No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll No File
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Extension: (YouTube) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-07]
CHR Extension: (Adblock Plus) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-05-07]
CHR Extension: (Anna Sui) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjohejgigkmiclpgnilojffhiohcglib [2014-06-04]
CHR Extension: (Google-Suche) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-07]
CHR Extension: (Clear Cache) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\cppjkneekbjaeellbfkmgnhonkkjfpdn [2014-05-07]
CHR Extension: (Modul zur Link-Untersuchung) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj [2014-05-07]
CHR Extension: (Sicherer Zahlungsverkehr) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh [2014-05-07]
CHR Extension: (SearchPreview) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\hcjdanpjacpeeppdjkppebobilhaglfo [2014-05-07]
CHR Extension: (Modul zum Sperren von gefährlichen Webseiten) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\hghkgaeecgjhjkannahfamoehjmkjail [2014-05-07]
CHR Extension: (Chrome to Mobile) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\idknbmbdnapjicclomlijcgfpikmndhd [2014-05-07]
CHR Extension: (Virtual Keyboard) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh [2014-05-07]
CHR Extension: (Google Wallet) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-07]
CHR Extension: (Google Mail) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-07]
CHR Extension: (Anti-Banner) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman [2014-05-07]
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\urladvisor.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\online_banking_chrome.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\content_blocker_chrome.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\ab.crx [2013-10-17]

==================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-12-06] (Advanced Micro Devices, Inc.)
R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2013-10-17] (Kaspersky Lab ZAO)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 RalinkRegistryWriter; C:\Program Files (x86)\NETGEAR\WNDA4100\Service\RaRegistry.exe [377088 2012-09-04] (Ralink Technology, Corp.)
R2 RalinkRegistryWriter64; C:\Program Files (x86)\NETGEAR\WNDA4100\Service\RaRegistry64.exe [455424 2012-09-04] (Ralink Technology, Corp.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

S0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra)
S0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [21160 2012-09-23] (Advanced Micro Devices, Inc.)
R2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59648 2013-09-19] (Advanced Micro Devices)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [222720 2013-09-24] (Advanced Micro Devices)
S3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-13] (Windows (R) Win 7 DDK provider)
S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 hitmanpro37; C:\Windows\system32\drivers\hitmanpro37.sys [32512 2014-06-04] ()
S3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation)
S3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation)
S0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-10] (Intel Corporation)
R0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2014-03-18] (Microsoft Corporation)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2014-05-07] (Kaspersky Lab ZAO)
S0 klelam; C:\Windows\System32\DRIVERS\klelam.sys [29792 2014-05-07] (Kaspersky Lab)
U5 klflt; C:\Windows\System32\Drivers\klflt.sys [115296 2014-05-07] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [625760 2014-05-07] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\system32\DRIVERS\klim6.sys [30304 2013-10-17] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\system32\DRIVERS\klkbdflt.sys [29280 2014-05-07] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\system32\DRIVERS\klmouflt.sys [29280 2013-10-17] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\system32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 klwfp; C:\Windows\system32\DRIVERS\klwfp.sys [65120 2014-05-07] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\system32\DRIVERS\kneps.sys [178272 2014-05-07] (Kaspersky Lab ZAO)
S0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-06-06] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2014-05-12] (Malwarebytes Corporation)
R3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation)
S3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation)
S3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924504 2014-03-18] (Microsoft Corporation)
S3 RtlWlanu; C:\Windows\system32\DRIVERS\rtwlanu.sys [1975000 2013-07-31] (Realtek Semiconductor Corporation                           )
S3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2014-03-18] (Microsoft Corporation)
S0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2014-03-18] (Microsoft Corporation)
S3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation)
S3 usbrndis6; C:\Windows\system32\DRIVERS\usb80236.sys [20992 2013-08-22] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation)
R0 Wof; C:\Windows\System32\Drivers\Wof.sys [157016 2014-03-13] (Microsoft Corporation)
S3 NPF; \SystemRoot\system32\DRIVERS\npf.sys [X]

==================== NetSvcs (Whitelisted) ===================
         

Und hier FRST - Teil 2:

==================== One Month Created Files and Folders ========

2014-06-06 09:41 - 2014-06-06 09:41 - 00000616 _____ () C:\Users\Manuela\Desktop\JRT.txt
2014-06-06 09:33 - 2014-06-06 09:33 - 00001192 _____ () C:\Users\Manuela\Desktop\AdwCleaner[S1].txt
2014-06-06 09:28 - 2014-06-06 09:28 - 00001146 _____ () C:\Users\Manuela\Desktop\mbam.txt
2014-06-04 15:39 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-06-04 15:16 - 2014-06-06 09:41 - 00000000 ____D () C:\FRST
2014-06-04 15:15 - 2014-06-04 15:15 - 00000000 _____ () C:\Users\Manuela\defogger_reenable
2014-06-04 15:01 - 2014-06-04 15:01 - 00032512 _____ () C:\Windows\system32\Drivers\hitmanpro37.sys
2014-06-04 15:01 - 2014-06-04 15:01 - 00000426 _____ () C:\Windows\system32\.crusader
2014-06-04 14:58 - 2014-06-04 15:01 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-06-04 14:48 - 2014-06-04 14:48 - 00000000 ____D () C:\Windows\ERUNT
2014-06-04 14:41 - 2014-06-06 09:31 - 00000000 ____D () C:\AdwCleaner
2014-06-04 14:11 - 2014-06-06 09:32 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-04 14:10 - 2014-06-04 14:10 - 00001121 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-04 14:10 - 2014-06-04 14:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-04 14:10 - 2014-06-04 14:10 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-04 14:10 - 2014-06-04 14:10 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-06-04 14:10 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-06-04 14:10 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-06-04 14:10 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-06-04 11:20 - 2014-06-04 11:20 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Xilisoft
2014-05-27 13:46 - 2014-05-27 13:46 - 00000000 ____D () C:\Windows\LastGood.Tmp
2014-05-27 13:45 - 2013-07-26 09:07 - 00827096 _____ (Realtek ) C:\Windows\system32\Drivers\Rt630x64.sys
2014-05-27 13:45 - 2013-07-26 09:07 - 00074456 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RtNicProp64.dll
2014-05-27 11:54 - 2014-05-27 11:54 - 00002086 _____ () C:\Users\Public\Desktop\NETGEAR WNDA4100 Genie.lnk
2014-05-27 11:54 - 2014-05-27 11:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NETGEAR WNDA4100 Genie
2014-05-27 11:54 - 2014-05-27 11:54 - 00000000 ____D () C:\Program Files (x86)\NETGEAR
2014-05-27 11:54 - 2014-05-27 11:54 - 00000000 ____D () C:\Program Files (x86)\Cisco
2014-05-27 11:54 - 2012-09-04 13:34 - 02403392 _____ (Ralink Technology, Corp.) C:\Windows\system32\RaCertMgr.dll
2014-05-27 11:54 - 2012-09-04 13:34 - 01121856 _____ (Ralink Technology, Corp.) C:\Windows\system32\RaIHV.dll
2014-05-27 11:54 - 2012-09-04 13:34 - 00128864 _____ (Ralink Technology, Corp.) C:\Windows\system32\RaExtUI.dll
2014-05-27 11:31 - 2014-05-27 11:33 - 00000000 ____D () C:\Users\Manuela\Desktop\ReportMaker
2014-05-26 11:11 - 2014-05-26 11:11 - 00000000 ____D () C:\Users\Manuela\AppData\Local\NETGEAR
2014-05-26 11:11 - 2014-05-26 11:11 - 00000000 ____D () C:\ProgramData\NETGEAR
2014-05-26 11:11 - 2012-10-22 14:50 - 00008192 _____ () C:\Windows\system32\Drivers\rt2870.bin
2014-05-15 10:37 - 2014-06-06 09:32 - 00000000 __RDO () C:\Users\Manuela\OneDrive
2014-05-15 09:41 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-15 09:41 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-15 09:41 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-15 09:41 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-15 09:41 - 2014-04-11 12:03 - 00555736 _____ (Microsoft Corporation) C:\Windows\system32\twinapi.appcore.dll
2014-05-15 09:41 - 2014-04-11 12:03 - 00054776 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-05-15 09:41 - 2014-04-11 10:25 - 00419928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinapi.appcore.dll
2014-05-15 09:41 - 2014-04-11 08:04 - 00056320 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-05-15 09:41 - 2014-04-11 07:53 - 00079872 _____ (Microsoft Corporation) C:\Windows\system32\WSReset.exe
2014-05-15 09:41 - 2014-04-11 07:22 - 00025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-05-15 09:41 - 2014-04-11 05:54 - 00201728 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2014-05-15 09:41 - 2014-04-11 05:36 - 11792384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2014-05-15 09:41 - 2014-04-11 05:24 - 13288960 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
2014-05-15 09:41 - 2014-04-11 05:06 - 00031232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-05-15 09:41 - 2014-04-11 05:05 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-05-15 09:41 - 2014-04-11 05:05 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-05-15 09:41 - 2014-04-11 05:02 - 00249344 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-05-15 09:41 - 2014-04-11 05:02 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-05-15 09:41 - 2014-04-11 05:01 - 00137728 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-05-15 09:41 - 2014-04-11 05:00 - 00080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-05-15 09:41 - 2014-04-11 04:59 - 00666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-05-15 09:41 - 2014-04-11 04:57 - 00190976 _____ (Microsoft Corporation) C:\Windows\system32\storewuauth.dll
2014-05-15 09:41 - 2014-04-11 04:56 - 00381440 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll
2014-05-15 09:41 - 2014-04-11 04:55 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-05-15 09:41 - 2014-04-11 04:53 - 00827392 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-05-15 09:41 - 2014-04-11 04:52 - 03464192 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-05-15 09:41 - 2014-04-11 04:46 - 01705472 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-05-15 09:41 - 2014-04-11 04:36 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.appcore.dll
2014-05-15 09:41 - 2014-04-11 04:34 - 00754688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-05-15 09:41 - 2014-04-11 04:29 - 01054208 _____ (Microsoft Corporation) C:\Windows\system32\twinui.appcore.dll
2014-05-15 09:41 - 2014-04-11 04:25 - 00921088 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-05-15 09:41 - 2014-04-09 00:46 - 00086688 _____ (Microsoft Corporation) C:\Windows\system32\mrt_map.dll
2014-05-15 09:41 - 2014-04-09 00:46 - 00028320 _____ (Microsoft Corporation) C:\Windows\system32\mrt100.dll
2014-05-15 09:41 - 2014-04-08 20:54 - 00080032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mrt_map.dll
2014-05-15 09:41 - 2014-04-08 20:54 - 00026784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mrt100.dll
2014-05-15 09:41 - 2014-03-27 11:12 - 21225584 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-15 09:41 - 2014-03-27 09:48 - 18679728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-15 09:41 - 2014-03-24 04:30 - 00257880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdFilter.sys
2014-05-15 09:41 - 2014-03-24 04:30 - 00123224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdNisDrv.sys
2014-05-15 09:41 - 2014-03-24 04:27 - 00035856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdBoot.sys
2014-05-15 09:41 - 2014-03-13 09:42 - 00308224 _____ (Microsoft Corporation) C:\Windows\system32\wusa.exe
2014-05-15 09:41 - 2014-03-13 08:51 - 00305152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wusa.exe
2014-05-13 18:46 - 2014-05-13 18:46 - 00000965 _____ () C:\Users\Public\Desktop\World of Warcraft.lnk
2014-05-13 18:46 - 2014-05-13 18:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft
2014-05-13 18:36 - 2014-05-13 20:19 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Battle.net
2014-05-13 18:36 - 2014-05-13 18:58 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Battle.net
2014-05-13 18:36 - 2014-05-13 18:36 - 00000841 _____ () C:\Users\Public\Desktop\Battle.net.lnk
2014-05-13 18:36 - 2014-05-13 18:36 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Blizzard Entertainment
2014-05-13 18:36 - 2014-05-13 18:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net
2014-05-13 18:36 - 2014-05-13 18:36 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment
2014-05-13 18:34 - 2014-05-13 18:34 - 00000000 ____D () C:\ProgramData\Battle.net
2014-05-11 13:04 - 2014-05-12 01:02 - 00000000 ____D () C:\Users\Manuela\AppData\Local\PasswordSafe
2014-05-11 13:01 - 2014-05-11 13:01 - 00001049 _____ () C:\Users\Manuela\Desktop\Password Safe.lnk
2014-05-11 13:01 - 2014-05-11 13:01 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Password Safe
2014-05-11 13:01 - 2014-05-11 13:01 - 00000000 ____D () C:\Program Files (x86)\Password Safe
2014-05-11 11:30 - 2014-06-04 11:19 - 00000000 ____D () C:\Program Files (x86)\MSECache
2014-05-09 16:18 - 2014-05-09 16:18 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Awesomium
2014-05-09 15:45 - 2014-05-09 15:45 - 00000000 ____D () C:\ProgramData\Elder Scrolls Online
2014-05-09 14:44 - 2014-05-09 14:44 - 00001060 _____ () C:\Users\Manuela\Desktop\The Elder Scrolls Online.lnk
2014-05-09 14:44 - 2014-05-09 14:44 - 00000000 ____D () C:\Windows\jre
2014-05-09 14:44 - 2014-05-09 14:44 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\The Elder Scrolls Online
2014-05-09 14:01 - 2014-05-09 14:44 - 00000000 ___HD () C:\Program Files (x86)\Zero G Registry
2014-05-09 13:59 - 2014-05-09 13:59 - 00000000 ___HD () C:\Users\Manuela\InstallAnywhere
2014-05-09 13:41 - 2014-05-09 13:41 - 00000890 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2014-05-09 13:41 - 2014-05-09 13:41 - 00000000 ____D () C:\Program Files\VideoLAN
2014-05-09 09:51 - 2014-05-26 17:41 - 00000000 ____D () C:\ProgramData\Nikon
2014-05-08 19:20 - 2014-05-08 19:20 - 00001301 _____ () C:\Users\Public\Desktop\FINAL FANTASY XIV - A Realm Reborn.lnk
2014-05-08 18:59 - 2014-05-08 18:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SQUARE ENIX
2014-05-08 18:57 - 2014-05-08 18:57 - 00000000 ____D () C:\Windows\SysWOW64\XPSViewer
2014-05-08 18:57 - 2014-05-08 18:57 - 00000000 ____D () C:\Program Files\Reference Assemblies
2014-05-08 18:57 - 2014-05-08 18:57 - 00000000 ____D () C:\Program Files\MSBuild
2014-05-08 18:57 - 2014-05-08 18:57 - 00000000 ____D () C:\Program Files (x86)\Reference Assemblies
2014-05-08 18:57 - 2014-05-08 18:57 - 00000000 ____D () C:\Program Files (x86)\MSBuild
2014-05-08 18:56 - 2014-05-08 18:56 - 00010085 _____ () C:\Windows\DirectX.log
2014-05-08 18:56 - 2013-08-03 06:48 - 01166520 _____ (Microsoft Corporation) C:\Windows\system32\PresentationNative_v0300.dll
2014-05-08 18:56 - 2013-08-03 06:48 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2014-05-08 18:56 - 2013-08-03 06:48 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-05-08 18:56 - 2013-08-03 06:41 - 00778936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationNative_v0300.dll
2014-05-08 18:56 - 2013-08-03 06:41 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2014-05-08 18:56 - 2013-08-03 06:41 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-05-08 18:56 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll
2014-05-08 18:56 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2014-05-08 18:56 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll
2014-05-08 18:56 - 2010-06-02 04:55 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_7.dll
2014-05-08 18:56 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2014-05-08 18:56 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll
2014-05-08 18:56 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2014-05-08 18:56 - 2010-05-26 11:41 - 02401112 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_43.dll
2014-05-08 18:56 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll
2014-05-08 18:56 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_43.dll
2014-05-08 18:56 - 2010-05-26 11:41 - 01907552 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll
2014-05-08 18:56 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll
2014-05-08 18:56 - 2010-05-26 11:41 - 00511328 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_43.dll
2014-05-08 18:56 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_43.dll
2014-05-08 18:56 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll
2014-05-08 18:56 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll
2014-05-08 18:56 - 2010-02-04 10:01 - 00530776 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_6.dll
2014-05-08 18:56 - 2010-02-04 10:01 - 00528216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_6.dll
2014-05-08 18:56 - 2010-02-04 10:01 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_6.dll
2014-05-08 18:56 - 2010-02-04 10:01 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_6.dll
2014-05-08 18:56 - 2010-02-04 10:01 - 00078680 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_4.dll
2014-05-08 18:56 - 2010-02-04 10:01 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_4.dll
2014-05-08 18:56 - 2010-02-04 10:01 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_7.dll
2014-05-08 18:56 - 2010-02-04 10:01 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_7.dll
2014-05-08 18:56 - 2009-09-04 17:44 - 00517960 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_5.dll
2014-05-08 18:56 - 2009-09-04 17:44 - 00515416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_5.dll
2014-05-08 18:56 - 2009-09-04 17:44 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_5.dll
2014-05-08 18:56 - 2009-09-04 17:44 - 00176968 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_5.dll
2014-05-08 18:56 - 2009-09-04 17:44 - 00073544 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_3.dll
2014-05-08 18:56 - 2009-09-04 17:44 - 00069464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_3.dll
2014-05-08 18:56 - 2009-09-04 17:29 - 05554512 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_42.dll
2014-05-08 18:56 - 2009-09-04 17:29 - 05501792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_42.dll
2014-05-08 18:56 - 2009-09-04 17:29 - 02582888 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_42.dll
2014-05-08 18:56 - 2009-09-04 17:29 - 02475352 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_42.dll
2014-05-08 18:56 - 2009-09-04 17:29 - 01974616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_42.dll
2014-05-08 18:56 - 2009-09-04 17:29 - 01892184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_42.dll
2014-05-08 18:56 - 2009-09-04 17:29 - 00523088 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll
2014-05-08 18:56 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_42.dll
2014-05-08 18:56 - 2009-09-04 17:29 - 00285024 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_42.dll
2014-05-08 18:56 - 2009-09-04 17:29 - 00235344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_42.dll
2014-05-08 18:56 - 2009-03-16 14:18 - 00521560 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_4.dll
2014-05-08 18:56 - 2009-03-16 14:18 - 00517448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_4.dll
2014-05-08 18:56 - 2009-03-16 14:18 - 00235352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_4.dll
2014-05-08 18:56 - 2009-03-16 14:18 - 00174936 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_4.dll
2014-05-08 18:56 - 2009-03-16 14:18 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_6.dll
2014-05-08 18:56 - 2009-03-16 14:18 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_6.dll
2014-05-08 18:56 - 2009-03-09 15:27 - 05425496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_41.dll
2014-05-08 18:56 - 2009-03-09 15:27 - 04178264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_41.dll
2014-05-08 18:56 - 2009-03-09 15:27 - 02430312 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_41.dll
2014-05-08 18:56 - 2009-03-09 15:27 - 01846632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_41.dll
2014-05-08 18:56 - 2009-03-09 15:27 - 00520544 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_41.dll
2014-05-08 18:56 - 2009-03-09 15:27 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_41.dll
2014-05-08 18:56 - 2008-10-27 10:04 - 00518480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_3.dll
2014-05-08 18:56 - 2008-10-27 10:04 - 00514384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_3.dll
2014-05-08 18:56 - 2008-10-27 10:04 - 00235856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_3.dll
2014-05-08 18:56 - 2008-10-27 10:04 - 00175440 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_3.dll
2014-05-08 18:56 - 2008-10-27 10:04 - 00074576 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_2.dll
2014-05-08 18:56 - 2008-10-27 10:04 - 00070992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_2.dll
2014-05-08 18:56 - 2008-10-27 10:04 - 00025936 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_5.dll
2014-05-08 18:56 - 2008-10-27 10:04 - 00023376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_5.dll
2014-05-08 18:56 - 2008-10-15 06:22 - 05631312 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_40.dll
2014-05-08 18:56 - 2008-10-15 06:22 - 04379984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_40.dll
2014-05-08 18:56 - 2008-10-15 06:22 - 02605920 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_40.dll
2014-05-08 18:56 - 2008-10-15 06:22 - 02036576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_40.dll
2014-05-08 18:56 - 2008-10-15 06:22 - 00519000 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_40.dll
2014-05-08 18:56 - 2008-10-15 06:22 - 00452440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_40.dll
2014-05-08 18:56 - 2008-07-31 10:41 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_2.dll
2014-05-08 18:56 - 2008-07-31 10:41 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_2.dll
2014-05-08 18:56 - 2008-07-31 10:41 - 00072200 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_1.dll
2014-05-08 18:56 - 2008-07-31 10:41 - 00068616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_1.dll
2014-05-08 18:56 - 2008-07-31 10:40 - 00513544 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_2.dll
2014-05-08 18:56 - 2008-07-31 10:40 - 00509448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_2.dll
2014-05-08 18:56 - 2008-07-10 11:01 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_39.dll
2014-05-08 18:56 - 2008-07-10 11:00 - 04992520 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_39.dll
2014-05-08 18:56 - 2008-07-10 11:00 - 03851784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll
2014-05-08 18:56 - 2008-07-10 11:00 - 01942552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_39.dll
2014-05-08 18:56 - 2008-07-10 11:00 - 01493528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_39.dll
2014-05-08 18:56 - 2008-07-10 11:00 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_39.dll
2014-05-08 18:56 - 2008-05-30 14:19 - 00511496 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_1.dll
2014-05-08 18:56 - 2008-05-30 14:19 - 00507400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_1.dll
2014-05-08 18:56 - 2008-05-30 14:18 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_1.dll
2014-05-08 18:56 - 2008-05-30 14:18 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_1.dll
2014-05-08 18:56 - 2008-05-30 14:17 - 00068104 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_0.dll
2014-05-08 18:56 - 2008-05-30 14:17 - 00065032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_0.dll
2014-05-08 18:56 - 2008-05-30 14:17 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_4.dll
2014-05-08 18:56 - 2008-05-30 14:16 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_4.dll
2014-05-08 18:56 - 2008-05-30 14:11 - 04991496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_38.dll
2014-05-08 18:56 - 2008-05-30 14:11 - 03850760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_38.dll
2014-05-08 18:56 - 2008-05-30 14:11 - 01941528 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_38.dll
2014-05-08 18:56 - 2008-05-30 14:11 - 01491992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_38.dll
2014-05-08 18:56 - 2008-05-30 14:11 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_38.dll
2014-05-08 18:56 - 2008-05-30 14:11 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_38.dll
2014-05-08 18:56 - 2008-03-05 16:04 - 00489480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_0.dll
2014-05-08 18:56 - 2008-03-05 16:03 - 00479752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_0.dll
2014-05-08 18:56 - 2008-03-05 16:03 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_0.dll
2014-05-08 18:56 - 2008-03-05 16:03 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_0.dll
2014-05-08 18:56 - 2008-03-05 16:00 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_3.dll
2014-05-08 18:56 - 2008-03-05 16:00 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_3.dll
2014-05-08 18:56 - 2008-03-05 15:56 - 04910088 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_37.dll
2014-05-08 18:56 - 2008-03-05 15:56 - 03786760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_37.dll
2014-05-08 18:56 - 2008-03-05 15:56 - 01860120 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_37.dll
2014-05-08 18:56 - 2008-03-05 15:56 - 01420824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_37.dll
2014-05-08 18:56 - 2008-02-05 23:07 - 00529424 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_37.dll
2014-05-08 18:56 - 2008-02-05 23:07 - 00462864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_37.dll
2014-05-08 18:56 - 2007-10-22 03:40 - 00411656 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_10.dll
2014-05-08 18:56 - 2007-10-22 03:39 - 00267272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_10.dll
2014-05-08 18:56 - 2007-10-22 03:37 - 00021000 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_2.dll
2014-05-08 18:56 - 2007-10-22 03:37 - 00017928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_2.dll
2014-05-08 18:56 - 2007-10-12 15:14 - 05081608 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_36.dll
2014-05-08 18:56 - 2007-10-12 15:14 - 03734536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_36.dll
2014-05-08 18:56 - 2007-10-12 15:14 - 02006552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_36.dll
2014-05-08 18:56 - 2007-10-12 15:14 - 01374232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_36.dll
2014-05-08 18:56 - 2007-10-02 09:56 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_36.dll
2014-05-08 18:56 - 2007-10-02 09:56 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_36.dll
2014-05-08 18:56 - 2007-07-20 00:57 - 00411496 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_9.dll
2014-05-08 18:56 - 2007-07-20 00:57 - 00267112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_9.dll
2014-05-08 18:56 - 2007-07-19 18:14 - 05073256 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_35.dll
2014-05-08 18:56 - 2007-07-19 18:14 - 03727720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_35.dll
2014-05-08 18:56 - 2007-07-19 18:14 - 01985904 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_35.dll
2014-05-08 18:56 - 2007-07-19 18:14 - 01358192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_35.dll
2014-05-08 18:56 - 2007-07-19 18:14 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_35.dll
2014-05-08 18:56 - 2007-07-19 18:14 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_35.dll
2014-05-08 18:56 - 2007-06-20 20:49 - 00409960 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_8.dll
2014-05-08 18:56 - 2007-06-20 20:46 - 00266088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_8.dll
2014-05-08 18:56 - 2007-05-16 16:45 - 04496232 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_34.dll
2014-05-08 18:56 - 2007-05-16 16:45 - 03497832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_34.dll
2014-05-08 18:56 - 2007-05-16 16:45 - 01401200 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_34.dll
2014-05-08 18:56 - 2007-05-16 16:45 - 01124720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_34.dll
2014-05-08 18:56 - 2007-05-16 16:45 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_34.dll
2014-05-08 18:56 - 2007-05-16 16:45 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_34.dll
2014-05-08 18:56 - 2007-04-04 18:55 - 00403304 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_7.dll
2014-05-08 18:56 - 2007-04-04 18:55 - 00261480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_7.dll
2014-05-08 18:56 - 2007-04-04 18:54 - 00107368 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_3.dll
2014-05-08 18:56 - 2007-04-04 18:53 - 00081768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_3.dll
2014-05-08 18:56 - 2007-03-15 16:57 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_33.dll
2014-05-08 18:56 - 2007-03-15 16:57 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_33.dll
2014-05-08 18:56 - 2007-03-12 16:42 - 04494184 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_33.dll
2014-05-08 18:56 - 2007-03-12 16:42 - 03495784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_33.dll
2014-05-08 18:56 - 2007-03-12 16:42 - 01400176 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_33.dll
2014-05-08 18:56 - 2007-03-12 16:42 - 01123696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_33.dll
2014-05-08 18:56 - 2007-03-05 12:42 - 00017688 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_1.dll
2014-05-08 18:56 - 2007-03-05 12:42 - 00015128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_1.dll
2014-05-08 18:56 - 2007-01-24 15:27 - 00393576 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_6.dll
2014-05-08 18:56 - 2007-01-24 15:27 - 00255848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_6.dll
2014-05-08 18:56 - 2006-12-08 12:02 - 00251672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_5.dll
2014-05-08 18:56 - 2006-12-08 12:00 - 00390424 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_5.dll
2014-05-08 18:56 - 2006-11-29 13:06 - 04398360 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_32.dll
2014-05-08 18:56 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_32.dll
2014-05-08 18:56 - 2006-11-29 13:06 - 00469264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10.dll
2014-05-08 18:56 - 2006-11-29 13:06 - 00440080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10.dll
2014-05-08 18:56 - 2006-09-28 16:05 - 03977496 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_31.dll
2014-05-08 18:56 - 2006-09-28 16:05 - 02414360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_31.dll
2014-05-08 18:56 - 2006-09-28 16:05 - 00237848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_4.dll
2014-05-08 18:56 - 2006-09-28 16:04 - 00364824 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_4.dll
2014-05-08 18:56 - 2006-07-28 09:31 - 00083736 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_2.dll
2014-05-08 18:56 - 2006-07-28 09:30 - 00363288 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_3.dll
2014-05-08 18:56 - 2006-07-28 09:30 - 00236824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_3.dll
2014-05-08 18:56 - 2006-07-28 09:30 - 00062744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_2.dll
2014-05-08 18:56 - 2006-05-31 07:24 - 00230168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_2.dll
2014-05-08 18:56 - 2006-05-31 07:22 - 00354072 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_2.dll
2014-05-08 18:56 - 2006-03-31 12:41 - 03927248 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_30.dll
2014-05-08 18:56 - 2006-03-31 12:40 - 02388176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_30.dll
2014-05-08 18:56 - 2006-03-31 12:40 - 00352464 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_1.dll
2014-05-08 18:56 - 2006-03-31 12:39 - 00229584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_1.dll
2014-05-08 18:56 - 2006-03-31 12:39 - 00083664 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_1.dll
2014-05-08 18:56 - 2006-03-31 12:39 - 00062672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_1.dll
2014-05-08 18:56 - 2006-02-03 08:43 - 03830992 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_29.dll
2014-05-08 18:56 - 2006-02-03 08:43 - 02332368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_29.dll
2014-05-08 18:56 - 2006-02-03 08:42 - 00355536 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_0.dll
2014-05-08 18:56 - 2006-02-03 08:42 - 00230096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_0.dll
2014-05-08 18:56 - 2006-02-03 08:41 - 00016592 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_0.dll
2014-05-08 18:56 - 2006-02-03 08:41 - 00014032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_0.dll
2014-05-08 18:56 - 2005-12-05 18:09 - 03815120 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_28.dll
2014-05-08 18:56 - 2005-12-05 18:09 - 02323664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_28.dll
2014-05-08 18:56 - 2005-07-22 19:59 - 03807440 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_27.dll
2014-05-08 18:56 - 2005-07-22 19:59 - 02319568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_27.dll
2014-05-08 18:56 - 2005-05-26 15:34 - 03767504 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_26.dll
2014-05-08 18:56 - 2005-05-26 15:34 - 02297552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_26.dll
2014-05-08 18:56 - 2005-03-18 17:19 - 03823312 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_25.dll
2014-05-08 18:56 - 2005-03-18 17:19 - 02337488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_25.dll
2014-05-08 18:56 - 2005-02-05 19:45 - 03544272 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_24.dll
2014-05-08 18:56 - 2005-02-05 19:45 - 02222800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_24.dll
2014-05-08 12:02 - 2014-06-04 23:21 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\TS3Client
2014-05-08 12:02 - 2014-05-08 12:02 - 00000881 _____ () C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2014-05-08 12:02 - 2014-05-08 12:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
2014-05-08 08:23 - 2014-05-08 08:24 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Nikon
2014-05-08 08:23 - 2014-05-08 08:23 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Nikon
2014-05-08 08:21 - 2014-05-08 08:21 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2014-05-08 08:15 - 2014-05-08 08:15 - 00002077 _____ () C:\Users\Public\Desktop\Panorama Maker 6.lnk
2014-05-08 08:15 - 2014-05-08 08:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ArcSoft Panorama Maker 6
2014-05-08 08:15 - 2014-05-08 08:15 - 00000000 ____D () C:\Program Files (x86)\ArcSoft
2014-05-08 08:14 - 2014-05-08 08:14 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\ArcSoft
2014-05-08 08:13 - 2014-06-04 13:52 - 00000020 ____H () C:\ProgramData\PKP_DLev.DAT
2014-05-08 08:13 - 2014-06-04 13:52 - 00000020 ____H () C:\ProgramData\PKP_DLet.DAT
2014-05-08 08:13 - 2014-05-27 11:53 - 00000000 ____D () C:\Windows\Downloaded Installations
2014-05-08 08:13 - 2014-05-08 08:13 - 00106496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ATL71.DLL
2014-05-08 08:13 - 2014-05-08 08:13 - 00002072 _____ () C:\Users\Public\Desktop\ViewNX 2.lnk
2014-05-08 08:13 - 2014-05-08 08:13 - 00000268 ___RH () C:\Users\Manuela\AppData\Roaming\Stingers
2014-05-08 08:13 - 2014-05-08 08:13 - 00000268 ___RH () C:\Users\Manuela\AppData\Roaming\StatusSheet
2014-05-08 08:13 - 2014-05-08 08:13 - 00000268 ___RH () C:\Users\Manuela\AppData\Roaming\Static Library
2014-05-08 08:13 - 2014-05-08 08:13 - 00000268 ___RH () C:\ProgramData\Super Strings
2014-05-08 08:13 - 2014-05-08 08:13 - 00000268 ___RH () C:\ProgramData\Strings
2014-05-08 08:13 - 2014-05-08 08:13 - 00000268 ___RH () C:\ProgramData\String Ensemble
2014-05-08 08:13 - 2014-05-08 08:13 - 00000020 ____H () C:\ProgramData\PKP_DLes.DAT
2014-05-08 08:13 - 2014-05-08 08:13 - 00000012 ___RH () C:\ProgramData\Track Settings
2014-05-08 08:13 - 2014-05-08 08:13 - 00000012 ___RH () C:\ProgramData\Textures
2014-05-08 08:13 - 2014-05-08 08:13 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Downloaded Installations
2014-05-08 08:13 - 2014-05-08 08:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ViewNX 2
2014-05-08 08:13 - 2014-05-08 08:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nikon Message Center 2
2014-05-08 08:13 - 2014-05-08 08:13 - 00000000 ____D () C:\ProgramData\54F3DE4E-B7BA-4EBD-8B3B-385D272CC583
2014-05-08 08:13 - 2014-05-08 08:13 - 00000000 ____D () C:\Program Files\Nikon
2014-05-08 08:13 - 2014-05-08 08:13 - 00000000 ____D () C:\Program Files\Common Files\Nikon
2014-05-08 08:13 - 2014-05-08 08:13 - 00000000 ____D () C:\Program Files (x86)\Nikon
2014-05-08 08:12 - 2014-05-08 08:13 - 00000012 ___RH () C:\ProgramData\Techno Kit
2014-05-08 08:12 - 2014-05-08 08:13 - 00000000 ____D () C:\ProgramData\Ultima_T15
2014-05-08 08:12 - 2014-05-08 08:13 - 00000000 ____D () C:\ProgramData\EnterNHelp
2014-05-08 08:12 - 2014-05-08 08:12 - 00000268 ___RH () C:\Users\Manuela\AppData\Roaming\Synth Textures
2014-05-08 08:12 - 2014-05-08 08:12 - 00000020 ____H () C:\ProgramData\PKP_DLeo.DAT
2014-05-08 08:12 - 2014-05-08 08:12 - 00000012 ___RH () C:\ProgramData\deskjet
2014-05-08 08:11 - 2014-05-08 08:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Link to Nikon
2014-05-08 00:02 - 2014-05-08 00:02 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
2014-05-07 22:21 - 2014-05-07 22:21 - 00122480 _____ () C:\Users\Manuela\AppData\Local\GDIPFONTCACHEV1.DAT
2014-05-07 21:33 - 2014-05-07 21:33 - 00007177 _____ () C:\Windows\system32\lvcoinst.log
2014-05-07 21:33 - 2014-05-07 21:33 - 00000000 ____D () C:\Program Files\Common Files\logishrd
2014-05-07 21:22 - 2007-01-19 18:24 - 00025312 _____ (Windows (R) Codename Longhorn DDK provider) C:\Windows\system32\Drivers\SCMNdisP.sys
2014-05-07 21:21 - 2014-05-07 21:21 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_bcmwlhigh664_01009.Wdf
2014-05-07 21:21 - 2014-05-07 21:21 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\InstallShield
2014-05-07 17:14 - 2014-05-07 17:14 - 00000000 __SHD () C:\Users\Manuela\AppData\Local\EmieUserList
2014-05-07 17:14 - 2014-05-07 17:14 - 00000000 __SHD () C:\Users\Manuela\AppData\Local\EmieSiteList
2014-05-07 17:13 - 2014-05-07 17:13 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Adobe
2014-05-07 15:27 - 2014-05-07 15:35 - 00002353 _____ () C:\Users\Manuela\Desktop\Sicherer Zahlungsverkehr.lnk
2014-05-07 15:27 - 2014-05-07 15:27 - 00001348 _____ () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security.lnk
2014-05-07 15:15 - 2014-06-06 09:32 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-05-07 15:15 - 2014-05-07 15:31 - 00625760 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-05-07 15:15 - 2014-05-07 15:31 - 00115296 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2014-05-07 15:15 - 2014-05-07 15:15 - 00001143 _____ () C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
2014-05-07 15:15 - 2014-05-07 15:15 - 00000000 ____D () C:\Program Files (x86)\Kaspersky Lab
2014-05-07 15:15 - 2013-05-06 09:13 - 00110176 _____ (Kaspersky Lab ZAO) C:\Windows\system32\klfphc.dll
2014-05-07 14:24 - 2014-05-07 14:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-05-07 14:23 - 2014-05-07 14:23 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-05-07 14:23 - 2014-05-07 14:23 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-05-07 14:07 - 2014-05-07 14:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Live Add-in
2014-05-07 14:04 - 2014-05-07 14:04 - 00000000 ____D () C:\Users\Default\AppData\Local\Microsoft Help
2014-05-07 14:04 - 2014-05-07 14:04 - 00000000 ____D () C:\Users\Default User\AppData\Local\Microsoft Help
2014-05-07 14:01 - 2014-05-07 14:01 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_LocationProvider_01_11_00.Wdf
2014-05-07 13:59 - 2014-05-07 14:00 - 00000000 ____D () C:\Users\Manuela\Desktop\MS Office
2014-05-07 13:56 - 2014-05-09 13:45 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\vlc
2014-05-07 13:56 - 2014-05-07 13:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-05-07 13:52 - 2014-05-07 13:52 - 00002655 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Neues Microsoft Office-Dokument.lnk
2014-05-07 13:52 - 2014-05-07 13:52 - 00002655 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Microsoft Office-Dokument öffnen.lnk
2014-05-07 13:52 - 2014-05-07 13:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2014-05-07 13:51 - 2014-05-07 13:53 - 00000000 ____D () C:\Program Files (x86)\Microsoft Works
2014-05-07 13:51 - 2014-05-07 13:51 - 00000000 ____D () C:\Windows\PCHEALTH
2014-05-07 13:51 - 2014-05-07 13:51 - 00000000 ____D () C:\Program Files (x86)\Microsoft Visual Studio
2014-05-07 13:50 - 2014-05-07 13:50 - 00000000 ____D () C:\Program Files\Microsoft Office
2014-05-07 13:49 - 2014-05-15 09:43 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-07 13:49 - 2014-05-07 14:05 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
2014-05-07 13:49 - 2014-05-07 13:49 - 00000000 __RHD () C:\MSOCache
2014-05-07 13:49 - 2014-05-07 13:49 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Microsoft Help
2014-05-07 13:41 - 2014-05-07 13:41 - 00001006 _____ () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TextPad.lnk
2014-05-07 13:41 - 2014-05-07 13:41 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Helios
2014-05-07 13:41 - 2014-05-07 13:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TextPad
2014-05-07 13:41 - 2014-05-07 13:41 - 00000000 ____D () C:\Program Files (x86)\TextPad 6
2014-05-07 13:39 - 2014-05-07 13:39 - 00001968 _____ () C:\Users\Public\Desktop\CDBurnerXP.lnk
2014-05-07 13:39 - 2014-05-07 13:39 - 00001918 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2014-05-07 13:39 - 2014-05-07 13:39 - 00001017 _____ () C:\Users\Public\Desktop\IrfanView.lnk
2014-05-07 13:39 - 2014-05-07 13:39 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\IrfanView
2014-05-07 13:39 - 2014-05-07 13:39 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Canneverbe Limited
2014-05-07 13:39 - 2014-05-07 13:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IrfanView
2014-05-07 13:39 - 2014-05-07 13:39 - 00000000 ____D () C:\ProgramData\Canneverbe Limited
2014-05-07 13:39 - 2014-05-07 13:39 - 00000000 ____D () C:\Program Files (x86)\IrfanView
2014-05-07 13:39 - 2014-05-07 13:39 - 00000000 ____D () C:\Program Files (x86)\CDBurnerXP
2014-05-07 13:32 - 2014-05-24 09:14 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-05-07 13:32 - 2014-05-07 17:17 - 00000000 ____D () C:\ProgramData\Adobe
2014-05-07 13:32 - 2014-05-07 13:32 - 00002042 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2014-05-07 13:32 - 2014-05-07 13:32 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-05-07 13:28 - 2014-05-07 13:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
2014-05-07 13:06 - 2014-05-07 13:06 - 00003554 _____ () C:\Windows\System32\Tasks\CreateChoiceProcessTask
2014-05-07 13:06 - 2013-08-22 08:57 - 00002143 ___RS () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Browser Choice.lnk
2014-05-07 13:03 - 2014-05-07 13:03 - 00000000 ___RD () C:\Windows\BrowserChoice
2014-05-07 13:02 - 2014-05-15 09:43 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-07 13:02 - 2014-05-15 09:42 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-07 13:02 - 2014-01-19 09:38 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-05-07 13:01 - 2014-05-07 12:20 - 00000000 ____D () C:\Windows\Panther
2014-05-07 13:01 - 2014-03-20 06:19 - 01291200 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-05-07 13:01 - 2014-03-20 05:41 - 02013016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-05-07 13:01 - 2014-03-20 05:41 - 00376152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\clfs.sys
2014-05-07 13:01 - 2014-03-20 05:40 - 01112536 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-07 13:01 - 2014-03-20 03:29 - 04268544 _____ (Microsoft Corporation) C:\Windows\system32\SyncEngine.dll
2014-05-07 13:01 - 2014-03-20 02:53 - 00950784 _____ (Microsoft Corporation) C:\Windows\system32\ReAgent.dll
2014-05-07 13:01 - 2014-03-20 02:48 - 00201216 _____ (Microsoft Corporation) C:\Windows\system32\ReInfo.dll
2014-05-07 13:01 - 2014-03-20 01:55 - 01036288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-05-07 13:01 - 2014-03-20 01:39 - 00800256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ReAgent.dll
2014-05-07 13:01 - 2014-03-20 01:36 - 00172544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ReInfo.dll
2014-05-07 13:01 - 2014-03-19 09:13 - 00836096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-05-07 13:01 - 2014-03-19 07:57 - 00621568 _____ (Microsoft Corporation) C:\Windows\system32\MDMAgent.exe
2014-05-07 13:01 - 2014-03-19 07:50 - 00079360 _____ (Microsoft Corporation) C:\Windows\system32\w32tm.exe
2014-05-07 13:01 - 2014-03-19 07:31 - 01656832 _____ (Microsoft Corporation) C:\Windows\system32\GdiPlus.dll
2014-05-07 13:01 - 2014-03-19 07:20 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\w32tm.exe
2014-05-07 13:01 - 2014-03-19 07:08 - 01351168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\GdiPlus.dll
2014-05-07 13:01 - 2014-03-19 06:41 - 00721408 _____ (Microsoft Corporation) C:\Windows\system32\SkyDriveTelemetry.dll
2014-05-07 13:01 - 2014-03-19 06:17 - 00872448 _____ (Microsoft Corporation) C:\Windows\system32\SkyDrive.exe
2014-05-07 13:01 - 2014-03-13 14:35 - 00157016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wof.sys
2014-05-07 13:01 - 2014-03-12 15:45 - 00387210 _____ () C:\Windows\system32\ApnDatabase.xml
2014-05-07 13:01 - 2014-03-11 17:18 - 01015808 _____ (Microsoft Corporation) C:\Windows\system32\aclui.dll
2014-05-07 13:01 - 2014-03-11 16:28 - 00887296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aclui.dll
2014-05-07 13:01 - 2014-03-11 14:42 - 02641920 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-05-07 13:01 - 2014-03-11 14:35 - 02317824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-05-07 13:01 - 2014-03-08 22:47 - 00565536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2014-05-07 13:01 - 2014-03-08 22:47 - 00180056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-07 13:01 - 2014-03-08 22:40 - 00136024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wfplwfs.sys
2014-05-07 13:01 - 2014-03-08 22:38 - 01542768 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2014-05-07 13:01 - 2014-03-08 22:35 - 00467800 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\USBHUB3.SYS
2014-05-07 13:01 - 2014-03-08 22:35 - 00337752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Classpnp.sys
2014-05-07 13:01 - 2014-03-08 17:29 - 01339240 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-05-07 13:01 - 2014-03-08 17:29 - 00356848 _____ (Microsoft Corporation) C:\Windows\system32\dcomp.dll
2014-05-07 13:01 - 2014-03-08 13:34 - 01095488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2014-05-07 13:01 - 2014-03-08 11:34 - 00731648 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2014-05-07 13:01 - 2014-03-08 11:02 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\sxproxy.dll
2014-05-07 13:01 - 2014-03-08 10:44 - 00731648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2014-05-07 13:01 - 2014-03-08 10:33 - 00271872 _____ (Microsoft Corporation) C:\Windows\system32\spp.dll
2014-05-07 13:01 - 2014-03-08 10:25 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\SetNetworkLocation.dll
2014-05-07 13:01 - 2014-03-08 10:12 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sxproxy.dll
2014-05-07 13:01 - 2014-03-08 09:53 - 01843712 _____ (Microsoft Corporation) C:\Windows\system32\Display.dll
2014-05-07 13:01 - 2014-03-08 09:51 - 00334848 _____ (Microsoft Corporation) C:\Windows\system32\MDEServer.exe
2014-05-07 13:01 - 2014-03-08 09:47 - 00222720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spp.dll
2014-05-07 13:01 - 2014-03-08 09:12 - 01816576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Display.dll
2014-05-07 13:01 - 2014-03-08 09:09 - 01411584 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-07 13:01 - 2014-03-08 09:04 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\AppxAllUserStore.dll
2014-05-07 13:01 - 2014-03-08 09:03 - 00939520 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-07 13:01 - 2014-03-08 09:01 - 00827392 _____ (Microsoft Corporation) C:\Windows\system32\BFE.DLL
2014-05-07 13:01 - 2014-03-08 08:50 - 01066496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-05-07 13:01 - 2014-03-08 08:48 - 00252928 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentClient.dll
2014-05-07 13:01 - 2014-03-08 08:46 - 01063424 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2014-05-07 13:01 - 2014-03-08 08:41 - 00412672 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2014-05-07 13:01 - 2014-03-08 08:40 - 00139776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AppxAllUserStore.dll
2014-05-07 13:01 - 2014-03-08 08:37 - 00755712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-05-07 13:01 - 2014-03-08 08:31 - 00222720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dcomp.dll
2014-05-07 13:01 - 2014-03-08 08:30 - 00197632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AppXDeploymentClient.dll
2014-05-07 13:01 - 2014-03-08 08:25 - 00264192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2014-05-07 13:01 - 2014-03-08 08:09 - 00958464 _____ (Microsoft Corporation) C:\Windows\system32\MFMediaEngine.dll
2014-05-07 13:01 - 2014-03-08 08:04 - 00717312 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2014-05-07 13:01 - 2014-03-08 08:02 - 00801792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MFMediaEngine.dll
2014-05-07 13:01 - 2014-03-08 07:58 - 00567296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2014-05-07 13:01 - 2014-03-08 07:41 - 01306624 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentServer.dll
2014-05-07 13:01 - 2014-03-08 07:11 - 00924160 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentExtensions.dll
2014-05-07 13:01 - 2014-03-06 16:35 - 01466864 _____ (Microsoft Corporation) C:\Windows\system32\propsys.dll
2014-05-07 13:01 - 2014-03-06 16:34 - 02331000 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-05-07 13:01 - 2014-03-06 16:34 - 00113648 _____ (Microsoft Corporation) C:\Windows\system32\userenv.dll
2014-05-07 13:01 - 2014-03-06 14:53 - 02141912 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll
2014-05-07 13:01 - 2014-03-06 14:53 - 00518552 _____ (Microsoft Corporation) C:\Windows\system32\dxgi.dll
2014-05-07 13:01 - 2014-03-06 14:51 - 01557848 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-05-07 13:01 - 2014-03-06 14:51 - 00488280 _____ (Microsoft Corporation) C:\Windows\system32\netcfgx.dll
2014-05-07 13:01 - 2014-03-06 14:51 - 00379224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2014-05-07 13:01 - 2014-03-06 14:42 - 07425368 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-07 13:01 - 2014-03-06 14:40 - 00492256 _____ (Microsoft Corporation) C:\Windows\system32\mfsvr.dll
2014-05-07 13:01 - 2014-03-06 14:40 - 00467504 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2014-05-07 13:01 - 2014-03-06 14:40 - 00463264 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2014-05-07 13:01 - 2014-03-06 14:40 - 00364640 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2014-05-07 13:01 - 2014-03-06 14:40 - 00244888 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2014-05-07 13:01 - 2014-03-06 14:39 - 00212992 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2014-05-07 13:01 - 2014-03-06 13:20 - 01200296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\propsys.dll
2014-05-07 13:01 - 2014-03-06 13:19 - 00390488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netcfgx.dll
2014-05-07 13:01 - 2014-03-06 13:19 - 00094016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\userenv.dll
2014-05-07 13:01 - 2014-03-06 13:13 - 01779800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2014-05-07 13:01 - 2014-03-06 13:13 - 00406912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxgi.dll
2014-05-07 13:01 - 2014-03-06 12:46 - 01679128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2014-05-07 13:01 - 2014-03-06 12:35 - 00406512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2014-05-07 13:01 - 2014-03-06 12:35 - 00388408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfsvr.dll
2014-05-07 13:01 - 2014-03-06 12:35 - 00326024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2014-05-07 13:01 - 2014-03-06 12:35 - 00305768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2014-05-07 13:01 - 2014-03-06 11:29 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\wlanhlp.dll
2014-05-07 13:01 - 2014-03-06 11:24 - 00111616 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2014-05-07 13:01 - 2014-03-06 11:24 - 00079360 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\IPMIDrv.sys
2014-05-07 13:01 - 2014-03-06 11:24 - 00033280 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\hidusb.sys
2014-05-07 13:01 - 2014-03-06 11:22 - 00679424 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2014-05-07 13:01 - 2014-03-06 11:22 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2014-05-07 13:01 - 2014-03-06 11:22 - 00134144 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dfsc.sys
2014-05-07 13:01 - 2014-03-06 11:20 - 00443392 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\nwifi.sys
2014-05-07 13:01 - 2014-03-06 11:20 - 00402944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2014-05-07 13:01 - 2014-03-06 11:20 - 00245760 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2014-05-07 13:01 - 2014-03-06 11:19 - 00283648 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2014-05-07 13:01 - 2014-03-06 11:19 - 00115200 _____ (Microsoft Corporation) C:\Windows\system32\umpnpmgr.dll
2014-05-07 13:01 - 2014-03-06 11:19 - 00057856 _____ (Microsoft Corporation) C:\Windows\system32\drvcfg.exe
2014-05-07 13:01 - 2014-03-06 11:19 - 00049152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpipreg.sys
2014-05-07 13:01 - 2014-03-06 11:19 - 00040960 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Shell.Search.UriHandler.dll
2014-05-07 13:01 - 2014-03-06 11:08 - 00110592 _____ (Microsoft Corporation) C:\Windows\system32\drvinst.exe
2014-05-07 13:01 - 2014-03-06 11:08 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\l2gpstore.dll
2014-05-07 13:01 - 2014-03-06 10:41 - 00115200 _____ (Microsoft Corporation) C:\Windows\system32\DevPropMgr.dll
2014-05-07 13:01 - 2014-03-06 10:38 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2014-05-07 13:01 - 2014-03-06 10:37 - 00064512 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2014-05-07 13:01 - 2014-03-06 10:28 - 00011264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlanhlp.dll
2014-05-07 13:01 - 2014-03-06 10:20 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Shell.Search.UriHandler.dll
2014-05-07 13:01 - 2014-03-06 10:10 - 00058368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\l2gpstore.dll
2014-05-07 13:01 - 2014-03-06 10:09 - 00098816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drvinst.exe
2014-05-07 13:01 - 2014-03-06 10:00 - 00247296 _____ (Microsoft Corporation) C:\Windows\system32\SensorsApi.dll
2014-05-07 13:01 - 2014-03-06 09:47 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2014-05-07 13:01 - 2014-03-06 09:46 - 00085504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2014-05-07 13:01 - 2014-03-06 09:44 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2014-05-07 13:01 - 2014-03-06 09:22 - 16875520 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Xaml.dll
2014-05-07 13:01 - 2014-03-06 09:16 - 00171008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SensorsApi.dll
2014-05-07 13:01 - 2014-03-06 09:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2014-05-07 13:01 - 2014-03-06 09:02 - 00834560 _____ (Microsoft Corporation) C:\Windows\system32\netlogon.dll
2014-05-07 13:01 - 2014-03-06 08:59 - 12732416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Xaml.dll
2014-05-07 13:01 - 2014-03-06 08:57 - 00443904 _____ (Microsoft Corporation) C:\Windows\system32\wlansec.dll
2014-05-07 13:01 - 2014-03-06 08:51 - 02900992 _____ (Microsoft Corporation) C:\Windows\system32\msftedit.dll
2014-05-07 13:01 - 2014-03-06 08:39 - 02133504 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2014-05-07 13:01 - 2014-03-06 08:34 - 00201216 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll
2014-05-07 13:01 - 2014-03-06 08:32 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\wlanapi.dll
2014-05-07 13:01 - 2014-03-06 08:31 - 02479616 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2014-05-07 13:01 - 2014-03-06 08:29 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netlogon.dll
2014-05-07 13:01 - 2014-03-06 08:27 - 00274944 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2014-05-07 13:01 - 2014-03-06 08:24 - 00462336 _____ (Microsoft Corporation) C:\Windows\system32\wlangpui.dll
2014-05-07 13:01 - 2014-03-06 08:23 - 02270208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msftedit.dll
2014-05-07 13:01 - 2014-03-06 08:23 - 00186368 _____ (Microsoft Corporation) C:\Windows\system32\dafWfdProvider.dll
2014-05-07 13:01 - 2014-03-06 08:21 - 00370176 _____ (Microsoft Corporation) C:\Windows\system32\wlanmsm.dll
2014-05-07 13:01 - 2014-03-06 08:21 - 00291840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Devices.Sensors.dll
2014-05-07 13:01 - 2014-03-06 08:16 - 01527296 _____ (Microsoft Corporation) C:\Windows\system32\wlansvc.dll
2014-05-07 13:01 - 2014-03-06 08:16 - 00834048 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2014-05-07 13:01 - 2014-03-06 08:13 - 00298496 _____ (Microsoft Corporation) C:\Windows\system32\WSDMon.dll
2014-05-07 13:01 - 2014-03-06 08:13 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlanapi.dll
2014-05-07 13:01 - 2014-03-06 08:11 - 02030080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll
2014-05-07 13:01 - 2014-03-06 08:09 - 01764864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2014-05-07 13:01 - 2014-03-06 08:06 - 00386560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlangpui.dll
2014-05-07 13:01 - 2014-03-06 08:05 - 01230336 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Media.dll
2014-05-07 13:01 - 2014-03-06 08:04 - 00300544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlanmsm.dll
2014-05-07 13:01 - 2014-03-06 08:04 - 00226304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Devices.Sensors.dll
2014-05-07 13:01 - 2014-03-06 08:01 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Devices.Scanners.dll
2014-05-07 13:01 - 2014-03-06 07:54 - 01023488 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2014-05-07 13:01 - 2014-03-06 07:54 - 00888320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Media.dll
2014-05-07 13:01 - 2014-03-06 07:51 - 00151040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Devices.Scanners.dll
2014-05-07 13:01 - 2014-03-06 07:47 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\SessEnv.dll
2014-05-07 13:01 - 2014-03-06 07:42 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\SearchFolder.dll
2014-05-07 13:01 - 2014-03-06 07:42 - 00280576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SessEnv.dll
2014-05-07 13:01 - 2014-03-06 07:33 - 00839168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchFolder.dll
2014-05-07 13:01 - 2014-03-06 07:28 - 08653824 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Search.dll
2014-05-07 13:01 - 2014-03-06 07:27 - 05833728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Search.dll
2014-05-07 13:01 - 2014-03-06 07:21 - 05770752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-05-07 13:01 - 2014-03-06 07:20 - 06641152 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-05-07 13:01 - 2014-03-04 14:25 - 02373784 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2014-05-07 13:01 - 2014-03-04 14:15 - 02519384 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-05-07 13:01 - 2014-03-04 14:15 - 00428888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-05-07 13:01 - 2014-03-04 14:14 - 00360512 _____ (Microsoft Corporation) C:\Windows\system32\mfreadwrite.dll
2014-05-07 13:01 - 2014-03-04 13:16 - 02088160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
2014-05-07 13:01 - 2014-03-04 13:10 - 00355832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfreadwrite.dll
2014-05-07 13:01 - 2014-03-04 09:16 - 00655360 _____ (Microsoft Corporation) C:\Windows\system32\dnsapi.dll
2014-05-07 13:01 - 2014-03-04 09:13 - 00254464 _____ (Microsoft Corporation) C:\Windows\system32\dnsrslvr.dll
2014-05-07 13:01 - 2014-03-04 09:08 - 00299008 _____ (Microsoft Corporation) C:\Windows\system32\pdh.dll
2014-05-07 13:01 - 2014-03-04 09:00 - 00512000 _____ (Microsoft Corporation) C:\Windows\system32\wlidprov.dll
2014-05-07 13:01 - 2014-03-04 08:56 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RMapi.dll
2014-05-07 13:01 - 2014-03-04 08:50 - 00220160 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2014-05-07 13:01 - 2014-03-04 08:42 - 00494592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dnsapi.dll
2014-05-07 13:01 - 2014-03-04 08:39 - 00254976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pdh.dll
2014-05-07 13:01 - 2014-03-04 08:32 - 00356864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlidprov.dll
2014-05-07 13:01 - 2014-03-04 08:15 - 00542208 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Graphics.Printing.dll
2014-05-07 13:01 - 2014-03-04 08:05 - 00402432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Graphics.Printing.dll
2014-05-07 13:01 - 2014-03-04 08:03 - 00669696 _____ (Microsoft Corporation) C:\Windows\system32\rasapi32.dll
2014-05-07 13:01 - 2014-03-04 08:03 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\CredentialMigrationHandler.dll
2014-05-07 13:01 - 2014-03-04 07:54 - 00027136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CredentialMigrationHandler.dll
2014-05-07 13:01 - 2014-03-04 07:52 - 00605184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasapi32.dll
2014-05-07 13:01 - 2014-02-07 00:59 - 00425984 _____ (Microsoft Corporation) C:\Windows\system32\clusapi.dll
2014-05-07 13:01 - 2014-02-06 23:26 - 00313344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clusapi.dll
2014-05-07 13:01 - 2013-12-24 01:28 - 00262656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\LocationApi.dll
2014-05-07 13:01 - 2013-12-24 01:26 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\LocationApi.dll
2014-05-07 13:00 - 2014-02-06 13:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-07 13:00 - 2014-02-06 12:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-07 12:59 - 2014-03-11 15:21 - 00918528 _____ (Microsoft Corporation) C:\Windows\system32\MrmCoreR.dll
2014-05-07 12:59 - 2014-03-11 15:02 - 00629760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MrmCoreR.dll
2014-05-07 12:56 - 2014-05-07 12:56 - 00000000 ____D () C:\Program Files (x86)\TeamViewer
2014-05-07 12:55 - 2014-05-07 12:55 - 04610320 _____ (TeamViewer) C:\Users\Manuela\Desktop\Fernwartung.exe
2014-05-07 12:55 - 2014-05-07 12:55 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\TeamViewer
2014-05-07 12:55 - 2014-05-07 12:55 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Macromedia
2014-05-07 12:54 - 2014-05-07 12:54 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2014-05-07 12:54 - 2014-05-07 12:54 - 00000000 ____D () C:\ProgramData\ATI
2014-05-07 12:53 - 2014-05-07 12:53 - 00060993 _____ () C:\Windows\SysWOW64\CCCInstall_201405071253555882.log
2014-05-07 12:53 - 2014-05-07 12:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2014-05-07 12:53 - 2014-05-07 12:53 - 00000000 ____D () C:\Program Files\ATI Technologies
2014-05-07 12:53 - 2014-05-07 12:53 - 00000000 ____D () C:\Program Files (x86)\AMD AVT
2014-05-07 12:53 - 2013-12-06 23:38 - 00230912 _____ () C:\Windows\system32\clinfo.exe
2014-05-07 12:53 - 2013-09-24 16:54 - 00222720 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\AtihdWB6.sys
2014-05-07 12:53 - 2013-09-24 16:54 - 00141312 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\amdacpksl.sys
2014-05-07 12:53 - 2013-09-24 16:51 - 00110080 _____ (TODO: <Company name>) C:\Windows\system32\DelayAPO.dll
2014-05-07 12:52 - 2012-09-23 01:17 - 00021160 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\Drivers\amdkmafd.sys
2014-05-07 12:34 - 2014-05-07 12:34 - 00000000 ____D () C:\Users\Manuela\AppData\Local\AMD
2014-05-07 12:29 - 2014-05-07 12:30 - 00000189 _____ () C:\Windows\LAN.log
2014-05-07 12:28 - 2014-05-07 12:28 - 00000000 ____D () C:\Windows\SysWOW64\RTCOM
2014-05-07 12:28 - 2014-05-07 12:28 - 00000000 ____D () C:\Program Files\Realtek
2014-05-07 12:28 - 2012-06-14 20:10 - 04060560 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RTKVHD64.sys
2014-05-07 12:28 - 2012-06-13 16:44 - 00290813 _____ () C:\Windows\system32\Drivers\RTAIODAT.DAT
2014-05-07 12:28 - 2012-06-10 18:18 - 03615888 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkAPO64.dll
2014-05-07 12:28 - 2012-06-08 13:14 - 00584320 _____ (Sony Corporation) C:\Windows\system32\SFSS_APO.dll
2014-05-07 12:28 - 2012-06-08 12:44 - 00869520 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkApi64.dll
2014-05-07 12:28 - 2012-06-07 13:38 - 05096448 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoRes64.dat
2014-05-07 12:28 - 2012-06-03 11:37 - 02674320 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtPgEx64.dll
2014-05-07 12:28 - 2012-06-02 20:08 - 00105616 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoInstII64.dll
2014-05-07 12:28 - 2012-05-19 13:29 - 07163744 _____ (Dolby Laboratories) C:\Windows\system32\R4EEP64A.dll
2014-05-07 12:28 - 2012-05-19 13:29 - 00433504 _____ (Dolby Laboratories) C:\Windows\system32\R4EED64A.dll
2014-05-07 12:28 - 2012-05-19 13:29 - 00141152 _____ (Dolby Laboratories) C:\Windows\system32\R4EEL64A.dll
2014-05-07 12:28 - 2012-05-19 13:29 - 00123744 _____ (Dolby Laboratories) C:\Windows\system32\R4EEA64A.dll
2014-05-07 12:28 - 2012-05-19 13:29 - 00074592 _____ (Dolby Laboratories) C:\Windows\system32\R4EEG64A.dll
2014-05-07 12:28 - 2012-05-12 17:22 - 01262696 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTCOM64.dll
2014-05-07 12:28 - 2012-04-05 20:42 - 01345368 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioRealtek264.dll
2014-05-07 12:28 - 2012-02-23 21:45 - 02605400 _____ (Waves Audio Ltd.) C:\Windows\system32\WavesGUILib.dll
2014-05-07 12:28 - 2012-02-19 17:54 - 00396632 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVolumeSDAPO.dll
2014-05-07 12:28 - 2012-02-16 02:05 - 08363864 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioRealtek.dll
2014-05-07 12:28 - 2012-02-01 13:43 - 00836544 _____ (TOSHIBA Corporation) C:\Windows\system32\tadefxapo264.dll
2014-05-07 12:28 - 2012-01-12 12:20 - 00065944 _____ (TOSHIBA CORPORATION.) C:\Windows\system32\tepeqapo64.dll
2014-05-07 12:28 - 2011-12-22 17:32 - 00331880 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtlCPAPI64.dll
2014-05-07 12:28 - 2011-12-15 18:58 - 01560168 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTSnMg64.cpl
2014-05-07 12:28 - 2011-11-24 18:28 - 00014952 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCoLDR64.dll
2014-05-07 12:28 - 2011-09-04 16:21 - 00221024 _____ (Synopsys, Inc.) C:\Windows\system32\SFNHK64.dll
2014-05-07 12:28 - 2011-09-04 16:21 - 00081248 _____ (Synopsys, Inc.) C:\Windows\system32\SFCOM64.dll
2014-05-07 12:28 - 2011-09-04 16:21 - 00078688 _____ (Synopsys, Inc.) C:\Windows\system32\SFAPO64.dll
2014-05-07 12:28 - 2011-03-19 14:17 - 01361336 _____ (TOSHIBA Corporation) C:\Windows\system32\tosade.dll
2014-05-07 12:28 - 2011-03-09 19:11 - 00148416 _____ (TOSHIBA Corporation) C:\Windows\system32\tadefxapo.dll
2014-05-07 12:28 - 2010-11-10 09:31 - 00375128 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEP64A.dll
2014-05-07 12:28 - 2010-11-10 09:31 - 00310104 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DHT64.dll
2014-05-07 12:28 - 2010-11-10 09:31 - 00310104 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DAA64.dll
2014-05-07 12:28 - 2010-11-10 09:31 - 00204120 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEED64A.dll
2014-05-07 12:28 - 2010-11-10 09:31 - 00101208 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEL64A.dll
2014-05-07 12:28 - 2010-11-10 09:31 - 00078680 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEG64A.dll
2014-05-07 12:28 - 2010-11-05 20:30 - 00149608 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCfg64.dll
2014-05-07 12:28 - 2010-07-24 18:48 - 00074064 _____ (Virage Logic Corporation / Sonic Focus) C:\Windows\SysWOW64\SFCOM.dll
2014-05-07 12:28 - 2009-11-26 11:55 - 00518896 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSX64.dll
2014-05-07 12:28 - 2009-11-26 11:55 - 00211184 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSH64.dll
2014-05-07 12:28 - 2009-11-26 11:55 - 00198896 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSHP64.dll
2014-05-07 12:28 - 2009-11-26 11:55 - 00155888 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSWOW64.dll
2014-05-07 12:27 - 2014-05-27 13:45 - 00000000 ____D () C:\Program Files (x86)\Realtek
2014-05-07 12:27 - 2014-05-07 12:28 - 00002217 _____ () C:\RHDSetup.log
2014-05-07 12:27 - 2014-05-07 12:28 - 00000206 _____ () C:\Windows\audio.log
2014-05-07 12:27 - 2014-05-07 12:28 - 00000000 ___HD () C:\Program Files (x86)\Temp
2014-05-07 12:27 - 2012-05-27 20:06 - 01706640 ____R (Realtek Semiconductor Corp.) C:\Windows\RtlExUpd.dll
2014-05-07 12:27 - 2012-04-12 16:40 - 02533952 _____ (Fortemedia Corporation) C:\Windows\system32\FMAPO64.dll
2014-05-07 12:27 - 2012-04-05 20:42 - 01015640 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPOShell64.dll
2014-05-07 12:27 - 2012-03-10 13:47 - 00202336 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAC64.dll
2014-05-07 12:27 - 2012-03-10 13:47 - 00108640 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAR64.dll
2014-05-07 12:27 - 2012-01-26 00:30 - 00537456 _____ (DTS) C:\Windows\system32\DTSU2PLFX64.dll
2014-05-07 12:27 - 2012-01-26 00:30 - 00524656 _____ (DTS) C:\Windows\system32\DTSU2PGFX64.dll
2014-05-07 12:27 - 2012-01-26 00:30 - 00449392 _____ (DTS) C:\Windows\system32\DTSU2PREC64.dll
2014-05-07 12:27 - 2011-12-20 19:58 - 02131288 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioEQ.dll
2014-05-07 12:27 - 2011-08-25 19:00 - 00603984 _____ (Knowles Acoustics ) C:\Windows\system32\KAAPORT64.dll
2014-05-07 12:27 - 2011-06-02 11:42 - 01756264 _____ (DTS) C:\Windows\system32\DTSS2SpeakerDLL64.dll
2014-05-07 12:27 - 2011-06-02 11:42 - 01568360 _____ (DTS) C:\Windows\system32\DTSS2HeadphoneDLL64.dll
2014-05-07 12:27 - 2011-06-02 11:42 - 01486952 _____ (DTS) C:\Windows\system32\DTSBoostDLL64.dll
2014-05-07 12:27 - 2011-06-02 11:42 - 00728680 _____ (DTS) C:\Windows\system32\DTSBassEnhancementDLL64.dll
2014-05-07 12:27 - 2011-06-02 11:42 - 00712296 _____ (DTS) C:\Windows\system32\DTSSymmetryDLL64.dll
2014-05-07 12:27 - 2011-06-02 11:42 - 00693352 _____ (DTS) C:\Windows\system32\DTSVoiceClarityDLL64.dll
2014-05-07 12:27 - 2011-06-02 11:42 - 00491112 _____ (DTS) C:\Windows\system32\DTSNeoPCDLL64.dll
2014-05-07 12:27 - 2011-06-02 11:42 - 00432744 _____ (DTS) C:\Windows\system32\DTSLimiterDLL64.dll
2014-05-07 12:27 - 2011-06-02 11:42 - 00428648 _____ (DTS) C:\Windows\system32\DTSGainCompensatorDLL64.dll
2014-05-07 12:27 - 2011-06-02 11:42 - 00242792 _____ (DTS) C:\Windows\system32\DTSLFXAPO64.dll
2014-05-07 12:27 - 2011-06-02 11:42 - 00242792 _____ (DTS) C:\Windows\system32\DTSGFXAPO64.dll
2014-05-07 12:27 - 2011-06-02 11:42 - 00241768 _____ (DTS) C:\Windows\system32\DTSGFXAPONS64.dll
2014-05-07 12:27 - 2010-10-05 15:46 - 00341336 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO30.dll
2014-05-07 12:27 - 2010-09-29 11:34 - 00318808 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO20.dll
2014-05-07 12:26 - 2014-05-07 12:53 - 00000000 ____D () C:\Program Files (x86)\ATI Technologies
2014-05-07 12:26 - 2014-05-07 12:26 - 00059972 _____ () C:\Windows\SysWOW64\CCCInstall_201405071226012588.log
2014-05-07 12:26 - 2014-05-07 12:26 - 00000000 ____D () C:\Windows\AsusInstAll
2014-05-07 12:26 - 2014-05-07 12:26 - 00000000 ____D () C:\Program Files (x86)\AMD APP
2014-05-07 12:25 - 2014-06-06 09:26 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2466271035-3364438158-1365813384-1001
2014-05-07 12:25 - 2014-05-27 13:01 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-05-07 12:25 - 2014-05-07 12:25 - 00060817 _____ () C:\Windows\SysWOW64\CCCInstall_201405071225252375.log
2014-05-07 12:25 - 2014-05-07 12:25 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\ATI
2014-05-07 12:25 - 2014-05-07 12:25 - 00000000 ____D () C:\Users\Manuela\AppData\Local\ATI
2014-05-07 12:25 - 2014-05-07 12:25 - 00000000 ____D () C:\ProgramData\Package Cache
2014-05-07 12:25 - 2014-05-07 12:25 - 00000000 ____D () C:\ProgramData\AMD
2014-05-07 12:25 - 2014-05-07 12:25 - 00000000 ____D () C:\Program Files\ATI
2014-05-07 12:25 - 2012-06-20 00:07 - 00057000 ____R (Advanced Micro Devices) C:\Windows\system32\Drivers\usbfilter.sys
2014-05-07 12:24 - 2014-06-06 09:34 - 00002198 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-05-07 12:24 - 2014-06-06 09:34 - 00001130 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-07 12:24 - 2014-06-06 09:32 - 00001126 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-07 12:24 - 2014-06-04 14:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-05-07 12:24 - 2014-05-07 13:29 - 00004102 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-07 12:24 - 2014-05-07 13:29 - 00003866 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-05-07 12:24 - 2014-05-07 12:53 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Google
2014-05-07 12:24 - 2014-05-07 12:24 - 00000000 ____D () C:\Program Files\Common Files\ATI Technologies
2014-05-07 12:24 - 2014-05-07 12:24 - 00000000 ____D () C:\Program Files\AMD
2014-05-07 12:24 - 2014-05-07 12:24 - 00000000 ____D () C:\Program Files (x86)\Google
2014-05-07 12:24 - 2014-05-07 12:24 - 00000000 ____D () C:\AMD
2014-05-07 12:24 - 2014-05-07 12:24 - 00000000 _____ () C:\Windows\ativpsrm.bin
2014-05-07 12:23 - 2014-05-07 12:30 - 00040014 _____ () C:\Windows\Ascd_log.ini
2014-05-07 12:23 - 2014-05-07 12:23 - 00029380 _____ () C:\Windows\Ascd_tmp.ini
2014-05-07 12:23 - 2014-05-07 12:23 - 00001769 _____ () C:\Windows\Language_trs.ini
2014-05-07 12:23 - 2009-04-03 22:30 - 00010296 _____ () C:\Windows\SysWOW64\Drivers\ASUSHWIO.SYS
2014-05-07 12:23 - 2009-02-27 13:35 - 00049152 ____R () C:\Windows\DAOD.exe
2014-05-07 12:20 - 2014-06-06 09:41 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Temp
2014-05-07 12:20 - 2014-06-06 09:31 - 01940883 _____ () C:\Windows\WindowsUpdate.log
2014-05-07 12:20 - 2014-06-04 15:15 - 00000000 ____D () C:\Users\Manuela
2014-05-07 12:20 - 2014-06-04 14:41 - 00001014 _____ () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-05-07 12:20 - 2014-05-26 17:55 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Packages
2014-05-07 12:20 - 2014-05-15 09:44 - 00000000 ___RD () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-07 12:20 - 2014-05-15 09:44 - 00000000 ___RD () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-07 12:20 - 2014-05-07 17:13 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Adobe
2014-05-07 12:20 - 2014-05-07 12:20 - 00000020 ___SH () C:\Users\Manuela\ntuser.ini
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 _SHDL () C:\Users\Manuela\Vorlagen
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 _SHDL () C:\Users\Manuela\Startmenü
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 _SHDL () C:\Users\Manuela\Netzwerkumgebung
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 _SHDL () C:\Users\Manuela\Lokale Einstellungen
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 _SHDL () C:\Users\Manuela\Eigene Dateien
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 _SHDL () C:\Users\Manuela\Druckumgebung
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 _SHDL () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 _SHDL () C:\Users\Manuela\AppData\Local\Verlauf
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 _SHDL () C:\Users\Manuela\AppData\Local\Anwendungsdaten
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 _SHDL () C:\Users\Manuela\Anwendungsdaten
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 ____D () C:\Users\Manuela\AppData\Local\VirtualStore
2014-05-07 12:20 - 2014-03-18 12:31 - 00000000 ___RD () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-05-07 12:20 - 2014-03-18 12:31 - 00000000 ___RD () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-05-07 12:20 - 2014-03-18 12:11 - 00000369 _____ () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk
2014-05-07 12:20 - 2014-03-18 12:11 - 00000369 _____ () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk
2014-05-07 12:20 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-05-07 12:20 - 2013-08-22 17:36 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default\Vorlagen
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default\Startmenü
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default\Netzwerkumgebung
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default\Lokale Einstellungen
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default\Eigene Dateien
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default\Druckumgebung
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Verlauf
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Anwendungsdaten
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default\Anwendungsdaten
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Verlauf
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Anwendungsdaten
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Programme
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\ProgramData\Vorlagen
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\ProgramData\Startmenü
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\ProgramData\Microsoft\Windows\Start Menu\Programme
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\ProgramData\Dokumente
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\ProgramData\Anwendungsdaten
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Program Files\Gemeinsame Dateien
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Dokumente und Einstellungen

==================== One Month Modified Files and Folders =======

2014-06-06 09:41 - 2014-06-06 09:41 - 00000616 _____ () C:\Users\Manuela\Desktop\JRT.txt
2014-06-06 09:41 - 2014-06-04 15:16 - 00000000 ____D () C:\FRST
2014-06-06 09:41 - 2014-05-07 12:20 - 01940883 _____ () C:\Windows\WindowsUpdate.log
2014-06-06 09:41 - 2014-05-07 12:20 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Temp
2014-06-06 09:36 - 2014-03-18 12:03 - 01776918 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-06 09:36 - 2014-03-18 11:25 - 00764340 _____ () C:\Windows\system32\perfh007.dat
2014-06-06 09:36 - 2014-03-18 11:25 - 00159160 _____ () C:\Windows\system32\perfc007.dat
2014-06-06 09:34 - 2014-05-07 12:24 - 00002198 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-06-06 09:34 - 2014-05-07 12:24 - 00001130 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-06 09:33 - 2014-06-06 09:33 - 00001192 _____ () C:\Users\Manuela\Desktop\AdwCleaner[S1].txt
2014-06-06 09:32 - 2014-06-04 14:11 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-06 09:32 - 2014-05-15 10:37 - 00000000 __RDO () C:\Users\Manuela\OneDrive
2014-06-06 09:32 - 2014-05-07 15:15 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-06-06 09:32 - 2014-05-07 12:24 - 00001126 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-06 09:32 - 2014-03-18 03:50 - 00007942 _____ () C:\Windows\PFRO.log
2014-06-06 09:32 - 2013-08-22 16:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-06 09:31 - 2014-06-04 14:41 - 00000000 ____D () C:\AdwCleaner
2014-06-06 09:31 - 2013-08-22 15:25 - 00262144 ___SH () C:\Windows\system32\config\BBI
2014-06-06 09:28 - 2014-06-06 09:28 - 00001146 _____ () C:\Users\Manuela\Desktop\mbam.txt
2014-06-06 09:26 - 2014-05-07 12:25 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2466271035-3364438158-1365813384-1001
2014-06-06 09:20 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\sru
2014-06-04 23:21 - 2014-05-08 12:02 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\TS3Client
2014-06-04 15:15 - 2014-06-04 15:15 - 00000000 _____ () C:\Users\Manuela\defogger_reenable
2014-06-04 15:15 - 2014-05-07 12:20 - 00000000 ____D () C:\Users\Manuela
2014-06-04 15:09 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\vpnplugins
2014-06-04 15:01 - 2014-06-04 15:01 - 00032512 _____ () C:\Windows\system32\Drivers\hitmanpro37.sys
2014-06-04 15:01 - 2014-06-04 15:01 - 00000426 _____ () C:\Windows\system32\.crusader
2014-06-04 15:01 - 2014-06-04 14:58 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-06-04 14:48 - 2014-06-04 14:48 - 00000000 ____D () C:\Windows\ERUNT
2014-06-04 14:41 - 2014-05-07 12:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-06-04 14:41 - 2014-05-07 12:20 - 00001014 _____ () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-06-04 14:18 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\Branding
2014-06-04 14:10 - 2014-06-04 14:10 - 00001121 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-04 14:10 - 2014-06-04 14:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-04 14:10 - 2014-06-04 14:10 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-04 14:10 - 2014-06-04 14:10 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-06-04 13:52 - 2014-05-08 08:13 - 00000020 ____H () C:\ProgramData\PKP_DLev.DAT
2014-06-04 13:52 - 2014-05-08 08:13 - 00000020 ____H () C:\ProgramData\PKP_DLet.DAT
2014-06-04 11:20 - 2014-06-04 11:20 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Xilisoft
2014-06-04 11:19 - 2014-05-11 11:30 - 00000000 ____D () C:\Program Files (x86)\MSECache
2014-06-04 10:18 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\AppReadiness
2014-06-04 10:10 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\NDF
2014-05-27 13:46 - 2014-05-27 13:46 - 00000000 ____D () C:\Windows\LastGood.Tmp
2014-05-27 13:45 - 2014-05-07 12:27 - 00000000 ____D () C:\Program Files (x86)\Realtek
2014-05-27 13:01 - 2014-05-07 12:25 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-05-27 11:54 - 2014-05-27 11:54 - 00002086 _____ () C:\Users\Public\Desktop\NETGEAR WNDA4100 Genie.lnk
2014-05-27 11:54 - 2014-05-27 11:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NETGEAR WNDA4100 Genie
2014-05-27 11:54 - 2014-05-27 11:54 - 00000000 ____D () C:\Program Files (x86)\NETGEAR
2014-05-27 11:54 - 2014-05-27 11:54 - 00000000 ____D () C:\Program Files (x86)\Cisco
2014-05-27 11:54 - 2013-08-22 17:36 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp
2014-05-27 11:53 - 2014-05-08 08:13 - 00000000 ____D () C:\Windows\Downloaded Installations
2014-05-27 11:33 - 2014-05-27 11:31 - 00000000 ____D () C:\Users\Manuela\Desktop\ReportMaker
2014-05-26 17:55 - 2014-05-07 12:20 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Packages
2014-05-26 17:41 - 2014-05-09 09:51 - 00000000 ____D () C:\ProgramData\Nikon
2014-05-26 11:11 - 2014-05-26 11:11 - 00000000 ____D () C:\Users\Manuela\AppData\Local\NETGEAR
2014-05-26 11:11 - 2014-05-26 11:11 - 00000000 ____D () C:\ProgramData\NETGEAR
2014-05-26 10:03 - 2013-08-22 16:46 - 00046107 _____ () C:\Windows\setupact.log
2014-05-24 09:14 - 2014-05-07 13:32 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-05-16 16:14 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\rescache
2014-05-16 08:33 - 2013-08-22 17:36 - 00000000 ___RD () C:\Windows\ToastData
2014-05-16 08:33 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-05-16 08:33 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-05-16 08:33 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\WinStore
2014-05-16 08:33 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows Defender
2014-05-16 08:33 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
2014-05-15 09:59 - 2013-08-22 17:20 - 00000000 ____D () C:\Windows\CbsTemp
2014-05-15 09:58 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\SecureBootUpdates
2014-05-15 09:44 - 2014-05-07 12:20 - 00000000 ___RD () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-15 09:44 - 2014-05-07 12:20 - 00000000 ___RD () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-15 09:43 - 2014-05-07 13:49 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-15 09:43 - 2014-05-07 13:02 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-15 09:42 - 2014-05-07 13:02 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-15 09:42 - 2013-08-22 15:25 - 00262144 ___SH () C:\Windows\system32\config\ELAM
2014-05-13 20:19 - 2014-05-13 18:36 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Battle.net
2014-05-13 18:58 - 2014-05-13 18:36 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Battle.net
2014-05-13 18:46 - 2014-05-13 18:46 - 00000965 _____ () C:\Users\Public\Desktop\World of Warcraft.lnk
2014-05-13 18:46 - 2014-05-13 18:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft
2014-05-13 18:36 - 2014-05-13 18:36 - 00000841 _____ () C:\Users\Public\Desktop\Battle.net.lnk
2014-05-13 18:36 - 2014-05-13 18:36 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Blizzard Entertainment
2014-05-13 18:36 - 2014-05-13 18:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net
2014-05-13 18:36 - 2014-05-13 18:36 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment
2014-05-13 18:34 - 2014-05-13 18:34 - 00000000 ____D () C:\ProgramData\Battle.net
2014-05-12 07:26 - 2014-06-04 14:10 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-12 07:26 - 2014-06-04 14:10 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-12 07:25 - 2014-06-04 14:10 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-12 01:02 - 2014-05-11 13:04 - 00000000 ____D () C:\Users\Manuela\AppData\Local\PasswordSafe
2014-05-11 13:01 - 2014-05-11 13:01 - 00001049 _____ () C:\Users\Manuela\Desktop\Password Safe.lnk
2014-05-11 13:01 - 2014-05-11 13:01 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Password Safe
2014-05-11 13:01 - 2014-05-11 13:01 - 00000000 ____D () C:\Program Files (x86)\Password Safe
2014-05-09 16:18 - 2014-05-09 16:18 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Awesomium
2014-05-09 15:45 - 2014-05-09 15:45 - 00000000 ____D () C:\ProgramData\Elder Scrolls Online
2014-05-09 14:44 - 2014-05-09 14:44 - 00001060 _____ () C:\Users\Manuela\Desktop\The Elder Scrolls Online.lnk
2014-05-09 14:44 - 2014-05-09 14:44 - 00000000 ____D () C:\Windows\jre
2014-05-09 14:44 - 2014-05-09 14:44 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\The Elder Scrolls Online
2014-05-09 14:44 - 2014-05-09 14:01 - 00000000 ___HD () C:\Program Files (x86)\Zero G Registry
2014-05-09 13:59 - 2014-05-09 13:59 - 00000000 ___HD () C:\Users\Manuela\InstallAnywhere
2014-05-09 13:45 - 2014-05-07 13:56 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\vlc
2014-05-09 13:41 - 2014-05-09 13:41 - 00000890 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2014-05-09 13:41 - 2014-05-09 13:41 - 00000000 ____D () C:\Program Files\VideoLAN
2014-05-08 19:20 - 2014-05-08 19:20 - 00001301 _____ () C:\Users\Public\Desktop\FINAL FANTASY XIV - A Realm Reborn.lnk
2014-05-08 18:59 - 2014-05-08 18:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SQUARE ENIX
2014-05-08 18:57 - 2014-05-08 18:57 - 00000000 ____D () C:\Windows\SysWOW64\XPSViewer
2014-05-08 18:57 - 2014-05-08 18:57 - 00000000 ____D () C:\Program Files\Reference Assemblies
2014-05-08 18:57 - 2014-05-08 18:57 - 00000000 ____D () C:\Program Files\MSBuild
2014-05-08 18:57 - 2014-05-08 18:57 - 00000000 ____D () C:\Program Files (x86)\Reference Assemblies
2014-05-08 18:57 - 2014-05-08 18:57 - 00000000 ____D () C:\Program Files (x86)\MSBuild
2014-05-08 18:57 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\SysWOW64\MUI
2014-05-08 18:57 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\MUI
2014-05-08 18:56 - 2014-05-08 18:56 - 00010085 _____ () C:\Windows\DirectX.log
2014-05-08 12:02 - 2014-05-08 12:02 - 00000881 _____ () C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2014-05-08 12:02 - 2014-05-08 12:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
2014-05-08 08:24 - 2014-05-08 08:23 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Nikon
2014-05-08 08:23 - 2014-05-08 08:23 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Nikon
2014-05-08 08:21 - 2014-05-08 08:21 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2014-05-08 08:15 - 2014-05-08 08:15 - 00002077 _____ () C:\Users\Public\Desktop\Panorama Maker 6.lnk
2014-05-08 08:15 - 2014-05-08 08:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ArcSoft Panorama Maker 6
2014-05-08 08:15 - 2014-05-08 08:15 - 00000000 ____D () C:\Program Files (x86)\ArcSoft
2014-05-08 08:14 - 2014-05-08 08:14 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\ArcSoft
2014-05-08 08:13 - 2014-05-08 08:13 - 00106496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ATL71.DLL
2014-05-08 08:13 - 2014-05-08 08:13 - 00002072 _____ () C:\Users\Public\Desktop\ViewNX 2.lnk
2014-05-08 08:13 - 2014-05-08 08:13 - 00000268 ___RH () C:\Users\Manuela\AppData\Roaming\Stingers
2014-05-08 08:13 - 2014-05-08 08:13 - 00000268 ___RH () C:\Users\Manuela\AppData\Roaming\StatusSheet
2014-05-08 08:13 - 2014-05-08 08:13 - 00000268 ___RH () C:\Users\Manuela\AppData\Roaming\Static Library
2014-05-08 08:13 - 2014-05-08 08:13 - 00000268 ___RH () C:\ProgramData\Super Strings
2014-05-08 08:13 - 2014-05-08 08:13 - 00000268 ___RH () C:\ProgramData\Strings
2014-05-08 08:13 - 2014-05-08 08:13 - 00000268 ___RH () C:\ProgramData\String Ensemble
2014-05-08 08:13 - 2014-05-08 08:13 - 00000020 ____H () C:\ProgramData\PKP_DLes.DAT
2014-05-08 08:13 - 2014-05-08 08:13 - 00000012 ___RH () C:\ProgramData\Track Settings
2014-05-08 08:13 - 2014-05-08 08:13 - 00000012 ___RH () C:\ProgramData\Textures
2014-05-08 08:13 - 2014-05-08 08:13 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Downloaded Installations
2014-05-08 08:13 - 2014-05-08 08:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ViewNX 2
2014-05-08 08:13 - 2014-05-08 08:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nikon Message Center 2
2014-05-08 08:13 - 2014-05-08 08:13 - 00000000 ____D () C:\ProgramData\54F3DE4E-B7BA-4EBD-8B3B-385D272CC583
2014-05-08 08:13 - 2014-05-08 08:13 - 00000000 ____D () C:\Program Files\Nikon
2014-05-08 08:13 - 2014-05-08 08:13 - 00000000 ____D () C:\Program Files\Common Files\Nikon
2014-05-08 08:13 - 2014-05-08 08:13 - 00000000 ____D () C:\Program Files (x86)\Nikon
2014-05-08 08:13 - 2014-05-08 08:12 - 00000012 ___RH () C:\ProgramData\Techno Kit
2014-05-08 08:13 - 2014-05-08 08:12 - 00000000 ____D () C:\ProgramData\Ultima_T15
2014-05-08 08:13 - 2014-05-08 08:12 - 00000000 ____D () C:\ProgramData\EnterNHelp
2014-05-08 08:12 - 2014-05-08 08:12 - 00000268 ___RH () C:\Users\Manuela\AppData\Roaming\Synth Textures
2014-05-08 08:12 - 2014-05-08 08:12 - 00000020 ____H () C:\ProgramData\PKP_DLeo.DAT
2014-05-08 08:12 - 2014-05-08 08:12 - 00000012 ___RH () C:\ProgramData\deskjet
2014-05-08 08:12 - 2014-05-08 08:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Link to Nikon
2014-05-08 08:12 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2014-05-08 00:02 - 2014-05-08 00:02 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
2014-05-07 22:21 - 2014-05-07 22:21 - 00122480 _____ () C:\Users\Manuela\AppData\Local\GDIPFONTCACHEV1.DAT
2014-05-07 21:33 - 2014-05-07 21:33 - 00007177 _____ () C:\Windows\system32\lvcoinst.log
2014-05-07 21:33 - 2014-05-07 21:33 - 00000000 ____D () C:\Program Files\Common Files\logishrd
2014-05-07 21:21 - 2014-05-07 21:21 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_bcmwlhigh664_01009.Wdf
2014-05-07 21:21 - 2014-05-07 21:21 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\InstallShield
2014-05-07 17:17 - 2014-05-07 13:32 - 00000000 ____D () C:\ProgramData\Adobe
2014-05-07 17:14 - 2014-05-07 17:14 - 00000000 __SHD () C:\Users\Manuela\AppData\Local\EmieUserList
2014-05-07 17:14 - 2014-05-07 17:14 - 00000000 __SHD () C:\Users\Manuela\AppData\Local\EmieSiteList
2014-05-07 17:13 - 2014-05-07 17:13 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Adobe
2014-05-07 17:13 - 2014-05-07 12:20 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Adobe
2014-05-07 15:35 - 2014-05-07 15:27 - 00002353 _____ () C:\Users\Manuela\Desktop\Sicherer Zahlungsverkehr.lnk
2014-05-07 15:31 - 2014-05-07 15:15 - 00625760 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-05-07 15:31 - 2014-05-07 15:15 - 00115296 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2014-05-07 15:31 - 2013-10-17 15:47 - 00458336 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kl1.sys
2014-05-07 15:31 - 2013-10-17 15:47 - 00029280 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klkbdflt.sys
2014-05-07 15:31 - 2013-06-06 17:38 - 00178272 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kneps.sys
2014-05-07 15:31 - 2013-05-07 17:56 - 00065120 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klwfp.sys
2014-05-07 15:31 - 2012-07-27 18:38 - 00029792 _____ (Kaspersky Lab) C:\Windows\system32\Drivers\klelam.sys
2014-05-07 15:27 - 2014-05-07 15:27 - 00001348 _____ () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security.lnk
2014-05-07 15:15 - 2014-05-07 15:15 - 00001143 _____ () C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
2014-05-07 15:15 - 2014-05-07 15:15 - 00000000 ____D () C:\Program Files (x86)\Kaspersky Lab
2014-05-07 15:15 - 2013-08-22 17:36 - 00000000 ___HD () C:\Windows\ELAMBKUP
2014-05-07 14:35 - 2013-07-29 14:46 - 00000000 ____D () C:\Program Files (x86)\aida64extreme300
2014-05-07 14:24 - 2014-05-07 14:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-05-07 14:23 - 2014-05-07 14:23 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-05-07 14:23 - 2014-05-07 14:23 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-05-07 14:14 - 2013-08-22 16:44 - 00478696 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-05-07 14:07 - 2014-05-07 14:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Live Add-in
2014-05-07 14:05 - 2014-05-07 13:49 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
2014-05-07 14:04 - 2014-05-07 14:04 - 00000000 ____D () C:\Users\Default\AppData\Local\Microsoft Help
2014-05-07 14:04 - 2014-05-07 14:04 - 00000000 ____D () C:\Users\Default User\AppData\Local\Microsoft Help
2014-05-07 14:02 - 2013-08-22 15:25 - 00000167 _____ () C:\Windows\win.ini
2014-05-07 14:01 - 2014-05-07 14:01 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_LocationProvider_01_11_00.Wdf
2014-05-07 14:00 - 2014-05-07 13:59 - 00000000 ____D () C:\Users\Manuela\Desktop\MS Office
2014-05-07 13:56 - 2014-05-07 13:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-05-07 13:53 - 2014-05-07 13:51 - 00000000 ____D () C:\Program Files (x86)\Microsoft Works
2014-05-07 13:52 - 2014-05-07 13:52 - 00002655 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Neues Microsoft Office-Dokument.lnk
2014-05-07 13:52 - 2014-05-07 13:52 - 00002655 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Microsoft Office-Dokument öffnen.lnk
2014-05-07 13:52 - 2014-05-07 13:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2014-05-07 13:51 - 2014-05-07 13:51 - 00000000 ____D () C:\Windows\PCHEALTH
2014-05-07 13:51 - 2014-05-07 13:51 - 00000000 ____D () C:\Program Files (x86)\Microsoft Visual Studio
2014-05-07 13:51 - 2014-03-18 11:40 - 00000000 ____D () C:\Windows\ShellNew
2014-05-07 13:50 - 2014-05-07 13:50 - 00000000 ____D () C:\Program Files\Microsoft Office
2014-05-07 13:49 - 2014-05-07 13:49 - 00000000 __RHD () C:\MSOCache
2014-05-07 13:49 - 2014-05-07 13:49 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Microsoft Help
2014-05-07 13:41 - 2014-05-07 13:41 - 00001006 _____ () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TextPad.lnk
2014-05-07 13:41 - 2014-05-07 13:41 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Helios
2014-05-07 13:41 - 2014-05-07 13:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TextPad
2014-05-07 13:41 - 2014-05-07 13:41 - 00000000 ____D () C:\Program Files (x86)\TextPad 6
2014-05-07 13:39 - 2014-05-07 13:39 - 00001968 _____ () C:\Users\Public\Desktop\CDBurnerXP.lnk
2014-05-07 13:39 - 2014-05-07 13:39 - 00001918 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2014-05-07 13:39 - 2014-05-07 13:39 - 00001017 _____ () C:\Users\Public\Desktop\IrfanView.lnk
2014-05-07 13:39 - 2014-05-07 13:39 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\IrfanView
2014-05-07 13:39 - 2014-05-07 13:39 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Canneverbe Limited
2014-05-07 13:39 - 2014-05-07 13:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IrfanView
2014-05-07 13:39 - 2014-05-07 13:39 - 00000000 ____D () C:\ProgramData\Canneverbe Limited
2014-05-07 13:39 - 2014-05-07 13:39 - 00000000 ____D () C:\Program Files (x86)\IrfanView
2014-05-07 13:39 - 2014-05-07 13:39 - 00000000 ____D () C:\Program Files (x86)\CDBurnerXP
2014-05-07 13:32 - 2014-05-07 13:32 - 00002042 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2014-05-07 13:32 - 2014-05-07 13:32 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-05-07 13:29 - 2014-05-07 12:24 - 00004102 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-07 13:29 - 2014-05-07 12:24 - 00003866 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-05-07 13:28 - 2014-05-07 13:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
2014-05-07 13:06 - 2014-05-07 13:06 - 00003554 _____ () C:\Windows\System32\Tasks\CreateChoiceProcessTask
2014-05-07 13:05 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\setup
2014-05-07 13:03 - 2014-05-07 13:03 - 00000000 ___RD () C:\Windows\BrowserChoice
2014-05-07 13:01 - 2013-08-22 17:36 - 00262144 _____ () C:\Windows\system32\config\BCD-Template
2014-05-07 12:56 - 2014-05-07 12:56 - 00000000 ____D () C:\Program Files (x86)\TeamViewer
2014-05-07 12:55 - 2014-05-07 12:55 - 04610320 _____ (TeamViewer) C:\Users\Manuela\Desktop\Fernwartung.exe
2014-05-07 12:55 - 2014-05-07 12:55 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\TeamViewer
2014-05-07 12:55 - 2014-05-07 12:55 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Macromedia
2014-05-07 12:54 - 2014-05-07 12:54 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2014-05-07 12:54 - 2014-05-07 12:54 - 00000000 ____D () C:\ProgramData\ATI
2014-05-07 12:53 - 2014-05-07 12:53 - 00060993 _____ () C:\Windows\SysWOW64\CCCInstall_201405071253555882.log
2014-05-07 12:53 - 2014-05-07 12:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2014-05-07 12:53 - 2014-05-07 12:53 - 00000000 ____D () C:\Program Files\ATI Technologies
2014-05-07 12:53 - 2014-05-07 12:53 - 00000000 ____D () C:\Program Files (x86)\AMD AVT
2014-05-07 12:53 - 2014-05-07 12:26 - 00000000 ____D () C:\Program Files (x86)\ATI Technologies
2014-05-07 12:53 - 2014-05-07 12:24 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Google
2014-05-07 12:34 - 2014-05-07 12:34 - 00000000 ____D () C:\Users\Manuela\AppData\Local\AMD
2014-05-07 12:30 - 2014-05-07 12:29 - 00000189 _____ () C:\Windows\LAN.log
2014-05-07 12:30 - 2014-05-07 12:23 - 00040014 _____ () C:\Windows\Ascd_log.ini
2014-05-07 12:28 - 2014-05-07 12:28 - 00000000 ____D () C:\Windows\SysWOW64\RTCOM
2014-05-07 12:28 - 2014-05-07 12:28 - 00000000 ____D () C:\Program Files\Realtek
2014-05-07 12:28 - 2014-05-07 12:27 - 00002217 _____ () C:\RHDSetup.log
2014-05-07 12:28 - 2014-05-07 12:27 - 00000206 _____ () C:\Windows\audio.log
2014-05-07 12:28 - 2014-05-07 12:27 - 00000000 ___HD () C:\Program Files (x86)\Temp
2014-05-07 12:26 - 2014-05-07 12:26 - 00059972 _____ () C:\Windows\SysWOW64\CCCInstall_201405071226012588.log
2014-05-07 12:26 - 2014-05-07 12:26 - 00000000 ____D () C:\Windows\AsusInstAll
2014-05-07 12:26 - 2014-05-07 12:26 - 00000000 ____D () C:\Program Files (x86)\AMD APP
2014-05-07 12:25 - 2014-05-07 12:25 - 00060817 _____ () C:\Windows\SysWOW64\CCCInstall_201405071225252375.log
2014-05-07 12:25 - 2014-05-07 12:25 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\ATI
2014-05-07 12:25 - 2014-05-07 12:25 - 00000000 ____D () C:\Users\Manuela\AppData\Local\ATI
2014-05-07 12:25 - 2014-05-07 12:25 - 00000000 ____D () C:\ProgramData\Package Cache
2014-05-07 12:25 - 2014-05-07 12:25 - 00000000 ____D () C:\ProgramData\AMD
2014-05-07 12:25 - 2014-05-07 12:25 - 00000000 ____D () C:\Program Files\ATI
2014-05-07 12:24 - 2014-05-07 12:24 - 00000000 ____D () C:\Program Files\Common Files\ATI Technologies
2014-05-07 12:24 - 2014-05-07 12:24 - 00000000 ____D () C:\Program Files\AMD
2014-05-07 12:24 - 2014-05-07 12:24 - 00000000 ____D () C:\Program Files (x86)\Google
2014-05-07 12:24 - 2014-05-07 12:24 - 00000000 ____D () C:\AMD
2014-05-07 12:24 - 2014-05-07 12:24 - 00000000 _____ () C:\Windows\ativpsrm.bin
2014-05-07 12:24 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\restore
2014-05-07 12:23 - 2014-05-07 12:23 - 00029380 _____ () C:\Windows\Ascd_tmp.ini
2014-05-07 12:23 - 2014-05-07 12:23 - 00001769 _____ () C:\Windows\Language_trs.ini
2014-05-07 12:20 - 2014-05-07 13:01 - 00000000 ____D () C:\Windows\Panther
2014-05-07 12:20 - 2014-05-07 12:20 - 00000020 ___SH () C:\Users\Manuela\ntuser.ini
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 _SHDL () C:\Users\Manuela\Vorlagen
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 _SHDL () C:\Users\Manuela\Startmenü
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 _SHDL () C:\Users\Manuela\Netzwerkumgebung
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 _SHDL () C:\Users\Manuela\Lokale Einstellungen
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 _SHDL () C:\Users\Manuela\Eigene Dateien
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 _SHDL () C:\Users\Manuela\Druckumgebung
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 _SHDL () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 _SHDL () C:\Users\Manuela\AppData\Local\Verlauf
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 _SHDL () C:\Users\Manuela\AppData\Local\Anwendungsdaten
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 _SHDL () C:\Users\Manuela\Anwendungsdaten
2014-05-07 12:20 - 2014-05-07 12:20 - 00000000 ____D () C:\Users\Manuela\AppData\Local\VirtualStore
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default\Vorlagen
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default\Startmenü
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default\Netzwerkumgebung
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default\Lokale Einstellungen
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default\Eigene Dateien
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default\Druckumgebung
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Verlauf
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Anwendungsdaten
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default\Anwendungsdaten
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Verlauf
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Anwendungsdaten
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Programme
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\ProgramData\Vorlagen
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\ProgramData\Startmenü
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\ProgramData\Microsoft\Windows\Start Menu\Programme
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\ProgramData\Dokumente
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\ProgramData\Anwendungsdaten
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Program Files\Gemeinsame Dateien
2014-05-07 12:03 - 2014-05-07 12:03 - 00000000 _SHDL () C:\Dokumente und Einstellungen
2014-05-07 12:03 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows NT
2014-05-07 12:03 - 2013-08-22 15:36 - 00000000 __RHD () C:\Users\Default
2014-05-07 12:02 - 2013-08-22 17:37 - 00002664 _____ () C:\Windows\DtcInstall.log
2014-05-07 12:02 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\Recovery

Files to move or delete:
====================
C:\ProgramData\PKP_DLeo.DAT
C:\ProgramData\PKP_DLes.DAT
C:\ProgramData\PKP_DLet.DAT
C:\ProgramData\PKP_DLev.DAT


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-06-02 12:08

==================== End Of Log ============================
         

ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Hi,

hier die Logs.

LG Manuela

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7587
# api_version=3.0.2
# EOSSerial=a6a8be498bdbbb42905a0894fa952285
# engine=18615
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=false
# utc_time=2014-06-08 08:45:12
# local_time=2014-06-08 10:45:12 (+0100, Mitteleuropäische Sommerzeit)
# country="Austria"
# lang=1031
# osver=6.2.9200 NT 
# compatibility_mode_1='Kaspersky Internet Security'
# compatibility_mode=1292 16777213 100 100 75632 33695134 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 1031310 6600633 0 0
# scanned=137558
# found=7
# cleaned=0
# scan_time=876
sh=4E475FD620FBCCBB37453AF2BD0427BDA73109FF ft=1 fh=70875884387ffbdb vn="Variante von Win32/Thinknice.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\DpInterface32.dll.vir"
sh=524ED1264811258D64BA2BE8B48005C6D1935713 ft=1 fh=19b60c262a337e59 vn="Win64/Thinknice.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\DpInterface64.dll.vir"
sh=72971E4B87542575A876B36FB87879B416F4EC88 ft=1 fh=eb8c71c588367618 vn="Variante von Win32/Thinknice.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\DpInterfacef32.dll.vir"
sh=F34BB16FA7EEF85B106A7C3A3FDEEE95ECF18001 ft=1 fh=7bd5299d4d87abc5 vn="Win32/Thinknice.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SearchProtect32.dll.vir"
sh=FB15CD6ADCD9BDFBF68D5DF5EAEA02BF329F8D4F ft=1 fh=dfa2b1c2f56e7303 vn="Win64/Thinknice.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SearchProtect64.dll.vir"
sh=1FBCCE3ECEBD5955F90E91C6B6B74EE06783CD66 ft=1 fh=cdd42cd0b2145c18 vn="Variante von Win32/Conduit.SearchProtect.N evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Manuela\AppData\Local\Microsoft\Windows\INetCache\IE\ZVA6K5X2\spstub[1].exe"
sh=C5BF235143845E5D2BF5BC3D1A97C1EAC2963762 ft=1 fh=959007e39f1e55af vn="Variante von Win32/DownloadGuide.A evtl. unerwünschte Anwendung" ac=I fn="H:\MyOwnDATA\Downloads\x-powerpoint-to-video-converter-free-de-Downloader.exe"
         

 Results of screen317's Security Check version 0.99.83  
   x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
Kaspersky Internet Security   
Windows Defender              
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:````````` 
 Adobe Reader XI  
 Google Chrome 34.0.1847.137  
 Google Chrome 35.0.1916.114  
````````Process Check: objlist.exe by Laurent````````  
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbam.exe  
 Malwarebytes Anti-Malware mbamscheduler.exe   
 Kaspersky Lab Kaspersky Internet Security 14.0.0 avp.exe  
 Kaspersky Lab Kaspersky Internet Security 14.0.0 avpui.exe  
 Kaspersky Lab Kaspersky Internet Security 14.0.0 klwtblfs.exe  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````
         

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 06-06-2014
Ran by Manuela (administrator) on ELA2014 on 08-06-2014 10:51:13
Running from H:\MyOwnDATA\Downloads
Platform: Windows 8.1 (Update 1) (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\NETGEAR\WNDA4100\Service\RaRegistry.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\NETGEAR\WNDA4100\Service\RaRegistry64.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe
(NETGEAR) C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6548112 2012-06-14] (Realtek Semiconductor)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-12-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Nikon Message Center 2] => C:\Program Files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe [571392 2011-10-30] (Nikon Corporation)
HKU\S-1-5-21-2466271035-3364438158-1365813384-1001\...\Run: [HydraVisionDesktopManager] => C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [389120 2013-12-06] (AMD)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NETGEAR WNDA4100 Genie.lnk
ShortcutTarget: NETGEAR WNDA4100 Genie.lnk -> C:\Program Files (x86)\NETGEAR\WNDA4100\WNDA4100.EXE (NETGEAR)
Startup: C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-AT
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.at.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xE6FEE80D076ACF01
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=protegere
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Tcpip\Parameters: [DhcpNameServer] 195.34.133.21 212.186.211.21

FireFox:
========
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.4 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 - H:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions:  - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: 卡巴斯基網址顧問 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com [2014-05-07]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: 虛擬鍵盤 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-05-07]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: 惡意網站攔截器 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com [2014-05-07]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Chặn quảng cáo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com [2014-05-07]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com [2014-05-07]

Chrome: 
=======
CHR HomePage: https://www.google.at/
CHR StartupUrls: "https://www.google.at/"
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\gcswf32.dll No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll No File
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Extension: (YouTube) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-07]
CHR Extension: (Adblock Plus) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-05-07]
CHR Extension: (Anna Sui) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjohejgigkmiclpgnilojffhiohcglib [2014-06-04]
CHR Extension: (Google-Suche) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-07]
CHR Extension: (Clear Cache) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\cppjkneekbjaeellbfkmgnhonkkjfpdn [2014-05-07]
CHR Extension: (Modul zur Link-Untersuchung) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj [2014-05-07]
CHR Extension: (Sicherer Zahlungsverkehr) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh [2014-05-07]
CHR Extension: (SearchPreview) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\hcjdanpjacpeeppdjkppebobilhaglfo [2014-05-07]
CHR Extension: (Modul zum Sperren von gefährlichen Webseiten) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\hghkgaeecgjhjkannahfamoehjmkjail [2014-05-07]
CHR Extension: (Chrome to Mobile) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\idknbmbdnapjicclomlijcgfpikmndhd [2014-05-07]
CHR Extension: (Virtual Keyboard) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh [2014-05-07]
CHR Extension: (Google Wallet) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-07]
CHR Extension: (Google Mail) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-07]
CHR Extension: (Anti-Banner) - C:\Users\Manuela\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman [2014-05-07]
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\urladvisor.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\online_banking_chrome.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\content_blocker_chrome.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx [2013-10-17]
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\ab.crx [2013-10-17]

==================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-12-06] (Advanced Micro Devices, Inc.)
R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2013-10-17] (Kaspersky Lab ZAO)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 RalinkRegistryWriter; C:\Program Files (x86)\NETGEAR\WNDA4100\Service\RaRegistry.exe [377088 2012-09-04] (Ralink Technology, Corp.)
R2 RalinkRegistryWriter64; C:\Program Files (x86)\NETGEAR\WNDA4100\Service\RaRegistry64.exe [455424 2012-09-04] (Ralink Technology, Corp.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

S0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra)
S0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [21160 2012-09-23] (Advanced Micro Devices, Inc.)
R2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59648 2013-09-19] (Advanced Micro Devices)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [222720 2013-09-24] (Advanced Micro Devices)
S3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-13] (Windows (R) Win 7 DDK provider)
S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 hitmanpro37; C:\Windows\system32\drivers\hitmanpro37.sys [32512 2014-06-04] ()
S3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation)
S3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation)
S0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-10] (Intel Corporation)
R0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2014-03-18] (Microsoft Corporation)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2014-05-07] (Kaspersky Lab ZAO)
S0 klelam; C:\Windows\System32\DRIVERS\klelam.sys [29792 2014-05-07] (Kaspersky Lab)
U5 klflt; C:\Windows\System32\Drivers\klflt.sys [115296 2014-05-07] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [625760 2014-05-07] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\system32\DRIVERS\klim6.sys [30304 2013-10-17] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\system32\DRIVERS\klkbdflt.sys [29280 2014-05-07] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\system32\DRIVERS\klmouflt.sys [29280 2013-10-17] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\system32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 klwfp; C:\Windows\system32\DRIVERS\klwfp.sys [65120 2014-05-07] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\system32\DRIVERS\kneps.sys [178272 2014-05-07] (Kaspersky Lab ZAO)
S0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-06-08] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2014-05-12] (Malwarebytes Corporation)
R3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation)
S3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation)
S3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924504 2014-03-18] (Microsoft Corporation)
S3 RtlWlanu; C:\Windows\system32\DRIVERS\rtwlanu.sys [1975000 2013-07-31] (Realtek Semiconductor Corporation                           )
S3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2014-03-18] (Microsoft Corporation)
S0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2014-03-18] (Microsoft Corporation)
S3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation)
S3 usbrndis6; C:\Windows\system32\DRIVERS\usb80236.sys [20992 2013-08-22] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation)
R0 Wof; C:\Windows\System32\Drivers\Wof.sys [157016 2014-03-13] (Microsoft Corporation)
S3 NPF; \SystemRoot\system32\DRIVERS\npf.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-08 10:49 - 2014-06-08 10:49 - 00000997 _____ () C:\Users\Manuela\Desktop\checkup.txt
2014-06-07 11:23 - 2014-06-07 11:23 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\48230029.sys
2014-06-06 09:41 - 2014-06-06 09:41 - 00000616 _____ () C:\Users\Manuela\Desktop\JRT.txt
2014-06-06 09:33 - 2014-06-06 09:33 - 00001192 _____ () C:\Users\Manuela\Desktop\AdwCleaner[S1].txt
2014-06-06 09:28 - 2014-06-06 09:28 - 00001146 _____ () C:\Users\Manuela\Desktop\mbam.txt
2014-06-04 15:39 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-06-04 15:16 - 2014-06-08 10:51 - 00000000 ____D () C:\FRST
2014-06-04 15:15 - 2014-06-04 15:15 - 00000000 _____ () C:\Users\Manuela\defogger_reenable
2014-06-04 15:01 - 2014-06-04 15:01 - 00032512 _____ () C:\Windows\system32\Drivers\hitmanpro37.sys
2014-06-04 15:01 - 2014-06-04 15:01 - 00000426 _____ () C:\Windows\system32\.crusader
2014-06-04 14:58 - 2014-06-04 15:01 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-06-04 14:48 - 2014-06-04 14:48 - 00000000 ____D () C:\Windows\ERUNT
2014-06-04 14:41 - 2014-06-06 09:31 - 00000000 ____D () C:\AdwCleaner
2014-06-04 14:11 - 2014-06-08 10:04 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-04 14:10 - 2014-06-04 14:10 - 00001121 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-04 14:10 - 2014-06-04 14:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-04 14:10 - 2014-06-04 14:10 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-04 14:10 - 2014-06-04 14:10 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-06-04 14:10 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-06-04 14:10 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-06-04 14:10 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-06-04 11:20 - 2014-06-04 11:20 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Xilisoft
2014-05-27 13:46 - 2014-05-27 13:46 - 00000000 ____D () C:\Windows\LastGood.Tmp
2014-05-27 13:45 - 2013-07-26 09:07 - 00827096 _____ (Realtek ) C:\Windows\system32\Drivers\Rt630x64.sys
2014-05-27 13:45 - 2013-07-26 09:07 - 00074456 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RtNicProp64.dll
2014-05-27 11:54 - 2014-05-27 11:54 - 00002086 _____ () C:\Users\Public\Desktop\NETGEAR WNDA4100 Genie.lnk
2014-05-27 11:54 - 2014-05-27 11:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NETGEAR WNDA4100 Genie
2014-05-27 11:54 - 2014-05-27 11:54 - 00000000 ____D () C:\Program Files (x86)\NETGEAR
2014-05-27 11:54 - 2014-05-27 11:54 - 00000000 ____D () C:\Program Files (x86)\Cisco
2014-05-27 11:54 - 2012-09-04 13:34 - 02403392 _____ (Ralink Technology, Corp.) C:\Windows\system32\RaCertMgr.dll
2014-05-27 11:54 - 2012-09-04 13:34 - 01121856 _____ (Ralink Technology, Corp.) C:\Windows\system32\RaIHV.dll
2014-05-27 11:54 - 2012-09-04 13:34 - 00128864 _____ (Ralink Technology, Corp.) C:\Windows\system32\RaExtUI.dll
2014-05-27 11:31 - 2014-05-27 11:33 - 00000000 ____D () C:\Users\Manuela\Desktop\ReportMaker
2014-05-26 11:11 - 2014-05-26 11:11 - 00000000 ____D () C:\Users\Manuela\AppData\Local\NETGEAR
2014-05-26 11:11 - 2014-05-26 11:11 - 00000000 ____D () C:\ProgramData\NETGEAR
2014-05-26 11:11 - 2012-10-22 14:50 - 00008192 _____ () C:\Windows\system32\Drivers\rt2870.bin
2014-05-15 10:37 - 2014-06-08 10:04 - 00000000 __RDO () C:\Users\Manuela\OneDrive
2014-05-15 09:41 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-15 09:41 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-15 09:41 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-15 09:41 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-15 09:41 - 2014-04-11 12:03 - 00555736 _____ (Microsoft Corporation) C:\Windows\system32\twinapi.appcore.dll
2014-05-15 09:41 - 2014-04-11 12:03 - 00054776 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-05-15 09:41 - 2014-04-11 10:25 - 00419928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinapi.appcore.dll
2014-05-15 09:41 - 2014-04-11 08:04 - 00056320 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-05-15 09:41 - 2014-04-11 07:53 - 00079872 _____ (Microsoft Corporation) C:\Windows\system32\WSReset.exe
2014-05-15 09:41 - 2014-04-11 07:22 - 00025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-05-15 09:41 - 2014-04-11 05:54 - 00201728 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2014-05-15 09:41 - 2014-04-11 05:36 - 11792384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2014-05-15 09:41 - 2014-04-11 05:24 - 13288960 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
2014-05-15 09:41 - 2014-04-11 05:06 - 00031232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-05-15 09:41 - 2014-04-11 05:05 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-05-15 09:41 - 2014-04-11 05:05 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-05-15 09:41 - 2014-04-11 05:02 - 00249344 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-05-15 09:41 - 2014-04-11 05:02 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-05-15 09:41 - 2014-04-11 05:01 - 00137728 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-05-15 09:41 - 2014-04-11 05:00 - 00080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-05-15 09:41 - 2014-04-11 04:59 - 00666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-05-15 09:41 - 2014-04-11 04:57 - 00190976 _____ (Microsoft Corporation) C:\Windows\system32\storewuauth.dll
2014-05-15 09:41 - 2014-04-11 04:56 - 00381440 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll
2014-05-15 09:41 - 2014-04-11 04:55 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-05-15 09:41 - 2014-04-11 04:53 - 00827392 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-05-15 09:41 - 2014-04-11 04:52 - 03464192 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-05-15 09:41 - 2014-04-11 04:46 - 01705472 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-05-15 09:41 - 2014-04-11 04:36 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.appcore.dll
2014-05-15 09:41 - 2014-04-11 04:34 - 00754688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-05-15 09:41 - 2014-04-11 04:29 - 01054208 _____ (Microsoft Corporation) C:\Windows\system32\twinui.appcore.dll
2014-05-15 09:41 - 2014-04-11 04:25 - 00921088 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-05-15 09:41 - 2014-04-09 00:46 - 00086688 _____ (Microsoft Corporation) C:\Windows\system32\mrt_map.dll
2014-05-15 09:41 - 2014-04-09 00:46 - 00028320 _____ (Microsoft Corporation) C:\Windows\system32\mrt100.dll
2014-05-15 09:41 - 2014-04-08 20:54 - 00080032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mrt_map.dll
2014-05-15 09:41 - 2014-04-08 20:54 - 00026784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mrt100.dll
2014-05-15 09:41 - 2014-03-27 11:12 - 21225584 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-15 09:41 - 2014-03-27 09:48 - 18679728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-15 09:41 - 2014-03-24 04:30 - 00257880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdFilter.sys
2014-05-15 09:41 - 2014-03-24 04:30 - 00123224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdNisDrv.sys
2014-05-15 09:41 - 2014-03-24 04:27 - 00035856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdBoot.sys
2014-05-15 09:41 - 2014-03-13 09:42 - 00308224 _____ (Microsoft Corporation) C:\Windows\system32\wusa.exe
2014-05-15 09:41 - 2014-03-13 08:51 - 00305152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wusa.exe
2014-05-13 18:46 - 2014-05-13 18:46 - 00000965 _____ () C:\Users\Public\Desktop\World of Warcraft.lnk
2014-05-13 18:46 - 2014-05-13 18:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft
2014-05-13 18:36 - 2014-05-13 20:19 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Battle.net
2014-05-13 18:36 - 2014-05-13 18:58 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Battle.net
2014-05-13 18:36 - 2014-05-13 18:36 - 00000841 _____ () C:\Users\Public\Desktop\Battle.net.lnk
2014-05-13 18:36 - 2014-05-13 18:36 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Blizzard Entertainment
2014-05-13 18:36 - 2014-05-13 18:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net
2014-05-13 18:36 - 2014-05-13 18:36 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment
2014-05-13 18:34 - 2014-05-13 18:34 - 00000000 ____D () C:\ProgramData\Battle.net
2014-05-11 13:04 - 2014-05-12 01:02 - 00000000 ____D () C:\Users\Manuela\AppData\Local\PasswordSafe
2014-05-11 13:01 - 2014-05-11 13:01 - 00001049 _____ () C:\Users\Manuela\Desktop\Password Safe.lnk
2014-05-11 13:01 - 2014-05-11 13:01 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Password Safe
2014-05-11 13:01 - 2014-05-11 13:01 - 00000000 ____D () C:\Program Files (x86)\Password Safe
2014-05-11 11:30 - 2014-06-04 11:19 - 00000000 ____D () C:\Program Files (x86)\MSECache
2014-05-09 16:18 - 2014-05-09 16:18 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Awesomium
2014-05-09 15:45 - 2014-05-09 15:45 - 00000000 ____D () C:\ProgramData\Elder Scrolls Online
2014-05-09 14:44 - 2014-05-09 14:44 - 00001060 _____ () C:\Users\Manuela\Desktop\The Elder Scrolls Online.lnk
2014-05-09 14:44 - 2014-05-09 14:44 - 00000000 ____D () C:\Windows\jre
2014-05-09 14:44 - 2014-05-09 14:44 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\The Elder Scrolls Online
2014-05-09 14:01 - 2014-05-09 14:44 - 00000000 ___HD () C:\Program Files (x86)\Zero G Registry
2014-05-09 13:59 - 2014-05-09 13:59 - 00000000 ___HD () C:\Users\Manuela\InstallAnywhere
2014-05-09 13:41 - 2014-05-09 13:41 - 00000890 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2014-05-09 13:41 - 2014-05-09 13:41 - 00000000 ____D () C:\Program Files\VideoLAN
2014-05-09 09:51 - 2014-05-26 17:41 - 00000000 ____D () C:\ProgramData\Nikon

==================== One Month Modified Files and Folders =======

2014-06-08 10:51 - 2014-06-04 15:16 - 00000000 ____D () C:\FRST
2014-06-08 10:51 - 2014-05-07 12:20 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Temp
2014-06-08 10:49 - 2014-06-08 10:49 - 00000997 _____ () C:\Users\Manuela\Desktop\checkup.txt
2014-06-08 10:34 - 2014-05-07 12:24 - 00001130 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-08 10:24 - 2014-05-07 12:20 - 01082997 _____ () C:\Windows\WindowsUpdate.log
2014-06-08 10:17 - 2014-05-07 12:25 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2466271035-3364438158-1365813384-1001
2014-06-08 10:04 - 2014-06-04 14:11 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-08 10:04 - 2014-05-15 10:37 - 00000000 __RDO () C:\Users\Manuela\OneDrive
2014-06-08 10:04 - 2014-05-07 15:15 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-06-08 10:04 - 2014-05-07 12:24 - 00002198 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-06-08 10:04 - 2014-05-07 12:24 - 00001126 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-08 00:00 - 2014-05-08 12:02 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\TS3Client
2014-06-08 00:00 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\sru
2014-06-07 13:50 - 2014-03-18 12:03 - 01776918 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-07 13:50 - 2014-03-18 11:25 - 00764340 _____ () C:\Windows\system32\perfh007.dat
2014-06-07 13:50 - 2014-03-18 11:25 - 00159160 _____ () C:\Windows\system32\perfc007.dat
2014-06-07 13:44 - 2013-08-22 16:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-07 13:44 - 2013-08-22 15:25 - 00262144 ___SH () C:\Windows\system32\config\BBI
2014-06-07 11:23 - 2014-06-07 11:23 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\48230029.sys
2014-06-07 11:21 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\AppReadiness
2014-06-06 09:41 - 2014-06-06 09:41 - 00000616 _____ () C:\Users\Manuela\Desktop\JRT.txt
2014-06-06 09:33 - 2014-06-06 09:33 - 00001192 _____ () C:\Users\Manuela\Desktop\AdwCleaner[S1].txt
2014-06-06 09:32 - 2014-03-18 03:50 - 00007942 _____ () C:\Windows\PFRO.log
2014-06-06 09:31 - 2014-06-04 14:41 - 00000000 ____D () C:\AdwCleaner
2014-06-06 09:28 - 2014-06-06 09:28 - 00001146 _____ () C:\Users\Manuela\Desktop\mbam.txt
2014-06-04 15:15 - 2014-06-04 15:15 - 00000000 _____ () C:\Users\Manuela\defogger_reenable
2014-06-04 15:15 - 2014-05-07 12:20 - 00000000 ____D () C:\Users\Manuela
2014-06-04 15:09 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\vpnplugins
2014-06-04 15:01 - 2014-06-04 15:01 - 00032512 _____ () C:\Windows\system32\Drivers\hitmanpro37.sys
2014-06-04 15:01 - 2014-06-04 15:01 - 00000426 _____ () C:\Windows\system32\.crusader
2014-06-04 15:01 - 2014-06-04 14:58 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-06-04 14:48 - 2014-06-04 14:48 - 00000000 ____D () C:\Windows\ERUNT
2014-06-04 14:41 - 2014-05-07 12:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-06-04 14:41 - 2014-05-07 12:20 - 00001014 _____ () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-06-04 14:18 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\Branding
2014-06-04 14:10 - 2014-06-04 14:10 - 00001121 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-04 14:10 - 2014-06-04 14:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-04 14:10 - 2014-06-04 14:10 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-04 14:10 - 2014-06-04 14:10 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-06-04 13:52 - 2014-05-08 08:13 - 00000020 ____H () C:\ProgramData\PKP_DLev.DAT
2014-06-04 13:52 - 2014-05-08 08:13 - 00000020 ____H () C:\ProgramData\PKP_DLet.DAT
2014-06-04 11:20 - 2014-06-04 11:20 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Xilisoft
2014-06-04 11:19 - 2014-05-11 11:30 - 00000000 ____D () C:\Program Files (x86)\MSECache
2014-06-04 10:10 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\NDF
2014-05-27 13:46 - 2014-05-27 13:46 - 00000000 ____D () C:\Windows\LastGood.Tmp
2014-05-27 13:45 - 2014-05-07 12:27 - 00000000 ____D () C:\Program Files (x86)\Realtek
2014-05-27 13:01 - 2014-05-07 12:25 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-05-27 11:54 - 2014-05-27 11:54 - 00002086 _____ () C:\Users\Public\Desktop\NETGEAR WNDA4100 Genie.lnk
2014-05-27 11:54 - 2014-05-27 11:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NETGEAR WNDA4100 Genie
2014-05-27 11:54 - 2014-05-27 11:54 - 00000000 ____D () C:\Program Files (x86)\NETGEAR
2014-05-27 11:54 - 2014-05-27 11:54 - 00000000 ____D () C:\Program Files (x86)\Cisco
2014-05-27 11:54 - 2013-08-22 17:36 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp
2014-05-27 11:53 - 2014-05-08 08:13 - 00000000 ____D () C:\Windows\Downloaded Installations
2014-05-27 11:33 - 2014-05-27 11:31 - 00000000 ____D () C:\Users\Manuela\Desktop\ReportMaker
2014-05-26 17:55 - 2014-05-07 12:20 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Packages
2014-05-26 17:41 - 2014-05-09 09:51 - 00000000 ____D () C:\ProgramData\Nikon
2014-05-26 11:11 - 2014-05-26 11:11 - 00000000 ____D () C:\Users\Manuela\AppData\Local\NETGEAR
2014-05-26 11:11 - 2014-05-26 11:11 - 00000000 ____D () C:\ProgramData\NETGEAR
2014-05-26 10:03 - 2013-08-22 16:46 - 00046107 _____ () C:\Windows\setupact.log
2014-05-24 09:14 - 2014-05-07 13:32 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-05-16 16:14 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\rescache
2014-05-16 08:33 - 2013-08-22 17:36 - 00000000 ___RD () C:\Windows\ToastData
2014-05-16 08:33 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-05-16 08:33 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-05-16 08:33 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\WinStore
2014-05-16 08:33 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows Defender
2014-05-16 08:33 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
2014-05-15 09:59 - 2013-08-22 17:20 - 00000000 ____D () C:\Windows\CbsTemp
2014-05-15 09:58 - 2013-08-22 17:36 - 00000000 ____D () C:\Windows\system32\SecureBootUpdates
2014-05-15 09:44 - 2014-05-07 12:20 - 00000000 ___RD () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-15 09:44 - 2014-05-07 12:20 - 00000000 ___RD () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-15 09:43 - 2014-05-07 13:49 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-15 09:43 - 2014-05-07 13:02 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-15 09:42 - 2014-05-07 13:02 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-15 09:42 - 2013-08-22 15:25 - 00262144 ___SH () C:\Windows\system32\config\ELAM
2014-05-13 20:19 - 2014-05-13 18:36 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Battle.net
2014-05-13 18:58 - 2014-05-13 18:36 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Battle.net
2014-05-13 18:46 - 2014-05-13 18:46 - 00000965 _____ () C:\Users\Public\Desktop\World of Warcraft.lnk
2014-05-13 18:46 - 2014-05-13 18:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft
2014-05-13 18:36 - 2014-05-13 18:36 - 00000841 _____ () C:\Users\Public\Desktop\Battle.net.lnk
2014-05-13 18:36 - 2014-05-13 18:36 - 00000000 ____D () C:\Users\Manuela\AppData\Local\Blizzard Entertainment
2014-05-13 18:36 - 2014-05-13 18:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net
2014-05-13 18:36 - 2014-05-13 18:36 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment
2014-05-13 18:34 - 2014-05-13 18:34 - 00000000 ____D () C:\ProgramData\Battle.net
2014-05-12 07:26 - 2014-06-04 14:10 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-12 07:26 - 2014-06-04 14:10 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-12 07:25 - 2014-06-04 14:10 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-12 01:02 - 2014-05-11 13:04 - 00000000 ____D () C:\Users\Manuela\AppData\Local\PasswordSafe
2014-05-11 13:01 - 2014-05-11 13:01 - 00001049 _____ () C:\Users\Manuela\Desktop\Password Safe.lnk
2014-05-11 13:01 - 2014-05-11 13:01 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Password Safe
2014-05-11 13:01 - 2014-05-11 13:01 - 00000000 ____D () C:\Program Files (x86)\Password Safe
2014-05-09 16:18 - 2014-05-09 16:18 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Awesomium
2014-05-09 15:45 - 2014-05-09 15:45 - 00000000 ____D () C:\ProgramData\Elder Scrolls Online
2014-05-09 14:44 - 2014-05-09 14:44 - 00001060 _____ () C:\Users\Manuela\Desktop\The Elder Scrolls Online.lnk
2014-05-09 14:44 - 2014-05-09 14:44 - 00000000 ____D () C:\Windows\jre
2014-05-09 14:44 - 2014-05-09 14:44 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\The Elder Scrolls Online
2014-05-09 14:44 - 2014-05-09 14:01 - 00000000 ___HD () C:\Program Files (x86)\Zero G Registry
2014-05-09 13:59 - 2014-05-09 13:59 - 00000000 ___HD () C:\Users\Manuela\InstallAnywhere
2014-05-09 13:45 - 2014-05-07 13:56 - 00000000 ____D () C:\Users\Manuela\AppData\Roaming\vlc
2014-05-09 13:41 - 2014-05-09 13:41 - 00000890 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2014-05-09 13:41 - 2014-05-09 13:41 - 00000000 ____D () C:\Program Files\VideoLAN

Files to move or delete:
====================
C:\ProgramData\PKP_DLeo.DAT
C:\ProgramData\PKP_DLes.DAT
C:\ProgramData\PKP_DLet.DAT
C:\ProgramData\PKP_DLev.DAT


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-06-02 12:08

==================== End Of Log ============================
         

--- --- ---

--- --- ---

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

C:\ProgramData\PKP_DLeo.DAT
C:\ProgramData\PKP_DLes.DAT
C:\ProgramData\PKP_DLet.DAT
C:\ProgramData\PKP_DLev.DAT
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Entfernen Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop.
Schließe nun alle offenen Programme und trenne Dich von dem Internet.
Doppelklick auf die TFC.exe und drücke auf Start.
Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen.




Fertig

Die Reihenfolge ist hier entscheidend.

1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
   • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
   • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
   • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
3. Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
   • Schließe alle offenen Programme.
   • Starte die delfix.exe mit einem Doppelklick.
   • Setze vor jede Funktion ein Häkchen.
   • Klicke auf Start.
   • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
   • Starte deinen Rechner abschließend neu.
4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun

Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

• Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
• Windows Updates
  • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
  • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
• Gehe sicher das die automatischen Updates aktiviert sind.
• Software Updates
  Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
  Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

• Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

• MalwareBytes Anti Malware
  Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
  Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
  Ein Tutorial zur Verwendung findest Du hier.
• WinPatrol
  Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

• SpywareBlaster
  Eine kurze Einführung findest du Hier
• MVPs hosts file
  Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
• WOT (Web of trust)
  Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

• Opera
• Mozilla Firefox.
  • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
  • NoScript
    Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    
  • AdblockPlus
    Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
    Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts

• Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
• verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
• Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
• Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Hallo,

alles erledigt.

Vielen, vielen Dank für deine Hilfe.

Liebe Grüsse
Manuela

Gern Geschehen