GVU Trojaner 2.12 Windows 7

DeniseBö · 29.06.2013, 17:51

Hallo,

ich habe mir einen Trojaner eingefangen.
Mit F8 konnte ich in den abgesicherten Modus kommen und habe bereits OTL scannen lassen.
Nun weiß ich nicht, wie ich mit den beiden Logs weiter verfahren soll, um fixen zu können.
Extras.txt befindet sich im Anhang, die OTL.txt-Datei ist allerdings zu groß, um sie hochladen zu können. Was nun?

Danke im Voraus,

Denise

schrauber · 29.06.2013, 18:00

Hi,

dann poste bitte das OTL log.

DeniseBö · 30.06.2013, 11:21

OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 6/29/2013 6:05:31 PM - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Pontolon\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16614)
Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.86 Gb Total Physical Memory | 2.81 Gb Available Physical Memory | 72.84% Memory free
7.71 Gb Paging File | 6.68 Gb Available in Paging File | 86.67% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 83.80 Gb Total Space | 38.82 Gb Free Space | 46.32% Space Free | Partition Type: NTFS
Drive D: | 373.85 Gb Total Space | 304.54 Gb Free Space | 81.46% Space Free | Partition Type: NTFS
 
Computer Name: DUNNI-PC | User Name: Pontolon | Logged in as Administrator.
Boot Mode: SafeMode | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013/06/29 17:03:44 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Pontolon\Desktop\OTL.exe
 
 
========== Modules (No Company Name) ==========
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2009/10/02 18:39:44 | 000,873,248 | ---- | M] (Broadcom Corporation.) [Auto | Stopped] -- C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)
SRV - [2013/06/12 14:32:31 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013/06/07 00:06:24 | 000,543,656 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2013/05/14 00:54:12 | 004,937,264 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Stopped] -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe -- (AVGIDSAgent)
SRV - [2013/04/18 04:34:38 | 000,283,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Stopped] -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe -- (avgwd)
SRV - [2013/02/28 18:45:16 | 000,161,384 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/10/03 00:21:00 | 001,258,856 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2012/06/21 05:01:58 | 000,092,632 | ---- | M] (TomTom) [Auto | Stopped] -- D:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe -- (TomTomHOMEService)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/03/18 11:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2009/06/10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009/03/05 11:54:50 | 000,311,296 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysWOW64\Rezip.exe -- (Rezip)
SRV - [2006/12/19 19:23:20 | 000,094,208 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe -- (EpsonBidirectionalService)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2013/03/29 02:53:48 | 000,246,072 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avgidsdrivera.sys -- (AVGIDSDriver)
DRV:64bit: - [2013/03/21 03:08:24 | 000,240,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avgtdia.sys -- (Avgtdia)
DRV:64bit: - [2013/02/08 04:37:56 | 000,116,536 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgmfx64.sys -- (Avgmfx64)
DRV:64bit: - [2013/02/08 04:37:54 | 000,311,096 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\avgloga.sys -- (Avgloga)
DRV:64bit: - [2013/02/08 04:37:50 | 000,071,480 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\avgidsha.sys -- (AVGIDSHA)
DRV:64bit: - [2013/02/08 04:37:42 | 000,206,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avgldx64.sys -- (Avgldx64)
DRV:64bit: - [2013/02/08 04:37:40 | 000,045,880 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgrkx64.sys -- (Avgrkx64)
DRV:64bit: - [2012/12/13 14:50:36 | 000,054,784 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2012/09/12 15:20:04 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
DRV:64bit: - [2012/08/23 16:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2012/08/23 16:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2012/07/03 17:25:16 | 000,189,288 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2012/03/01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011/12/13 04:32:22 | 002,797,056 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2011/09/22 21:28:27 | 000,021,160 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwrchid.sys -- (btwrchid)
DRV:64bit: - [2011/09/22 21:28:26 | 000,132,648 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt)
DRV:64bit: - [2011/09/22 21:28:26 | 000,098,344 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio)
DRV:64bit: - [2011/09/22 21:28:26 | 000,035,104 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwl2cap.sys -- (btwl2cap)
DRV:64bit: - [2011/07/29 13:54:56 | 000,016,776 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\epmntdrv.sys -- (epmntdrv)
DRV:64bit: - [2011/07/29 13:54:56 | 000,009,096 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\EuGdiDrv.sys -- (EuGdiDrv)
DRV:64bit: - [2011/04/12 12:45:50 | 000,018,432 | ---- | M] (TPMX Electronics Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HPub4DE3.sys -- (HPub4DE3)
DRV:64bit: - [2011/03/11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011/03/09 11:44:44 | 000,025,088 | ---- | M] (TPMX Electronics Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HPMo4DE3.sys -- (HPMo4DE3)
DRV:64bit: - [2011/02/25 11:14:22 | 001,414,704 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2010/11/20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/02/26 16:32:12 | 000,158,976 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Impcd.sys -- (Impcd)
DRV:64bit: - [2009/11/20 08:09:48 | 000,537,112 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2009/09/28 11:22:00 | 000,395,264 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\yk62x64.sys -- (yukonw7)
DRV:64bit: - [2009/07/14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/07/01 22:46:58 | 000,052,264 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btusbflt.sys -- (btusbflt)
DRV:64bit: - [2009/06/10 22:37:05 | 006,108,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2009/06/10 22:35:42 | 000,187,392 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2009/06/10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009/06/03 00:58:24 | 000,507,392 | ---- | M] (ITETech                  ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AF15BDA.sys -- (AF15BDA)
DRV:64bit: - [2009/05/28 08:38:04 | 000,013,824 | ---- | M] (SAMSUNG ELECTRONICS) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\SABI.sys -- (SABI)
DRV:64bit: - [2009/03/18 17:35:42 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi)
DRV - [2011/07/29 13:54:56 | 000,014,216 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\epmntdrv.sys -- (epmntdrv)
DRV - [2011/07/29 13:54:56 | 000,008,456 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\EuGdiDrv.sys -- (EuGdiDrv)
DRV - [2009/07/14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.qvo6.com/?utm_source=b&utm_medium=adk&from=adk&uid=HitachiXHTS545050B9A300_100504PBN403B7GWE3ZLX&ts=1369937231
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.qvo6.com/?utm_source=b&utm_medium=adk&from=adk&uid=HitachiXHTS545050B9A300_100504PBN403B7GWE3ZLX&ts=1369937231
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {33BB0A4E-99AF-4226-BDF6-49120163DE86}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}: "URL" = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=adk&from=adk&uid=HitachiXHTS545050B9A300_100504PBN403B7GWE3ZLX&ts=0
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.qvo6.com/?utm_source=b&utm_medium=adk&from=adk&uid=HitachiXHTS545050B9A300_100504PBN403B7GWE3ZLX&ts=1369937231
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.qvo6.com/?utm_source=b&utm_medium=adk&from=adk&uid=HitachiXHTS545050B9A300_100504PBN403B7GWE3ZLX&ts=1369937231
IE - HKLM\..\SearchScopes,DefaultScope = {33BB0A4E-99AF-4226-BDF6-49120163DE86}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}: "URL" = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=adk&from=adk&uid=HitachiXHTS545050B9A300_100504PBN403B7GWE3ZLX&ts=0
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-3653625925-304732537-2994858790-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.qvo6.com/?utm_source=b&utm_medium=adk&from=adk&uid=HitachiXHTS545050B9A300_100504PBN403B7GWE3ZLX&ts=1369937231
IE - HKU\S-1-5-21-3653625925-304732537-2994858790-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\S-1-5-21-3653625925-304732537-2994858790-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-3653625925-304732537-2994858790-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-3653625925-304732537-2994858790-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B7 CB 0C 03 C6 2A CD 01  [binary data]
IE - HKU\S-1-5-21-3653625925-304732537-2994858790-1005\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - No CLSID value found
IE - HKU\S-1-5-21-3653625925-304732537-2994858790-1005\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-3653625925-304732537-2994858790-1005\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
IE - HKU\S-1-5-21-3653625925-304732537-2994858790-1005\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://mixidj.delta-search.com/?q={searchTerms}&affID=121139&babsrc=SP_ss&mntrId=BC79B482FE9B3E21
IE - HKU\S-1-5-21-3653625925-304732537-2994858790-1005\..\SearchScopes\{2D3DCE8C-F2F6-4120-81D8-74A368F55931}: "URL" = hxxp://searchou.com/?q={searchTerms}&id=bc798091000000000000b482fe9b3e21&r=827
IE - HKU\S-1-5-21-3653625925-304732537-2994858790-1005\..\SearchScopes\{2E95E3E0-BEC6-48D2-BFE4-85A1E7B671BE}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=6996957E-0501-4C18-B1C5-CBB8CEC60D01&apn_sauid=4C664587-9BF3-4AC9-819E-E0F9EF0B1FC9
IE - HKU\S-1-5-21-3653625925-304732537-2994858790-1005\..\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}: "URL" = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=adk&from=adk&uid=HitachiXHTS545050B9A300_100504PBN403B7GWE3ZLX&ts=0
IE - HKU\S-1-5-21-3653625925-304732537-2994858790-1005\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN_de
IE - HKU\S-1-5-21-3653625925-304732537-2994858790-1005\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7MXGB_deDE533
IE - HKU\S-1-5-21-3653625925-304732537-2994858790-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: D:\Programme (x86)\java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.1.0-git-20120217-1212: d:\Programme\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1200112.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3505.0912: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011/11/28 00:01:41 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 12.0\extensions\\Components: d:\Programme (x86)\Mozilla Thunderbird\components [2013/06/26 10:40:32 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 12.0\extensions\\Plugins: d:\Programme (x86)\Mozilla Thunderbird\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\avgthb@avg.com: D:\Programme (x86)\AVG\AVG2012\Thunderbird\ [2011/12/23 20:38:48 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 17.0.7\extensions\\Components: D:\Programme (x86)\Mozilla Thunderbird\components [2013/06/26 10:40:32 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 17.0.7\extensions\\Plugins: D:\Programme (x86)\Mozilla Thunderbird\plugins
 
[2012/07/14 00:15:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Pontolon\AppData\Roaming\mozilla\Extensions
[2012/07/14 00:15:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Pontolon\AppData\Roaming\mozilla\Extensions\home2@tomtom.com
[2013/05/01 02:55:35 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
 
O1 HOSTS File: ([2012/05/05 17:25:16 | 000,442,949 | R--- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1	www.007guard.com
O1 - Hosts: 127.0.0.1	007guard.com
O1 - Hosts: 127.0.0.1	008i.com
O1 - Hosts: 127.0.0.1	www.008k.com
O1 - Hosts: 127.0.0.1	008k.com
O1 - Hosts: 127.0.0.1	www.00hq.com
O1 - Hosts: 127.0.0.1	00hq.com
O1 - Hosts: 127.0.0.1	010402.com
O1 - Hosts: 127.0.0.1	www.032439.com
O1 - Hosts: 127.0.0.1	032439.com
O1 - Hosts: 127.0.0.1	www.0scan.com
O1 - Hosts: 127.0.0.1	0scan.com
O1 - Hosts: 127.0.0.1	1000gratisproben.com
O1 - Hosts: 127.0.0.1	www.1000gratisproben.com
O1 - Hosts: 127.0.0.1	1001namen.com
O1 - Hosts: 127.0.0.1	www.1001namen.com
O1 - Hosts: 127.0.0.1	100888290cs.com
O1 - Hosts: 127.0.0.1	www.100888290cs.com
O1 - Hosts: 127.0.0.1	www.100sexlinks.com
O1 - Hosts: 127.0.0.1	100sexlinks.com
O1 - Hosts: 127.0.0.1	10sek.com
O1 - Hosts: 127.0.0.1	www.10sek.com
O1 - Hosts: 127.0.0.1	www.1-2005-search.com
O1 - Hosts: 127.0.0.1	1-2005-search.com
O1 - Hosts: 127.0.0.1	123fporn.info
O1 - Hosts: 15215 more lines...
O2:64bit: - BHO: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
O2:64bit: - BHO: (DVDVideoSoft WebPageAdjuster Class) - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)
O2 - BHO: (WebCake) - {2A5A2A90-3B30-4E6E-A955-2F232C6EF517} - C:\Program Files (x86)\WebCake\WebCakeIEClient.dll (WebCake LLC)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MIF5BA~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (DVDVideoSoft WebPageAdjuster Class) - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
O3:64bit: - HKLM\..\Toolbar: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O3:64bit: - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {5018CFD2-804D-4C99-9F81-25EAEA2769DE} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-3653625925-304732537-2994858790-1005\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-21-3653625925-304732537-2994858790-1005\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG_UI] C:\Program Files (x86)\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [CLMLServer] C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [EEventManager] C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [PDVD8LanguageShortcut] C:\Program Files (x86)\CyberLink\PowerDVD8\Language\Language.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RemoteControl8] C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateLBPShortCut] C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePDRShortCut] C:\Program Files (x86)\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePPShortCut] C:\Program Files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePSTShortCut] C:\Program Files (x86)\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-3653625925-304732537-2994858790-1005..\Run: [ctfmon.exe] C:\ProgramData\dooco.dat (Microsoft Corporation)
O4 - HKU\S-1-5-21-3653625925-304732537-2994858790-1005..\Run: [Epson Stylus SX430(Netzwerk)] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIHAE.EXE /FU "C:\Users\Pontolon\AppData\Local\Temp\E_S6AC1.tmp" /EF "HKCU" File not found
O4 - HKU\S-1-5-21-3653625925-304732537-2994858790-1005..\Run: [PlayNC Launcher]  File not found
O4 - HKU\S-1-5-21-3653625925-304732537-2994858790-1005..\Run: [Steam] C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
O4 - HKU\S-1-5-21-3653625925-304732537-2994858790-1005..\Run: [TomTomHOME.exe] D:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe (TomTom)
O4 - HKU\S-1-5-21-3653625925-304732537-2994858790-1005..\Run: [WebCake Desktop] C:\Users\Pontolon\AppData\Roaming\WebCake\WebCakeDesktop.exe (WebCake LLC)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-21-3653625925-304732537-2994858790-1005..\RunOnce: [Uninstall C:\Users\Pontolon\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64] C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Pontolon\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64" File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-21-3653625925-304732537-2994858790-1005\Software\Policies\Microsoft\Internet Explorer\Recovery present
O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MIF5BA~1\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm ()
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MIF5BA~1\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MIF5BA~1\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm ()
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MIF5BA~1\Office14\EXCEL.EXE/3000 File not found
O9:64bit: - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra Button: Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)
O9:64bit: - Extra 'Tools' menuitem : Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)
O9 - Extra Button: Senden an Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Senden an &Bluetooth-Gerät... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
O9 - Extra 'Tools' menuitem : Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab (Reg Error: Key error.)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} hxxp://game.zylom.com/activex/zylomgamesplayer.cab (Zylom Games Player)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 10.9.2)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C009198A-3027-44A3-91E8-447F50989DD4}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\linkscanner - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\linkscanner - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\SafeStick.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (sdnclean64.exe)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013/06/29 17:42:10 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Pontolon\Desktop\OTL.exe
[2013/06/29 10:46:57 | 000,155,648 | ---- | C] (Microsoft Corporation) -- C:\ProgramData\dooco.dat
[2013/06/29 10:46:57 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\ProgramData\rundll32.exe
[2013/06/29 10:46:27 | 000,155,648 | ---- | C] (Microsoft Corporation) -- C:\Users\Pontolon\5978713.dll
[2013/06/18 21:36:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\PDF Architect
[2013/06/18 13:32:48 | 000,000,000 | ---D | C] -- C:\Users\Pontolon\AppData\Roaming\PDF Architect
[2013/06/18 10:37:42 | 000,000,000 | ---D | C] -- C:\Users\Pontolon\AppData\Roaming\WordToPDF
[2013/06/15 21:27:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MyPC Backup
[2013/06/15 21:27:03 | 000,000,000 | ---D | C] -- C:\Users\Pontolon\AppData\Roaming\Systweak
[2013/06/15 21:27:00 | 000,020,312 | ---- | C] (Systweak Inc., (www.systweak.com)) -- C:\Windows\SysNative\roboot64.exe
[2013/06/15 21:26:52 | 000,000,000 | ---D | C] -- C:\Users\Pontolon\AppData\Roaming\player
[2013/06/15 19:40:03 | 000,526,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2013/06/15 19:40:03 | 000,391,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2013/06/14 08:05:19 | 000,136,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll
[2013/06/14 08:05:19 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll
[2013/06/14 08:05:19 | 000,089,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe
[2013/06/14 08:05:19 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2013/06/14 08:05:19 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
[2013/06/14 08:05:19 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2013/06/14 08:05:19 | 000,051,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
[2013/06/14 08:05:19 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
[2013/06/14 08:05:19 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2013/06/14 08:05:18 | 000,855,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2013/06/14 08:05:18 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2013/06/14 08:05:18 | 000,603,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2013/06/14 08:05:17 | 003,958,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2013/06/12 08:18:52 | 000,751,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\win32spl.dll
[2013/06/12 08:18:52 | 000,492,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\win32spl.dll
[2013/06/12 08:18:49 | 000,030,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptdlg.dll
[2013/06/12 08:18:49 | 000,024,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cryptdlg.dll
[2013/06/12 08:18:46 | 001,424,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecs.dll
[2013/06/12 08:18:40 | 001,192,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\certutil.exe
[2013/06/12 08:18:39 | 001,464,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll
[2013/06/12 08:18:39 | 000,903,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\certutil.exe
[2013/06/12 08:18:39 | 000,139,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll
[2013/06/12 08:18:39 | 000,052,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\certenc.dll
[2013/06/12 08:18:39 | 000,043,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\certenc.dll
[2013/06/12 08:18:36 | 001,887,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d11.dll
[2013/06/12 08:18:36 | 001,505,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3d11.dll
[2013/06/11 21:43:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
[2013/06/11 21:43:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DESIGNER
[2013/06/11 21:43:29 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH
[2013/06/11 21:39:40 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
[2013/06/11 21:39:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Analysis Services
[2013/06/11 21:39:09 | 000,000,000 | ---D | C] -- C:\Users\Pontolon\AppData\Local\Microsoft Help
[2013/06/11 21:39:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Office
[2013/06/11 21:38:47 | 000,000,000 | RH-D | C] -- C:\MSOCache
[2013/06/11 09:17:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
[2013/06/10 17:10:39 | 000,000,000 | ---D | C] -- C:\Users\Pontolon\AppData\Local\DayZCommander
[2013/06/10 17:10:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Dotjosh Studios
[2013/06/09 19:09:33 | 000,000,000 | ---D | C] -- C:\Users\Pontolon\Documents\ArmA 2
[2013/06/09 19:09:33 | 000,000,000 | ---D | C] -- C:\Users\Pontolon\AppData\Local\ArmA 2
[2013/06/09 19:09:29 | 000,000,000 | ---D | C] -- C:\Users\Pontolon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bohemia Interactive
[2013/06/09 19:09:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bohemia Interactive
[2013/06/08 01:09:05 | 000,000,000 | ---D | C] -- C:\Users\Pontolon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
[2013/06/08 00:57:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Steam
[2013/06/08 00:57:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
[2013/06/08 00:57:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Steam
[2013/06/06 21:53:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Iminent
[2013/06/01 00:02:01 | 000,000,000 | ---D | C] -- C:\Users\Pontolon\AppData\Roaming\.minecraft
[2013/05/30 20:07:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\337
[2013/05/30 20:07:26 | 000,000,000 | ---D | C] -- C:\Users\Pontolon\AppData\Roaming\WebCake
[2013/05/30 20:07:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\WebCake
[2013/05/30 20:07:25 | 000,000,000 | ---D | C] -- C:\ProgramData\eSafe
[2013/05/30 20:07:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Tarma Installer
[2013/05/30 20:07:02 | 000,000,000 | ---D | C] -- C:\Users\Pontolon\AppData\Roaming\eIntaller
[2013/05/30 19:56:32 | 000,000,000 | ---D | C] -- C:\Users\Pontolon\AppData\Roaming\ftblauncher
[4 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013/06/29 18:04:17 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/06/29 18:04:03 | 3106,103,296 | -HS- | M] () -- C:\hiberfil.sys
[2013/06/29 18:03:22 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/06/29 18:03:21 | 095,023,320 | ---- | M] () -- C:\ProgramData\ocood.pad
[2013/06/29 17:08:30 | 001,612,484 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013/06/29 17:08:30 | 000,696,870 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013/06/29 17:08:30 | 000,652,148 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013/06/29 17:08:30 | 000,148,134 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013/06/29 17:08:30 | 000,121,080 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013/06/29 17:03:44 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Pontolon\Desktop\OTL.exe
[2013/06/29 17:00:40 | 000,013,936 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/06/29 17:00:40 | 000,013,936 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/06/29 16:32:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/06/29 16:17:00 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/06/29 10:47:04 | 000,001,023 | ---- | M] () -- C:\Users\Pontolon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msconfig.lnk
[2013/06/29 10:47:02 | 000,002,609 | ---- | M] () -- C:\ProgramData\ocood.js
[2013/06/29 10:47:02 | 000,000,151 | ---- | M] () -- C:\ProgramData\ocood.reg
[2013/06/29 10:47:02 | 000,000,055 | ---- | M] () -- C:\ProgramData\ocood.bat
[2013/06/29 10:46:57 | 000,155,648 | ---- | M] (Microsoft Corporation) -- C:\ProgramData\dooco.dat
[2013/06/29 10:46:57 | 000,044,544 | ---- | M] (Microsoft Corporation) -- C:\ProgramData\rundll32.exe
[2013/06/29 10:46:56 | 000,155,648 | ---- | M] (Microsoft Corporation) -- C:\Users\Pontolon\5978713.dll
[2013/06/26 15:07:52 | 000,004,190 | ---- | M] () -- C:\Users\Pontolon\Desktop\ich glaube, dass diese Frau....rtf
[2013/06/21 15:11:53 | 000,000,187 | ---- | M] () -- C:\Users\Pontolon\Desktop\Dokument.rtf
[2013/06/21 15:11:34 | 000,000,187 | ---- | M] () -- C:\Users\Pontolon\Documents\Dokument.rtf
[2013/06/19 10:25:08 | 000,006,425 | ---- | M] () -- C:\Users\Pontolon\Desktop\dm.odt
[2013/06/19 10:19:28 | 000,638,163 | ---- | M] () -- C:\Users\Pontolon\Desktop\dm.pdf
[2013/06/18 21:41:49 | 000,652,415 | ---- | M] () -- C:\Users\Pontolon\Desktop\Zeugnis Ernstings.pdf
[2013/06/18 21:40:59 | 000,205,069 | ---- | M] () -- C:\Users\Pontolon\Desktop\Verkäuferin Lebenslauf.pdf
[2013/06/15 20:16:13 | 000,000,898 | ---- | M] () -- C:\Windows\SysWow64\InstallUtil.InstallLog
[2013/06/15 19:44:27 | 001,590,378 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2013/06/14 10:25:32 | 000,118,108 | ---- | M] () -- C:\Users\Pontolon\Documents\Family.pdf
[2013/06/14 10:10:00 | 000,002,528 | ---- | M] () -- C:\Users\Pontolon\Desktop\Ernstings Family.rtf
[2013/06/13 18:36:18 | 000,011,481 | ---- | M] () -- C:\Users\Pontolon\Desktop\+.rtf
[2013/06/12 14:32:30 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2013/06/12 14:32:30 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013/06/12 11:44:47 | 000,000,356 | ---- | M] () -- C:\Users\Pontolon\Documents\Fast lustiger Spruch.rtf
[2013/06/12 09:35:23 | 000,386,672 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013/06/11 22:03:22 | 000,034,858 | ---- | M] () -- C:\Users\Pontolon\Desktop\Bewerbung Buch Presse.rtf
[2013/06/11 22:03:22 | 000,000,162 | -H-- | M] () -- C:\Users\Pontolon\Desktop\~$werbung Buch Presse.rtf
[2013/06/11 21:02:43 | 000,004,050 | ---- | M] () -- C:\Users\Pontolon\Desktop\Verkäuferin Lebenslauf.rtf
[2013/06/08 16:06:58 | 000,526,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2013/06/08 13:40:02 | 000,391,168 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[4 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013/06/29 10:47:04 | 000,001,023 | ---- | C] () -- C:\Users\Pontolon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msconfig.lnk
[2013/06/29 10:47:02 | 000,002,609 | ---- | C] () -- C:\ProgramData\ocood.js
[2013/06/29 10:47:02 | 000,000,151 | ---- | C] () -- C:\ProgramData\ocood.reg
[2013/06/29 10:47:02 | 000,000,055 | ---- | C] () -- C:\ProgramData\ocood.bat
[2013/06/29 10:47:00 | 095,023,320 | ---- | C] () -- C:\ProgramData\ocood.pad
[2013/06/21 15:11:53 | 000,000,187 | ---- | C] () -- C:\Users\Pontolon\Desktop\Dokument.rtf
[2013/06/21 15:11:34 | 000,000,187 | ---- | C] () -- C:\Users\Pontolon\Documents\Dokument.rtf
[2013/06/21 02:25:56 | 000,004,190 | ---- | C] () -- C:\Users\Pontolon\Desktop\ich glaube, dass diese Frau....rtf
[2013/06/19 10:24:53 | 000,205,069 | ---- | C] () -- C:\Users\Pontolon\Desktop\Verkäuferin Lebenslauf.pdf
[2013/06/19 10:24:38 | 000,652,415 | ---- | C] () -- C:\Users\Pontolon\Desktop\Zeugnis Ernstings.pdf
[2013/06/19 10:17:29 | 000,638,163 | ---- | C] () -- C:\Users\Pontolon\Desktop\dm.pdf
[2013/06/19 10:10:01 | 000,006,425 | ---- | C] () -- C:\Users\Pontolon\Desktop\dm.odt
[2013/06/14 10:25:32 | 000,118,108 | ---- | C] () -- C:\Users\Pontolon\Documents\Family.pdf
[2013/06/14 10:07:38 | 000,002,528 | ---- | C] () -- C:\Users\Pontolon\Desktop\Ernstings Family.rtf
[2013/06/13 08:26:27 | 000,011,481 | ---- | C] () -- C:\Users\Pontolon\Desktop\+.rtf
[2013/06/12 11:44:47 | 000,000,356 | ---- | C] () -- C:\Users\Pontolon\Documents\Fast lustiger Spruch.rtf
[2013/06/11 22:03:22 | 000,034,858 | ---- | C] () -- C:\Users\Pontolon\Desktop\Bewerbung Buch Presse.rtf
[2013/06/11 22:03:22 | 000,000,162 | -H-- | C] () -- C:\Users\Pontolon\Desktop\~$werbung Buch Presse.rtf
[2013/06/11 21:02:43 | 000,004,050 | ---- | C] () -- C:\Users\Pontolon\Desktop\Verkäuferin Lebenslauf.rtf
[2013/06/06 21:54:07 | 000,000,898 | ---- | C] () -- C:\Windows\SysWow64\InstallUtil.InstallLog
[2013/02/15 19:27:51 | 000,010,495 | ---- | C] () -- C:\Users\Pontolon\Holgi_elster_2048.pfx
[2013/02/15 19:22:45 | 000,010,495 | ---- | C] () -- C:\Users\Pontolon\Duni_elster_2048.pfx
[2012/06/09 11:37:42 | 002,469,760 | ---- | C] () -- C:\Windows\SysWow64\BootMan.exe
[2012/06/09 11:37:42 | 000,086,408 | ---- | C] () -- C:\Windows\SysWow64\setupempdrv03.exe
[2012/06/09 11:37:42 | 000,019,840 | ---- | C] () -- C:\Windows\SysWow64\EuEpmGdi.dll
[2012/06/09 11:37:42 | 000,014,216 | ---- | C] () -- C:\Windows\SysWow64\epmntdrv.sys
[2012/06/09 11:37:42 | 000,008,456 | ---- | C] () -- C:\Windows\SysWow64\EuGdiDrv.sys
[2012/05/26 23:38:42 | 000,000,036 | ---- | C] () -- C:\Users\Pontolon\AppData\Local\housecall.guid.cache
[2012/05/05 16:02:44 | 000,000,218 | ---- | C] () -- C:\Users\Pontolon\.recently-used.xbel
[2011/09/22 20:20:00 | 001,590,378 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
 
========== ZeroAccess Check ==========
 
[2009/07/14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013/02/27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013/02/27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2013/01/11 10:56:51 | 000,000,000 | ---D | M] -- C:\Users\Default\AppData\Roaming\TuneUp Software
[2013/01/11 10:56:51 | 000,000,000 | ---D | M] -- C:\Users\Default User\AppData\Roaming\TuneUp Software
[2013/06/01 12:31:16 | 000,000,000 | ---D | M] -- C:\Users\Pontolon\AppData\Roaming\.minecraft
[2013/04/06 21:14:25 | 000,000,000 | ---D | M] -- C:\Users\Pontolon\AppData\Roaming\.skyrimcraft
[2012/12/13 14:34:28 | 000,000,000 | ---D | M] -- C:\Users\Pontolon\AppData\Roaming\AVG2013
[2013/05/12 20:26:51 | 000,000,000 | ---D | M] -- C:\Users\Pontolon\AppData\Roaming\Babylon
[2013/05/12 20:26:45 | 000,000,000 | ---D | M] -- C:\Users\Pontolon\AppData\Roaming\DVDVideoSoft
[2013/05/12 20:26:38 | 000,000,000 | ---D | M] -- C:\Users\Pontolon\AppData\Roaming\DVDVideoSoftIEHelpers
[2013/05/30 20:07:02 | 000,000,000 | ---D | M] -- C:\Users\Pontolon\AppData\Roaming\eIntaller
[2012/05/05 15:42:55 | 000,000,000 | ---D | M] -- C:\Users\Pontolon\AppData\Roaming\Epson
[2013/05/30 19:58:58 | 000,000,000 | ---D | M] -- C:\Users\Pontolon\AppData\Roaming\ftblauncher
[2013/05/12 20:26:24 | 000,000,000 | ---D | M] -- C:\Users\Pontolon\AppData\Roaming\OpenCandy
[2012/12/06 17:11:58 | 000,000,000 | ---D | M] -- C:\Users\Pontolon\AppData\Roaming\Origin
[2013/06/18 13:32:56 | 000,000,000 | ---D | M] -- C:\Users\Pontolon\AppData\Roaming\PDF Architect
[2013/06/18 21:33:40 | 000,000,000 | ---D | M] -- C:\Users\Pontolon\AppData\Roaming\player
[2013/06/18 21:27:24 | 000,000,000 | ---D | M] -- C:\Users\Pontolon\AppData\Roaming\Systweak
[2012/05/05 15:49:14 | 000,000,000 | ---D | M] -- C:\Users\Pontolon\AppData\Roaming\Thunderbird
[2012/07/14 00:15:05 | 000,000,000 | ---D | M] -- C:\Users\Pontolon\AppData\Roaming\TomTom
[2013/03/28 22:52:55 | 000,000,000 | ---D | M] -- C:\Users\Pontolon\AppData\Roaming\TS3Client
[2012/12/13 14:33:22 | 000,000,000 | ---D | M] -- C:\Users\Pontolon\AppData\Roaming\TuneUp Software
[2013/06/06 14:49:26 | 000,000,000 | ---D | M] -- C:\Users\Pontolon\AppData\Roaming\WebCake
[2013/06/18 10:37:42 | 000,000,000 | ---D | M] -- C:\Users\Pontolon\AppData\Roaming\WordToPDF
[2013/01/11 10:56:51 | 000,000,000 | ---D | M] -- C:\Users\UpdatusUser\AppData\Roaming\TuneUp Software
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 119 bytes -> C:\ProgramData\Temp:373E1720

< End of report >

--- --- ---

schrauber · 30.06.2013, 14:08

Hi,

Fixen mit OTL

Starte bitte die OTL.exe.
Kopiere nun den Inhalt aus der Codebox in die Textbox.

Code:

ATTFilter

:OTL
O4 - HKU\S-1-5-21-3653625925-304732537-2994858790-1005..\Run: [ctfmon.exe] C:\ProgramData\dooco.dat (Microsoft Corporation)
[2013/06/29 10:46:57 | 000,155,648 | ---- | C] (Microsoft Corporation) -- C:\ProgramData\dooco.dat
[2013/06/29 10:46:57 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\ProgramData\rundll32.exe
[2013/06/29 10:46:27 | 000,155,648 | ---- | C] (Microsoft Corporation) -- C:\Users\Pontolon\5978713.dll
[2013/06/29 10:47:04 | 000,001,023 | ---- | C] () -- C:\Users\Pontolon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msconfig.lnk
[2013/06/29 10:47:02 | 000,002,609 | ---- | C] () -- C:\ProgramData\ocood.js
[2013/06/29 10:47:02 | 000,000,151 | ---- | C] () -- C:\ProgramData\ocood.reg
[2013/06/29 10:47:02 | 000,000,055 | ---- | C] () -- C:\ProgramData\ocood.bat
[2013/06/29 10:47:00 | 095,023,320 | ---- | C] () -- C:\ProgramData\ocood.pad

Solltest du deinen Benutzernamen z. B. durch "*****" unkenntlich gemacht haben, so füge an entsprechender Stelle deinen richtigen Benutzernamen ein. Andernfalls wird der Fix nicht funktionieren.
Schließe bitte nun alle Programme.
Klicke nun bitte auf den Fix Button.
OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
( Auch zu finden unter C:\_OTL\MovedFiles\<Uhrzeit_Datum>.txt)
Kopiere nun den Inhalt hier in Deinen Thread

DeniseBö · 30.06.2013, 15:59

========== OTL ==========
Registry value HKEY_USERS\S-1-5-21-3653625925-304732537-2994858790-1005\Software\Microsoft\Windows\CurrentVersion\Run\\ctfmon.exe deleted successfully.
C:\ProgramData\dooco.dat moved successfully.
File C:\ProgramData\dooco.dat not found.
C:\ProgramData\rundll32.exe moved successfully.
C:\Users\Pontolon\5978713.dll moved successfully.
C:\Users\Pontolon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msconfig.lnk moved successfully.
C:\ProgramData\ocood.js moved successfully.
C:\ProgramData\ocood.reg moved successfully.
C:\ProgramData\ocood.bat moved successfully.
C:\ProgramData\ocood.pad moved successfully.

OTL by Oldtimer - Version 3.2.69.0 log created on 06302013_164506

schrauber · 30.06.2013, 16:00

Neu booten?

DeniseBö · 30.06.2013, 16:12

Ich habe zunächst wieder Zugriff auf alles als Benutzer

schrauber · 30.06.2013, 16:13

dann ab jetzt KOntrollscans im normalen Windows

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

Systemscan mit FRST
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Start > Computer (Rechtsklick) > Eigenschaften)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Scan.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

DeniseBö · 30.06.2013, 16:48

Hier die FRST.txt , die anderen Dateien befinden sich im Anhang

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-06-2013 01
Ran by Pontolon (administrator) on 30-06-2013 17:42:10
Running from C:\Users\Pontolon\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AVG Technologies CZ, s.r.o.) C:\PROGRA~2\AVG\AVG2013\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgcsrva.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
() C:\Windows\SysWOW64\Rezip.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(TomTom) D:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgemca.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(SAMSUNG Electronics) C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(TomTom) D:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgui.exe
(ArcSoft, Inc.) D:\Programme (x86)\MSI\ArcSoft TotalMedia\TMMonitor.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [11855976 2011-05-18] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2706216 2011-02-25] (Synaptics Incorporated)
HKCU\...\Run: [Epson Stylus SX430(Netzwerk)] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIHAE.EXE /FU "C:\Users\Pontolon\AppData\Local\Temp\E_S6AC1.tmp" /EF "HKCU" [x] <===== ATTENTION
HKCU\...\Run: [TomTomHOME.exe] "D:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe" [x]
HKCU\...\Run: [PlayNC Launcher]  [x]
HKCU\...\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun [18678376 2013-04-19] (Skype Technologies S.A.)
HKCU\...\Run: [Steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent [1641896 2013-06-07] (Valve Corporation)
HKCU\...\Runonce: [Uninstall C:\Users\Pontolon\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64] C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Pontolon\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64" [x]
HKCU\...\Policies\system: [DisableRegistryTools] 0
HKCU\...\Policies\system: [DisableTaskMgr] 0
MountPoints2: F - F:\SafeStick.exe
HKLM-x32\...\Run: [UpdateLBPShortCut] "C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5" [222504 2009-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [CLMLServer] "C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [103720 2009-06-03] (CyberLink)
HKLM-x32\...\Run: [UpdateP2GoShortCut] "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0" [222504 2009-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdatePDRShortCut] "C:\Program Files (x86)\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\PowerDirector" UpdateWithCreateOnce "Software\CyberLink\PowerDirector\7.0" [222504 2008-01-04] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl8] "C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe" [91432 2009-04-15] (CyberLink Corp.)
HKLM-x32\...\Run: [PDVD8LanguageShortcut] "C:\Program Files (x86)\CyberLink\PowerDVD8\Language\Language.exe" [50472 2009-04-15] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdatePPShortCut] "C:\Program Files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\PowerProducer" UpdateWithCreateOnce "Software\CyberLink\PowerProducer\5.0" [218408 2008-12-03] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdatePSTShortCut] "C:\Program Files (x86)\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\DVD Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter" [210216 2009-07-21] (CyberLink Corp.)
HKLM-x32\...\Run: [UCam_Menu] "C:\Program Files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\2.0" [222504 2009-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [EEventManager] "C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe" [979328 2010-10-12] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [946352 2012-12-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [41208 2012-12-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: []  [x]
HKLM-x32\...\Run: [AVG_UI] "C:\Program Files (x86)\AVG\AVG2013\avgui.exe" /TRAYONLY [4408368 2013-04-29] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-01-28] (Apple Inc.)
Startup: C:\ProgramData\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Start Menu\Programs\Startup\TMMonitor.lnk
ShortcutTarget: TMMonitor.lnk -> D:\Programme (x86)\MSI\ArcSoft TotalMedia\TMMonitor.exe (ArcSoft, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
SearchScopes: HKCU - {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = 
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Programme (x86)\java\jre6\bin\jp2ssv.dll No File
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MIF5BA~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
DPF: HKLM {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: HKLM-x32 {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: HKLM-x32 {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} hxxp://game.zylom.com/activex/zylomgamesplayer.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} -  No File
Handler-x32: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

==================== Services (Whitelisted) =================

R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe [4937264 2013-05-14] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [283136 2013-04-18] (AVG Technologies CZ, s.r.o.)
R2 Rezip; C:\Windows\SysWOW64\Rezip.exe [311296 2009-03-05] ()
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152 2009-07-07] ()
R2 TomTomHOMEService; D:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe [92632 2012-06-21] (TomTom)

==================== Drivers (Whitelisted) ====================

R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [246072 2013-03-29] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [71480 2013-02-08] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [206136 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [311096 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [116536 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [45880 2013-02-08] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [240952 2013-03-21] (AVG Technologies CZ, s.r.o.)
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [16776 2011-07-29] ()
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [16776 2011-07-29] ()
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9096 2011-07-29] ()
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9096 2011-07-29] ()
S3 HPMo4DE3; C:\Windows\System32\DRIVERS\HPMo4DE3.sys [25088 2011-03-09] (TPMX Electronics Ltd.)
S3 HPub4DE3; C:\Windows\System32\Drivers\HPub4DE3.sys [18432 2011-04-12] (TPMX Electronics Ltd.)
S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-09-28] ()
S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-30 17:42 - 2013-06-30 17:42 - 00000000 ____D C:\FRST
2013-06-30 17:39 - 2013-06-30 17:39 - 01933592 ____A (Farbar) C:\Users\Pontolon\Downloads\FRST64 (1).exe
2013-06-30 17:38 - 2013-06-30 17:38 - 01933592 ____A (Farbar) C:\Users\Pontolon\Downloads\FRST64.exe
2013-06-30 17:37 - 2013-06-30 17:37 - 01933592 ____A (Farbar) C:\Users\Pontolon\Desktop\FRST64.exe
2013-06-30 17:34 - 2013-06-30 17:34 - 00001074 ____A C:\Users\Pontolon\Desktop\JRT.txt
2013-06-30 17:30 - 2013-06-30 17:30 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Pontolon\Desktop\JRT.exe
2013-06-30 17:30 - 2013-06-30 17:30 - 00000000 ____D C:\Windows\ERUNT
2013-06-30 17:30 - 2013-06-30 17:30 - 00000000 ____D C:\JRT
2013-06-30 17:23 - 2013-06-30 17:23 - 00024277 ____A C:\Users\Pontolon\Desktop\AdwCleaner[S1].txt
2013-06-30 17:18 - 2013-06-30 17:22 - 00648201 ____A C:\Users\Pontolon\Desktop\adwcleaner.exe
2013-06-30 16:25 - 2013-06-30 16:25 - 00000162 ___AH C:\Users\Pontolon\Desktop\~$dm.odt
2013-06-29 18:16 - 2013-06-29 18:16 - 00000000 ____D C:\_OTL
2013-06-29 18:13 - 2013-06-29 18:13 - 00108144 ____A C:\Users\Pontolon\Desktop\OTL.Txt
2013-06-29 18:13 - 2013-06-29 18:13 - 00069766 ____A C:\Users\Pontolon\Desktop\Extras.Txt
2013-06-29 17:42 - 2013-06-29 17:03 - 00602112 ____A (OldTimer Tools) C:\Users\Pontolon\Desktop\OTL.exe
2013-06-29 10:47 - 2013-06-30 04:35 - 00000000 ____A C:\ProgramData\as98213.txt
2013-06-25 21:20 - 2013-06-25 21:20 - 00215096 ____A C:\Users\Pontolon\Downloads\UtilityChest.exe
2013-06-25 14:42 - 2013-06-25 14:42 - 00215088 ____A C:\Users\Pontolon\Downloads\MapsGalaxy.exe
2013-06-24 08:28 - 2013-06-29 10:51 - 00004542 ____A C:\Windows\PFRO.log
2013-06-23 01:15 - 2013-06-30 17:25 - 00001355 ____A C:\Windows\setupact.log
2013-06-23 01:15 - 2013-06-23 01:15 - 00000000 ____A C:\Windows\setuperr.log
2013-06-19 10:10 - 2013-06-19 10:25 - 00006425 ____A C:\Users\Pontolon\Desktop\dm.odt
2013-06-18 13:32 - 2013-06-18 13:32 - 00000000 ____D C:\Users\Pontolon\AppData\Roaming\PDF Architect
2013-06-18 10:37 - 2013-06-18 10:37 - 00000000 ____D C:\Users\Pontolon\AppData\Roaming\WordToPDF
2013-06-18 10:36 - 2013-06-18 10:36 - 00001280 ____A C:\Users\Pontolon\Downloads\SetupWordToPDF_237_v2.9 - Verknüpfung.lnk
2013-06-18 10:35 - 2013-06-18 10:35 - 01594813 ____A (Mario Noack                                                 ) C:\Users\Pontolon\Downloads\SetupWordToPDF_237_v2.9.exe
2013-06-18 10:35 - 2013-06-18 10:35 - 01594813 ____A (Mario Noack                                                 ) C:\Users\Pontolon\Downloads\SetupWordToPDF_237_v2.9 (1).exe
2013-06-15 21:27 - 2013-06-18 21:35 - 00000000 ____D C:\Program Files (x86)\MyPC Backup
2013-06-15 21:27 - 2013-05-07 16:51 - 00020312 ____A (Systweak Inc., (www.systweak.com)) C:\Windows\System32\roboot64.exe
2013-06-15 21:26 - 2013-06-18 21:33 - 00000000 ____D C:\Users\Pontolon\AppData\Roaming\player
2013-06-15 19:40 - 2013-06-08 16:08 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-15 19:40 - 2013-06-08 16:07 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-15 19:40 - 2013-06-08 16:06 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-15 19:40 - 2013-06-08 16:06 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-15 19:40 - 2013-06-08 16:06 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-15 19:40 - 2013-06-08 14:28 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-15 19:40 - 2013-06-08 13:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-15 19:40 - 2013-06-08 13:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-15 19:40 - 2013-06-08 13:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-15 19:40 - 2013-06-08 13:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-15 19:40 - 2013-06-08 13:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-15 19:39 - 2013-06-08 13:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-14 08:05 - 2013-05-17 03:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-14 08:05 - 2013-05-17 03:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-14 08:05 - 2013-05-17 03:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-14 08:05 - 2013-05-17 03:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-14 08:05 - 2013-05-17 03:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-06-14 08:05 - 2013-05-17 03:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-06-14 08:05 - 2013-05-17 03:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-14 08:05 - 2013-05-17 03:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-06-14 08:05 - 2013-05-17 02:59 - 02241024 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-14 08:05 - 2013-05-17 02:59 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-14 08:05 - 2013-05-17 02:58 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-14 08:05 - 2013-05-17 02:58 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-14 08:05 - 2013-05-17 02:58 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-14 08:05 - 2013-05-17 02:58 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-14 08:05 - 2013-05-17 02:58 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-14 08:05 - 2013-05-17 02:58 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-14 08:05 - 2013-05-17 02:58 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-14 08:05 - 2013-05-14 14:23 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-14 08:05 - 2013-05-14 10:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-06-14 08:04 - 2013-06-14 08:04 - 00000000 ____D C:\Users\Default\AppData\Local\Microsoft Help
2013-06-14 08:04 - 2013-06-14 08:04 - 00000000 ____D C:\Users\Default User\AppData\Local\Microsoft Help
2013-06-12 08:18 - 2013-05-13 07:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 08:18 - 2013-05-13 07:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 08:18 - 2013-05-13 07:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 08:18 - 2013-05-13 07:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 08:18 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-12 08:18 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-06-12 08:18 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-12 08:18 - 2013-05-13 05:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 08:18 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-12 08:18 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-06-12 08:18 - 2013-05-10 07:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-12 08:18 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-06-12 08:18 - 2013-05-08 08:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-12 08:18 - 2013-04-26 07:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 08:18 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-06-12 08:18 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-06-12 08:18 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-06-12 08:18 - 2013-04-17 08:24 - 01424384 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-12 08:18 - 2013-04-01 00:52 - 01887232 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-11 21:43 - 2013-06-11 21:43 - 00000000 ____D C:\Windows\PCHEALTH
2013-06-11 21:39 - 2013-06-18 20:31 - 00000000 ____D C:\Users\Pontolon\AppData\Local\Microsoft Help
2013-06-11 21:39 - 2013-06-11 21:43 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2013-06-11 21:39 - 2013-06-11 21:39 - 00000000 ____D C:\Program Files\Microsoft Office
2013-06-11 21:39 - 2013-06-11 21:39 - 00000000 ____D C:\Program Files (x86)\Microsoft Analysis Services
2013-06-11 21:38 - 2013-06-11 21:38 - 00000000 __RHD C:\MSOCache
2013-06-10 17:10 - 2013-06-10 17:10 - 02936832 ____A C:\Users\Pontolon\Downloads\Dotjosh.DayZCommander.Installer.msi
2013-06-10 17:10 - 2013-06-10 17:10 - 00000000 ____D C:\Users\Pontolon\AppData\Local\DayZCommander
2013-06-10 17:10 - 2013-06-10 17:10 - 00000000 ____D C:\Program Files (x86)\Dotjosh Studios
2013-06-10 17:07 - 2013-06-10 17:09 - 107737453 ____A C:\Users\Pontolon\Downloads\DayZ_1.7.2.5A.zip
2013-06-09 19:09 - 2013-06-09 19:16 - 00000000 ____D C:\Users\Pontolon\Documents\ArmA 2
2013-06-09 19:09 - 2013-06-09 19:10 - 00000000 ____D C:\Users\Pontolon\AppData\Local\ArmA 2
2013-06-08 00:57 - 2013-06-30 17:26 - 00000000 ____D C:\Program Files (x86)\Steam
2013-06-06 21:54 - 2013-06-15 20:16 - 00000898 ____A C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-06-01 00:02 - 2013-06-01 12:31 - 00000000 ____D C:\Users\Pontolon\AppData\Roaming\.minecraft
2013-05-31 23:59 - 2013-05-31 23:59 - 00016601 ____A C:\Users\Pontolon\Downloads\CustomMobSpawner 2.2.2.zip
2013-05-31 23:57 - 2013-05-31 23:58 - 01928217 ____A C:\Users\Pontolon\Downloads\minecraftforge-universal-1.5.2-7.8.0.684.zip
2013-05-31 18:35 - 2013-05-31 18:35 - 06228244 ____A C:\Users\Pontolon\Downloads\Derivation_5.zip
2013-05-31 18:19 - 2013-05-31 18:19 - 00097946 ____A C:\Users\Pontolon\Downloads\TooManyItems2013_04_25_1.5.2.zip
2013-05-31 15:06 - 2013-05-31 15:06 - 01417057 ____A C:\Users\Pontolon\Downloads\Withers Challenge 1.5.zip
2013-05-31 12:32 - 2013-05-31 12:32 - 00000319 ____A C:\Users\Pontolon\Downloads\allopass-codes-20130531.txt

==================== One Month Modified Files and Folders =======

2013-06-30 17:42 - 2013-06-30 17:42 - 00000000 ____D C:\FRST
2013-06-30 17:39 - 2013-06-30 17:39 - 01933592 ____A (Farbar) C:\Users\Pontolon\Downloads\FRST64 (1).exe
2013-06-30 17:39 - 2012-12-28 18:19 - 00000000 ____D C:\Users\Pontolon\AppData\Roaming\Skype
2013-06-30 17:38 - 2013-06-30 17:38 - 01933592 ____A (Farbar) C:\Users\Pontolon\Downloads\FRST64.exe
2013-06-30 17:38 - 2009-07-14 06:45 - 00013936 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-30 17:38 - 2009-07-14 06:45 - 00013936 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-30 17:37 - 2013-06-30 17:37 - 01933592 ____A (Farbar) C:\Users\Pontolon\Desktop\FRST64.exe
2013-06-30 17:34 - 2013-06-30 17:34 - 00001074 ____A C:\Users\Pontolon\Desktop\JRT.txt
2013-06-30 17:32 - 2012-03-30 08:15 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-30 17:30 - 2013-06-30 17:30 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Pontolon\Desktop\JRT.exe
2013-06-30 17:30 - 2013-06-30 17:30 - 00000000 ____D C:\Windows\ERUNT
2013-06-30 17:30 - 2013-06-30 17:30 - 00000000 ____D C:\JRT
2013-06-30 17:28 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\System32\NDF
2013-06-30 17:26 - 2013-06-08 00:57 - 00000000 ____D C:\Program Files (x86)\Steam
2013-06-30 17:25 - 2013-06-23 01:15 - 00001355 ____A C:\Windows\setupact.log
2013-06-30 17:25 - 2012-03-20 21:28 - 00001104 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-06-30 17:25 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-30 17:24 - 2013-04-07 23:30 - 01099246 ____A C:\Windows\WindowsUpdate.log
2013-06-30 17:23 - 2013-06-30 17:23 - 00024277 ____A C:\Users\Pontolon\Desktop\AdwCleaner[S1].txt
2013-06-30 17:22 - 2013-06-30 17:18 - 00648201 ____A C:\Users\Pontolon\Desktop\adwcleaner.exe
2013-06-30 17:17 - 2012-03-20 21:28 - 00001108 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-30 17:09 - 2011-09-16 23:01 - 00000000 ____D C:\ProgramData\MFAData
2013-06-30 16:45 - 2012-05-05 15:41 - 00000000 ____D C:\users\Pontolon
2013-06-30 16:25 - 2013-06-30 16:25 - 00000162 ___AH C:\Users\Pontolon\Desktop\~$dm.odt
2013-06-30 04:38 - 2012-06-16 17:32 - 00000000 ____D C:\Users\Pontolon\AppData\Roaming\TS3Client
2013-06-30 04:35 - 2013-06-29 10:47 - 00000000 ____A C:\ProgramData\as98213.txt
2013-06-29 18:16 - 2013-06-29 18:16 - 00000000 ____D C:\_OTL
2013-06-29 18:13 - 2013-06-29 18:13 - 00108144 ____A C:\Users\Pontolon\Desktop\OTL.Txt
2013-06-29 18:13 - 2013-06-29 18:13 - 00069766 ____A C:\Users\Pontolon\Desktop\Extras.Txt
2013-06-29 17:18 - 2013-05-09 00:59 - 00226816 __ASH C:\Users\Pontolon\Desktop\Thumbs.db
2013-06-29 17:08 - 2009-12-15 23:59 - 00696870 ____A C:\Windows\System32\perfh007.dat
2013-06-29 17:08 - 2009-12-15 23:59 - 00148134 ____A C:\Windows\System32\perfc007.dat
2013-06-29 17:08 - 2009-07-14 07:13 - 01612484 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-29 17:03 - 2013-06-29 17:42 - 00602112 ____A (OldTimer Tools) C:\Users\Pontolon\Desktop\OTL.exe
2013-06-29 10:51 - 2013-06-24 08:28 - 00004542 ____A C:\Windows\PFRO.log
2013-06-26 21:25 - 2009-07-14 07:32 - 00000000 ____D C:\Windows\System32\FxsTmp
2013-06-25 21:20 - 2013-06-25 21:20 - 00215096 ____A C:\Users\Pontolon\Downloads\UtilityChest.exe
2013-06-25 14:42 - 2013-06-25 14:42 - 00215088 ____A C:\Users\Pontolon\Downloads\MapsGalaxy.exe
2013-06-23 01:15 - 2013-06-23 01:15 - 00000000 ____A C:\Windows\setuperr.log
2013-06-19 10:25 - 2013-06-19 10:10 - 00006425 ____A C:\Users\Pontolon\Desktop\dm.odt
2013-06-19 10:05 - 2013-04-08 13:46 - 00000000 ____D C:\Users\Pontolon\Desktop\Dunja Bewerbungen
2013-06-18 21:35 - 2013-06-15 21:27 - 00000000 ____D C:\Program Files (x86)\MyPC Backup
2013-06-18 21:33 - 2013-06-15 21:26 - 00000000 ____D C:\Users\Pontolon\AppData\Roaming\player
2013-06-18 21:16 - 2012-05-05 15:42 - 00000000 ____D C:\Users\Pontolon\AppData\Local\VirtualStore
2013-06-18 20:31 - 2013-06-11 21:39 - 00000000 ____D C:\Users\Pontolon\AppData\Local\Microsoft Help
2013-06-18 13:32 - 2013-06-18 13:32 - 00000000 ____D C:\Users\Pontolon\AppData\Roaming\PDF Architect
2013-06-18 10:37 - 2013-06-18 10:37 - 00000000 ____D C:\Users\Pontolon\AppData\Roaming\WordToPDF
2013-06-18 10:36 - 2013-06-18 10:36 - 00001280 ____A C:\Users\Pontolon\Downloads\SetupWordToPDF_237_v2.9 - Verknüpfung.lnk
2013-06-18 10:35 - 2013-06-18 10:35 - 01594813 ____A (Mario Noack                                                 ) C:\Users\Pontolon\Downloads\SetupWordToPDF_237_v2.9.exe
2013-06-18 10:35 - 2013-06-18 10:35 - 01594813 ____A (Mario Noack                                                 ) C:\Users\Pontolon\Downloads\SetupWordToPDF_237_v2.9 (1).exe
2013-06-16 23:55 - 2011-09-16 13:31 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-15 20:26 - 2009-08-02 04:27 - 00000000 ____D C:\Windows\Panther
2013-06-15 20:20 - 2013-04-07 01:53 - 00000000 ____D C:\Users\Pontolon\AppData\Local\Unity
2013-06-15 20:19 - 2013-04-07 21:44 - 00000000 ____D C:\Program Files (x86)\VS Revo Group
2013-06-15 20:16 - 2013-06-06 21:54 - 00000898 ____A C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-06-15 20:15 - 2012-05-17 22:56 - 00000000 ____D C:\Users\Pontolon\AppData\Local\Google
2013-06-15 20:15 - 2012-05-17 22:56 - 00000000 ____D C:\ProgramData\Google
2013-06-15 20:15 - 2012-05-17 22:56 - 00000000 ____D C:\Program Files (x86)\Google
2013-06-15 20:08 - 2013-04-06 22:25 - 00000000 ____D C:\BrickForce
2013-06-15 19:44 - 2011-09-22 20:20 - 01590378 ____A C:\Windows\SysWOW64\PerfStringBackup.INI
2013-06-14 11:13 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-06-14 08:05 - 2011-09-16 20:02 - 75825640 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-14 08:04 - 2013-06-14 08:04 - 00000000 ____D C:\Users\Default\AppData\Local\Microsoft Help
2013-06-14 08:04 - 2013-06-14 08:04 - 00000000 ____D C:\Users\Default User\AppData\Local\Microsoft Help
2013-06-12 14:32 - 2012-03-30 08:15 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-12 14:32 - 2011-09-16 21:40 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-12 09:38 - 2013-01-29 17:41 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-06-12 09:38 - 2011-11-10 20:42 - 00000000 ____D C:\ProgramData\Skype
2013-06-12 09:35 - 2009-07-14 06:45 - 00386672 ____A C:\Windows\System32\FNTCACHE.DAT
2013-06-11 22:05 - 2012-05-05 16:02 - 00101744 ____A C:\Users\Pontolon\AppData\Local\GDIPFONTCACHEV1.DAT
2013-06-11 21:43 - 2013-06-11 21:43 - 00000000 ____D C:\Windows\PCHEALTH
2013-06-11 21:43 - 2013-06-11 21:39 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2013-06-11 21:42 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-06-11 21:39 - 2013-06-11 21:39 - 00000000 ____D C:\Program Files\Microsoft Office
2013-06-11 21:39 - 2013-06-11 21:39 - 00000000 ____D C:\Program Files (x86)\Microsoft Analysis Services
2013-06-11 21:39 - 2009-12-15 23:47 - 00000000 ____D C:\Windows\ShellNew
2013-06-11 21:38 - 2013-06-11 21:38 - 00000000 __RHD C:\MSOCache
2013-06-10 17:10 - 2013-06-10 17:10 - 02936832 ____A C:\Users\Pontolon\Downloads\Dotjosh.DayZCommander.Installer.msi
2013-06-10 17:10 - 2013-06-10 17:10 - 00000000 ____D C:\Users\Pontolon\AppData\Local\DayZCommander
2013-06-10 17:10 - 2013-06-10 17:10 - 00000000 ____D C:\Program Files (x86)\Dotjosh Studios
2013-06-10 17:09 - 2013-06-10 17:07 - 107737453 ____A C:\Users\Pontolon\Downloads\DayZ_1.7.2.5A.zip
2013-06-09 19:16 - 2013-06-09 19:09 - 00000000 ____D C:\Users\Pontolon\Documents\ArmA 2
2013-06-09 19:10 - 2013-06-09 19:09 - 00000000 ____D C:\Users\Pontolon\AppData\Local\ArmA 2
2013-06-08 16:08 - 2013-06-15 19:40 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-08 16:07 - 2013-06-15 19:40 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-08 16:06 - 2013-06-15 19:40 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-08 16:06 - 2013-06-15 19:40 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-08 16:06 - 2013-06-15 19:40 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-08 14:28 - 2013-06-15 19:40 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-08 13:42 - 2013-06-15 19:40 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-08 13:40 - 2013-06-15 19:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-08 13:40 - 2013-06-15 19:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-08 13:40 - 2013-06-15 19:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-08 13:40 - 2013-06-15 19:39 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-08 13:13 - 2013-06-15 19:40 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-03 15:19 - 2012-10-04 10:12 - 00000000 ____D C:\Users\Pontolon\AppData\Local\Windows Live
2013-06-01 12:31 - 2013-06-01 00:02 - 00000000 ____D C:\Users\Pontolon\AppData\Roaming\.minecraft
2013-05-31 23:59 - 2013-05-31 23:59 - 00016601 ____A C:\Users\Pontolon\Downloads\CustomMobSpawner 2.2.2.zip
2013-05-31 23:58 - 2013-05-31 23:57 - 01928217 ____A C:\Users\Pontolon\Downloads\minecraftforge-universal-1.5.2-7.8.0.684.zip
2013-05-31 18:35 - 2013-05-31 18:35 - 06228244 ____A C:\Users\Pontolon\Downloads\Derivation_5.zip
2013-05-31 18:19 - 2013-05-31 18:19 - 00097946 ____A C:\Users\Pontolon\Downloads\TooManyItems2013_04_25_1.5.2.zip
2013-05-31 15:06 - 2013-05-31 15:06 - 01417057 ____A C:\Users\Pontolon\Downloads\Withers Challenge 1.5.zip
2013-05-31 12:32 - 2013-05-31 12:32 - 00000319 ____A C:\Users\Pontolon\Downloads\allopass-codes-20130531.txt

ZeroAccess:
C:\Windows\assembly\tmp
C:\Windows\assembly\tmp\01LCPS7R
C:\Windows\assembly\tmp\01Z28C9E
C:\Windows\assembly\tmp\027OTBUF
C:\Windows\assembly\tmp\02O2DKOV
C:\Windows\assembly\tmp\04E2P0OP
C:\Windows\assembly\tmp\04ZIP9D0
C:\Windows\assembly\tmp\05J5Y2UX
C:\Windows\assembly\tmp\05P17FV9
C:\Windows\assembly\tmp\05V73462
C:\Windows\assembly\tmp\0661HXHK
C:\Windows\assembly\tmp\06TOV8UQ
C:\Windows\assembly\tmp\06V7N6N2
C:\Windows\assembly\tmp\072YJFSQ
C:\Windows\assembly\tmp\07TRCS89
C:\Windows\assembly\tmp\0863VGF9
C:\Windows\assembly\tmp\08BES79W
C:\Windows\assembly\tmp\08L643Q2
C:\Windows\assembly\tmp\08TGCNFD
C:\Windows\assembly\tmp\09YO4T0B
C:\Windows\assembly\tmp\0AZ0DTFA
C:\Windows\assembly\tmp\0B8YS3DZ
C:\Windows\assembly\tmp\0BE95IVL
C:\Windows\assembly\tmp\0C22JSPW
C:\Windows\assembly\tmp\0CN4Q804
C:\Windows\assembly\tmp\0CYZ8ZV5
C:\Windows\assembly\tmp\0E58DZGY
C:\Windows\assembly\tmp\0E9ZYZBG
C:\Windows\assembly\tmp\0ESCBMWH
C:\Windows\assembly\tmp\0FL5RXBF
C:\Windows\assembly\tmp\0GMAIHPE
C:\Windows\assembly\tmp\0GP0CV75
C:\Windows\assembly\tmp\0H0BH9JP
C:\Windows\assembly\tmp\0IBJ3481
C:\Windows\assembly\tmp\0IV4KFF7
C:\Windows\assembly\tmp\0J78AO5A
C:\Windows\assembly\tmp\0JJY8PBZ
C:\Windows\assembly\tmp\0L9LK3X3
C:\Windows\assembly\tmp\0LJ9LK49
C:\Windows\assembly\tmp\0LUZ64EN
C:\Windows\assembly\tmp\0LW395IK
C:\Windows\assembly\tmp\0MP007TE
C:\Windows\assembly\tmp\0N60P44W
C:\Windows\assembly\tmp\0O6DQ36O
C:\Windows\assembly\tmp\0OFJU9NW
C:\Windows\assembly\tmp\0P4574VE
C:\Windows\assembly\tmp\0Q8IWL14
C:\Windows\assembly\tmp\0QYJWBY9
C:\Windows\assembly\tmp\0R920OUU
C:\Windows\assembly\tmp\0RRSA12I
C:\Windows\assembly\tmp\0SNRX1WW
C:\Windows\assembly\tmp\0T3QN2AR
C:\Windows\assembly\tmp\0U3JZ6NR
C:\Windows\assembly\tmp\0U6GZJU2
C:\Windows\assembly\tmp\0UFW05NZ
C:\Windows\assembly\tmp\0UJ92X96
C:\Windows\assembly\tmp\0V9Y0YN3
C:\Windows\assembly\tmp\0VLMGHJQ
C:\Windows\assembly\tmp\0W6LIPIW
C:\Windows\assembly\tmp\0WFNBN8H
C:\Windows\assembly\tmp\0WTGYWXD
C:\Windows\assembly\tmp\0Y13HTAP
C:\Windows\assembly\tmp\0Y2FZB8V
C:\Windows\assembly\tmp\0YCP6UOR
C:\Windows\assembly\tmp\0ZZD0W9I
C:\Windows\assembly\tmp\10NUWQNF
C:\Windows\assembly\tmp\11BTDEHI
C:\Windows\assembly\tmp\126I6V4A
C:\Windows\assembly\tmp\12DBFZSN
C:\Windows\assembly\tmp\135UA4ZJ
C:\Windows\assembly\tmp\13QST77E
C:\Windows\assembly\tmp\13VS3GD6
C:\Windows\assembly\tmp\14CYX8LN
C:\Windows\assembly\tmp\159DNM4O
C:\Windows\assembly\tmp\1602EH55
C:\Windows\assembly\tmp\168WIJ03
C:\Windows\assembly\tmp\17Z2CEOL
C:\Windows\assembly\tmp\17ZP59CC
C:\Windows\assembly\tmp\18GEV9HL
C:\Windows\assembly\tmp\19O5KFNH
C:\Windows\assembly\tmp\1D63DVX0
C:\Windows\assembly\tmp\1DO6YGQN
C:\Windows\assembly\tmp\1E0K59UZ
C:\Windows\assembly\tmp\1EQ2DH6Q
C:\Windows\assembly\tmp\1ES2SWMZ
C:\Windows\assembly\tmp\1HD597QH
C:\Windows\assembly\tmp\1HQ619P5
C:\Windows\assembly\tmp\1HTQ4E8C
C:\Windows\assembly\tmp\1IHJU2O8
C:\Windows\assembly\tmp\1IS93BZN
C:\Windows\assembly\tmp\1JYBBSNO
C:\Windows\assembly\tmp\1JZ6ARLZ
C:\Windows\assembly\tmp\1K2BW3T2
C:\Windows\assembly\tmp\1KEDGWXB
C:\Windows\assembly\tmp\1KU4AGUK
C:\Windows\assembly\tmp\1LNHMYTB
C:\Windows\assembly\tmp\1M158DPB
C:\Windows\assembly\tmp\1MJPAROW
C:\Windows\assembly\tmp\1MJR5JWP
C:\Windows\assembly\tmp\1MMXOFLW
C:\Windows\assembly\tmp\1N36O8B1
C:\Windows\assembly\tmp\1N619QGN
C:\Windows\assembly\tmp\1N94PQ9V
C:\Windows\assembly\tmp\1NIVG18N
C:\Windows\assembly\tmp\1NKAZ7WA
C:\Windows\assembly\tmp\1NOEH9F9
C:\Windows\assembly\tmp\1O19D4TQ
C:\Windows\assembly\tmp\1Q6Q8RVA
C:\Windows\assembly\tmp\1QM4ML8D
C:\Windows\assembly\tmp\1SIR1CR9
C:\Windows\assembly\tmp\1SMAMUQN
C:\Windows\assembly\tmp\1TP4UAI5
C:\Windows\assembly\tmp\1TXOQYPZ
C:\Windows\assembly\tmp\1UGHQHRO
C:\Windows\assembly\tmp\1V5P9QQF
C:\Windows\assembly\tmp\1V9DF6C2
C:\Windows\assembly\tmp\1VFKAI2J
C:\Windows\assembly\tmp\1X668DNT
C:\Windows\assembly\tmp\1XC655LE
C:\Windows\assembly\tmp\1XIN37ZW
C:\Windows\assembly\tmp\1ZY3MKHU
C:\Windows\assembly\tmp\2079F0TH
C:\Windows\assembly\tmp\20PJIYHX
C:\Windows\assembly\tmp\20SXEOF1
C:\Windows\assembly\tmp\20TIMZ6Y
C:\Windows\assembly\tmp\2130VZB3
C:\Windows\assembly\tmp\2139FJ4S
C:\Windows\assembly\tmp\21S09XOZ
C:\Windows\assembly\tmp\226SLA5H
C:\Windows\assembly\tmp\22DCLKRN
C:\Windows\assembly\tmp\22KW37U2
C:\Windows\assembly\tmp\22QNLJ3C
C:\Windows\assembly\tmp\24Z2X7MF
C:\Windows\assembly\tmp\25FQFXX6
C:\Windows\assembly\tmp\25MW0KH7
C:\Windows\assembly\tmp\25O11WLD
C:\Windows\assembly\tmp\25X4O2CQ
C:\Windows\assembly\tmp\26AK9KNX
C:\Windows\assembly\tmp\26E4FVUO
C:\Windows\assembly\tmp\27JK9OOD
C:\Windows\assembly\tmp\28FH5KKR
C:\Windows\assembly\tmp\28NJ4PXY
C:\Windows\assembly\tmp\28ZKX2K7
C:\Windows\assembly\tmp\2B9O15GJ
C:\Windows\assembly\tmp\2BFSC45Q
C:\Windows\assembly\tmp\2BISFI8J
C:\Windows\assembly\tmp\2BZO89TZ
C:\Windows\assembly\tmp\2CGNDOIY
C:\Windows\assembly\tmp\2CNYE58Y
C:\Windows\assembly\tmp\2CWMCVVB
C:\Windows\assembly\tmp\2D3GM378
C:\Windows\assembly\tmp\2D7NXDGS
C:\Windows\assembly\tmp\2DQ5IQKY
C:\Windows\assembly\tmp\2EFBCHOG
C:\Windows\assembly\tmp\2F2R41UG
C:\Windows\assembly\tmp\2GSHQ2C6
C:\Windows\assembly\tmp\2IFNO3FV
C:\Windows\assembly\tmp\2IICND4W
C:\Windows\assembly\tmp\2ILRU2U4
C:\Windows\assembly\tmp\2IN0IJV0
C:\Windows\assembly\tmp\2IU2IZ8O
C:\Windows\assembly\tmp\2J1Y9BQV
C:\Windows\assembly\tmp\2J6XTNR3
C:\Windows\assembly\tmp\2KABNKUK
C:\Windows\assembly\tmp\2MDA9D1W
C:\Windows\assembly\tmp\2NGM5AGV
C:\Windows\assembly\tmp\2O8VJCDF
C:\Windows\assembly\tmp\2PEU13LU
C:\Windows\assembly\tmp\2PY0MFIC
C:\Windows\assembly\tmp\2QISP1GT
C:\Windows\assembly\tmp\2QLH2FX7
C:\Windows\assembly\tmp\2QNO65V8
C:\Windows\assembly\tmp\2QXFJ5UQ
C:\Windows\assembly\tmp\2R2HDCS6
C:\Windows\assembly\tmp\2RA840C9
C:\Windows\assembly\tmp\2SIUEXYI
C:\Windows\assembly\tmp\2SK4DU0M
C:\Windows\assembly\tmp\2SO5XIW7
C:\Windows\assembly\tmp\2TAERHD0
C:\Windows\assembly\tmp\2TVM14H1
C:\Windows\assembly\tmp\2XS68R4E
C:\Windows\assembly\tmp\2Z5R43DU
C:\Windows\assembly\tmp\2ZGGLE2L
C:\Windows\assembly\tmp\2ZZWA86D
C:\Windows\assembly\tmp\30ROE94Y
C:\Windows\assembly\tmp\3167O89O
C:\Windows\assembly\tmp\31UO9B9N
C:\Windows\assembly\tmp\31YQ2RBB
C:\Windows\assembly\tmp\32WJBT75
C:\Windows\assembly\tmp\33UUVAVO
C:\Windows\assembly\tmp\34ITVT6I
C:\Windows\assembly\tmp\350BC66H
C:\Windows\assembly\tmp\35JVDFQ3
C:\Windows\assembly\tmp\35WA8EN3
C:\Windows\assembly\tmp\35Z7T23E
C:\Windows\assembly\tmp\36SQ4KWD
C:\Windows\assembly\tmp\36X9DH2B
C:\Windows\assembly\tmp\36XL7JIY
C:\Windows\assembly\tmp\37E6POSD
C:\Windows\assembly\tmp\37THJ8X8
C:\Windows\assembly\tmp\384UJRKN
C:\Windows\assembly\tmp\38DZ93GZ
C:\Windows\assembly\tmp\38U2WQUD
C:\Windows\assembly\tmp\39FROJWV
C:\Windows\assembly\tmp\39KTM42D
C:\Windows\assembly\tmp\3ACC3P06
C:\Windows\assembly\tmp\3CHJLDJS
C:\Windows\assembly\tmp\3CS32I5Y
C:\Windows\assembly\tmp\3DFDLRKY
C:\Windows\assembly\tmp\3DJG1UQG
C:\Windows\assembly\tmp\3DZSTCX9
C:\Windows\assembly\tmp\3E31VI83
C:\Windows\assembly\tmp\3E5JCBYQ
C:\Windows\assembly\tmp\3E7GU17M
C:\Windows\assembly\tmp\3GOWBG95
C:\Windows\assembly\tmp\3GQ9FM26
C:\Windows\assembly\tmp\3HZGZXC5
C:\Windows\assembly\tmp\3IRWK1HJ
C:\Windows\assembly\tmp\3JAG212B
C:\Windows\assembly\tmp\3JT2W6UH
C:\Windows\assembly\tmp\3JXL4KCW
C:\Windows\assembly\tmp\3LC4U2T2
C:\Windows\assembly\tmp\3LDXIOX2
C:\Windows\assembly\tmp\3LIFV04D
C:\Windows\assembly\tmp\3LOI3GUN
C:\Windows\assembly\tmp\3M2CYZDU
C:\Windows\assembly\tmp\3MPA5TZS
C:\Windows\assembly\tmp\3MPSSCI7
C:\Windows\assembly\tmp\3MZSQYLG
C:\Windows\assembly\tmp\3N8T921R
C:\Windows\assembly\tmp\3NN3IP65
C:\Windows\assembly\tmp\3NRB8TSR
C:\Windows\assembly\tmp\3OTVIGPB
C:\Windows\assembly\tmp\3QIL5HJQ
C:\Windows\assembly\tmp\3RLZCBHD
C:\Windows\assembly\tmp\3TFUYMLX
C:\Windows\assembly\tmp\3TGKA6A4
C:\Windows\assembly\tmp\3TLNJ43A
C:\Windows\assembly\tmp\3TQ1S4DA
C:\Windows\assembly\tmp\3TR3BIIW
C:\Windows\assembly\tmp\3VIYQVKI
C:\Windows\assembly\tmp\3VRRN3AS
C:\Windows\assembly\tmp\3VYZGTQ2
C:\Windows\assembly\tmp\3W8IJ96W
C:\Windows\assembly\tmp\3WG7KKDJ
C:\Windows\assembly\tmp\3WJ62WQ1
C:\Windows\assembly\tmp\3WKBSRLI
C:\Windows\assembly\tmp\3WXK4WB2
C:\Windows\assembly\tmp\3X0DOP9X
C:\Windows\assembly\tmp\3XPUGHXL
C:\Windows\assembly\tmp\3XQWIOTG
C:\Windows\assembly\tmp\3Y4IAPNQ
C:\Windows\assembly\tmp\3YK721N7
C:\Windows\assembly\tmp\3Z0RV6TS
C:\Windows\assembly\tmp\3Z2P7K3Z
C:\Windows\assembly\tmp\3ZDOVALS
C:\Windows\assembly\tmp\3ZTC5GTF
C:\Windows\assembly\tmp\415DC2BU
C:\Windows\assembly\tmp\41EF50GF
C:\Windows\assembly\tmp\4245Q7SD
C:\Windows\assembly\tmp\42VIZK20
C:\Windows\assembly\tmp\445JCD9B
C:\Windows\assembly\tmp\44CRGUU5
C:\Windows\assembly\tmp\44ZS093B
C:\Windows\assembly\tmp\471X4EB3
C:\Windows\assembly\tmp\474UHT03
C:\Windows\assembly\tmp\476XCL01
C:\Windows\assembly\tmp\477F7MKM
C:\Windows\assembly\tmp\47H24ZCZ
C:\Windows\assembly\tmp\47LL5115
C:\Windows\assembly\tmp\48ZWJQNQ
C:\Windows\assembly\tmp\491TTMNQ
C:\Windows\assembly\tmp\496FMC8N
C:\Windows\assembly\tmp\496PVPF9
C:\Windows\assembly\tmp\49IUWBUJ
C:\Windows\assembly\tmp\49TI08OL
C:\Windows\assembly\tmp\4AL2C35Q
C:\Windows\assembly\tmp\4B4PLM3A
C:\Windows\assembly\tmp\4BCC6EN2
C:\Windows\assembly\tmp\4BQNI1ZT
C:\Windows\assembly\tmp\4BU214TE
C:\Windows\assembly\tmp\4C7RJFVT
C:\Windows\assembly\tmp\4CTJ0YLQ
C:\Windows\assembly\tmp\4CU71LL8
C:\Windows\assembly\tmp\4D9F50CH
C:\Windows\assembly\tmp\4DXUIYZF
C:\Windows\assembly\tmp\4DZKNVTF
C:\Windows\assembly\tmp\4EHNWPL6
C:\Windows\assembly\tmp\4F361NUO
C:\Windows\assembly\tmp\4G5EP1TW
C:\Windows\assembly\tmp\4GSLGW27
C:\Windows\assembly\tmp\4GXBW862
C:\Windows\assembly\tmp\4JJ4YLTR
C:\Windows\assembly\tmp\4JZVY1DP
C:\Windows\assembly\tmp\4K0O9G5U
C:\Windows\assembly\tmp\4LG6UKVH
C:\Windows\assembly\tmp\4MM37C3F
C:\Windows\assembly\tmp\4NDFTL55
C:\Windows\assembly\tmp\4NRL8JHC
C:\Windows\assembly\tmp\4OIGCIKX
C:\Windows\assembly\tmp\4OKFFQ5G
C:\Windows\assembly\tmp\4ORGHMA2
C:\Windows\assembly\tmp\4OWBU6WK
C:\Windows\assembly\tmp\4P7KMPGO
C:\Windows\assembly\tmp\4PAKZ1WG
C:\Windows\assembly\tmp\4QJSWEFE
C:\Windows\assembly\tmp\4QKON3N5
C:\Windows\assembly\tmp\4R8C6RRN
C:\Windows\assembly\tmp\4R8FMA21
C:\Windows\assembly\tmp\4RGESNKK
C:\Windows\assembly\tmp\4SMYS8LS
C:\Windows\assembly\tmp\4T32F5WR
C:\Windows\assembly\tmp\4TJPCTZ2
C:\Windows\assembly\tmp\4UTN0C44
C:\Windows\assembly\tmp\4UX5SHO2
C:\Windows\assembly\tmp\4VR6GDIH
C:\Windows\assembly\tmp\4VWR86PZ
C:\Windows\assembly\tmp\4XAEIC4T
C:\Windows\assembly\tmp\4XFVOTJY
C:\Windows\assembly\tmp\4YT1W7KS
C:\Windows\assembly\tmp\4ZVU14EH
C:\Windows\assembly\tmp\4ZWIR48B
C:\Windows\assembly\tmp\5095PITS
C:\Windows\assembly\tmp\50ZJRHNN
C:\Windows\assembly\tmp\512UBIVW
C:\Windows\assembly\tmp\51TEX2MZ
C:\Windows\assembly\tmp\520FX0P0
C:\Windows\assembly\tmp\52FZBT98
C:\Windows\assembly\tmp\53A516BG
C:\Windows\assembly\tmp\53HYV1DN
C:\Windows\assembly\tmp\554BWZ8N
C:\Windows\assembly\tmp\55L6ZOCJ
C:\Windows\assembly\tmp\55ZG8L55
C:\Windows\assembly\tmp\57LXDYID
C:\Windows\assembly\tmp\57MLF7R5
C:\Windows\assembly\tmp\57P8A5RX
C:\Windows\assembly\tmp\59469XG3
C:\Windows\assembly\tmp\59TSN342
C:\Windows\assembly\tmp\5AKQPSVJ
C:\Windows\assembly\tmp\5AKQSB3S
C:\Windows\assembly\tmp\5CI0PJPV
C:\Windows\assembly\tmp\5CNOO13T
C:\Windows\assembly\tmp\5DMERA4S
C:\Windows\assembly\tmp\5E96O769
C:\Windows\assembly\tmp\5E9ADNXS
C:\Windows\assembly\tmp\5FJB1KYT
C:\Windows\assembly\tmp\5FNK97X4
C:\Windows\assembly\tmp\5FWU4OFS
C:\Windows\assembly\tmp\5FXFZDTW
C:\Windows\assembly\tmp\5G4U9M6V
C:\Windows\assembly\tmp\5GDVZJL9
C:\Windows\assembly\tmp\5GHQSQ4V
C:\Windows\assembly\tmp\5GPESRFT
C:\Windows\assembly\tmp\5GQWZ7XB
C:\Windows\assembly\tmp\5GYN1P46
C:\Windows\assembly\tmp\5HP2TCEY
C:\Windows\assembly\tmp\5HPF54PW
C:\Windows\assembly\tmp\5J46H7PU
C:\Windows\assembly\tmp\5JGYNOKI
C:\Windows\assembly\tmp\5JI06R6I
C:\Windows\assembly\tmp\5JQ93T2D
C:\Windows\assembly\tmp\5KMBCKJ3
C:\Windows\assembly\tmp\5L8N0D82
C:\Windows\assembly\tmp\5LJGN1A8
C:\Windows\assembly\tmp\5M1JW4GJ
C:\Windows\assembly\tmp\5MOXL0LN
C:\Windows\assembly\tmp\5MQMQJ2F
C:\Windows\assembly\tmp\5N40BNPH
C:\Windows\assembly\tmp\5NBABDRS
C:\Windows\assembly\tmp\5NBWJBPZ
C:\Windows\assembly\tmp\5NL9PDVH
C:\Windows\assembly\tmp\5NLHU64X
C:\Windows\assembly\tmp\5NRK85TW
C:\Windows\assembly\tmp\5OKKBDZP
C:\Windows\assembly\tmp\5P5ZBB48
C:\Windows\assembly\tmp\5PUNEFCR
C:\Windows\assembly\tmp\5SDZLJ3X
C:\Windows\assembly\tmp\5SUO3HU5
C:\Windows\assembly\tmp\5SUTITYQ
C:\Windows\assembly\tmp\5W71J05E
C:\Windows\assembly\tmp\5W8PR132
C:\Windows\assembly\tmp\5WHD3VDT
C:\Windows\assembly\tmp\5WHWSZYK
C:\Windows\assembly\tmp\5XR7U5H1
C:\Windows\assembly\tmp\5YP9TJKU
C:\Windows\assembly\tmp\5YXB0K29
C:\Windows\assembly\tmp\5YYAK9O7
C:\Windows\assembly\tmp\5ZF0PVDV
C:\Windows\assembly\tmp\5ZMU1400
C:\Windows\assembly\tmp\5ZY4HSUI
C:\Windows\assembly\tmp\6050ZAP5
C:\Windows\assembly\tmp\60JIV354
C:\Windows\assembly\tmp\61JAUVD6
C:\Windows\assembly\tmp\61JRYQD7
C:\Windows\assembly\tmp\622MW6A5
C:\Windows\assembly\tmp\63ILJDP6
C:\Windows\assembly\tmp\647YG3L8
C:\Windows\assembly\tmp\652MQLPL
C:\Windows\assembly\tmp\67GBKA1C
C:\Windows\assembly\tmp\67JGZZB8
C:\Windows\assembly\tmp\69WRNC8A
C:\Windows\assembly\tmp\6BSU7W5Z
C:\Windows\assembly\tmp\6DK1FLFT
C:\Windows\assembly\tmp\6DRALRT9
C:\Windows\assembly\tmp\6ECD12OK
C:\Windows\assembly\tmp\6EZDKR2N
C:\Windows\assembly\tmp\6F3P8O20
C:\Windows\assembly\tmp\6FL91W95
C:\Windows\assembly\tmp\6G3U6SO3
C:\Windows\assembly\tmp\6HANXBLL
C:\Windows\assembly\tmp\6I1YDAMF
C:\Windows\assembly\tmp\6IDIJJVU
C:\Windows\assembly\tmp\6J23T0IE
C:\Windows\assembly\tmp\6JOPQMCT
C:\Windows\assembly\tmp\6L6ICF78
C:\Windows\assembly\tmp\6L6TETRF
C:\Windows\assembly\tmp\6L8VYZV8
C:\Windows\assembly\tmp\6LHA1OHB
C:\Windows\assembly\tmp\6LSIBI6V
C:\Windows\assembly\tmp\6LZP07G3
C:\Windows\assembly\tmp\6M7ULFA1
C:\Windows\assembly\tmp\6MPJWIXY
C:\Windows\assembly\tmp\6MY7M3V3
C:\Windows\assembly\tmp\6NHWRDO3
C:\Windows\assembly\tmp\6O8KXF21
C:\Windows\assembly\tmp\6OEY8MJL
C:\Windows\assembly\tmp\6OVXUZ14
C:\Windows\assembly\tmp\6P5CJUZI
C:\Windows\assembly\tmp\6PH4UI2I
C:\Windows\assembly\tmp\6PQSCVDH
C:\Windows\assembly\tmp\6RAM9VYK
C:\Windows\assembly\tmp\6RPJOH8Y
C:\Windows\assembly\tmp\6SJJLCSZ
C:\Windows\assembly\tmp\6SYF69H2
C:\Windows\assembly\tmp\6TXO2BEP
C:\Windows\assembly\tmp\6UXPB9A2
C:\Windows\assembly\tmp\6V0LFM80
C:\Windows\assembly\tmp\6W4X48AA
C:\Windows\assembly\tmp\6Y6DWDS3
C:\Windows\assembly\tmp\6Y7AR409
C:\Windows\assembly\tmp\6Z31LM10
C:\Windows\assembly\tmp\6ZB594KQ
C:\Windows\assembly\tmp\6ZGSZWO6
C:\Windows\assembly\tmp\6ZMYSQS8
C:\Windows\assembly\tmp\70OWG7DX
C:\Windows\assembly\tmp\718YX5JG
C:\Windows\assembly\tmp\72NEULGD
C:\Windows\assembly\tmp\73DW7CHO
C:\Windows\assembly\tmp\73J2CKXB
C:\Windows\assembly\tmp\73Y0NBXC
C:\Windows\assembly\tmp\747OSC4T
C:\Windows\assembly\tmp\74I4UTVJ
C:\Windows\assembly\tmp\74Z96DDZ
C:\Windows\assembly\tmp\756SL7P6
C:\Windows\assembly\tmp\75JVJ9I9
C:\Windows\assembly\tmp\75KNVH3H
C:\Windows\assembly\tmp\76JG5A7Q
C:\Windows\assembly\tmp\77FU71NK
C:\Windows\assembly\tmp\77HJGYYL
C:\Windows\assembly\tmp\77Z5JSGQ
C:\Windows\assembly\tmp\783LNFQR
C:\Windows\assembly\tmp\78G595HV
C:\Windows\assembly\tmp\790KTDL3
C:\Windows\assembly\tmp\79ZFP0PX
C:\Windows\assembly\tmp\7AFMTHAI
C:\Windows\assembly\tmp\7AOXKHG1
C:\Windows\assembly\tmp\7ARUQPLH
C:\Windows\assembly\tmp\7B21115K
C:\Windows\assembly\tmp\7BSQ6AXZ
C:\Windows\assembly\tmp\7BZPH7DA
C:\Windows\assembly\tmp\7D0HXP7Q
C:\Windows\assembly\tmp\7E3RKG7Z
C:\Windows\assembly\tmp\7EXY2S28
C:\Windows\assembly\tmp\7F2VAZEH
C:\Windows\assembly\tmp\7GR7M9OW
C:\Windows\assembly\tmp\7GZKWSCX
C:\Windows\assembly\tmp\7HCKRXYG
C:\Windows\assembly\tmp\7I8KLL8N
C:\Windows\assembly\tmp\7JCHCD07
C:\Windows\assembly\tmp\7JLHJYEQ
C:\Windows\assembly\tmp\7JSL91QZ
C:\Windows\assembly\tmp\7L32ICIX
C:\Windows\assembly\tmp\7MR6BE58
C:\Windows\assembly\tmp\7NA7RYCQ
C:\Windows\assembly\tmp\7NAAZHPU
C:\Windows\assembly\tmp\7NW651JO
C:\Windows\assembly\tmp\7NZPHI2W
C:\Windows\assembly\tmp\7O762ULE
C:\Windows\assembly\tmp\7OZ0D454
C:\Windows\assembly\tmp\7PV16PK3
C:\Windows\assembly\tmp\7Q4IWZ5F
C:\Windows\assembly\tmp\7QAOIHCQ
C:\Windows\assembly\tmp\7QCDEZHA
C:\Windows\assembly\tmp\7QGCJL8D
C:\Windows\assembly\tmp\7SFEYJ3L
C:\Windows\assembly\tmp\7SI5VJDB
C:\Windows\assembly\tmp\7SRGSYBB
C:\Windows\assembly\tmp\7SV5ZSHI
C:\Windows\assembly\tmp\7T6CVZEA
C:\Windows\assembly\tmp\7T8UB72U
C:\Windows\assembly\tmp\7TFLW3BN
C:\Windows\assembly\tmp\7TFR0FGM
C:\Windows\assembly\tmp\7U0KELC6
C:\Windows\assembly\tmp\7UD0GHNN
C:\Windows\assembly\tmp\7UVID0LL
C:\Windows\assembly\tmp\7VERX5IS
C:\Windows\assembly\tmp\7WBVNZA8
C:\Windows\assembly\tmp\7WH60TQ4
C:\Windows\assembly\tmp\7WHQS09J
C:\Windows\assembly\tmp\7XNZC7IE
C:\Windows\assembly\tmp\7Y3XA581
C:\Windows\assembly\tmp\7YHOKTNJ
C:\Windows\assembly\tmp\7YKQ4LXC
C:\Windows\assembly\tmp\7ZDM3IBQ
C:\Windows\assembly\tmp\7ZXPP5Q0
C:\Windows\assembly\tmp\80PBDK53
C:\Windows\assembly\tmp\81J0J4V2
C:\Windows\assembly\tmp\830PJDGI
C:\Windows\assembly\tmp\83O2AQBT
C:\Windows\assembly\tmp\83RSO25N
C:\Windows\assembly\tmp\83VBX38M
C:\Windows\assembly\tmp\841A1NUJ
C:\Windows\assembly\tmp\84ZJT518
C:\Windows\assembly\tmp\856EIJE7
C:\Windows\assembly\tmp\85Q1VDFN
C:\Windows\assembly\tmp\870PAL1G
C:\Windows\assembly\tmp\87625VCF
C:\Windows\assembly\tmp\87OTSU48
C:\Windows\assembly\tmp\886XXRH1
C:\Windows\assembly\tmp\88R8PI7G
C:\Windows\assembly\tmp\88VHBWMY
C:\Windows\assembly\tmp\8A1F9MPG
C:\Windows\assembly\tmp\8A9DXA6H
C:\Windows\assembly\tmp\8D8JG1YS
C:\Windows\assembly\tmp\8EPJBARS
C:\Windows\assembly\tmp\8EXD3F2M
C:\Windows\assembly\tmp\8FL8GUCQ
C:\Windows\assembly\tmp\8HMDETW9
C:\Windows\assembly\tmp\8HQOY2D3
C:\Windows\assembly\tmp\8HTWGR5T
C:\Windows\assembly\tmp\8IDJ2HM4
C:\Windows\assembly\tmp\8J3O6I2G
C:\Windows\assembly\tmp\8J7KM8B5
C:\Windows\assembly\tmp\8J8WGR5M
C:\Windows\assembly\tmp\8JMICF1E
C:\Windows\assembly\tmp\8KT0P7CP
C:\Windows\assembly\tmp\8MH63DVG
C:\Windows\assembly\tmp\8MHY8AU0
C:\Windows\assembly\tmp\8O1YSNDZ
C:\Windows\assembly\tmp\8Q55JP8J
C:\Windows\assembly\tmp\8RS7A3Z9
C:\Windows\assembly\tmp\8RTCTYCY
C:\Windows\assembly\tmp\8SH7VZ5U
C:\Windows\assembly\tmp\8TURO9K3
C:\Windows\assembly\tmp\8VMYFFRC
C:\Windows\assembly\tmp\8VPFLTU3
C:\Windows\assembly\tmp\8W8DKVJG
C:\Windows\assembly\tmp\8WEG3WAP
C:\Windows\assembly\tmp\8WMRZIB2
C:\Windows\assembly\tmp\8WWXAPKD
C:\Windows\assembly\tmp\8X3JL029
C:\Windows\assembly\tmp\8XH6TA8V
C:\Windows\assembly\tmp\8YTO1O4I
C:\Windows\assembly\tmp\907J593W
C:\Windows\assembly\tmp\90OLE8ZW
C:\Windows\assembly\tmp\912YMKJU
C:\Windows\assembly\tmp\92B1BA3J
C:\Windows\assembly\tmp\92EXJZYI
C:\Windows\assembly\tmp\92V8YXZ6
C:\Windows\assembly\tmp\9344MLTF
C:\Windows\assembly\tmp\934WE83D
C:\Windows\assembly\tmp\941LQQ9K
C:\Windows\assembly\tmp\94QDQV84
C:\Windows\assembly\tmp\95M97YEY
C:\Windows\assembly\tmp\95TAPQV0
C:\Windows\assembly\tmp\95ZQYP9W
C:\Windows\assembly\tmp\96I6551K
C:\Windows\assembly\tmp\96ICLAQ9
C:\Windows\assembly\tmp\96II34DR
C:\Windows\assembly\tmp\975F2PPA
C:\Windows\assembly\tmp\98YPROL1
C:\Windows\assembly\tmp\99HUBYOV
C:\Windows\assembly\tmp\99KMS2JA
C:\Windows\assembly\tmp\99SGZIG5
C:\Windows\assembly\tmp\99VFK9O8
C:\Windows\assembly\tmp\9A8LNORH
C:\Windows\assembly\tmp\9AGIFMYP
C:\Windows\assembly\tmp\9AHPWQ2H
C:\Windows\assembly\tmp\9B3P7ZDV
C:\Windows\assembly\tmp\9BNPKA5J
C:\Windows\assembly\tmp\9CIU9639
C:\Windows\assembly\tmp\9CSWMFWH
C:\Windows\assembly\tmp\9E6O4OJK
C:\Windows\assembly\tmp\9EL813YW
C:\Windows\assembly\tmp\9EMRRMM3
C:\Windows\assembly\tmp\9ETM45B0
C:\Windows\assembly\tmp\9F1P892W
C:\Windows\assembly\tmp\9FCFTQTM
C:\Windows\assembly\tmp\9FD746G2
C:\Windows\assembly\tmp\9FF4OHZE
C:\Windows\assembly\tmp\9FRK87RV
C:\Windows\assembly\tmp\9G76C1G8
C:\Windows\assembly\tmp\9G8LDTAC
C:\Windows\assembly\tmp\9GD3737J
C:\Windows\assembly\tmp\9GX127KN
C:\Windows\assembly\tmp\9HW2N7KR
C:\Windows\assembly\tmp\9HWTJPBE
C:\Windows\assembly\tmp\9I69ZVLQ
C:\Windows\assembly\tmp\9J2S9KSM
C:\Windows\assembly\tmp\9K0JRCZ3
C:\Windows\assembly\tmp\9K7MYRBT
C:\Windows\assembly\tmp\9KYTJG94
C:\Windows\assembly\tmp\9LETTMTL
C:\Windows\assembly\tmp\9LGWTR9A
C:\Windows\assembly\tmp\9LMFDJNL
C:\Windows\assembly\tmp\9M4GT552
C:\Windows\assembly\tmp\9N1TY0CO
C:\Windows\assembly\tmp\9P676Z8O
C:\Windows\assembly\tmp\9PLE84VE
C:\Windows\assembly\tmp\9PX2CT6U
C:\Windows\assembly\tmp\9S0Z0JT2
C:\Windows\assembly\tmp\9SVZZ3F6
C:\Windows\assembly\tmp\9T0BQEEP
C:\Windows\assembly\tmp\9TFRFAKB
C:\Windows\assembly\tmp\9TIPRXMJ
C:\Windows\assembly\tmp\9UDKTPAE
C:\Windows\assembly\tmp\9V6GNI7J
C:\Windows\assembly\tmp\9VQA9OM6
C:\Windows\assembly\tmp\9VTQBAGU
C:\Windows\assembly\tmp\9XKG7HMZ
C:\Windows\assembly\tmp\9XPMSKG9
C:\Windows\assembly\tmp\9XQAY63V
C:\Windows\assembly\tmp\9YM1JK2S
C:\Windows\assembly\tmp\9YX1W6N6
C:\Windows\assembly\tmp\9ZRPTV3I
C:\Windows\assembly\tmp\A01CL9CE
C:\Windows\assembly\tmp\A076A15L
C:\Windows\assembly\tmp\A0QH76BZ
C:\Windows\assembly\tmp\A1E9R1F4
C:\Windows\assembly\tmp\A21MZ3YG
C:\Windows\assembly\tmp\A2K1LZH1
C:\Windows\assembly\tmp\A42D3A26
C:\Windows\assembly\tmp\A5GHJ9AL
C:\Windows\assembly\tmp\A5UFLKZD
C:\Windows\assembly\tmp\A61Z8N6Y
C:\Windows\assembly\tmp\A814QEJ3
C:\Windows\assembly\tmp\A82JVMYI
C:\Windows\assembly\tmp\A88BFYOT
C:\Windows\assembly\tmp\A8QT6VNA
C:\Windows\assembly\tmp\A8V3RAFQ
C:\Windows\assembly\tmp\A9XNUK7X
C:\Windows\assembly\tmp\AA60SBMG
C:\Windows\assembly\tmp\AAL949KQ
C:\Windows\assembly\tmp\AAPWYAN4
C:\Windows\assembly\tmp\ACQVYKUQ
C:\Windows\assembly\tmp\AD8KECFJ
C:\Windows\assembly\tmp\ADKCJD4K
C:\Windows\assembly\tmp\ADMENA40
C:\Windows\assembly\tmp\ADP0C4QQ
C:\Windows\assembly\tmp\AEE7T8FV
C:\Windows\assembly\tmp\AFUXXPFJ
C:\Windows\assembly\tmp\AGRV78IZ
C:\Windows\assembly\tmp\AGUJDAO8
C:\Windows\assembly\tmp\AHM2N3RH
C:\Windows\assembly\tmp\AI1AINAF
C:\Windows\assembly\tmp\AIA6KYN9
C:\Windows\assembly\tmp\AJFQGPK3
C:\Windows\assembly\tmp\AK3ZTU27
C:\Windows\assembly\tmp\AMIONYFI
C:\Windows\assembly\tmp\AN4KKGGC
C:\Windows\assembly\tmp\AN57HF2U
C:\Windows\assembly\tmp\AN74N0P8
C:\Windows\assembly\tmp\ANPB5IQS
C:\Windows\assembly\tmp\ANQOGX8H
C:\Windows\assembly\tmp\ANZYB6JJ
C:\Windows\assembly\tmp\AOEUDDP0
C:\Windows\assembly\tmp\AOGMPGJX
C:\Windows\assembly\tmp\AOOGOAD2
C:\Windows\assembly\tmp\AOPWF3FM
C:\Windows\assembly\tmp\AP29UDOF
C:\Windows\assembly\tmp\AP7OD5NW
C:\Windows\assembly\tmp\APGI9702
C:\Windows\assembly\tmp\APZ0GOK7
C:\Windows\assembly\tmp\AQ8L1CI0
C:\Windows\assembly\tmp\AQVHDV5Y
C:\Windows\assembly\tmp\AQYGI7ED
C:\Windows\assembly\tmp\ARIPCS14
C:\Windows\assembly\tmp\ARROZNJ1
C:\Windows\assembly\tmp\AS4QQW51
C:\Windows\assembly\tmp\AV0BNCRX
C:\Windows\assembly\tmp\AX9QAOH6
C:\Windows\assembly\tmp\AXGNM36S
C:\Windows\assembly\tmp\AYF6XC80
C:\Windows\assembly\tmp\AYFBRRVY
C:\Windows\assembly\tmp\AYKALEPI
C:\Windows\assembly\tmp\AYL5K8K0
C:\Windows\assembly\tmp\AYP949V7
C:\Windows\assembly\tmp\AYP9VLQO
C:\Windows\assembly\tmp\AZA469K0
C:\Windows\assembly\tmp\B034W37A
C:\Windows\assembly\tmp\B10XDK8D
C:\Windows\assembly\tmp\B1N9MMG0
C:\Windows\assembly\tmp\B1PQNWTM
C:\Windows\assembly\tmp\B25UIDG5
C:\Windows\assembly\tmp\B2QW90NU
C:\Windows\assembly\tmp\B3738T0V
C:\Windows\assembly\tmp\B4FVUMC5
C:\Windows\assembly\tmp\B4WKM7V1
C:\Windows\assembly\tmp\B6BT80GU
C:\Windows\assembly\tmp\B6VFDRPI
C:\Windows\assembly\tmp\B8BWKWB1
C:\Windows\assembly\tmp\B8JEFO8U
C:\Windows\assembly\tmp\B9JMLEAJ
C:\Windows\assembly\tmp\BA8M7BY1
C:\Windows\assembly\tmp\BC3DP6B1
C:\Windows\assembly\tmp\BDE6D4UP
C:\Windows\assembly\tmp\BDL1RKBG
C:\Windows\assembly\tmp\BDOVXMNN
C:\Windows\assembly\tmp\BDTRBJZG
C:\Windows\assembly\tmp\BEN4K8TW
C:\Windows\assembly\tmp\BEVYYBFC
C:\Windows\assembly\tmp\BGB8Y9VV
C:\Windows\assembly\tmp\BGKF2LD9
C:\Windows\assembly\tmp\BH07QWXY
C:\Windows\assembly\tmp\BHCYHS4U
C:\Windows\assembly\tmp\BI6E7TZY
C:\Windows\assembly\tmp\BI9C0TE9
C:\Windows\assembly\tmp\BJ6L2FGB
C:\Windows\assembly\tmp\BJIQV47E
C:\Windows\assembly\tmp\BJOBDIYT
C:\Windows\assembly\tmp\BJZI9GEK
C:\Windows\assembly\tmp\BKMUEIXG
C:\Windows\assembly\tmp\BKS3EQQ6
C:\Windows\assembly\tmp\BLHWACNA
C:\Windows\assembly\tmp\BMFAWDJ8
C:\Windows\assembly\tmp\BMPZJFTS
C:\Windows\assembly\tmp\BNFUKGC7
C:\Windows\assembly\tmp\BNUXBHPK
C:\Windows\assembly\tmp\BOWPT4PL
C:\Windows\assembly\tmp\BQ6TUUBH
C:\Windows\assembly\tmp\BQAHF5R1
C:\Windows\assembly\tmp\BQD0946G
C:\Windows\assembly\tmp\BQJ6AM5O
C:\Windows\assembly\tmp\BRNNOHTQ
C:\Windows\assembly\tmp\BSQ79C2S
C:\Windows\assembly\tmp\BSYPKS20
C:\Windows\assembly\tmp\BTD1UG4C
C:\Windows\assembly\tmp\BTVXPPCA
C:\Windows\assembly\tmp\BU7179YG
C:\Windows\assembly\tmp\BUQMZSP1
C:\Windows\assembly\tmp\BUT84CI3
C:\Windows\assembly\tmp\BUUZG4UM
C:\Windows\assembly\tmp\BUWGXO9O
C:\Windows\assembly\tmp\BVHS53IB
C:\Windows\assembly\tmp\BVM0U1GN
C:\Windows\assembly\tmp\BVXISSAS
C:\Windows\assembly\tmp\BW1H2G2C
C:\Windows\assembly\tmp\BWC69BBV
C:\Windows\assembly\tmp\BX1MOCFQ
C:\Windows\assembly\tmp\BXKHKY4J
C:\Windows\assembly\tmp\BXNBKGNW
C:\Windows\assembly\tmp\BXYBFR2Z
C:\Windows\assembly\tmp\BYM02TOH
C:\Windows\assembly\tmp\BZBGATEU
C:\Windows\assembly\tmp\BZDHLDQG
C:\Windows\assembly\tmp\BZE9XS7Y
C:\Windows\assembly\tmp\C08QJYMU
C:\Windows\assembly\tmp\C0A1WBUQ
C:\Windows\assembly\tmp\C225UJVI
C:\Windows\assembly\tmp\C2A1O6SA
C:\Windows\assembly\tmp\C2ENO0DC
C:\Windows\assembly\tmp\C2L8SPJH
C:\Windows\assembly\tmp\C2QZKQPZ
C:\Windows\assembly\tmp\C40H11Y0
C:\Windows\assembly\tmp\C4C3J9EL
C:\Windows\assembly\tmp\C4TAWJ8D
C:\Windows\assembly\tmp\C5MPXT25
C:\Windows\assembly\tmp\C5TFMVZZ
C:\Windows\assembly\tmp\C697EFUF
C:\Windows\assembly\tmp\C6GYJJP0
C:\Windows\assembly\tmp\C867ADJ8
C:\Windows\assembly\tmp\C9YSAFXJ
C:\Windows\assembly\tmp\CA71F3BG
C:\Windows\assembly\tmp\CASWTAI0
C:\Windows\assembly\tmp\CBA1GX4A
C:\Windows\assembly\tmp\CBIVYYQP
C:\Windows\assembly\tmp\CBRG0DEK
C:\Windows\assembly\tmp\CCPR7TD0
C:\Windows\assembly\tmp\CCZK05YK
C:\Windows\assembly\tmp\CFQIEBLR
C:\Windows\assembly\tmp\CGG9B3QF
C:\Windows\assembly\tmp\CH2QJMT7
C:\Windows\assembly\tmp\CHFIM67E
C:\Windows\assembly\tmp\CHK3J92E
C:\Windows\assembly\tmp\CI4GSXMZ
C:\Windows\assembly\tmp\CK64YMRX
C:\Windows\assembly\tmp\CLLF57UD
C:\Windows\assembly\tmp\CLPI85BO
C:\Windows\assembly\tmp\CMGZPAZI
C:\Windows\assembly\tmp\CNI8UNSE
C:\Windows\assembly\tmp\CNMRG4CZ
C:\Windows\assembly\tmp\COPKVXRA
C:\Windows\assembly\tmp\CPPY8RET
C:\Windows\assembly\tmp\CPYL1OBW
C:\Windows\assembly\tmp\CQOPMDUF
C:\Windows\assembly\tmp\CQP55CIB
C:\Windows\assembly\tmp\CQRZS5Y5
C:\Windows\assembly\tmp\CR9ZHY5I
C:\Windows\assembly\tmp\CRQU1PVO
C:\Windows\assembly\tmp\CRUMIF85
C:\Windows\assembly\tmp\CT6D3236
C:\Windows\assembly\tmp\CTWDNC1P
C:\Windows\assembly\tmp\CV88AOV7
C:\Windows\assembly\tmp\CW6J2I43
C:\Windows\assembly\tmp\CWCEQ3KP
C:\Windows\assembly\tmp\CWJ4WGVR
C:\Windows\assembly\tmp\CWN7ZSRA
C:\Windows\assembly\tmp\CWOG44Z6
C:\Windows\assembly\tmp\CYZEZAS9
C:\Windows\assembly\tmp\D0349NUX
C:\Windows\assembly\tmp\D09QQ4KM
C:\Windows\assembly\tmp\D0EC2NS7
C:\Windows\assembly\tmp\D0S2DT8L
C:\Windows\assembly\tmp\D13AN75Z
C:\Windows\assembly\tmp\D13YZI02
C:\Windows\assembly\tmp\D18EWR8Z
C:\Windows\assembly\tmp\D2SRXVK9
C:\Windows\assembly\tmp\D34FRHBF
C:\Windows\assembly\tmp\D3RWOCTI
C:\Windows\assembly\tmp\D3VKZILN
C:\Windows\assembly\tmp\D40NSDXZ
C:\Windows\assembly\tmp\D4C1MUIP
C:\Windows\assembly\tmp\D4I7RHJB
C:\Windows\assembly\tmp\D4SN3AAE
C:\Windows\assembly\tmp\D556T664
C:\Windows\assembly\tmp\D55Z6I0D
C:\Windows\assembly\tmp\D5HJQIX6
C:\Windows\assembly\tmp\D5QWC9Y1
C:\Windows\assembly\tmp\D6NQVZ5I
C:\Windows\assembly\tmp\D7J5KS0O
C:\Windows\assembly\tmp\D7SUX5KH
C:\Windows\assembly\tmp\D8231A1D
C:\Windows\assembly\tmp\D88GFRV8
C:\Windows\assembly\tmp\D8PAXX9F
C:\Windows\assembly\tmp\D9MDIP1D
C:\Windows\assembly\tmp\D9OHZWWP
C:\Windows\assembly\tmp\DA89MEPF
C:\Windows\assembly\tmp\DAV2VTZG
C:\Windows\assembly\tmp\DBKTAURY
C:\Windows\assembly\tmp\DCZ29X5L
C:\Windows\assembly\tmp\DD12BGJR
C:\Windows\assembly\tmp\DDXV33II
C:\Windows\assembly\tmp\DDY5PC14
C:\Windows\assembly\tmp\DE6NGE65
C:\Windows\assembly\tmp\DE97YBOL
C:\Windows\assembly\tmp\DFVCBHF7
C:\Windows\assembly\tmp\DG9DT61R
C:\Windows\assembly\tmp\DGEV424W
C:\Windows\assembly\tmp\DGKWDFFV
C:\Windows\assembly\tmp\DJ06HAWC
C:\Windows\assembly\tmp\DJ41X6GY
C:\Windows\assembly\tmp\DKOFB3VZ
C:\Windows\assembly\tmp\DLFFIFL0
C:\Windows\assembly\tmp\DMPS4A7W
C:\Windows\assembly\tmp\DNT7M2YU
C:\Windows\assembly\tmp\DNWGG0CV
C:\Windows\assembly\tmp\DPL8UVAA
C:\Windows\assembly\tmp\DQCE3WVC
C:\Windows\assembly\tmp\DQHYSNF4
C:\Windows\assembly\tmp\DR46TGNU
C:\Windows\assembly\tmp\DS9YDI4K
C:\Windows\assembly\tmp\DSM957JA
C:\Windows\assembly\tmp\DSP4RQMC
C:\Windows\assembly\tmp\DT0TX51R
C:\Windows\assembly\tmp\DU3OAZHP
C:\Windows\assembly\tmp\DU7WE6JF
C:\Windows\assembly\tmp\DU8Z85YS
C:\Windows\assembly\tmp\DULFKR9X
C:\Windows\assembly\tmp\DUTZ4N2U
C:\Windows\assembly\tmp\DVBJA49D
C:\Windows\assembly\tmp\DXG70FQF
C:\Windows\assembly\tmp\E00OX9AG
C:\Windows\assembly\tmp\E0D6TZMV
C:\Windows\assembly\tmp\E16IN3NH
C:\Windows\assembly\tmp\E1PZ82EF
C:\Windows\assembly\tmp\E37AUK01
C:\Windows\assembly\tmp\E3FM91WO
C:\Windows\assembly\tmp\E3U71UEK
C:\Windows\assembly\tmp\E4N2ASXF
C:\Windows\assembly\tmp\E55BUAVI
C:\Windows\assembly\tmp\E55GEX8A
C:\Windows\assembly\tmp\E571TEI4
C:\Windows\assembly\tmp\E5EDFULS
C:\Windows\assembly\tmp\E62I7AD2
C:\Windows\assembly\tmp\E6C4D3M3
C:\Windows\assembly\tmp\E72JYVZ1
C:\Windows\assembly\tmp\E7EKOYKO
C:\Windows\assembly\tmp\E7VO5W7G
C:\Windows\assembly\tmp\E9OB3HG4
C:\Windows\assembly\tmp\EA1LVJMU
C:\Windows\assembly\tmp\EB1NBUCZ
C:\Windows\assembly\tmp\EB5MSA9R
C:\Windows\assembly\tmp\EC6DJIWC
C:\Windows\assembly\tmp\EC7CI1MG
C:\Windows\assembly\tmp\ECIUUY1M
C:\Windows\assembly\tmp\ECV5ROIT
C:\Windows\assembly\tmp\EDG9DAZC
C:\Windows\assembly\tmp\EDJKL7TK
C:\Windows\assembly\tmp\EDKY4HK1
C:\Windows\assembly\tmp\EE7B4OUG
C:\Windows\assembly\tmp\EEOQUIRS
C:\Windows\assembly\tmp\EF0WVTNW
C:\Windows\assembly\tmp\EFF6IKHW
C:\Windows\assembly\tmp\EFOT2405
C:\Windows\assembly\tmp\EGZOF8V6
C:\Windows\assembly\tmp\EHKDAZ4A
C:\Windows\assembly\tmp\EI6BP0PJ
C:\Windows\assembly\tmp\EIHXIBZQ
C:\Windows\assembly\tmp\EIOENJUS
C:\Windows\assembly\tmp\EJDU1Z6C
C:\Windows\assembly\tmp\EJHAMQSD
C:\Windows\assembly\tmp\EK41UMRO
C:\Windows\assembly\tmp\ELO3LW2P
C:\Windows\assembly\tmp\ELWJA681
C:\Windows\assembly\tmp\EMXTHKE5
C:\Windows\assembly\tmp\ENTBJGKO
C:\Windows\assembly\tmp\EO3LTWH2
C:\Windows\assembly\tmp\EO3Y50K0
C:\Windows\assembly\tmp\EPLDNWRI
C:\Windows\assembly\tmp\EPP8DOA9
C:\Windows\assembly\tmp\EQ71FIPC
C:\Windows\assembly\tmp\EQF27DCT
C:\Windows\assembly\tmp\EQK1INKJ
C:\Windows\assembly\tmp\EQLBGQ14
C:\Windows\assembly\tmp\EQX7H4C2
C:\Windows\assembly\tmp\ES0O8R3I
C:\Windows\assembly\tmp\ESDK6HEN
C:\Windows\assembly\tmp\ESJOLWCC
C:\Windows\assembly\tmp\ESL9HBIA
C:\Windows\assembly\tmp\ETERKDH8
C:\Windows\assembly\tmp\ETXGA8B5
C:\Windows\assembly\tmp\ETYIB5HO
C:\Windows\assembly\tmp\EU60J6DA
C:\Windows\assembly\tmp\EU7XFG46
C:\Windows\assembly\tmp\EUZZKZ2D
C:\Windows\assembly\tmp\EVDSG574
C:\Windows\assembly\tmp\EVVQ8519
C:\Windows\assembly\tmp\EWH0ZZYM
C:\Windows\assembly\tmp\EWY907R8
C:\Windows\assembly\tmp\EXXUK6D1
C:\Windows\assembly\tmp\EXYEUXLK
C:\Windows\assembly\tmp\EZ02GNBY
C:\Windows\assembly\tmp\F0XY8E6R
C:\Windows\assembly\tmp\F2H8WZ5A
C:\Windows\assembly\tmp\F36WMH4I
C:\Windows\assembly\tmp\F37JQKHJ
C:\Windows\assembly\tmp\F38CI4SY
C:\Windows\assembly\tmp\F3LJKEKD
C:\Windows\assembly\tmp\F5F1YE12
C:\Windows\assembly\tmp\F61YZSKF
C:\Windows\assembly\tmp\F6RUO2QH
C:\Windows\assembly\tmp\F6VW67ET
C:\Windows\assembly\tmp\F6ZLE53C
C:\Windows\assembly\tmp\F72UO98I
C:\Windows\assembly\tmp\F7BSRK7V
C:\Windows\assembly\tmp\F7HB1QRC
C:\Windows\assembly\tmp\F83N5ZY0
C:\Windows\assembly\tmp\F8D9HKZG
C:\Windows\assembly\tmp\F8EZLIEY
C:\Windows\assembly\tmp\F96KSD7Y
C:\Windows\assembly\tmp\FA5TAAKF
C:\Windows\assembly\tmp\FAIZX5P1
C:\Windows\assembly\tmp\FBE41O8A
C:\Windows\assembly\tmp\FD4CRHXG
C:\Windows\assembly\tmp\FDBIU6F1
C:\Windows\assembly\tmp\FDJV0SPZ
C:\Windows\assembly\tmp\FE4RR6KB
C:\Windows\assembly\tmp\FE9N44UU
C:\Windows\assembly\tmp\FED2RT5N
C:\Windows\assembly\tmp\FEOIUT08
C:\Windows\assembly\tmp\FEQUUUUE
C:\Windows\assembly\tmp\FFHVNH45
C:\Windows\assembly\tmp\FFQ93ACB
C:\Windows\assembly\tmp\FFUPWEQ1
C:\Windows\assembly\tmp\FFW6269K
C:\Windows\assembly\tmp\FG0F3CIF
C:\Windows\assembly\tmp\FGBIBNSA
C:\Windows\assembly\tmp\FIO2R7T7
C:\Windows\assembly\tmp\FIR9ALUK
C:\Windows\assembly\tmp\FITETCT8
C:\Windows\assembly\tmp\FJBDFOHO
C:\Windows\assembly\tmp\FJJ4VV5B
C:\Windows\assembly\tmp\FLBL0WT7
C:\Windows\assembly\tmp\FM2XYT7L
C:\Windows\assembly\tmp\FMHSCHYV
C:\Windows\assembly\tmp\FMMG6YF5
C:\Windows\assembly\tmp\FMYAHX4U
C:\Windows\assembly\tmp\FNDXKXC4
C:\Windows\assembly\tmp\FNIIP2W5
C:\Windows\assembly\tmp\FNWUJP4Z
C:\Windows\assembly\tmp\FO0DQP1T
C:\Windows\assembly\tmp\FQB5I8UM
C:\Windows\assembly\tmp\FQR1NHRA
C:\Windows\assembly\tmp\FRR9MBE2
C:\Windows\assembly\tmp\FS0NY8EV
C:\Windows\assembly\tmp\FSYI5D29
C:\Windows\assembly\tmp\FUSVWQKL
C:\Windows\assembly\tmp\FVGIGUH7
C:\Windows\assembly\tmp\FVJ4AZRD
C:\Windows\assembly\tmp\FVVDBMOA
C:\Windows\assembly\tmp\FWJM9E0X
C:\Windows\assembly\tmp\FWN8ZXNN
C:\Windows\assembly\tmp\FWT4ML4X
C:\Windows\assembly\tmp\FX4DYXE7
C:\Windows\assembly\tmp\FXION6I1
C:\Windows\assembly\tmp\FXVOUS6Q
C:\Windows\assembly\tmp\FYJ2CNSK
C:\Windows\assembly\tmp\FYR0VYHD
C:\Windows\assembly\tmp\G0XS94L8
C:\Windows\assembly\tmp\G0Z1DHBN
C:\Windows\assembly\tmp\G26WV39P
C:\Windows\assembly\tmp\G2Z950CQ
C:\Windows\assembly\tmp\G3GSPKNJ
C:\Windows\assembly\tmp\G3PCB168
C:\Windows\assembly\tmp\G3RNPR9V
C:\Windows\assembly\tmp\G4ASHD73
C:\Windows\assembly\tmp\G4EODIFF
C:\Windows\assembly\tmp\G4TFLBVI
C:\Windows\assembly\tmp\G5AALN5Y
C:\Windows\assembly\tmp\G89UFYZ7
C:\Windows\assembly\tmp\G8TTM7K5
C:\Windows\assembly\tmp\G9CR1V2O
C:\Windows\assembly\tmp\GC5ZENQ7
C:\Windows\assembly\tmp\GCGWB4RT
C:\Windows\assembly\tmp\GCK3AW2B
C:\Windows\assembly\tmp\GD1U8JP5
C:\Windows\assembly\tmp\GEQ2KDUT
C:\Windows\assembly\tmp\GG6HMGUB
C:\Windows\assembly\tmp\GG93ZOM1
C:\Windows\assembly\tmp\GGDIOT2Q
C:\Windows\assembly\tmp\GGKS7M2T
C:\Windows\assembly\tmp\GH6KGIJI
C:\Windows\assembly\tmp\GHBAWUG8
C:\Windows\assembly\tmp\GHHOHOE8
C:\Windows\assembly\tmp\GI1KGR30
C:\Windows\assembly\tmp\GIKLIRSH
C:\Windows\assembly\tmp\GKRHIKOO
C:\Windows\assembly\tmp\GLG6ZOQT
C:\Windows\assembly\tmp\GLMS0YLP
C:\Windows\assembly\tmp\GMNQQJKV
C:\Windows\assembly\tmp\GMWTJ54D
C:\Windows\assembly\tmp\GN6GTD0N
C:\Windows\assembly\tmp\GNA5ZBZL
C:\Windows\assembly\tmp\GNQSPXUD
C:\Windows\assembly\tmp\GOLRRY3C
C:\Windows\assembly\tmp\GP9JXBXK
C:\Windows\assembly\tmp\GR644RET
C:\Windows\assembly\tmp\GR96ADR7
C:\Windows\assembly\tmp\GRP44XJK
C:\Windows\assembly\tmp\GTZMWX7C
C:\Windows\assembly\tmp\GU575DOY
C:\Windows\assembly\tmp\GVHODZ02
C:\Windows\assembly\tmp\GVLDW0CJ
C:\Windows\assembly\tmp\GW3R5XZH
C:\Windows\assembly\tmp\GWA2M5BC
C:\Windows\assembly\tmp\GXBWJM99
C:\Windows\assembly\tmp\GXW6KB8E
C:\Windows\assembly\tmp\GY94CBZ4
C:\Windows\assembly\tmp\GZ49C9XP
C:\Windows\assembly\tmp\GZLNW6NP
C:\Windows\assembly\tmp\GZM8BJX0
C:\Windows\assembly\tmp\H14DJ238
C:\Windows\assembly\tmp\H16CE8J5
C:\Windows\assembly\tmp\H1E9V3P2
C:\Windows\assembly\tmp\H25SJQSS
C:\Windows\assembly\tmp\H2KR6DIZ
C:\Windows\assembly\tmp\H2X7373T
C:\Windows\assembly\tmp\H3EVR4CC
C:\Windows\assembly\tmp\H3I3V4AK
C:\Windows\assembly\tmp\H46J98ZQ
C:\Windows\assembly\tmp\H5KUE5EF
C:\Windows\assembly\tmp\H5RX2V9H
C:\Windows\assembly\tmp\H79MK5M3
C:\Windows\assembly\tmp\H82TUG2X
C:\Windows\assembly\tmp\H8SJSC1O
C:\Windows\assembly\tmp\H94XMBBA
C:\Windows\assembly\tmp\H97SY945
C:\Windows\assembly\tmp\H9SA1SDN
C:\Windows\assembly\tmp\HAFPPL1X
C:\Windows\assembly\tmp\HB4U3L9T
C:\Windows\assembly\tmp\HB6BI58E
C:\Windows\assembly\tmp\HBA7324Y
C:\Windows\assembly\tmp\HBRKY4BF
C:\Windows\assembly\tmp\HCHJ1JHJ
C:\Windows\assembly\tmp\HCZHGXJE
C:\Windows\assembly\tmp\HDDCEBJ7
C:\Windows\assembly\tmp\HEKYYV38
C:\Windows\assembly\tmp\HGGXRZKC
C:\Windows\assembly\tmp\HGXVY7MY
C:\Windows\assembly\tmp\HH0J2X5H
C:\Windows\assembly\tmp\HHA5FYJN
C:\Windows\assembly\tmp\HIIIB3FE
C:\Windows\assembly\tmp\HIVVCDLZ
C:\Windows\assembly\tmp\HJ22XMWT
C:\Windows\assembly\tmp\HJ3GZP3B
C:\Windows\assembly\tmp\HL348WXQ
C:\Windows\assembly\tmp\HL3GXO5P
C:\Windows\assembly\tmp\HL4SPG0X
C:\Windows\assembly\tmp\HLLFSDPG
C:\Windows\assembly\tmp\HLP6CTQJ
C:\Windows\assembly\tmp\HM0R17R3
C:\Windows\assembly\tmp\HN9PSS8U
C:\Windows\assembly\tmp\HOCHF5R8
C:\Windows\assembly\tmp\HPIP5X26
C:\Windows\assembly\tmp\HPLGBK3J
C:\Windows\assembly\tmp\HQJB54GH
C:\Windows\assembly\tmp\HQOU30T9
C:\Windows\assembly\tmp\HR4HAPV9
C:\Windows\assembly\tmp\HRT1EM09
C:\Windows\assembly\tmp\HS9A8I72
C:\Windows\assembly\tmp\HSE1FH97
C:\Windows\assembly\tmp\HTB8TR8F
C:\Windows\assembly\tmp\HU7DW0VE
C:\Windows\assembly\tmp\HUMHSMYA
C:\Windows\assembly\tmp\HUV84BV4
C:\Windows\assembly\tmp\HUWHSTC0
C:\Windows\assembly\tmp\HV0CNZ8U
C:\Windows\assembly\tmp\HVVIYIVV
C:\Windows\assembly\tmp\HWO6FVBU
C:\Windows\assembly\tmp\HXIGHNH4
C:\Windows\assembly\tmp\HYL14J1E
C:\Windows\assembly\tmp\HZ6GQQPA
C:\Windows\assembly\tmp\HZQ52WEG
C:\Windows\assembly\tmp\I0LI9MJ4
C:\Windows\assembly\tmp\I0USZ4DU
C:\Windows\assembly\tmp\I17XGGK3
C:\Windows\assembly\tmp\I1BUD1OR
C:\Windows\assembly\tmp\I1X8FZ3T
C:\Windows\assembly\tmp\I2C7MQNA
C:\Windows\assembly\tmp\I2QP5WT7
C:\Windows\assembly\tmp\I2ZM96FE
C:\Windows\assembly\tmp\I3PH0KDN
C:\Windows\assembly\tmp\I44H55CZ
C:\Windows\assembly\tmp\I5I89K03
C:\Windows\assembly\tmp\I5U3WEWO
C:\Windows\assembly\tmp\I64GT7ZY
C:\Windows\assembly\tmp\I6QAZ3LI
C:\Windows\assembly\tmp\I79QPH9Y
C:\Windows\assembly\tmp\I7A2DVLP
C:\Windows\assembly\tmp\I9U2SW9E
C:\Windows\assembly\tmp\I9YZVULL
C:\Windows\assembly\tmp\IA4OJQRL
C:\Windows\assembly\tmp\IAKOH8J8
C:\Windows\assembly\tmp\IAV4JL6E
C:\Windows\assembly\tmp\IB1AMOL7
C:\Windows\assembly\tmp\IB7XGGHM
C:\Windows\assembly\tmp\IBWTP0BW
C:\Windows\assembly\tmp\ICNN3CZ9
C:\Windows\assembly\tmp\ICRMF3YD
C:\Windows\assembly\tmp\ID98W447
C:\Windows\assembly\tmp\IFEU35J7
C:\Windows\assembly\tmp\IFL7YGKA
C:\Windows\assembly\tmp\IHNY5TAF
C:\Windows\assembly\tmp\IJD54BEF
C:\Windows\assembly\tmp\IKG128SW
C:\Windows\assembly\tmp\IL6AUZBI
C:\Windows\assembly\tmp\ILNE72V9
C:\Windows\assembly\tmp\IM2CHPWR
C:\Windows\assembly\tmp\IM65091Y
C:\Windows\assembly\tmp\IMIB9ITM
C:\Windows\assembly\tmp\IMK5XH9I
C:\Windows\assembly\tmp\INFX814D
C:\Windows\assembly\tmp\INK1CQWU
C:\Windows\assembly\tmp\INV1KA6J
C:\Windows\assembly\tmp\IP0K20CF
C:\Windows\assembly\tmp\IP9U8K7H
C:\Windows\assembly\tmp\IPLDIX3S
C:\Windows\assembly\tmp\IPUZS8KX
C:\Windows\assembly\tmp\IPZTWGUN
C:\Windows\assembly\tmp\IQL049TT
C:\Windows\assembly\tmp\IRW0QY1Z
C:\Windows\assembly\tmp\ISJC00J8
C:\Windows\assembly\tmp\ISMVTSWG
C:\Windows\assembly\tmp\ISQR1MWY
C:\Windows\assembly\tmp\IT0BUSAW
C:\Windows\assembly\tmp\IU1E6GCY
C:\Windows\assembly\tmp\IVP9ESK3
C:\Windows\assembly\tmp\IX69LVY9
C:\Windows\assembly\tmp\IX6W32XG
C:\Windows\assembly\tmp\IXZHYSJU
C:\Windows\assembly\tmp\IYL32EOE
C:\Windows\assembly\tmp\IYZAILHT
C:\Windows\assembly\tmp\IZN3EKTU
C:\Windows\assembly\tmp\J0AUA037
C:\Windows\assembly\tmp\J0D5RH4F
C:\Windows\assembly\tmp\J0QGL6WE
C:\Windows\assembly\tmp\J0Z3NAKT
C:\Windows\assembly\tmp\J0ZSEYU5
C:\Windows\assembly\tmp\J19PLVYN
C:\Windows\assembly\tmp\J1ZYOMTN
C:\Windows\assembly\tmp\J2ESNOAH
C:\Windows\assembly\tmp\J2HRR1JX
C:\Windows\assembly\tmp\J43T8WL8
C:\Windows\assembly\tmp\J4MQKOXD
C:\Windows\assembly\tmp\J5UVL8ZA
C:\Windows\assembly\tmp\J6QVSZOM
C:\Windows\assembly\tmp\J6SKKGTC
C:\Windows\assembly\tmp\J6TM3ZCY
C:\Windows\assembly\tmp\J71MMJ2I
C:\Windows\assembly\tmp\J8FGR8JQ
C:\Windows\assembly\tmp\J97248TG
C:\Windows\assembly\tmp\JAMNXM6A
C:\Windows\assembly\tmp\JBHZOHHB
C:\Windows\assembly\tmp\JBWMGKFC
C:\Windows\assembly\tmp\JDO34FUJ
C:\Windows\assembly\tmp\JEBNRDRK
C:\Windows\assembly\tmp\JF5E0Y95
C:\Windows\assembly\tmp\JG488H11
C:\Windows\assembly\tmp\JGNQD21J
C:\Windows\assembly\tmp\JHMBEZP8
C:\Windows\assembly\tmp\JI0CC75Z
C:\Windows\assembly\tmp\JI6ZSHDP
C:\Windows\assembly\tmp\JJ14OJSL
C:\Windows\assembly\tmp\JJYK9PMT
C:\Windows\assembly\tmp\JJZQ7SF3
C:\Windows\assembly\tmp\JKDZTKZA
C:\Windows\assembly\tmp\JLBRBUM2
C:\Windows\assembly\tmp\JMC5HBS5
C:\Windows\assembly\tmp\JMD53GWU
C:\Windows\assembly\tmp\JMUDLN56
C:\Windows\assembly\tmp\JN1LD8ZG
C:\Windows\assembly\tmp\JN607TMN
C:\Windows\assembly\tmp\JN67JYPT
C:\Windows\assembly\tmp\JNNIK9ZG
C:\Windows\assembly\tmp\JP84VIII
C:\Windows\assembly\tmp\JQGAU92O
C:\Windows\assembly\tmp\JQKJTGUK
C:\Windows\assembly\tmp\JQLS42VV
C:\Windows\assembly\tmp\JRM7GP8X
C:\Windows\assembly\tmp\JS9I9S78
C:\Windows\assembly\tmp\JUFAF3X1
C:\Windows\assembly\tmp\JUG09KJ1
C:\Windows\assembly\tmp\JUMJDZJP
C:\Windows\assembly\tmp\JUW9R51F
C:\Windows\assembly\tmp\JXYX4O4U
C:\Windows\assembly\tmp\JYAAJ3YZ
C:\Windows\assembly\tmp\JZGD7A8X
C:\Windows\assembly\tmp\K050KCI8
C:\Windows\assembly\tmp\K0LVUTBZ
C:\Windows\assembly\tmp\K16R6LHL
C:\Windows\assembly\tmp\K245GNHU
C:\Windows\assembly\tmp\K2FB74M4
C:\Windows\assembly\tmp\K2Q9IBJG
C:\Windows\assembly\tmp\K33YO86F
C:\Windows\assembly\tmp\K3LJM3JH
C:\Windows\assembly\tmp\K4H4EM7Z
C:\Windows\assembly\tmp\K4L6OBTK
C:\Windows\assembly\tmp\K5JITS4V
C:\Windows\assembly\tmp\K5YDUFXV
C:\Windows\assembly\tmp\K6ETCR85
C:\Windows\assembly\tmp\K9Q14Q9Z
C:\Windows\assembly\tmp\KA09PNKB
C:\Windows\assembly\tmp\KAC5L1N1
C:\Windows\assembly\tmp\KAFIY9O8
C:\Windows\assembly\tmp\KAO4Q24G
C:\Windows\assembly\tmp\KB3GU5VX
C:\Windows\assembly\tmp\KB5UCF5K
C:\Windows\assembly\tmp\KCYGA09J
C:\Windows\assembly\tmp\KCYXP4FB
C:\Windows\assembly\tmp\KDYSZNGH
C:\Windows\assembly\tmp\KDZD1Q3T
C:\Windows\assembly\tmp\KE4KTKBQ
C:\Windows\assembly\tmp\KEU09E7U
C:\Windows\assembly\tmp\KEXN3OR8
C:\Windows\assembly\tmp\KF1BS6DX
C:\Windows\assembly\tmp\KFPAPZO3
C:\Windows\assembly\tmp\KGGB9W13
C:\Windows\assembly\tmp\KGHIXX3P
C:\Windows\assembly\tmp\KGP9H4JL
C:\Windows\assembly\tmp\KH37BZ4M
C:\Windows\assembly\tmp\KH7O1ZPP
C:\Windows\assembly\tmp\KIBNLD7O
C:\Windows\assembly\tmp\KJ5ICAYJ
C:\Windows\assembly\tmp\KK0T35JV
C:\Windows\assembly\tmp\KK9I4N7C
C:\Windows\assembly\tmp\KL7W70TA
C:\Windows\assembly\tmp\KNHF0TZZ
C:\Windows\assembly\tmp\KNIZXXKP
C:\Windows\assembly\tmp\KP9EDNUO
C:\Windows\assembly\tmp\KS0EVX5E
C:\Windows\assembly\tmp\KTBC9RUU
C:\Windows\assembly\tmp\KTEYY7YH
C:\Windows\assembly\tmp\KTZGYHX6
C:\Windows\assembly\tmp\KUGPEDBG
C:\Windows\assembly\tmp\KUXLQEKK
C:\Windows\assembly\tmp\KV2CJZGP
C:\Windows\assembly\tmp\KVJQ5I23
C:\Windows\assembly\tmp\KVVU6QA3
C:\Windows\assembly\tmp\KW5CAZ79
C:\Windows\assembly\tmp\KWQZCVBE
C:\Windows\assembly\tmp\KXTZWXY1
C:\Windows\assembly\tmp\KZX8S9IG
C:\Windows\assembly\tmp\L12MQ2SA
C:\Windows\assembly\tmp\L2AS5OJL
C:\Windows\assembly\tmp\L3KSDWJC
C:\Windows\assembly\tmp\L4ZDKK2M
C:\Windows\assembly\tmp\L4ZKV7ZE
C:\Windows\assembly\tmp\L5IKYS7H
C:\Windows\assembly\tmp\L5L6DWQN
C:\Windows\assembly\tmp\L7BLPM4B
C:\Windows\assembly\tmp\L7DPT2EA
C:\Windows\assembly\tmp\L8ISX86H
C:\Windows\assembly\tmp\L97REDIV
C:\Windows\assembly\tmp\L9DEK0WO
C:\Windows\assembly\tmp\LA3NY3XJ
C:\Windows\assembly\tmp\LBF4JG8E
C:\Windows\assembly\tmp\LD8YVPDJ
C:\Windows\assembly\tmp\LDBH6S5W
C:\Windows\assembly\tmp\LDFPJRJN
C:\Windows\assembly\tmp\LDOMXVNE
C:\Windows\assembly\tmp\LDXJPBNQ
C:\Windows\assembly\tmp\LE3TYL9I
C:\Windows\assembly\tmp\LEIPW23W
C:\Windows\assembly\tmp\LF2C4ROH
C:\Windows\assembly\tmp\LH63OLEK
C:\Windows\assembly\tmp\LHNQ9ODF
C:\Windows\assembly\tmp\LI8D5O7K
C:\Windows\assembly\tmp\LIII89F1
C:\Windows\assembly\tmp\LIUW06NR
C:\Windows\assembly\tmp\LJ4GTBQX
C:\Windows\assembly\tmp\LJN4J02Z
C:\Windows\assembly\tmp\LJSJHPWU
C:\Windows\assembly\tmp\LK8BY7VE
C:\Windows\assembly\tmp\LKJ9N5VQ
C:\Windows\assembly\tmp\LMCREAB2
C:\Windows\assembly\tmp\LN9W7WA2
C:\Windows\assembly\tmp\LNIOW777
C:\Windows\assembly\tmp\LNO1PKAY
C:\Windows\assembly\tmp\LNSR44K6
C:\Windows\assembly\tmp\LOUHOV5X
C:\Windows\assembly\tmp\LPBKL2HS
C:\Windows\assembly\tmp\LPTV9ME9
C:\Windows\assembly\tmp\LQ5WJESF
C:\Windows\assembly\tmp\LQDIXF78
C:\Windows\assembly\tmp\LQUMWTFC
C:\Windows\assembly\tmp\LQWHZNVF
C:\Windows\assembly\tmp\LRCWLPUP
C:\Windows\assembly\tmp\LS740KFF
C:\Windows\assembly\tmp\LSZ69WRA
C:\Windows\assembly\tmp\LT4T6EKQ
C:\Windows\assembly\tmp\LT5OXEBE
C:\Windows\assembly\tmp\LT61P6AN
C:\Windows\assembly\tmp\LT6BTCQB
C:\Windows\assembly\tmp\LTOOLLQ1
C:\Windows\assembly\tmp\LTPBGHZ1
C:\Windows\assembly\tmp\LTYBF9A8
C:\Windows\assembly\tmp\LV5HWR7T
C:\Windows\assembly\tmp\LW0OM979
C:\Windows\assembly\tmp\LWNNB7PA
C:\Windows\assembly\tmp\LYAKSEW0
C:\Windows\assembly\tmp\LZAM6NFU
C:\Windows\assembly\tmp\LZKZ6XN8
C:\Windows\assembly\tmp\M0OSOHKM
C:\Windows\assembly\tmp\M1CTZXI8
C:\Windows\assembly\tmp\M24FOTF2
C:\Windows\assembly\tmp\M24J9VSR
C:\Windows\assembly\tmp\M3INCB4S
C:\Windows\assembly\tmp\M3SB17Y4
C:\Windows\assembly\tmp\M3T3QQ6A
C:\Windows\assembly\tmp\M3ZBGMIL
C:\Windows\assembly\tmp\M48V0KRS
C:\Windows\assembly\tmp\M4AR7M86
C:\Windows\assembly\tmp\M4OPEGY8
C:\Windows\assembly\tmp\M580OYGD
C:\Windows\assembly\tmp\M5J7DT54
C:\Windows\assembly\tmp\M61YHUVC
C:\Windows\assembly\tmp\M65G4MUD
C:\Windows\assembly\tmp\M6EUW7FM
C:\Windows\assembly\tmp\M6XBMHRK
C:\Windows\assembly\tmp\M7R3W63B
C:\Windows\assembly\tmp\M92Y8RJN
C:\Windows\assembly\tmp\M9DH7414
C:\Windows\assembly\tmp\M9L65EK1
C:\Windows\assembly\tmp\M9YEMA56
C:\Windows\assembly\tmp\M9Z5QTPK
C:\Windows\assembly\tmp\MA7O588L
C:\Windows\assembly\tmp\MALUB3CH
C:\Windows\assembly\tmp\MBNHMGEC
C:\Windows\assembly\tmp\MBTANYQM
C:\Windows\assembly\tmp\MC2FLMBO
C:\Windows\assembly\tmp\MCD5KFML
C:\Windows\assembly\tmp\MCVKN1FZ
C:\Windows\assembly\tmp\MD3ZKXSR
C:\Windows\assembly\tmp\MD73C6GX
C:\Windows\assembly\tmp\MFD1RVMS
C:\Windows\assembly\tmp\MFH7BL5P
C:\Windows\assembly\tmp\MFTI751G
C:\Windows\assembly\tmp\MGGBLXAO
C:\Windows\assembly\tmp\MGKSVHBA
C:\Windows\assembly\tmp\MGVOI91M
C:\Windows\assembly\tmp\MH22OUPU
C:\Windows\assembly\tmp\MH8DJ901
C:\Windows\assembly\tmp\MHMX04HS
C:\Windows\assembly\tmp\MHQ8SHAT
C:\Windows\assembly\tmp\MHSEX38X
C:\Windows\assembly\tmp\MIN7R545
C:\Windows\assembly\tmp\MKAHT9O7
C:\Windows\assembly\tmp\MKIN87U3
C:\Windows\assembly\tmp\MKWER0F0
C:\Windows\assembly\tmp\MKZUVMLX
C:\Windows\assembly\tmp\MM0CI8H2
C:\Windows\assembly\tmp\MM1K2U5Z
C:\Windows\assembly\tmp\MOXU1NBZ
C:\Windows\assembly\tmp\MRRZJDP8
C:\Windows\assembly\tmp\MS405OOY
C:\Windows\assembly\tmp\MS61NT7U
C:\Windows\assembly\tmp\MSGGBH9N
C:\Windows\assembly\tmp\MTROWIWO
C:\Windows\assembly\tmp\MV2THKU5
C:\Windows\assembly\tmp\MVDNIMGQ
C:\Windows\assembly\tmp\MY1FZ05G
C:\Windows\assembly\tmp\MYGJ2W74
C:\Windows\assembly\tmp\MYQDO08P
C:\Windows\assembly\tmp\MZ0R0QE2
C:\Windows\assembly\tmp\MZ2LJ91J
C:\Windows\assembly\tmp\MZHVIK1Z
C:\Windows\assembly\tmp\MZYMVNTL
C:\Windows\assembly\tmp\N03GH4II
C:\Windows\assembly\tmp\N197VMRY
C:\Windows\assembly\tmp\N1BCX2NO
C:\Windows\assembly\tmp\N1T3SF8M
C:\Windows\assembly\tmp\N1THAEYA
C:\Windows\assembly\tmp\N2WHLUC6
C:\Windows\assembly\tmp\N2XTZYC1
C:\Windows\assembly\tmp\N3PFUUD2
C:\Windows\assembly\tmp\N3Z2OVSH
C:\Windows\assembly\tmp\N4BUUBN2
C:\Windows\assembly\tmp\N4PYGEZ0
C:\Windows\assembly\tmp\N4QGCK62
C:\Windows\assembly\tmp\N550FR9M
C:\Windows\assembly\tmp\N5R7SLUI
C:\Windows\assembly\tmp\N6JQG94U
C:\Windows\assembly\tmp\N76XXSUA
C:\Windows\assembly\tmp\N7C066SF
C:\Windows\assembly\tmp\N7S7UG6W
C:\Windows\assembly\tmp\N855QUBW
C:\Windows\assembly\tmp\N85IKFDI
C:\Windows\assembly\tmp\N8YO4W8S
C:\Windows\assembly\tmp\N92T3RKK
C:\Windows\assembly\tmp\NA0IOLON
C:\Windows\assembly\tmp\NAEXD5ZA
C:\Windows\assembly\tmp\NAS7HLU8
C:\Windows\assembly\tmp\NATIMUSZ
C:\Windows\assembly\tmp\NAWYFBQK
C:\Windows\assembly\tmp\NAXUUZV0
C:\Windows\assembly\tmp\NC44YT54
C:\Windows\assembly\tmp\NCQ4G7QP
C:\Windows\assembly\tmp\NCVX720H
C:\Windows\assembly\tmp\NCWW4RQ7
C:\Windows\assembly\tmp\NCXY4NSS
C:\Windows\assembly\tmp\NF4M41PG
C:\Windows\assembly\tmp\NGWJMLGF
C:\Windows\assembly\tmp\NH5IS5CR
C:\Windows\assembly\tmp\NI8XG9OC
C:\Windows\assembly\tmp\NIEWKIVA
C:\Windows\assembly\tmp\NJNWZT6X
C:\Windows\assembly\tmp\NKF8V69L
C:\Windows\assembly\tmp\NKJ61S9F
C:\Windows\assembly\tmp\NMOEXWYJ
C:\Windows\assembly\tmp\NP6MDTYS
C:\Windows\assembly\tmp\NQ2DTM3F
C:\Windows\assembly\tmp\NQHQLU7B
C:\Windows\assembly\tmp\NQI61D5U
C:\Windows\assembly\tmp\NQZS0XKQ
C:\Windows\assembly\tmp\NRNZUV7T
C:\Windows\assembly\tmp\NS77BUJQ
C:\Windows\assembly\tmp\NSMX7YT9
C:\Windows\assembly\tmp\NTE9196V
C:\Windows\assembly\tmp\NTGBL3HX
C:\Windows\assembly\tmp\NTGO9ESO
C:\Windows\assembly\tmp\NTKVD0OJ
C:\Windows\assembly\tmp\NUF8965T
C:\Windows\assembly\tmp\NULEBI1P
C:\Windows\assembly\tmp\NUVNHI3L
C:\Windows\assembly\tmp\NV0JSENE
C:\Windows\assembly\tmp\NWBALH75
C:\Windows\assembly\tmp\NXR517UL
C:\Windows\assembly\tmp\NY2BS69W
C:\Windows\assembly\tmp\NZ3OERCD
C:\Windows\assembly\tmp\NZEU00F2
C:\Windows\assembly\tmp\NZMX3LDN
C:\Windows\assembly\tmp\O02J5OQ6
C:\Windows\assembly\tmp\O1U12W5O
C:\Windows\assembly\tmp\O32JTAQU
C:\Windows\assembly\tmp\O33FYTYR
C:\Windows\assembly\tmp\O3TF3I6Q
C:\Windows\assembly\tmp\O4U1GA2Z
C:\Windows\assembly\tmp\O55F9TP4
C:\Windows\assembly\tmp\O57J6E2K
C:\Windows\assembly\tmp\O5VTFAK4
C:\Windows\assembly\tmp\O6EGJQNK
C:\Windows\assembly\tmp\O6KT7NDG
C:\Windows\assembly\tmp\O7522S4Q
C:\Windows\assembly\tmp\O7HD95O6
C:\Windows\assembly\tmp\OA0M4TW3
C:\Windows\assembly\tmp\OAIHWRHT
C:\Windows\assembly\tmp\OAIXC44P
C:\Windows\assembly\tmp\OATCXZHK
C:\Windows\assembly\tmp\OAVDGTFB
C:\Windows\assembly\tmp\OB5GU76O
C:\Windows\assembly\tmp\OC75BJAH
C:\Windows\assembly\tmp\OCUR6R22
C:\Windows\assembly\tmp\ODKU962Q
C:\Windows\assembly\tmp\ODWC8N9A
C:\Windows\assembly\tmp\OEBLBKXC
C:\Windows\assembly\tmp\OEJAYQI9
C:\Windows\assembly\tmp\OFWFVKPJ
C:\Windows\assembly\tmp\OGNT74W9
C:\Windows\assembly\tmp\OI94S9BU
C:\Windows\assembly\tmp\OKQC1BI7
C:\Windows\assembly\tmp\OKS7EHJ8
C:\Windows\assembly\tmp\OL55ZVME
C:\Windows\assembly\tmp\ON70PFYA
C:\Windows\assembly\tmp\OOCVT139
C:\Windows\assembly\tmp\OP98XTEG
C:\Windows\assembly\tmp\OP9Z9H3M
C:\Windows\assembly\tmp\OPJ46NU5
C:\Windows\assembly\tmp\OQ0FSHWD
C:\Windows\assembly\tmp\OQ6EP25G
C:\Windows\assembly\tmp\OQDG42UU
C:\Windows\assembly\tmp\OSBFF08O
C:\Windows\assembly\tmp\OSNLG9BR
C:\Windows\assembly\tmp\OSOLVU86
C:\Windows\assembly\tmp\OSPY1V3Q
C:\Windows\assembly\tmp\OTB8EGTO
C:\Windows\assembly\tmp\OU5UYY90
C:\Windows\assembly\tmp\OUHEICL1
C:\Windows\assembly\tmp\OV4Z8UU1
C:\Windows\assembly\tmp\OW25XHJ1
C:\Windows\assembly\tmp\OXP0B35J
C:\Windows\assembly\tmp\OXQA54NM
C:\Windows\assembly\tmp\OY2GPTK0
C:\Windows\assembly\tmp\P0O7J8YD
C:\Windows\assembly\tmp\P0TH4TYG
C:\Windows\assembly\tmp\P0ZS7HAP
C:\Windows\assembly\tmp\P1OKBM6X
C:\Windows\assembly\tmp\P1PB2E2V
C:\Windows\assembly\tmp\P1TA1OC8
C:\Windows\assembly\tmp\P210Z4KP
C:\Windows\assembly\tmp\P2N5FQFA
C:\Windows\assembly\tmp\P3E3JMPZ
C:\Windows\assembly\tmp\P4RP0NQX
C:\Windows\assembly\tmp\P529DYLJ
C:\Windows\assembly\tmp\P5DSPUOH
C:\Windows\assembly\tmp\P5FIWRR8
C:\Windows\assembly\tmp\P6IMNDAZ
C:\Windows\assembly\tmp\P6PKB116
C:\Windows\assembly\tmp\P7KNNLVY
C:\Windows\assembly\tmp\P9LJFG24
C:\Windows\assembly\tmp\PA8GX61Z
C:\Windows\assembly\tmp\PA9RTOVW
C:\Windows\assembly\tmp\PAHKZR8T
C:\Windows\assembly\tmp\PATR4JR9
C:\Windows\assembly\tmp\PBK9Q536
C:\Windows\assembly\tmp\PC750QNO
C:\Windows\assembly\tmp\PDF0YQMF
C:\Windows\assembly\tmp\PDVZP51A
C:\Windows\assembly\tmp\PDXPZ673
C:\Windows\assembly\tmp\PEGOZREG
C:\Windows\assembly\tmp\PFMO3965
C:\Windows\assembly\tmp\PGMJGCUM
C:\Windows\assembly\tmp\PGT8BVKV
C:\Windows\assembly\tmp\PGWZQEXL
C:\Windows\assembly\tmp\PHV0M0OV
C:\Windows\assembly\tmp\PI0AK8IG
C:\Windows\assembly\tmp\PIDXVGUR
C:\Windows\assembly\tmp\PIMVONX1
C:\Windows\assembly\tmp\PIOCB321
C:\Windows\assembly\tmp\PJZTI9XO
C:\Windows\assembly\tmp\PKBFN80T
C:\Windows\assembly\tmp\PKEGTEDD
C:\Windows\assembly\tmp\PKQ33S1H
C:\Windows\assembly\tmp\PKX2KIHD
C:\Windows\assembly\tmp\PLMLRTP9
C:\Windows\assembly\tmp\PNKS3KMA
C:\Windows\assembly\tmp\PNNZ0WWU
C:\Windows\assembly\tmp\PNYLUVY6
C:\Windows\assembly\tmp\PNZZ28WB
C:\Windows\assembly\tmp\PO6P4EGU
C:\Windows\assembly\tmp\POL2E6A1
C:\Windows\assembly\tmp\PP3D76UF
C:\Windows\assembly\tmp\PPDKG404
C:\Windows\assembly\tmp\PQWMJ6HW
C:\Windows\assembly\tmp\PSO3WCI8
C:\Windows\assembly\tmp\PTJKPNBF
C:\Windows\assembly\tmp\PU67FMZB
C:\Windows\assembly\tmp\PV9H2I45
C:\Windows\assembly\tmp\PWH2DANX
C:\Windows\assembly\tmp\PXN5C87D
C:\Windows\assembly\tmp\PXQ3R5QO
C:\Windows\assembly\tmp\PZ50BHSU
C:\Windows\assembly\tmp\Q07UA852
C:\Windows\assembly\tmp\Q0GB6JH1
C:\Windows\assembly\tmp\Q3H1BA46
C:\Windows\assembly\tmp\Q3KCGL56
C:\Windows\assembly\tmp\Q4ICS14Z
C:\Windows\assembly\tmp\Q4TAL7Y0
C:\Windows\assembly\tmp\Q6215SEQ
C:\Windows\assembly\tmp\Q64YMJCF
C:\Windows\assembly\tmp\Q6HN9LMT
C:\Windows\assembly\tmp\Q6XGJ3NX
C:\Windows\assembly\tmp\Q767JSLF
C:\Windows\assembly\tmp\Q820FQCQ
C:\Windows\assembly\tmp\Q8IIC50I
C:\Windows\assembly\tmp\Q9A7DBB6
C:\Windows\assembly\tmp\QA36VMWJ
C:\Windows\assembly\tmp\QA5F4CCJ
C:\Windows\assembly\tmp\QA5VIQDA
C:\Windows\assembly\tmp\QANKKP8P
C:\Windows\assembly\tmp\QB3BML56
C:\Windows\assembly\tmp\QBEQN004
C:\Windows\assembly\tmp\QC32PI6S
C:\Windows\assembly\tmp\QCOOZZXI
C:\Windows\assembly\tmp\QCWS22AE
C:\Windows\assembly\tmp\QD0LX5LN
C:\Windows\assembly\tmp\QDBXQPOI
C:\Windows\assembly\tmp\QDSO7P0A
C:\Windows\assembly\tmp\QE2IGX9X
C:\Windows\assembly\tmp\QEZGCX8V
C:\Windows\assembly\tmp\QFAG3PDA
C:\Windows\assembly\tmp\QFXFVO7K
C:\Windows\assembly\tmp\QHEK63NX
C:\Windows\assembly\tmp\QIH7O4AU
C:\Windows\assembly\tmp\QIOAHE4E
C:\Windows\assembly\tmp\QION7NOI
C:\Windows\assembly\tmp\QJAT3AWT
C:\Windows\assembly\tmp\QJRE76NI
C:\Windows\assembly\tmp\QJSMS8HB
C:\Windows\assembly\tmp\QK5XAKJY
C:\Windows\assembly\tmp\QLO2ITBT
C:\Windows\assembly\tmp\QMZBIJEF
C:\Windows\assembly\tmp\QN4FNU6J
C:\Windows\assembly\tmp\QN9R7GLH
C:\Windows\assembly\tmp\QNFXOG4U
C:\Windows\assembly\tmp\QNPSSU0N
C:\Windows\assembly\tmp\QO2CW23Z
C:\Windows\assembly\tmp\QOQNNJ0W
C:\Windows\assembly\tmp\QPF6TM2R
C:\Windows\assembly\tmp\QPGYXX48
C:\Windows\assembly\tmp\QPOEJ6QT
C:\Windows\assembly\tmp\QQ2DKT3R
C:\Windows\assembly\tmp\QQ3FFDNV
C:\Windows\assembly\tmp\QQIMU3D3
C:\Windows\assembly\tmp\QR06NK9M
C:\Windows\assembly\tmp\QR4CH8CN
C:\Windows\assembly\tmp\QRJXV5CP
C:\Windows\assembly\tmp\QSEGH4W6
C:\Windows\assembly\tmp\QTCJ172C
C:\Windows\assembly\tmp\QTP3J7T2
C:\Windows\assembly\tmp\QU82BFRY
C:\Windows\assembly\tmp\QXGFWR84
C:\Windows\assembly\tmp\QY1Q5N7N
C:\Windows\assembly\tmp\QYV93WXF
C:\Windows\assembly\tmp\QZ45S5HH
C:\Windows\assembly\tmp\R10P2O0M
C:\Windows\assembly\tmp\R1CS0LO6
C:\Windows\assembly\tmp\R1JWHFZG
C:\Windows\assembly\tmp\R1XFV3AZ
C:\Windows\assembly\tmp\R289SBEM
C:\Windows\assembly\tmp\R2CCA6Q4
C:\Windows\assembly\tmp\R2RZANQM
C:\Windows\assembly\tmp\R3ZCK8PO
C:\Windows\assembly\tmp\R40YZO71
C:\Windows\assembly\tmp\R4SLEKI3
C:\Windows\assembly\tmp\R6LENSTI
C:\Windows\assembly\tmp\R7BRN3L3
C:\Windows\assembly\tmp\R7M3NH46
C:\Windows\assembly\tmp\R89E98PP
C:\Windows\assembly\tmp\R8ETRCAU
C:\Windows\assembly\tmp\R8JLLBVP
C:\Windows\assembly\tmp\R9SDHHRG
C:\Windows\assembly\tmp\RAX885Y1
C:\Windows\assembly\tmp\RBXL2P0Z
C:\Windows\assembly\tmp\RC7LCGG9
C:\Windows\assembly\tmp\RCB984BK
C:\Windows\assembly\tmp\RCW8APPN
C:\Windows\assembly\tmp\RDOYLUKH
C:\Windows\assembly\tmp\RFWKO32M
C:\Windows\assembly\tmp\RGAXP7C2
C:\Windows\assembly\tmp\RH5KDSZI
C:\Windows\assembly\tmp\RHAKMFO8
C:\Windows\assembly\tmp\RHGE64H5
C:\Windows\assembly\tmp\RIETWJQX
C:\Windows\assembly\tmp\RJ3R6JHY
C:\Windows\assembly\tmp\RJHGGHMO
C:\Windows\assembly\tmp\RJJ9OH8I
C:\Windows\assembly\tmp\RKXL61XZ
C:\Windows\assembly\tmp\RL6FH69M
C:\Windows\assembly\tmp\RLSQ2PH6
C:\Windows\assembly\tmp\RLZA795V
C:\Windows\assembly\tmp\RM8D1UQE
C:\Windows\assembly\tmp\RN6VJZO1
C:\Windows\assembly\tmp\ROIMFSLP
C:\Windows\assembly\tmp\ROSMS57C
C:\Windows\assembly\tmp\RP7DNRWH
C:\Windows\assembly\tmp\RQF13HQ7
C:\Windows\assembly\tmp\RQGFY5XF
C:\Windows\assembly\tmp\RQOYB3GD
C:\Windows\assembly\tmp\RSRVBX1R
C:\Windows\assembly\tmp\RTELMKYT
C:\Windows\assembly\tmp\RTSAJWLL
C:\Windows\assembly\tmp\RUAHLT7B
C:\Windows\assembly\tmp\RURYH2B6
C:\Windows\assembly\tmp\RVD9EOE9
C:\Windows\assembly\tmp\RVMC75US
C:\Windows\assembly\tmp\RWK81URA
C:\Windows\assembly\tmp\RYHT8FK5
C:\Windows\assembly\tmp\RYS3GOR6
C:\Windows\assembly\tmp\RZ7G7ISN
C:\Windows\assembly\tmp\RZGTE37Z
C:\Windows\assembly\tmp\S0B355J7
C:\Windows\assembly\tmp\S0LYM7O2
C:\Windows\assembly\tmp\S10SV8NB
C:\Windows\assembly\tmp\S2EO5XDU
C:\Windows\assembly\tmp\S2OUIO7Q
C:\Windows\assembly\tmp\S2P5MZU5
C:\Windows\assembly\tmp\S2WROPWN
C:\Windows\assembly\tmp\S3K2ERNL
C:\Windows\assembly\tmp\S3NZPT93
C:\Windows\assembly\tmp\S4N6US3A
C:\Windows\assembly\tmp\S566MMQ2
C:\Windows\assembly\tmp\S5VEAGJV
C:\Windows\assembly\tmp\S5Y3FM8C
C:\Windows\assembly\tmp\S60AHMIU
C:\Windows\assembly\tmp\S6KYK9OB
C:\Windows\assembly\tmp\S7B3S16M
C:\Windows\assembly\tmp\S7OUKVHW
C:\Windows\assembly\tmp\S7RT3BFN
C:\Windows\assembly\tmp\S8K50PCA
C:\Windows\assembly\tmp\S90LVGTD
C:\Windows\assembly\tmp\S9FOXDZO
C:\Windows\assembly\tmp\S9ZODF11
C:\Windows\assembly\tmp\SA21S5ZL
C:\Windows\assembly\tmp\SA7ZMIJ9
C:\Windows\assembly\tmp\SAE21PSI
C:\Windows\assembly\tmp\SASCD2W7
C:\Windows\assembly\tmp\SBTD47YS
C:\Windows\assembly\tmp\SD0KPOK1
C:\Windows\assembly\tmp\SDXJK2KF
C:\Windows\assembly\tmp\SE3ERGX4
C:\Windows\assembly\tmp\SF20WAIU
C:\Windows\assembly\tmp\SFC4DD98
C:\Windows\assembly\tmp\SFE9OTIM
C:\Windows\assembly\tmp\SGB6WHM3
C:\Windows\assembly\tmp\SGPOGLND
C:\Windows\assembly\tmp\SGQGK5ML
C:\Windows\assembly\tmp\SGZIBRNN
C:\Windows\assembly\tmp\SH4OWKT3
C:\Windows\assembly\tmp\SHSFDRPJ
C:\Windows\assembly\tmp\SI621DBU
C:\Windows\assembly\tmp\SIHKF4TV
C:\Windows\assembly\tmp\SJGDBI2Y
C:\Windows\assembly\tmp\SJOUALJA
C:\Windows\assembly\tmp\SKCZ6KIJ
C:\Windows\assembly\tmp\SL0AV08O
C:\Windows\assembly\tmp\SN8FS4TQ
C:\Windows\assembly\tmp\SO3L7K4C
C:\Windows\assembly\tmp\SO6ZG7C0
C:\Windows\assembly\tmp\SONIJO8Y
C:\Windows\assembly\tmp\SOOEX0SM
C:\Windows\assembly\tmp\SOVI757T
C:\Windows\assembly\tmp\SQS9QBNR
C:\Windows\assembly\tmp\SS626UOG
C:\Windows\assembly\tmp\SS6TEK45
C:\Windows\assembly\tmp\STH7JEVL
C:\Windows\assembly\tmp\STWOA02V
C:\Windows\assembly\tmp\STZO29CO
C:\Windows\assembly\tmp\SV0HKI1V
C:\Windows\assembly\tmp\SVLQYRD4
C:\Windows\assembly\tmp\SVWAN3LL
C:\Windows\assembly\tmp\SW0ABYEA
C:\Windows\assembly\tmp\SW1Z5Z1W
C:\Windows\assembly\tmp\SW4I6J2F
C:\Windows\assembly\tmp\SXHE3I70
C:\Windows\assembly\tmp\SXXXTSST
C:\Windows\assembly\tmp\SYN8WJBL
C:\Windows\assembly\tmp\SYXQLRI8
C:\Windows\assembly\tmp\SZLUJOS9
C:\Windows\assembly\tmp\SZMUYFNH
C:\Windows\assembly\tmp\T03PE3KZ
C:\Windows\assembly\tmp\T05O634V
C:\Windows\assembly\tmp\T0SHZK8Q
C:\Windows\assembly\tmp\T3TKCI1I
C:\Windows\assembly\tmp\T5IEFSJO
C:\Windows\assembly\tmp\T82OT0BN
C:\Windows\assembly\tmp\T9TGFH7U
C:\Windows\assembly\tmp\T9ZAOJO4
C:\Windows\assembly\tmp\TBLN33NB
C:\Windows\assembly\tmp\TC3IVGCD
C:\Windows\assembly\tmp\TC5IF61J
C:\Windows\assembly\tmp\TEA7DKEM
C:\Windows\assembly\tmp\TEJG75IM
C:\Windows\assembly\tmp\TFF6K5HQ
C:\Windows\assembly\tmp\TGGCV25R
C:\Windows\assembly\tmp\THSTY9TV
C:\Windows\assembly\tmp\TI1GLLJ5
C:\Windows\assembly\tmp\TJ2SK9U2
C:\Windows\assembly\tmp\TK3IJ0QX
C:\Windows\assembly\tmp\TKFTTK4G
C:\Windows\assembly\tmp\TLC8G2DD
C:\Windows\assembly\tmp\TLFU2HUZ
C:\Windows\assembly\tmp\TMNF56QZ
C:\Windows\assembly\tmp\TNE6RTJA
C:\Windows\assembly\tmp\TOH21HCJ
C:\Windows\assembly\tmp\TOHQM67W
C:\Windows\assembly\tmp\TOW1R8YT
C:\Windows\assembly\tmp\TP388BRZ
C:\Windows\assembly\tmp\TPX5XAJM
C:\Windows\assembly\tmp\TR4F954H
C:\Windows\assembly\tmp\TRT1DVYL
C:\Windows\assembly\tmp\TSG4W5NV
C:\Windows\assembly\tmp\TSUIX6VL
C:\Windows\assembly\tmp\TSVSAMDI
C:\Windows\assembly\tmp\TT20V2NI
C:\Windows\assembly\tmp\TT52K387
C:\Windows\assembly\tmp\TT5M8VJM
C:\Windows\assembly\tmp\TT789O9O
C:\Windows\assembly\tmp\TUHHWS6X
C:\Windows\assembly\tmp\TUP7S3DF
C:\Windows\assembly\tmp\TV9GY152
C:\Windows\assembly\tmp\TWA6JOCX
C:\Windows\assembly\tmp\TX72YMHU
C:\Windows\assembly\tmp\TX7E0AR7
C:\Windows\assembly\tmp\TXLV6ZF0
C:\Windows\assembly\tmp\TXMNAHUA
C:\Windows\assembly\tmp\TY5NECS5
C:\Windows\assembly\tmp\TYH9C5NK
C:\Windows\assembly\tmp\TZ53ZYNK
C:\Windows\assembly\tmp\TZ5PR90C
C:\Windows\assembly\tmp\U
C:\Windows\assembly\tmp\U09GS5M0
C:\Windows\assembly\tmp\U0JGA1AE
C:\Windows\assembly\tmp\U11RNXP6
C:\Windows\assembly\tmp\U12IVPLB
C:\Windows\assembly\tmp\U173GF4P
C:\Windows\assembly\tmp\U1CE21EM
C:\Windows\assembly\tmp\U1CUSE46
C:\Windows\assembly\tmp\U1Z8EHR8
C:\Windows\assembly\tmp\U1ZJC7JW
C:\Windows\assembly\tmp\U2J3PLBJ
C:\Windows\assembly\tmp\U2NYMMA9
C:\Windows\assembly\tmp\U2U9TEJP
C:\Windows\assembly\tmp\U3A49O16
C:\Windows\assembly\tmp\U469Z39Y
C:\Windows\assembly\tmp\U4MOE4SO
C:\Windows\assembly\tmp\U4URTD1Z
C:\Windows\assembly\tmp\U5Z7P6KA
C:\Windows\assembly\tmp\U6ZO10SE
C:\Windows\assembly\tmp\U7KJBIRU
C:\Windows\assembly\tmp\U7ZFJA3H
C:\Windows\assembly\tmp\U87HA5PU
C:\Windows\assembly\tmp\U8BDAN3C
C:\Windows\assembly\tmp\U8D3RHGY
C:\Windows\assembly\tmp\U8SX0K6G
C:\Windows\assembly\tmp\U9CHH55W
C:\Windows\assembly\tmp\U9CJ0ZG4
C:\Windows\assembly\tmp\UACVFPAR
C:\Windows\assembly\tmp\UAYANVOW
C:\Windows\assembly\tmp\UB3G3NW7
C:\Windows\assembly\tmp\UBPJ56UP
C:\Windows\assembly\tmp\UC59TW3C
C:\Windows\assembly\tmp\UCEZ6HDL
C:\Windows\assembly\tmp\UE5R864K
C:\Windows\assembly\tmp\UEZ82QO0
C:\Windows\assembly\tmp\UFHELH97
C:\Windows\assembly\tmp\UG1YK5IK
C:\Windows\assembly\tmp\UG9C8XUH
C:\Windows\assembly\tmp\UHCIVKQF
C:\Windows\assembly\tmp\UHCQ2PC3
C:\Windows\assembly\tmp\UHW89YW4
C:\Windows\assembly\tmp\UIO3F9XA
C:\Windows\assembly\tmp\UJ3HQNNR
C:\Windows\assembly\tmp\UJHJ4HVH
C:\Windows\assembly\tmp\UK87JWJY
C:\Windows\assembly\tmp\UK98M8P6
C:\Windows\assembly\tmp\ULD1DWUH
C:\Windows\assembly\tmp\ULDU9AV5
C:\Windows\assembly\tmp\UMAT2F6T
C:\Windows\assembly\tmp\UMUNK8WR
C:\Windows\assembly\tmp\UN3Y05XS
C:\Windows\assembly\tmp\UN9IC74J
C:\Windows\assembly\tmp\UNBFEFFN
C:\Windows\assembly\tmp\UNOMOKA5
C:\Windows\assembly\tmp\UNPPK18N
C:\Windows\assembly\tmp\UO2BOFFJ
C:\Windows\assembly\tmp\UOQTF8EG
C:\Windows\assembly\tmp\UPQ1U1UA
C:\Windows\assembly\tmp\UPWLR8EF
C:\Windows\assembly\tmp\UQBCNGZG
C:\Windows\assembly\tmp\UQEFP48B
C:\Windows\assembly\tmp\UQNAH45P
C:\Windows\assembly\tmp\UQYAYKUB
C:\Windows\assembly\tmp\URC6DO3P
C:\Windows\assembly\tmp\USVDX8QB
C:\Windows\assembly\tmp\UT08L9ZX
C:\Windows\assembly\tmp\UV2SKNUV
C:\Windows\assembly\tmp\UVGY44U1
C:\Windows\assembly\tmp\UWBTAE7E
C:\Windows\assembly\tmp\UWCXO2GS
C:\Windows\assembly\tmp\UWQ8Y1MO
C:\Windows\assembly\tmp\UWW12ZUE
C:\Windows\assembly\tmp\UXC2W7XL
C:\Windows\assembly\tmp\UXYWCDW2
C:\Windows\assembly\tmp\UYISF6M5
C:\Windows\assembly\tmp\UYQLNJKL
C:\Windows\assembly\tmp\UYTPV0R3
C:\Windows\assembly\tmp\UYY0T9E0
C:\Windows\assembly\tmp\UZ9UZAST
C:\Windows\assembly\tmp\V0Q7NHG4
C:\Windows\assembly\tmp\V19DH54Z
C:\Windows\assembly\tmp\V2GX0FL4
C:\Windows\assembly\tmp\V37KZ67Q
C:\Windows\assembly\tmp\V425CYWJ
C:\Windows\assembly\tmp\V55HNBGD
C:\Windows\assembly\tmp\V63HT55B
C:\Windows\assembly\tmp\V675SQIO
C:\Windows\assembly\tmp\V6ALW690
C:\Windows\assembly\tmp\V6FPXVT8
C:\Windows\assembly\tmp\V6NNMHGM
C:\Windows\assembly\tmp\V72OFK61
C:\Windows\assembly\tmp\V7ZQR9VS
C:\Windows\assembly\tmp\V8H0387S
C:\Windows\assembly\tmp\V8PGVFJR
C:\Windows\assembly\tmp\V99HHLSZ
C:\Windows\assembly\tmp\V9HG9YXO
C:\Windows\assembly\tmp\VB4K7MXI
C:\Windows\assembly\tmp\VBF4KAXU
C:\Windows\assembly\tmp\VCM3FFOO
C:\Windows\assembly\tmp\VD1RRLJ8
C:\Windows\assembly\tmp\VD2THCKK
C:\Windows\assembly\tmp\VEA49E64
C:\Windows\assembly\tmp\VEC6H787
C:\Windows\assembly\tmp\VEDCSDE1
C:\Windows\assembly\tmp\VEPMUCTV
C:\Windows\assembly\tmp\VEZPLW1F
C:\Windows\assembly\tmp\VF9NGNMZ
C:\Windows\assembly\tmp\VFCX16KQ
C:\Windows\assembly\tmp\VG3T48SS
C:\Windows\assembly\tmp\VGVT685N
C:\Windows\assembly\tmp\VHH1UHTA
C:\Windows\assembly\tmp\VHKLMH15
C:\Windows\assembly\tmp\VJ00W3FM
C:\Windows\assembly\tmp\VJGRW7LK
C:\Windows\assembly\tmp\VKE0LGML
C:\Windows\assembly\tmp\VLFWWRMQ
C:\Windows\assembly\tmp\VMCSIXYE
C:\Windows\assembly\tmp\VMEZ6KNA
C:\Windows\assembly\tmp\VMJ6VVBT
C:\Windows\assembly\tmp\VMNNUGLO
C:\Windows\assembly\tmp\VMUX2C3J
C:\Windows\assembly\tmp\VNFHWYLB
C:\Windows\assembly\tmp\VNR4MIV9
C:\Windows\assembly\tmp\VNXYA0AG
C:\Windows\assembly\tmp\VO1KH7UP
C:\Windows\assembly\tmp\VOCBELSJ
C:\Windows\assembly\tmp\VORQUFCA
C:\Windows\assembly\tmp\VOSXWNR0
C:\Windows\assembly\tmp\VOVCEN19
C:\Windows\assembly\tmp\VP0I0GPN
C:\Windows\assembly\tmp\VP7LDAL6
C:\Windows\assembly\tmp\VQ4A6TC7
C:\Windows\assembly\tmp\VQ6711OA
C:\Windows\assembly\tmp\VQL41DT1
C:\Windows\assembly\tmp\VR078YFA
C:\Windows\assembly\tmp\VRH4VJ2N
C:\Windows\assembly\tmp\VTF7RXVQ
C:\Windows\assembly\tmp\VTJ6IORY
C:\Windows\assembly\tmp\VUBQUYGM
C:\Windows\assembly\tmp\VUN6Z539
C:\Windows\assembly\tmp\VW52EHZQ
C:\Windows\assembly\tmp\VWIXE25X
C:\Windows\assembly\tmp\VWPGN9LW
C:\Windows\assembly\tmp\VWX6HDL8
C:\Windows\assembly\tmp\VYXR1C85
C:\Windows\assembly\tmp\W0YZL341
C:\Windows\assembly\tmp\W1FPY7FE
C:\Windows\assembly\tmp\W1SCE759
C:\Windows\assembly\tmp\W23HKNI3
C:\Windows\assembly\tmp\W2E0S9VB
C:\Windows\assembly\tmp\W2E9Z6BB
C:\Windows\assembly\tmp\W36K00S2
C:\Windows\assembly\tmp\W37U75FZ
C:\Windows\assembly\tmp\W38LC59Y
C:\Windows\assembly\tmp\W3T6BKOI
C:\Windows\assembly\tmp\W49XQEX5
C:\Windows\assembly\tmp\W4VK8ZYK
C:\Windows\assembly\tmp\W4WRPPDA
C:\Windows\assembly\tmp\W4ZTRS27
C:\Windows\assembly\tmp\W60GEQMV
C:\Windows\assembly\tmp\W6TITOC0
C:\Windows\assembly\tmp\W7XOM2S7
C:\Windows\assembly\tmp\W8SU4WNA
C:\Windows\assembly\tmp\W9EAFRK9
C:\Windows\assembly\tmp\W9SRA19B
C:\Windows\assembly\tmp\WA7E75FH
C:\Windows\assembly\tmp\WAA94F0N
C:\Windows\assembly\tmp\WAGZRRZ3
C:\Windows\assembly\tmp\WAMD2XBM
C:\Windows\assembly\tmp\WB24POI6
C:\Windows\assembly\tmp\WBH83YU4
C:\Windows\assembly\tmp\WBO0WFDX
C:\Windows\assembly\tmp\WBQOGOSQ
C:\Windows\assembly\tmp\WC1URUYK
C:\Windows\assembly\tmp\WC5EW1TN
C:\Windows\assembly\tmp\WCA10PTJ
C:\Windows\assembly\tmp\WCOVOBCO
C:\Windows\assembly\tmp\WF9E13IZ
C:\Windows\assembly\tmp\WFVY7J2L
C:\Windows\assembly\tmp\WFYMHL4Q
C:\Windows\assembly\tmp\WGDE9HN9
C:\Windows\assembly\tmp\WGXWOKNY
C:\Windows\assembly\tmp\WH7D09UH
C:\Windows\assembly\tmp\WH8NADO8
C:\Windows\assembly\tmp\WH9N6NVO
C:\Windows\assembly\tmp\WIM1CS85
C:\Windows\assembly\tmp\WJBA9OOS
C:\Windows\assembly\tmp\WL1H4FZY
C:\Windows\assembly\tmp\WL2TJSST
C:\Windows\assembly\tmp\WL5TKLF1
C:\Windows\assembly\tmp\WLI06WWU
C:\Windows\assembly\tmp\WLLO80LZ
C:\Windows\assembly\tmp\WLOGDTZJ
C:\Windows\assembly\tmp\WM4FXU8D
C:\Windows\assembly\tmp\WN3N3RA6
C:\Windows\assembly\tmp\WNCPE7EN
C:\Windows\assembly\tmp\WNXIR4JY
C:\Windows\assembly\tmp\WO38V3N9
C:\Windows\assembly\tmp\WOHQ2NO2
C:\Windows\assembly\tmp\WOTKOSM4
C:\Windows\assembly\tmp\WP0FP67N
C:\Windows\assembly\tmp\WP4K7B7W
C:\Windows\assembly\tmp\WP8VMGEV
C:\Windows\assembly\tmp\WPRGNR4N
C:\Windows\assembly\tmp\WQ11HO34
C:\Windows\assembly\tmp\WR16COZT
C:\Windows\assembly\tmp\WRR8H13J
C:\Windows\assembly\tmp\WS6MH29T
C:\Windows\assembly\tmp\WS7725M4
C:\Windows\assembly\tmp\WTIGPTA5
C:\Windows\assembly\tmp\WTIUP4RG
C:\Windows\assembly\tmp\WURPUWPX
C:\Windows\assembly\tmp\WV080UB4
C:\Windows\assembly\tmp\WVZJFIHK
C:\Windows\assembly\tmp\WW40OM3C
C:\Windows\assembly\tmp\WW765MMV
C:\Windows\assembly\tmp\WX3OLO5F
C:\Windows\assembly\tmp\WXRB2N1F
C:\Windows\assembly\tmp\WXWS7BGW
C:\Windows\assembly\tmp\WYRVNMSZ
C:\Windows\assembly\tmp\X006664B
C:\Windows\assembly\tmp\X1NAVWJE
C:\Windows\assembly\tmp\X2XALIE0
C:\Windows\assembly\tmp\X4ZHT486
C:\Windows\assembly\tmp\X5LWP82W
C:\Windows\assembly\tmp\X6R6YOQN
C:\Windows\assembly\tmp\X6XWU3R7
C:\Windows\assembly\tmp\X75NR0UT
C:\Windows\assembly\tmp\X7LUOLI2
C:\Windows\assembly\tmp\X873X9NA
C:\Windows\assembly\tmp\X8ISV7ZZ
C:\Windows\assembly\tmp\X8RBGA5Z
C:\Windows\assembly\tmp\X9TMEN99
C:\Windows\assembly\tmp\X9V2KYV0
C:\Windows\assembly\tmp\XA751IH5
C:\Windows\assembly\tmp\XADQVQX8
C:\Windows\assembly\tmp\XB05CHPR
C:\Windows\assembly\tmp\XD1INNVN
C:\Windows\assembly\tmp\XD2WLBXM
C:\Windows\assembly\tmp\XEK5S4TV
C:\Windows\assembly\tmp\XEN3ZDC5
C:\Windows\assembly\tmp\XEO02SBG
C:\Windows\assembly\tmp\XESUMY0S
C:\Windows\assembly\tmp\XF1T4NNO
C:\Windows\assembly\tmp\XFJHVX3D
C:\Windows\assembly\tmp\XGI1FOJB
C:\Windows\assembly\tmp\XGNEC5XB
C:\Windows\assembly\tmp\XGNG3XAR
C:\Windows\assembly\tmp\XHOW86XE
C:\Windows\assembly\tmp\XI8X72PS
C:\Windows\assembly\tmp\XISFQG6Z
C:\Windows\assembly\tmp\XK9O7YTZ
C:\Windows\assembly\tmp\XLC300YT
C:\Windows\assembly\tmp\XLVFRZ55
C:\Windows\assembly\tmp\XMF0O4SO
C:\Windows\assembly\tmp\XN0Q4MGV
C:\Windows\assembly\tmp\XNHOCN80
C:\Windows\assembly\tmp\XO4S7IV2
C:\Windows\assembly\tmp\XPAXZP8Y
C:\Windows\assembly\tmp\XQ1Z3Q6C
C:\Windows\assembly\tmp\XQXFVFK4
C:\Windows\assembly\tmp\XR3QHAVK
C:\Windows\assembly\tmp\XROOE35T
C:\Windows\assembly\tmp\XSAVQ8WN
C:\Windows\assembly\tmp\XSW9K0DL
C:\Windows\assembly\tmp\XSWR1WE3
C:\Windows\assembly\tmp\XT7IADVF
C:\Windows\assembly\tmp\XU31IHD3
C:\Windows\assembly\tmp\XUJQ9ENJ
C:\Windows\assembly\tmp\XUMEE4FW
C:\Windows\assembly\tmp\XWDJ0Z3E
C:\Windows\assembly\tmp\XWKY71KD
C:\Windows\assembly\tmp\XX3ZMETR
C:\Windows\assembly\tmp\XXFMWTEC
C:\Windows\assembly\tmp\XXXTA0IJ
C:\Windows\assembly\tmp\XY10LF03
C:\Windows\assembly\tmp\XY76EBHF
C:\Windows\assembly\tmp\XYNG51Q9
C:\Windows\assembly\tmp\XYVAYVDX
C:\Windows\assembly\tmp\XZ2JV4Z1
C:\Windows\assembly\tmp\XZDOD819
C:\Windows\assembly\tmp\Y0S64RKZ
C:\Windows\assembly\tmp\Y17IE711
C:\Windows\assembly\tmp\Y1OZHS0O
C:\Windows\assembly\tmp\Y1WEP56Z
C:\Windows\assembly\tmp\Y372XSFR
C:\Windows\assembly\tmp\Y4XHQZYM
C:\Windows\assembly\tmp\Y50NPNVN
C:\Windows\assembly\tmp\Y51PD7HA
C:\Windows\assembly\tmp\Y5Q95VC1
C:\Windows\assembly\tmp\Y6BTM8YV
C:\Windows\assembly\tmp\Y70WYEKX
C:\Windows\assembly\tmp\Y7VRLWZQ
C:\Windows\assembly\tmp\Y86PQZHB
C:\Windows\assembly\tmp\Y8GNOG8Z
C:\Windows\assembly\tmp\Y9Q3IR84
C:\Windows\assembly\tmp\YA27JOVF
C:\Windows\assembly\tmp\YA283RCP
C:\Windows\assembly\tmp\YA33VHU0
C:\Windows\assembly\tmp\YAV5NCFK
C:\Windows\assembly\tmp\YC0CG21F
C:\Windows\assembly\tmp\YC51R3CM
C:\Windows\assembly\tmp\YCIC72JC
C:\Windows\assembly\tmp\YCJV4P2K
C:\Windows\assembly\tmp\YD3DK787
C:\Windows\assembly\tmp\YD56TGCO
C:\Windows\assembly\tmp\YD57MOYN
C:\Windows\assembly\tmp\YDDGE7J3
C:\Windows\assembly\tmp\YDZHJ09A
C:\Windows\assembly\tmp\YERWSZ3C
C:\Windows\assembly\tmp\YF0E7XYL
C:\Windows\assembly\tmp\YFB23740
C:\Windows\assembly\tmp\YG0SJPO3
C:\Windows\assembly\tmp\YH16I5HK
C:\Windows\assembly\tmp\YI2927KF
C:\Windows\assembly\tmp\YJ20G91J
C:\Windows\assembly\tmp\YJETFJEQ
C:\Windows\assembly\tmp\YJHS1A6U
C:\Windows\assembly\tmp\YJJCMZ6F
C:\Windows\assembly\tmp\YLLSN8DN
C:\Windows\assembly\tmp\YM5XH712
C:\Windows\assembly\tmp\YM6PD8EN
C:\Windows\assembly\tmp\YMG47SXW
C:\Windows\assembly\tmp\YMWZA53B
C:\Windows\assembly\tmp\YNNLVQVZ
C:\Windows\assembly\tmp\YPGBOU5H
C:\Windows\assembly\tmp\YRR14CSQ
C:\Windows\assembly\tmp\YSTDP4HB
C:\Windows\assembly\tmp\YSVGFYQF
C:\Windows\assembly\tmp\YT505NSQ
C:\Windows\assembly\tmp\YTE8EOIX
C:\Windows\assembly\tmp\YTGHKX6C
C:\Windows\assembly\tmp\YTMMDXLU
C:\Windows\assembly\tmp\YU2DIBTZ
C:\Windows\assembly\tmp\YUR2ZLWF
C:\Windows\assembly\tmp\YURYNND4
C:\Windows\assembly\tmp\YVIQVV7V
C:\Windows\assembly\tmp\YVRDIKR2
C:\Windows\assembly\tmp\YVTN22LL
C:\Windows\assembly\tmp\YWLRYNKE
C:\Windows\assembly\tmp\YX109ZAY
C:\Windows\assembly\tmp\YXIOCMN9
C:\Windows\assembly\tmp\YY44K0BO
C:\Windows\assembly\tmp\YY56F4WX
C:\Windows\assembly\tmp\YY8OC0KN
C:\Windows\assembly\tmp\YYK0P6Q4
C:\Windows\assembly\tmp\YZO02Z1U
C:\Windows\assembly\tmp\YZSLG14C
C:\Windows\assembly\tmp\YZXYLGPK
C:\Windows\assembly\tmp\YZZ2167B
C:\Windows\assembly\tmp\Z04QJPED
C:\Windows\assembly\tmp\Z0IG2FB5
C:\Windows\assembly\tmp\Z0ZNXK29
C:\Windows\assembly\tmp\Z2AT5Y4K
C:\Windows\assembly\tmp\Z2I2A3I9
C:\Windows\assembly\tmp\Z34FM3UQ
C:\Windows\assembly\tmp\Z3BZJXOU
C:\Windows\assembly\tmp\Z3O76M2V
C:\Windows\assembly\tmp\Z4B6MFAY
C:\Windows\assembly\tmp\Z4M6258X
C:\Windows\assembly\tmp\Z5237NQE
C:\Windows\assembly\tmp\Z52I8VDN
C:\Windows\assembly\tmp\Z5HN2FAC
C:\Windows\assembly\tmp\Z5PA5XVH
C:\Windows\assembly\tmp\Z6I2962A
C:\Windows\assembly\tmp\Z6O7J9XE
C:\Windows\assembly\tmp\Z6RTKFA1
C:\Windows\assembly\tmp\Z7FLNU14
C:\Windows\assembly\tmp\Z7YFCU4B
C:\Windows\assembly\tmp\Z7ZMA8E3
C:\Windows\assembly\tmp\Z8AK7WIF
C:\Windows\assembly\tmp\Z8ZMGSSN
C:\Windows\assembly\tmp\Z95I23SO
C:\Windows\assembly\tmp\Z9JNFOKH
C:\Windows\assembly\tmp\ZA6XUNXD
C:\Windows\assembly\tmp\ZB4V9P8Y
C:\Windows\assembly\tmp\ZB8BBOI9
C:\Windows\assembly\tmp\ZBNFS9J9
C:\Windows\assembly\tmp\ZCD9A2FD
C:\Windows\assembly\tmp\ZD5XBZ0T
C:\Windows\assembly\tmp\ZDI6O6BG
C:\Windows\assembly\tmp\ZDSP4TWK
C:\Windows\assembly\tmp\ZEFY9IX7
C:\Windows\assembly\tmp\ZEPNN3XP
C:\Windows\assembly\tmp\ZETX8ZG9
C:\Windows\assembly\tmp\ZFRP6BRU
C:\Windows\assembly\tmp\ZGH6NDB8
C:\Windows\assembly\tmp\ZI82NWWX
C:\Windows\assembly\tmp\ZIOSY2RR
C:\Windows\assembly\tmp\ZJ3GGAL9
C:\Windows\assembly\tmp\ZJ7UBF2L
C:\Windows\assembly\tmp\ZJJGEAHL
C:\Windows\assembly\tmp\ZK9WX5TC
C:\Windows\assembly\tmp\ZKLCZE5P
C:\Windows\assembly\tmp\ZKXT8GTN
C:\Windows\assembly\tmp\ZKZE6S4A
C:\Windows\assembly\tmp\ZMSNENRK
C:\Windows\assembly\tmp\ZO9VIJOD
C:\Windows\assembly\tmp\ZOFPEDL5
C:\Windows\assembly\tmp\ZPAFFI32
C:\Windows\assembly\tmp\ZROG2ID2
C:\Windows\assembly\tmp\ZS0QCDF5
C:\Windows\assembly\tmp\ZSY2ZEO3
C:\Windows\assembly\tmp\ZT26RIJJ
C:\Windows\assembly\tmp\ZTHZZ6YD
C:\Windows\assembly\tmp\ZUEDHQ6T
C:\Windows\assembly\tmp\ZUSJAR9V
C:\Windows\assembly\tmp\ZV88SH6U
C:\Windows\assembly\tmp\ZVHRP3HZ
C:\Windows\assembly\tmp\ZW57IT8F
C:\Windows\assembly\tmp\ZW6TJ35S
C:\Windows\assembly\tmp\ZW9RAOEM
C:\Windows\assembly\tmp\ZWGODMEU
C:\Windows\assembly\tmp\ZWNTTFH3
C:\Windows\assembly\tmp\ZXCBTBTN
C:\Windows\assembly\tmp\ZY6IMMBE
C:\Windows\assembly\tmp\ZZE62AVC
C:\Windows\assembly\tmp\ZZWX1WQJ
C:\Windows\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-06-23 01:16

==================== End Of Log ============================

--- --- ---

schrauber · 30.06.2013, 19:49

Hi,

soweit gut

Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop.
Schließe nun alle offenen Programme und trenne Dich von dem Internet.
Doppelklick auf die TFC.exe und drücke auf Start.
Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen.

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST Log bitte. Noch Probleme?

DeniseBö · 30.06.2013, 22:40

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-06-2013 01
Ran by Pontolon (administrator) on 30-06-2013 23:32:34
Running from C:\Users\Pontolon\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AVG Technologies CZ, s.r.o.) C:\PROGRA~2\AVG\AVG2013\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgcsrva.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
() C:\Windows\SysWOW64\Rezip.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(TomTom) D:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgemca.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgui.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [11855976 2011-05-18] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2706216 2011-02-25] (Synaptics Incorporated)
HKCU\...\Run: [Epson Stylus SX430(Netzwerk)] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIHAE.EXE /FU "C:\Users\Pontolon\AppData\Local\Temp\E_S6AC1.tmp" /EF "HKCU" [x] <===== ATTENTION
HKCU\...\Run: [TomTomHOME.exe] "D:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe" [x]
HKCU\...\Run: [PlayNC Launcher]  [x]
HKCU\...\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun [18678376 2013-04-19] (Skype Technologies S.A.)
HKCU\...\Run: [Steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent [1641896 2013-06-07] (Valve Corporation)
HKCU\...\Runonce: [Uninstall C:\Users\Pontolon\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64] C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Pontolon\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64" [x]
HKCU\...\Policies\system: [DisableRegistryTools] 0
HKCU\...\Policies\system: [DisableTaskMgr] 0
MountPoints2: F - F:\SafeStick.exe
HKLM-x32\...\Run: [UpdateLBPShortCut] "C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5" [222504 2009-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [CLMLServer] "C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [103720 2009-06-03] (CyberLink)
HKLM-x32\...\Run: [UpdateP2GoShortCut] "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0" [222504 2009-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdatePDRShortCut] "C:\Program Files (x86)\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\PowerDirector" UpdateWithCreateOnce "Software\CyberLink\PowerDirector\7.0" [222504 2008-01-04] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl8] "C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe" [91432 2009-04-15] (CyberLink Corp.)
HKLM-x32\...\Run: [PDVD8LanguageShortcut] "C:\Program Files (x86)\CyberLink\PowerDVD8\Language\Language.exe" [50472 2009-04-15] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdatePPShortCut] "C:\Program Files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\PowerProducer" UpdateWithCreateOnce "Software\CyberLink\PowerProducer\5.0" [218408 2008-12-03] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdatePSTShortCut] "C:\Program Files (x86)\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\DVD Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter" [210216 2009-07-21] (CyberLink Corp.)
HKLM-x32\...\Run: [UCam_Menu] "C:\Program Files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\2.0" [222504 2009-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [EEventManager] "C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe" [979328 2010-10-12] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [946352 2012-12-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [41208 2012-12-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: []  [x]
HKLM-x32\...\Run: [AVG_UI] "C:\Program Files (x86)\AVG\AVG2013\avgui.exe" /TRAYONLY [4408368 2013-04-29] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-01-28] (Apple Inc.)
Startup: C:\ProgramData\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Start Menu\Programs\Startup\TMMonitor.lnk
ShortcutTarget: TMMonitor.lnk -> D:\Programme (x86)\MSI\ArcSoft TotalMedia\TMMonitor.exe (ArcSoft, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
SearchScopes: HKCU - {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = 
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Programme (x86)\java\jre6\bin\jp2ssv.dll No File
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MIF5BA~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
DPF: HKLM {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: HKLM-x32 {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: HKLM-x32 {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} hxxp://game.zylom.com/activex/zylomgamesplayer.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} -  No File
Handler-x32: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

==================== Services (Whitelisted) =================

R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe [4937264 2013-05-14] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [283136 2013-04-18] (AVG Technologies CZ, s.r.o.)
R2 Rezip; C:\Windows\SysWOW64\Rezip.exe [311296 2009-03-05] ()
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152 2009-07-07] ()
R2 TomTomHOMEService; D:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe [92632 2012-06-21] (TomTom)

==================== Drivers (Whitelisted) ====================

R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [246072 2013-03-29] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [71480 2013-02-08] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [206136 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [311096 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [116536 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [45880 2013-02-08] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [240952 2013-03-21] (AVG Technologies CZ, s.r.o.)
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [16776 2011-07-29] ()
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [16776 2011-07-29] ()
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9096 2011-07-29] ()
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9096 2011-07-29] ()
S3 HPMo4DE3; C:\Windows\System32\DRIVERS\HPMo4DE3.sys [25088 2011-03-09] (TPMX Electronics Ltd.)
S3 HPub4DE3; C:\Windows\System32\Drivers\HPub4DE3.sys [18432 2011-04-12] (TPMX Electronics Ltd.)
S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-09-28] ()
S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-30 23:31 - 2013-06-30 23:31 - 00000041 ____A C:\Users\Pontolon\Desktop\checkup.txt
2013-06-30 23:27 - 2013-06-30 23:27 - 00890988 ____A C:\Users\Pontolon\Downloads\SecurityCheck.exe
2013-06-30 23:27 - 2013-06-30 23:27 - 00890988 ____A C:\Users\Pontolon\Desktop\SecurityCheck.exe
2013-06-30 21:40 - 2013-06-30 21:40 - 02347384 ____A (ESET) C:\Users\Pontolon\Desktop\esetsmartinstaller_enu.exe
2013-06-30 21:40 - 2013-06-30 21:40 - 00000000 ____D C:\Program Files (x86)\ESET
2013-06-30 21:39 - 2013-06-30 21:39 - 02347384 ____A (ESET) C:\Users\Pontolon\Downloads\esetsmartinstaller_enu.exe
2013-06-30 21:29 - 2013-06-30 21:29 - 00448512 ____A (OldTimer Tools) C:\Users\Pontolon\Desktop\TFC.exe
2013-06-30 17:42 - 2013-06-30 17:43 - 00019317 ____A C:\Users\Pontolon\Desktop\Addition.txt
2013-06-30 17:42 - 2013-06-30 17:42 - 00000000 ____D C:\FRST
2013-06-30 17:39 - 2013-06-30 17:39 - 01933592 ____A (Farbar) C:\Users\Pontolon\Downloads\FRST64 (1).exe
2013-06-30 17:38 - 2013-06-30 17:38 - 01933592 ____A (Farbar) C:\Users\Pontolon\Downloads\FRST64.exe
2013-06-30 17:37 - 2013-06-30 17:37 - 01933592 ____A (Farbar) C:\Users\Pontolon\Desktop\FRST64.exe
2013-06-30 17:34 - 2013-06-30 17:34 - 00001074 ____A C:\Users\Pontolon\Desktop\JRT.txt
2013-06-30 17:30 - 2013-06-30 17:30 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Pontolon\Desktop\JRT.exe
2013-06-30 17:30 - 2013-06-30 17:30 - 00000000 ____D C:\Windows\ERUNT
2013-06-30 17:30 - 2013-06-30 17:30 - 00000000 ____D C:\JRT
2013-06-30 17:23 - 2013-06-30 17:23 - 00024277 ____A C:\Users\Pontolon\Desktop\AdwCleaner[S1].txt
2013-06-30 17:18 - 2013-06-30 17:22 - 00648201 ____A C:\Users\Pontolon\Desktop\adwcleaner.exe
2013-06-30 16:25 - 2013-06-30 16:25 - 00000162 ___AH C:\Users\Pontolon\Desktop\~$dm.odt
2013-06-29 18:16 - 2013-06-29 18:16 - 00000000 ____D C:\_OTL
2013-06-29 18:13 - 2013-06-29 18:13 - 00108144 ____A C:\Users\Pontolon\Desktop\OTL.Txt
2013-06-29 18:13 - 2013-06-29 18:13 - 00069766 ____A C:\Users\Pontolon\Desktop\Extras.Txt
2013-06-29 17:42 - 2013-06-29 17:03 - 00602112 ____A (OldTimer Tools) C:\Users\Pontolon\Desktop\OTL.exe
2013-06-29 10:47 - 2013-06-30 04:35 - 00000000 ____A C:\ProgramData\as98213.txt
2013-06-25 21:20 - 2013-06-25 21:20 - 00215096 ____A C:\Users\Pontolon\Downloads\UtilityChest.exe
2013-06-25 14:42 - 2013-06-25 14:42 - 00215088 ____A C:\Users\Pontolon\Downloads\MapsGalaxy.exe
2013-06-24 08:28 - 2013-06-29 10:51 - 00004542 ____A C:\Windows\PFRO.log
2013-06-23 01:15 - 2013-06-30 19:49 - 00001579 ____A C:\Windows\setupact.log
2013-06-23 01:15 - 2013-06-23 01:15 - 00000000 ____A C:\Windows\setuperr.log
2013-06-19 10:10 - 2013-06-19 10:25 - 00006425 ____A C:\Users\Pontolon\Desktop\dm.odt
2013-06-18 13:32 - 2013-06-18 13:32 - 00000000 ____D C:\Users\Pontolon\AppData\Roaming\PDF Architect
2013-06-18 10:37 - 2013-06-18 10:37 - 00000000 ____D C:\Users\Pontolon\AppData\Roaming\WordToPDF
2013-06-18 10:36 - 2013-06-18 10:36 - 00001280 ____A C:\Users\Pontolon\Downloads\SetupWordToPDF_237_v2.9 - Verknüpfung.lnk
2013-06-18 10:35 - 2013-06-18 10:35 - 01594813 ____A (Mario Noack                                                 ) C:\Users\Pontolon\Downloads\SetupWordToPDF_237_v2.9.exe
2013-06-18 10:35 - 2013-06-18 10:35 - 01594813 ____A (Mario Noack                                                 ) C:\Users\Pontolon\Downloads\SetupWordToPDF_237_v2.9 (1).exe
2013-06-15 21:27 - 2013-06-18 21:35 - 00000000 ____D C:\Program Files (x86)\MyPC Backup
2013-06-15 21:27 - 2013-05-07 16:51 - 00020312 ____A (Systweak Inc., (www.systweak.com)) C:\Windows\System32\roboot64.exe
2013-06-15 21:26 - 2013-06-18 21:33 - 00000000 ____D C:\Users\Pontolon\AppData\Roaming\player
2013-06-15 19:40 - 2013-06-08 16:08 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-15 19:40 - 2013-06-08 16:07 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-15 19:40 - 2013-06-08 16:06 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-15 19:40 - 2013-06-08 16:06 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-15 19:40 - 2013-06-08 16:06 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-15 19:40 - 2013-06-08 14:28 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-15 19:40 - 2013-06-08 13:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-15 19:40 - 2013-06-08 13:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-15 19:40 - 2013-06-08 13:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-15 19:40 - 2013-06-08 13:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-15 19:40 - 2013-06-08 13:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-15 19:39 - 2013-06-08 13:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-14 08:05 - 2013-05-17 03:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-14 08:05 - 2013-05-17 03:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-14 08:05 - 2013-05-17 03:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-14 08:05 - 2013-05-17 03:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-14 08:05 - 2013-05-17 03:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-06-14 08:05 - 2013-05-17 03:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-06-14 08:05 - 2013-05-17 03:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-14 08:05 - 2013-05-17 03:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-06-14 08:05 - 2013-05-17 02:59 - 02241024 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-14 08:05 - 2013-05-17 02:59 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-14 08:05 - 2013-05-17 02:58 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-14 08:05 - 2013-05-17 02:58 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-14 08:05 - 2013-05-17 02:58 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-14 08:05 - 2013-05-17 02:58 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-14 08:05 - 2013-05-17 02:58 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-14 08:05 - 2013-05-17 02:58 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-14 08:05 - 2013-05-17 02:58 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-14 08:05 - 2013-05-14 14:23 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-14 08:05 - 2013-05-14 10:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-06-14 08:04 - 2013-06-14 08:04 - 00000000 ____D C:\Users\Default\AppData\Local\Microsoft Help
2013-06-14 08:04 - 2013-06-14 08:04 - 00000000 ____D C:\Users\Default User\AppData\Local\Microsoft Help
2013-06-12 08:18 - 2013-05-13 07:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 08:18 - 2013-05-13 07:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 08:18 - 2013-05-13 07:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 08:18 - 2013-05-13 07:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 08:18 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-12 08:18 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-06-12 08:18 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-12 08:18 - 2013-05-13 05:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 08:18 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-12 08:18 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-06-12 08:18 - 2013-05-10 07:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-12 08:18 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-06-12 08:18 - 2013-05-08 08:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-12 08:18 - 2013-04-26 07:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 08:18 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-06-12 08:18 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-06-12 08:18 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-06-12 08:18 - 2013-04-17 08:24 - 01424384 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-12 08:18 - 2013-04-01 00:52 - 01887232 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-11 21:43 - 2013-06-11 21:43 - 00000000 ____D C:\Windows\PCHEALTH
2013-06-11 21:39 - 2013-06-18 20:31 - 00000000 ____D C:\Users\Pontolon\AppData\Local\Microsoft Help
2013-06-11 21:39 - 2013-06-11 21:43 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2013-06-11 21:39 - 2013-06-11 21:39 - 00000000 ____D C:\Program Files\Microsoft Office
2013-06-11 21:39 - 2013-06-11 21:39 - 00000000 ____D C:\Program Files (x86)\Microsoft Analysis Services
2013-06-11 21:38 - 2013-06-11 21:38 - 00000000 __RHD C:\MSOCache
2013-06-10 17:10 - 2013-06-10 17:10 - 02936832 ____A C:\Users\Pontolon\Downloads\Dotjosh.DayZCommander.Installer.msi
2013-06-10 17:10 - 2013-06-10 17:10 - 00000000 ____D C:\Users\Pontolon\AppData\Local\DayZCommander
2013-06-10 17:10 - 2013-06-10 17:10 - 00000000 ____D C:\Program Files (x86)\Dotjosh Studios
2013-06-10 17:07 - 2013-06-10 17:09 - 107737453 ____A C:\Users\Pontolon\Downloads\DayZ_1.7.2.5A.zip
2013-06-09 19:09 - 2013-06-09 19:16 - 00000000 ____D C:\Users\Pontolon\Documents\ArmA 2
2013-06-09 19:09 - 2013-06-09 19:10 - 00000000 ____D C:\Users\Pontolon\AppData\Local\ArmA 2
2013-06-08 00:57 - 2013-06-30 17:26 - 00000000 ____D C:\Program Files (x86)\Steam
2013-06-06 21:54 - 2013-06-15 20:16 - 00000898 ____A C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-06-01 00:02 - 2013-06-01 12:31 - 00000000 ____D C:\Users\Pontolon\AppData\Roaming\.minecraft
2013-05-31 23:59 - 2013-05-31 23:59 - 00016601 ____A C:\Users\Pontolon\Downloads\CustomMobSpawner 2.2.2.zip
2013-05-31 23:57 - 2013-05-31 23:58 - 01928217 ____A C:\Users\Pontolon\Downloads\minecraftforge-universal-1.5.2-7.8.0.684.zip
2013-05-31 18:35 - 2013-05-31 18:35 - 06228244 ____A C:\Users\Pontolon\Downloads\Derivation_5.zip
2013-05-31 18:19 - 2013-05-31 18:19 - 00097946 ____A C:\Users\Pontolon\Downloads\TooManyItems2013_04_25_1.5.2.zip
2013-05-31 15:06 - 2013-05-31 15:06 - 01417057 ____A C:\Users\Pontolon\Downloads\Withers Challenge 1.5.zip
2013-05-31 12:32 - 2013-05-31 12:32 - 00000319 ____A C:\Users\Pontolon\Downloads\allopass-codes-20130531.txt

==================== One Month Modified Files and Folders =======

2013-06-30 23:32 - 2012-03-30 08:15 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-30 23:31 - 2013-06-30 23:31 - 00000041 ____A C:\Users\Pontolon\Desktop\checkup.txt
2013-06-30 23:27 - 2013-06-30 23:27 - 00890988 ____A C:\Users\Pontolon\Downloads\SecurityCheck.exe
2013-06-30 23:27 - 2013-06-30 23:27 - 00890988 ____A C:\Users\Pontolon\Desktop\SecurityCheck.exe
2013-06-30 23:17 - 2012-03-20 21:28 - 00001108 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-30 22:38 - 2011-09-16 23:01 - 00000000 ____D C:\ProgramData\MFAData
2013-06-30 22:14 - 2013-04-07 23:30 - 01102017 ____A C:\Windows\WindowsUpdate.log
2013-06-30 21:40 - 2013-06-30 21:40 - 02347384 ____A (ESET) C:\Users\Pontolon\Desktop\esetsmartinstaller_enu.exe
2013-06-30 21:40 - 2013-06-30 21:40 - 00000000 ____D C:\Program Files (x86)\ESET
2013-06-30 21:39 - 2013-06-30 21:39 - 02347384 ____A (ESET) C:\Users\Pontolon\Downloads\esetsmartinstaller_enu.exe
2013-06-30 21:36 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\System32\NDF
2013-06-30 21:29 - 2013-06-30 21:29 - 00448512 ____A (OldTimer Tools) C:\Users\Pontolon\Desktop\TFC.exe
2013-06-30 21:28 - 2012-12-28 18:19 - 00000000 ____D C:\Users\Pontolon\AppData\Roaming\Skype
2013-06-30 19:49 - 2013-06-23 01:15 - 00001579 ____A C:\Windows\setupact.log
2013-06-30 17:43 - 2013-06-30 17:42 - 00019317 ____A C:\Users\Pontolon\Desktop\Addition.txt
2013-06-30 17:42 - 2013-06-30 17:42 - 00000000 ____D C:\FRST
2013-06-30 17:39 - 2013-06-30 17:39 - 01933592 ____A (Farbar) C:\Users\Pontolon\Downloads\FRST64 (1).exe
2013-06-30 17:38 - 2013-06-30 17:38 - 01933592 ____A (Farbar) C:\Users\Pontolon\Downloads\FRST64.exe
2013-06-30 17:38 - 2009-07-14 06:45 - 00013936 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-30 17:38 - 2009-07-14 06:45 - 00013936 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-30 17:37 - 2013-06-30 17:37 - 01933592 ____A (Farbar) C:\Users\Pontolon\Desktop\FRST64.exe
2013-06-30 17:34 - 2013-06-30 17:34 - 00001074 ____A C:\Users\Pontolon\Desktop\JRT.txt
2013-06-30 17:30 - 2013-06-30 17:30 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Pontolon\Desktop\JRT.exe
2013-06-30 17:30 - 2013-06-30 17:30 - 00000000 ____D C:\Windows\ERUNT
2013-06-30 17:30 - 2013-06-30 17:30 - 00000000 ____D C:\JRT
2013-06-30 17:26 - 2013-06-08 00:57 - 00000000 ____D C:\Program Files (x86)\Steam
2013-06-30 17:25 - 2012-03-20 21:28 - 00001104 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-06-30 17:25 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-30 17:23 - 2013-06-30 17:23 - 00024277 ____A C:\Users\Pontolon\Desktop\AdwCleaner[S1].txt
2013-06-30 17:22 - 2013-06-30 17:18 - 00648201 ____A C:\Users\Pontolon\Desktop\adwcleaner.exe
2013-06-30 16:45 - 2012-05-05 15:41 - 00000000 ____D C:\users\Pontolon
2013-06-30 16:25 - 2013-06-30 16:25 - 00000162 ___AH C:\Users\Pontolon\Desktop\~$dm.odt
2013-06-30 04:38 - 2012-06-16 17:32 - 00000000 ____D C:\Users\Pontolon\AppData\Roaming\TS3Client
2013-06-30 04:35 - 2013-06-29 10:47 - 00000000 ____A C:\ProgramData\as98213.txt
2013-06-29 18:16 - 2013-06-29 18:16 - 00000000 ____D C:\_OTL
2013-06-29 18:13 - 2013-06-29 18:13 - 00108144 ____A C:\Users\Pontolon\Desktop\OTL.Txt
2013-06-29 18:13 - 2013-06-29 18:13 - 00069766 ____A C:\Users\Pontolon\Desktop\Extras.Txt
2013-06-29 17:18 - 2013-05-09 00:59 - 00226816 __ASH C:\Users\Pontolon\Desktop\Thumbs.db
2013-06-29 17:08 - 2009-12-15 23:59 - 00696870 ____A C:\Windows\System32\perfh007.dat
2013-06-29 17:08 - 2009-12-15 23:59 - 00148134 ____A C:\Windows\System32\perfc007.dat
2013-06-29 17:08 - 2009-07-14 07:13 - 01612484 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-29 17:03 - 2013-06-29 17:42 - 00602112 ____A (OldTimer Tools) C:\Users\Pontolon\Desktop\OTL.exe
2013-06-29 10:51 - 2013-06-24 08:28 - 00004542 ____A C:\Windows\PFRO.log
2013-06-26 21:25 - 2009-07-14 07:32 - 00000000 ____D C:\Windows\System32\FxsTmp
2013-06-25 21:20 - 2013-06-25 21:20 - 00215096 ____A C:\Users\Pontolon\Downloads\UtilityChest.exe
2013-06-25 14:42 - 2013-06-25 14:42 - 00215088 ____A C:\Users\Pontolon\Downloads\MapsGalaxy.exe
2013-06-23 01:15 - 2013-06-23 01:15 - 00000000 ____A C:\Windows\setuperr.log
2013-06-19 10:25 - 2013-06-19 10:10 - 00006425 ____A C:\Users\Pontolon\Desktop\dm.odt
2013-06-19 10:05 - 2013-04-08 13:46 - 00000000 ____D C:\Users\Pontolon\Desktop\Dunja Bewerbungen
2013-06-18 21:35 - 2013-06-15 21:27 - 00000000 ____D C:\Program Files (x86)\MyPC Backup
2013-06-18 21:33 - 2013-06-15 21:26 - 00000000 ____D C:\Users\Pontolon\AppData\Roaming\player
2013-06-18 21:16 - 2012-05-05 15:42 - 00000000 ____D C:\Users\Pontolon\AppData\Local\VirtualStore
2013-06-18 20:31 - 2013-06-11 21:39 - 00000000 ____D C:\Users\Pontolon\AppData\Local\Microsoft Help
2013-06-18 13:32 - 2013-06-18 13:32 - 00000000 ____D C:\Users\Pontolon\AppData\Roaming\PDF Architect
2013-06-18 10:37 - 2013-06-18 10:37 - 00000000 ____D C:\Users\Pontolon\AppData\Roaming\WordToPDF
2013-06-18 10:36 - 2013-06-18 10:36 - 00001280 ____A C:\Users\Pontolon\Downloads\SetupWordToPDF_237_v2.9 - Verknüpfung.lnk
2013-06-18 10:35 - 2013-06-18 10:35 - 01594813 ____A (Mario Noack                                                 ) C:\Users\Pontolon\Downloads\SetupWordToPDF_237_v2.9.exe
2013-06-18 10:35 - 2013-06-18 10:35 - 01594813 ____A (Mario Noack                                                 ) C:\Users\Pontolon\Downloads\SetupWordToPDF_237_v2.9 (1).exe
2013-06-16 23:55 - 2011-09-16 13:31 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-15 20:26 - 2009-08-02 04:27 - 00000000 ____D C:\Windows\Panther
2013-06-15 20:20 - 2013-04-07 01:53 - 00000000 ____D C:\Users\Pontolon\AppData\Local\Unity
2013-06-15 20:19 - 2013-04-07 21:44 - 00000000 ____D C:\Program Files (x86)\VS Revo Group
2013-06-15 20:16 - 2013-06-06 21:54 - 00000898 ____A C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-06-15 20:15 - 2012-05-17 22:56 - 00000000 ____D C:\Users\Pontolon\AppData\Local\Google
2013-06-15 20:15 - 2012-05-17 22:56 - 00000000 ____D C:\ProgramData\Google
2013-06-15 20:15 - 2012-05-17 22:56 - 00000000 ____D C:\Program Files (x86)\Google
2013-06-15 20:08 - 2013-04-06 22:25 - 00000000 ____D C:\BrickForce
2013-06-15 19:44 - 2011-09-22 20:20 - 01590378 ____A C:\Windows\SysWOW64\PerfStringBackup.INI
2013-06-14 11:13 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-06-14 08:05 - 2011-09-16 20:02 - 75825640 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-14 08:04 - 2013-06-14 08:04 - 00000000 ____D C:\Users\Default\AppData\Local\Microsoft Help
2013-06-14 08:04 - 2013-06-14 08:04 - 00000000 ____D C:\Users\Default User\AppData\Local\Microsoft Help
2013-06-12 14:32 - 2012-03-30 08:15 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-12 14:32 - 2011-09-16 21:40 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-12 09:38 - 2013-01-29 17:41 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-06-12 09:38 - 2011-11-10 20:42 - 00000000 ____D C:\ProgramData\Skype
2013-06-12 09:35 - 2009-07-14 06:45 - 00386672 ____A C:\Windows\System32\FNTCACHE.DAT
2013-06-11 22:05 - 2012-05-05 16:02 - 00101744 ____A C:\Users\Pontolon\AppData\Local\GDIPFONTCACHEV1.DAT
2013-06-11 21:43 - 2013-06-11 21:43 - 00000000 ____D C:\Windows\PCHEALTH
2013-06-11 21:43 - 2013-06-11 21:39 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2013-06-11 21:42 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-06-11 21:39 - 2013-06-11 21:39 - 00000000 ____D C:\Program Files\Microsoft Office
2013-06-11 21:39 - 2013-06-11 21:39 - 00000000 ____D C:\Program Files (x86)\Microsoft Analysis Services
2013-06-11 21:39 - 2009-12-15 23:47 - 00000000 ____D C:\Windows\ShellNew
2013-06-11 21:38 - 2013-06-11 21:38 - 00000000 __RHD C:\MSOCache
2013-06-10 17:10 - 2013-06-10 17:10 - 02936832 ____A C:\Users\Pontolon\Downloads\Dotjosh.DayZCommander.Installer.msi
2013-06-10 17:10 - 2013-06-10 17:10 - 00000000 ____D C:\Users\Pontolon\AppData\Local\DayZCommander
2013-06-10 17:10 - 2013-06-10 17:10 - 00000000 ____D C:\Program Files (x86)\Dotjosh Studios
2013-06-10 17:09 - 2013-06-10 17:07 - 107737453 ____A C:\Users\Pontolon\Downloads\DayZ_1.7.2.5A.zip
2013-06-09 19:16 - 2013-06-09 19:09 - 00000000 ____D C:\Users\Pontolon\Documents\ArmA 2
2013-06-09 19:10 - 2013-06-09 19:09 - 00000000 ____D C:\Users\Pontolon\AppData\Local\ArmA 2
2013-06-08 16:08 - 2013-06-15 19:40 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-08 16:07 - 2013-06-15 19:40 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-08 16:06 - 2013-06-15 19:40 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-08 16:06 - 2013-06-15 19:40 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-08 16:06 - 2013-06-15 19:40 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-08 14:28 - 2013-06-15 19:40 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-08 13:42 - 2013-06-15 19:40 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-08 13:40 - 2013-06-15 19:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-08 13:40 - 2013-06-15 19:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-08 13:40 - 2013-06-15 19:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-08 13:40 - 2013-06-15 19:39 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-08 13:13 - 2013-06-15 19:40 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-03 15:19 - 2012-10-04 10:12 - 00000000 ____D C:\Users\Pontolon\AppData\Local\Windows Live
2013-06-01 12:31 - 2013-06-01 00:02 - 00000000 ____D C:\Users\Pontolon\AppData\Roaming\.minecraft
2013-05-31 23:59 - 2013-05-31 23:59 - 00016601 ____A C:\Users\Pontolon\Downloads\CustomMobSpawner 2.2.2.zip
2013-05-31 23:58 - 2013-05-31 23:57 - 01928217 ____A C:\Users\Pontolon\Downloads\minecraftforge-universal-1.5.2-7.8.0.684.zip
2013-05-31 18:35 - 2013-05-31 18:35 - 06228244 ____A C:\Users\Pontolon\Downloads\Derivation_5.zip
2013-05-31 18:19 - 2013-05-31 18:19 - 00097946 ____A C:\Users\Pontolon\Downloads\TooManyItems2013_04_25_1.5.2.zip
2013-05-31 15:06 - 2013-05-31 15:06 - 01417057 ____A C:\Users\Pontolon\Downloads\Withers Challenge 1.5.zip
2013-05-31 12:32 - 2013-05-31 12:32 - 00000319 ____A C:\Users\Pontolon\Downloads\allopass-codes-20130531.txt

ZeroAccess:
C:\Windows\assembly\tmp
C:\Windows\assembly\tmp\01LCPS7R
C:\Windows\assembly\tmp\01Z28C9E
C:\Windows\assembly\tmp\027OTBUF
C:\Windows\assembly\tmp\02O2DKOV
C:\Windows\assembly\tmp\04E2P0OP
C:\Windows\assembly\tmp\04ZIP9D0
C:\Windows\assembly\tmp\05J5Y2UX
C:\Windows\assembly\tmp\05P17FV9
C:\Windows\assembly\tmp\05V73462
C:\Windows\assembly\tmp\0661HXHK
C:\Windows\assembly\tmp\06TOV8UQ
C:\Windows\assembly\tmp\06V7N6N2
C:\Windows\assembly\tmp\072YJFSQ
C:\Windows\assembly\tmp\07TRCS89
C:\Windows\assembly\tmp\0863VGF9
C:\Windows\assembly\tmp\08BES79W
C:\Windows\assembly\tmp\08L643Q2
C:\Windows\assembly\tmp\08TGCNFD
C:\Windows\assembly\tmp\09YO4T0B
C:\Windows\assembly\tmp\0AZ0DTFA
C:\Windows\assembly\tmp\0B8YS3DZ
C:\Windows\assembly\tmp\0BE95IVL
C:\Windows\assembly\tmp\0C22JSPW
C:\Windows\assembly\tmp\0CN4Q804
C:\Windows\assembly\tmp\0CYZ8ZV5
C:\Windows\assembly\tmp\0E58DZGY
C:\Windows\assembly\tmp\0E9ZYZBG
C:\Windows\assembly\tmp\0ESCBMWH
C:\Windows\assembly\tmp\0FL5RXBF
C:\Windows\assembly\tmp\0GMAIHPE
C:\Windows\assembly\tmp\0GP0CV75
C:\Windows\assembly\tmp\0H0BH9JP
C:\Windows\assembly\tmp\0IBJ3481
C:\Windows\assembly\tmp\0IV4KFF7
C:\Windows\assembly\tmp\0J78AO5A
C:\Windows\assembly\tmp\0JJY8PBZ
C:\Windows\assembly\tmp\0L9LK3X3
C:\Windows\assembly\tmp\0LJ9LK49
C:\Windows\assembly\tmp\0LUZ64EN
C:\Windows\assembly\tmp\0LW395IK
C:\Windows\assembly\tmp\0MP007TE
C:\Windows\assembly\tmp\0N60P44W
C:\Windows\assembly\tmp\0O6DQ36O
C:\Windows\assembly\tmp\0OFJU9NW
C:\Windows\assembly\tmp\0P4574VE
C:\Windows\assembly\tmp\0Q8IWL14
C:\Windows\assembly\tmp\0QYJWBY9
C:\Windows\assembly\tmp\0R920OUU
C:\Windows\assembly\tmp\0RRSA12I
C:\Windows\assembly\tmp\0SNRX1WW
C:\Windows\assembly\tmp\0T3QN2AR
C:\Windows\assembly\tmp\0U3JZ6NR
C:\Windows\assembly\tmp\0U6GZJU2
C:\Windows\assembly\tmp\0UFW05NZ
C:\Windows\assembly\tmp\0UJ92X96
C:\Windows\assembly\tmp\0V9Y0YN3
C:\Windows\assembly\tmp\0VLMGHJQ
C:\Windows\assembly\tmp\0W6LIPIW
C:\Windows\assembly\tmp\0WFNBN8H
C:\Windows\assembly\tmp\0WTGYWXD
C:\Windows\assembly\tmp\0Y13HTAP
C:\Windows\assembly\tmp\0Y2FZB8V
C:\Windows\assembly\tmp\0YCP6UOR
C:\Windows\assembly\tmp\0ZZD0W9I
C:\Windows\assembly\tmp\10NUWQNF
C:\Windows\assembly\tmp\11BTDEHI
C:\Windows\assembly\tmp\126I6V4A
C:\Windows\assembly\tmp\12DBFZSN
C:\Windows\assembly\tmp\135UA4ZJ
C:\Windows\assembly\tmp\13QST77E
C:\Windows\assembly\tmp\13VS3GD6
C:\Windows\assembly\tmp\14CYX8LN
C:\Windows\assembly\tmp\159DNM4O
C:\Windows\assembly\tmp\1602EH55
C:\Windows\assembly\tmp\168WIJ03
C:\Windows\assembly\tmp\17Z2CEOL
C:\Windows\assembly\tmp\17ZP59CC
C:\Windows\assembly\tmp\18GEV9HL
C:\Windows\assembly\tmp\19O5KFNH
C:\Windows\assembly\tmp\1D63DVX0
C:\Windows\assembly\tmp\1DO6YGQN
C:\Windows\assembly\tmp\1E0K59UZ
C:\Windows\assembly\tmp\1EQ2DH6Q
C:\Windows\assembly\tmp\1ES2SWMZ
C:\Windows\assembly\tmp\1HD597QH
C:\Windows\assembly\tmp\1HQ619P5
C:\Windows\assembly\tmp\1HTQ4E8C
C:\Windows\assembly\tmp\1IHJU2O8
C:\Windows\assembly\tmp\1IS93BZN
C:\Windows\assembly\tmp\1JYBBSNO
C:\Windows\assembly\tmp\1JZ6ARLZ
C:\Windows\assembly\tmp\1K2BW3T2
C:\Windows\assembly\tmp\1KEDGWXB
C:\Windows\assembly\tmp\1KU4AGUK
C:\Windows\assembly\tmp\1LNHMYTB
C:\Windows\assembly\tmp\1M158DPB
C:\Windows\assembly\tmp\1MJPAROW
C:\Windows\assembly\tmp\1MJR5JWP
C:\Windows\assembly\tmp\1MMXOFLW
C:\Windows\assembly\tmp\1N36O8B1
C:\Windows\assembly\tmp\1N619QGN
C:\Windows\assembly\tmp\1N94PQ9V
C:\Windows\assembly\tmp\1NIVG18N
C:\Windows\assembly\tmp\1NKAZ7WA
C:\Windows\assembly\tmp\1NOEH9F9
C:\Windows\assembly\tmp\1O19D4TQ
C:\Windows\assembly\tmp\1Q6Q8RVA
C:\Windows\assembly\tmp\1QM4ML8D
C:\Windows\assembly\tmp\1SIR1CR9
C:\Windows\assembly\tmp\1SMAMUQN
C:\Windows\assembly\tmp\1TP4UAI5
C:\Windows\assembly\tmp\1TXOQYPZ
C:\Windows\assembly\tmp\1UGHQHRO
C:\Windows\assembly\tmp\1V5P9QQF
C:\Windows\assembly\tmp\1V9DF6C2
C:\Windows\assembly\tmp\1VFKAI2J
C:\Windows\assembly\tmp\1X668DNT
C:\Windows\assembly\tmp\1XC655LE
C:\Windows\assembly\tmp\1XIN37ZW
C:\Windows\assembly\tmp\1ZY3MKHU
C:\Windows\assembly\tmp\2079F0TH
C:\Windows\assembly\tmp\20PJIYHX
C:\Windows\assembly\tmp\20SXEOF1
C:\Windows\assembly\tmp\20TIMZ6Y
C:\Windows\assembly\tmp\2130VZB3
C:\Windows\assembly\tmp\2139FJ4S
C:\Windows\assembly\tmp\21S09XOZ
C:\Windows\assembly\tmp\226SLA5H
C:\Windows\assembly\tmp\22DCLKRN
C:\Windows\assembly\tmp\22KW37U2
C:\Windows\assembly\tmp\22QNLJ3C
C:\Windows\assembly\tmp\24Z2X7MF
C:\Windows\assembly\tmp\25FQFXX6
C:\Windows\assembly\tmp\25MW0KH7
C:\Windows\assembly\tmp\25O11WLD
C:\Windows\assembly\tmp\25X4O2CQ
C:\Windows\assembly\tmp\26AK9KNX
C:\Windows\assembly\tmp\26E4FVUO
C:\Windows\assembly\tmp\27JK9OOD
C:\Windows\assembly\tmp\28FH5KKR
C:\Windows\assembly\tmp\28NJ4PXY
C:\Windows\assembly\tmp\28ZKX2K7
C:\Windows\assembly\tmp\2B9O15GJ
C:\Windows\assembly\tmp\2BFSC45Q
C:\Windows\assembly\tmp\2BISFI8J
C:\Windows\assembly\tmp\2BZO89TZ
C:\Windows\assembly\tmp\2CGNDOIY
C:\Windows\assembly\tmp\2CNYE58Y
C:\Windows\assembly\tmp\2CWMCVVB
C:\Windows\assembly\tmp\2D3GM378
C:\Windows\assembly\tmp\2D7NXDGS
C:\Windows\assembly\tmp\2DQ5IQKY
C:\Windows\assembly\tmp\2EFBCHOG
C:\Windows\assembly\tmp\2F2R41UG
C:\Windows\assembly\tmp\2GSHQ2C6
C:\Windows\assembly\tmp\2IFNO3FV
C:\Windows\assembly\tmp\2IICND4W
C:\Windows\assembly\tmp\2ILRU2U4
C:\Windows\assembly\tmp\2IN0IJV0
C:\Windows\assembly\tmp\2IU2IZ8O
C:\Windows\assembly\tmp\2J1Y9BQV
C:\Windows\assembly\tmp\2J6XTNR3
C:\Windows\assembly\tmp\2KABNKUK
C:\Windows\assembly\tmp\2MDA9D1W
C:\Windows\assembly\tmp\2NGM5AGV
C:\Windows\assembly\tmp\2O8VJCDF
C:\Windows\assembly\tmp\2PEU13LU
C:\Windows\assembly\tmp\2PY0MFIC
C:\Windows\assembly\tmp\2QISP1GT
C:\Windows\assembly\tmp\2QLH2FX7
C:\Windows\assembly\tmp\2QNO65V8
C:\Windows\assembly\tmp\2QXFJ5UQ
C:\Windows\assembly\tmp\2R2HDCS6
C:\Windows\assembly\tmp\2RA840C9
C:\Windows\assembly\tmp\2SIUEXYI
C:\Windows\assembly\tmp\2SK4DU0M
C:\Windows\assembly\tmp\2SO5XIW7
C:\Windows\assembly\tmp\2TAERHD0
C:\Windows\assembly\tmp\2TVM14H1
C:\Windows\assembly\tmp\2XS68R4E
C:\Windows\assembly\tmp\2Z5R43DU
C:\Windows\assembly\tmp\2ZGGLE2L
C:\Windows\assembly\tmp\2ZZWA86D
C:\Windows\assembly\tmp\30ROE94Y
C:\Windows\assembly\tmp\3167O89O
C:\Windows\assembly\tmp\31UO9B9N
C:\Windows\assembly\tmp\31YQ2RBB
C:\Windows\assembly\tmp\32WJBT75
C:\Windows\assembly\tmp\33UUVAVO
C:\Windows\assembly\tmp\34ITVT6I
C:\Windows\assembly\tmp\350BC66H
C:\Windows\assembly\tmp\35JVDFQ3
C:\Windows\assembly\tmp\35WA8EN3
C:\Windows\assembly\tmp\35Z7T23E
C:\Windows\assembly\tmp\36SQ4KWD
C:\Windows\assembly\tmp\36X9DH2B
C:\Windows\assembly\tmp\36XL7JIY
C:\Windows\assembly\tmp\37E6POSD
C:\Windows\assembly\tmp\37THJ8X8
C:\Windows\assembly\tmp\384UJRKN
C:\Windows\assembly\tmp\38DZ93GZ
C:\Windows\assembly\tmp\38U2WQUD
C:\Windows\assembly\tmp\39FROJWV
C:\Windows\assembly\tmp\39KTM42D
C:\Windows\assembly\tmp\3ACC3P06
C:\Windows\assembly\tmp\3CHJLDJS
C:\Windows\assembly\tmp\3CS32I5Y
C:\Windows\assembly\tmp\3DFDLRKY
C:\Windows\assembly\tmp\3DJG1UQG
C:\Windows\assembly\tmp\3DZSTCX9
C:\Windows\assembly\tmp\3E31VI83
C:\Windows\assembly\tmp\3E5JCBYQ
C:\Windows\assembly\tmp\3E7GU17M
C:\Windows\assembly\tmp\3GOWBG95
C:\Windows\assembly\tmp\3GQ9FM26
C:\Windows\assembly\tmp\3HZGZXC5
C:\Windows\assembly\tmp\3IRWK1HJ
C:\Windows\assembly\tmp\3JAG212B
C:\Windows\assembly\tmp\3JT2W6UH
C:\Windows\assembly\tmp\3JXL4KCW
C:\Windows\assembly\tmp\3LC4U2T2
C:\Windows\assembly\tmp\3LDXIOX2
C:\Windows\assembly\tmp\3LIFV04D
C:\Windows\assembly\tmp\3LOI3GUN
C:\Windows\assembly\tmp\3M2CYZDU
C:\Windows\assembly\tmp\3MPA5TZS
C:\Windows\assembly\tmp\3MPSSCI7
C:\Windows\assembly\tmp\3MZSQYLG
C:\Windows\assembly\tmp\3N8T921R
C:\Windows\assembly\tmp\3NN3IP65
C:\Windows\assembly\tmp\3NRB8TSR
C:\Windows\assembly\tmp\3OTVIGPB
C:\Windows\assembly\tmp\3QIL5HJQ
C:\Windows\assembly\tmp\3RLZCBHD
C:\Windows\assembly\tmp\3TFUYMLX
C:\Windows\assembly\tmp\3TGKA6A4
C:\Windows\assembly\tmp\3TLNJ43A
C:\Windows\assembly\tmp\3TQ1S4DA
C:\Windows\assembly\tmp\3TR3BIIW
C:\Windows\assembly\tmp\3VIYQVKI
C:\Windows\assembly\tmp\3VRRN3AS
C:\Windows\assembly\tmp\3VYZGTQ2
C:\Windows\assembly\tmp\3W8IJ96W
C:\Windows\assembly\tmp\3WG7KKDJ
C:\Windows\assembly\tmp\3WJ62WQ1
C:\Windows\assembly\tmp\3WKBSRLI
C:\Windows\assembly\tmp\3WXK4WB2
C:\Windows\assembly\tmp\3X0DOP9X
C:\Windows\assembly\tmp\3XPUGHXL
C:\Windows\assembly\tmp\3XQWIOTG
C:\Windows\assembly\tmp\3Y4IAPNQ
C:\Windows\assembly\tmp\3YK721N7
C:\Windows\assembly\tmp\3Z0RV6TS
C:\Windows\assembly\tmp\3Z2P7K3Z
C:\Windows\assembly\tmp\3ZDOVALS
C:\Windows\assembly\tmp\3ZTC5GTF
C:\Windows\assembly\tmp\415DC2BU
C:\Windows\assembly\tmp\41EF50GF
C:\Windows\assembly\tmp\4245Q7SD
C:\Windows\assembly\tmp\42VIZK20
C:\Windows\assembly\tmp\445JCD9B
C:\Windows\assembly\tmp\44CRGUU5
C:\Windows\assembly\tmp\44ZS093B
C:\Windows\assembly\tmp\471X4EB3
C:\Windows\assembly\tmp\474UHT03
C:\Windows\assembly\tmp\476XCL01
C:\Windows\assembly\tmp\477F7MKM
C:\Windows\assembly\tmp\47H24ZCZ
C:\Windows\assembly\tmp\47LL5115
C:\Windows\assembly\tmp\48ZWJQNQ
C:\Windows\assembly\tmp\491TTMNQ
C:\Windows\assembly\tmp\496FMC8N
C:\Windows\assembly\tmp\496PVPF9
C:\Windows\assembly\tmp\49IUWBUJ
C:\Windows\assembly\tmp\49TI08OL
C:\Windows\assembly\tmp\4AL2C35Q
C:\Windows\assembly\tmp\4B4PLM3A
C:\Windows\assembly\tmp\4BCC6EN2
C:\Windows\assembly\tmp\4BQNI1ZT
C:\Windows\assembly\tmp\4BU214TE
C:\Windows\assembly\tmp\4C7RJFVT
C:\Windows\assembly\tmp\4CTJ0YLQ
C:\Windows\assembly\tmp\4CU71LL8
C:\Windows\assembly\tmp\4D9F50CH
C:\Windows\assembly\tmp\4DXUIYZF
C:\Windows\assembly\tmp\4DZKNVTF
C:\Windows\assembly\tmp\4EHNWPL6
C:\Windows\assembly\tmp\4F361NUO
C:\Windows\assembly\tmp\4G5EP1TW
C:\Windows\assembly\tmp\4GSLGW27
C:\Windows\assembly\tmp\4GXBW862
C:\Windows\assembly\tmp\4JJ4YLTR
C:\Windows\assembly\tmp\4JZVY1DP
C:\Windows\assembly\tmp\4K0O9G5U
C:\Windows\assembly\tmp\4LG6UKVH
C:\Windows\assembly\tmp\4MM37C3F
C:\Windows\assembly\tmp\4NDFTL55
C:\Windows\assembly\tmp\4NRL8JHC
C:\Windows\assembly\tmp\4OIGCIKX
C:\Windows\assembly\tmp\4OKFFQ5G
C:\Windows\assembly\tmp\4ORGHMA2
C:\Windows\assembly\tmp\4OWBU6WK
C:\Windows\assembly\tmp\4P7KMPGO
C:\Windows\assembly\tmp\4PAKZ1WG
C:\Windows\assembly\tmp\4QJSWEFE
C:\Windows\assembly\tmp\4QKON3N5
C:\Windows\assembly\tmp\4R8C6RRN
C:\Windows\assembly\tmp\4R8FMA21
C:\Windows\assembly\tmp\4RGESNKK
C:\Windows\assembly\tmp\4SMYS8LS
C:\Windows\assembly\tmp\4T32F5WR
C:\Windows\assembly\tmp\4TJPCTZ2
C:\Windows\assembly\tmp\4UTN0C44
C:\Windows\assembly\tmp\4UX5SHO2
C:\Windows\assembly\tmp\4VR6GDIH
C:\Windows\assembly\tmp\4VWR86PZ
C:\Windows\assembly\tmp\4XAEIC4T
C:\Windows\assembly\tmp\4XFVOTJY
C:\Windows\assembly\tmp\4YT1W7KS
C:\Windows\assembly\tmp\4ZVU14EH
C:\Windows\assembly\tmp\4ZWIR48B
C:\Windows\assembly\tmp\5095PITS
C:\Windows\assembly\tmp\50ZJRHNN
C:\Windows\assembly\tmp\512UBIVW
C:\Windows\assembly\tmp\51TEX2MZ
C:\Windows\assembly\tmp\520FX0P0
C:\Windows\assembly\tmp\52FZBT98
C:\Windows\assembly\tmp\53A516BG
C:\Windows\assembly\tmp\53HYV1DN
C:\Windows\assembly\tmp\554BWZ8N
C:\Windows\assembly\tmp\55L6ZOCJ
C:\Windows\assembly\tmp\55ZG8L55
C:\Windows\assembly\tmp\57LXDYID
C:\Windows\assembly\tmp\57MLF7R5
C:\Windows\assembly\tmp\57P8A5RX
C:\Windows\assembly\tmp\59469XG3
C:\Windows\assembly\tmp\59TSN342
C:\Windows\assembly\tmp\5AKQPSVJ
C:\Windows\assembly\tmp\5AKQSB3S
C:\Windows\assembly\tmp\5CI0PJPV
C:\Windows\assembly\tmp\5CNOO13T
C:\Windows\assembly\tmp\5DMERA4S
C:\Windows\assembly\tmp\5E96O769
C:\Windows\assembly\tmp\5E9ADNXS
C:\Windows\assembly\tmp\5FJB1KYT
C:\Windows\assembly\tmp\5FNK97X4
C:\Windows\assembly\tmp\5FWU4OFS
C:\Windows\assembly\tmp\5FXFZDTW
C:\Windows\assembly\tmp\5G4U9M6V
C:\Windows\assembly\tmp\5GDVZJL9
C:\Windows\assembly\tmp\5GHQSQ4V
C:\Windows\assembly\tmp\5GPESRFT
C:\Windows\assembly\tmp\5GQWZ7XB
C:\Windows\assembly\tmp\5GYN1P46
C:\Windows\assembly\tmp\5HP2TCEY
C:\Windows\assembly\tmp\5HPF54PW
C:\Windows\assembly\tmp\5J46H7PU
C:\Windows\assembly\tmp\5JGYNOKI
C:\Windows\assembly\tmp\5JI06R6I
C:\Windows\assembly\tmp\5JQ93T2D
C:\Windows\assembly\tmp\5KMBCKJ3
C:\Windows\assembly\tmp\5L8N0D82
C:\Windows\assembly\tmp\5LJGN1A8
C:\Windows\assembly\tmp\5M1JW4GJ
C:\Windows\assembly\tmp\5MOXL0LN
C:\Windows\assembly\tmp\5MQMQJ2F
C:\Windows\assembly\tmp\5N40BNPH
C:\Windows\assembly\tmp\5NBABDRS
C:\Windows\assembly\tmp\5NBWJBPZ
C:\Windows\assembly\tmp\5NL9PDVH
C:\Windows\assembly\tmp\5NLHU64X
C:\Windows\assembly\tmp\5NRK85TW
C:\Windows\assembly\tmp\5OKKBDZP
C:\Windows\assembly\tmp\5P5ZBB48
C:\Windows\assembly\tmp\5PUNEFCR
C:\Windows\assembly\tmp\5SDZLJ3X
C:\Windows\assembly\tmp\5SUO3HU5
C:\Windows\assembly\tmp\5SUTITYQ
C:\Windows\assembly\tmp\5W71J05E
C:\Windows\assembly\tmp\5W8PR132
C:\Windows\assembly\tmp\5WHD3VDT
C:\Windows\assembly\tmp\5WHWSZYK
C:\Windows\assembly\tmp\5XR7U5H1
C:\Windows\assembly\tmp\5YP9TJKU
C:\Windows\assembly\tmp\5YXB0K29
C:\Windows\assembly\tmp\5YYAK9O7
C:\Windows\assembly\tmp\5ZF0PVDV
C:\Windows\assembly\tmp\5ZMU1400
C:\Windows\assembly\tmp\5ZY4HSUI
C:\Windows\assembly\tmp\6050ZAP5
C:\Windows\assembly\tmp\60JIV354
C:\Windows\assembly\tmp\61JAUVD6
C:\Windows\assembly\tmp\61JRYQD7
C:\Windows\assembly\tmp\622MW6A5
C:\Windows\assembly\tmp\63ILJDP6
C:\Windows\assembly\tmp\647YG3L8
C:\Windows\assembly\tmp\652MQLPL
C:\Windows\assembly\tmp\67GBKA1C
C:\Windows\assembly\tmp\67JGZZB8
C:\Windows\assembly\tmp\69WRNC8A
C:\Windows\assembly\tmp\6BSU7W5Z
C:\Windows\assembly\tmp\6DK1FLFT
C:\Windows\assembly\tmp\6DRALRT9
C:\Windows\assembly\tmp\6ECD12OK
C:\Windows\assembly\tmp\6EZDKR2N
C:\Windows\assembly\tmp\6F3P8O20
C:\Windows\assembly\tmp\6FL91W95
C:\Windows\assembly\tmp\6G3U6SO3
C:\Windows\assembly\tmp\6HANXBLL
C:\Windows\assembly\tmp\6I1YDAMF
C:\Windows\assembly\tmp\6IDIJJVU
C:\Windows\assembly\tmp\6J23T0IE
C:\Windows\assembly\tmp\6JOPQMCT
C:\Windows\assembly\tmp\6L6ICF78
C:\Windows\assembly\tmp\6L6TETRF
C:\Windows\assembly\tmp\6L8VYZV8
C:\Windows\assembly\tmp\6LHA1OHB
C:\Windows\assembly\tmp\6LSIBI6V
C:\Windows\assembly\tmp\6LZP07G3
C:\Windows\assembly\tmp\6M7ULFA1
C:\Windows\assembly\tmp\6MPJWIXY
C:\Windows\assembly\tmp\6MY7M3V3
C:\Windows\assembly\tmp\6NHWRDO3
C:\Windows\assembly\tmp\6O8KXF21
C:\Windows\assembly\tmp\6OEY8MJL
C:\Windows\assembly\tmp\6OVXUZ14
C:\Windows\assembly\tmp\6P5CJUZI
C:\Windows\assembly\tmp\6PH4UI2I
C:\Windows\assembly\tmp\6PQSCVDH
C:\Windows\assembly\tmp\6RAM9VYK
C:\Windows\assembly\tmp\6RPJOH8Y
C:\Windows\assembly\tmp\6SJJLCSZ
C:\Windows\assembly\tmp\6SYF69H2
C:\Windows\assembly\tmp\6TXO2BEP
C:\Windows\assembly\tmp\6UXPB9A2
C:\Windows\assembly\tmp\6V0LFM80
C:\Windows\assembly\tmp\6W4X48AA
C:\Windows\assembly\tmp\6Y6DWDS3
C:\Windows\assembly\tmp\6Y7AR409
C:\Windows\assembly\tmp\6Z31LM10
C:\Windows\assembly\tmp\6ZB594KQ
C:\Windows\assembly\tmp\6ZGSZWO6
C:\Windows\assembly\tmp\6ZMYSQS8
C:\Windows\assembly\tmp\70OWG7DX
C:\Windows\assembly\tmp\718YX5JG
C:\Windows\assembly\tmp\72NEULGD
C:\Windows\assembly\tmp\73DW7CHO
C:\Windows\assembly\tmp\73J2CKXB
C:\Windows\assembly\tmp\73Y0NBXC
C:\Windows\assembly\tmp\747OSC4T
C:\Windows\assembly\tmp\74I4UTVJ
C:\Windows\assembly\tmp\74Z96DDZ
C:\Windows\assembly\tmp\756SL7P6
C:\Windows\assembly\tmp\75JVJ9I9
C:\Windows\assembly\tmp\75KNVH3H
C:\Windows\assembly\tmp\76JG5A7Q
C:\Windows\assembly\tmp\77FU71NK
C:\Windows\assembly\tmp\77HJGYYL
C:\Windows\assembly\tmp\77Z5JSGQ
C:\Windows\assembly\tmp\783LNFQR
C:\Windows\assembly\tmp\78G595HV
C:\Windows\assembly\tmp\790KTDL3
C:\Windows\assembly\tmp\79ZFP0PX
C:\Windows\assembly\tmp\7AFMTHAI
C:\Windows\assembly\tmp\7AOXKHG1
C:\Windows\assembly\tmp\7ARUQPLH
C:\Windows\assembly\tmp\7B21115K
C:\Windows\assembly\tmp\7BSQ6AXZ
C:\Windows\assembly\tmp\7BZPH7DA
C:\Windows\assembly\tmp\7D0HXP7Q
C:\Windows\assembly\tmp\7E3RKG7Z
C:\Windows\assembly\tmp\7EXY2S28
C:\Windows\assembly\tmp\7F2VAZEH
C:\Windows\assembly\tmp\7GR7M9OW
C:\Windows\assembly\tmp\7GZKWSCX
C:\Windows\assembly\tmp\7HCKRXYG
C:\Windows\assembly\tmp\7I8KLL8N
C:\Windows\assembly\tmp\7JCHCD07
C:\Windows\assembly\tmp\7JLHJYEQ
C:\Windows\assembly\tmp\7JSL91QZ
C:\Windows\assembly\tmp\7L32ICIX
C:\Windows\assembly\tmp\7MR6BE58
C:\Windows\assembly\tmp\7NA7RYCQ
C:\Windows\assembly\tmp\7NAAZHPU
C:\Windows\assembly\tmp\7NW651JO
C:\Windows\assembly\tmp\7NZPHI2W
C:\Windows\assembly\tmp\7O762ULE
C:\Windows\assembly\tmp\7OZ0D454
C:\Windows\assembly\tmp\7PV16PK3
C:\Windows\assembly\tmp\7Q4IWZ5F
C:\Windows\assembly\tmp\7QAOIHCQ
C:\Windows\assembly\tmp\7QCDEZHA
C:\Windows\assembly\tmp\7QGCJL8D
C:\Windows\assembly\tmp\7SFEYJ3L
C:\Windows\assembly\tmp\7SI5VJDB
C:\Windows\assembly\tmp\7SRGSYBB
C:\Windows\assembly\tmp\7SV5ZSHI
C:\Windows\assembly\tmp\7T6CVZEA
C:\Windows\assembly\tmp\7T8UB72U
C:\Windows\assembly\tmp\7TFLW3BN
C:\Windows\assembly\tmp\7TFR0FGM
C:\Windows\assembly\tmp\7U0KELC6
C:\Windows\assembly\tmp\7UD0GHNN
C:\Windows\assembly\tmp\7UVID0LL
C:\Windows\assembly\tmp\7VERX5IS
C:\Windows\assembly\tmp\7WBVNZA8
C:\Windows\assembly\tmp\7WH60TQ4
C:\Windows\assembly\tmp\7WHQS09J
C:\Windows\assembly\tmp\7XNZC7IE
C:\Windows\assembly\tmp\7Y3XA581
C:\Windows\assembly\tmp\7YHOKTNJ
C:\Windows\assembly\tmp\7YKQ4LXC
C:\Windows\assembly\tmp\7ZDM3IBQ
C:\Windows\assembly\tmp\7ZXPP5Q0
C:\Windows\assembly\tmp\80PBDK53
C:\Windows\assembly\tmp\81J0J4V2
C:\Windows\assembly\tmp\830PJDGI
C:\Windows\assembly\tmp\83O2AQBT
C:\Windows\assembly\tmp\83RSO25N
C:\Windows\assembly\tmp\83VBX38M
C:\Windows\assembly\tmp\841A1NUJ
C:\Windows\assembly\tmp\84ZJT518
C:\Windows\assembly\tmp\856EIJE7
C:\Windows\assembly\tmp\85Q1VDFN
C:\Windows\assembly\tmp\870PAL1G
C:\Windows\assembly\tmp\87625VCF
C:\Windows\assembly\tmp\87OTSU48
C:\Windows\assembly\tmp\886XXRH1
C:\Windows\assembly\tmp\88R8PI7G
C:\Windows\assembly\tmp\88VHBWMY
C:\Windows\assembly\tmp\8A1F9MPG
C:\Windows\assembly\tmp\8A9DXA6H
C:\Windows\assembly\tmp\8D8JG1YS
C:\Windows\assembly\tmp\8EPJBARS
C:\Windows\assembly\tmp\8EXD3F2M
C:\Windows\assembly\tmp\8FL8GUCQ
C:\Windows\assembly\tmp\8HMDETW9
C:\Windows\assembly\tmp\8HQOY2D3
C:\Windows\assembly\tmp\8HTWGR5T
C:\Windows\assembly\tmp\8IDJ2HM4
C:\Windows\assembly\tmp\8J3O6I2G
C:\Windows\assembly\tmp\8J7KM8B5
C:\Windows\assembly\tmp\8J8WGR5M
C:\Windows\assembly\tmp\8JMICF1E
C:\Windows\assembly\tmp\8KT0P7CP
C:\Windows\assembly\tmp\8MH63DVG
C:\Windows\assembly\tmp\8MHY8AU0
C:\Windows\assembly\tmp\8O1YSNDZ
C:\Windows\assembly\tmp\8Q55JP8J
C:\Windows\assembly\tmp\8RS7A3Z9
C:\Windows\assembly\tmp\8RTCTYCY
C:\Windows\assembly\tmp\8SH7VZ5U
C:\Windows\assembly\tmp\8TURO9K3
C:\Windows\assembly\tmp\8VMYFFRC
C:\Windows\assembly\tmp\8VPFLTU3
C:\Windows\assembly\tmp\8W8DKVJG
C:\Windows\assembly\tmp\8WEG3WAP
C:\Windows\assembly\tmp\8WMRZIB2
C:\Windows\assembly\tmp\8WWXAPKD
C:\Windows\assembly\tmp\8X3JL029
C:\Windows\assembly\tmp\8XH6TA8V
C:\Windows\assembly\tmp\8YTO1O4I
C:\Windows\assembly\tmp\907J593W
C:\Windows\assembly\tmp\90OLE8ZW
C:\Windows\assembly\tmp\912YMKJU
C:\Windows\assembly\tmp\92B1BA3J
C:\Windows\assembly\tmp\92EXJZYI
C:\Windows\assembly\tmp\92V8YXZ6
C:\Windows\assembly\tmp\9344MLTF
C:\Windows\assembly\tmp\934WE83D
C:\Windows\assembly\tmp\941LQQ9K
C:\Windows\assembly\tmp\94QDQV84
C:\Windows\assembly\tmp\95M97YEY
C:\Windows\assembly\tmp\95TAPQV0
C:\Windows\assembly\tmp\95ZQYP9W
C:\Windows\assembly\tmp\96I6551K
C:\Windows\assembly\tmp\96ICLAQ9
C:\Windows\assembly\tmp\96II34DR
C:\Windows\assembly\tmp\975F2PPA
C:\Windows\assembly\tmp\98YPROL1
C:\Windows\assembly\tmp\99HUBYOV
C:\Windows\assembly\tmp\99KMS2JA
C:\Windows\assembly\tmp\99SGZIG5
C:\Windows\assembly\tmp\99VFK9O8
C:\Windows\assembly\tmp\9A8LNORH
C:\Windows\assembly\tmp\9AGIFMYP
C:\Windows\assembly\tmp\9AHPWQ2H
C:\Windows\assembly\tmp\9B3P7ZDV
C:\Windows\assembly\tmp\9BNPKA5J
C:\Windows\assembly\tmp\9CIU9639
C:\Windows\assembly\tmp\9CSWMFWH
C:\Windows\assembly\tmp\9E6O4OJK
C:\Windows\assembly\tmp\9EL813YW
C:\Windows\assembly\tmp\9EMRRMM3
C:\Windows\assembly\tmp\9ETM45B0
C:\Windows\assembly\tmp\9F1P892W
C:\Windows\assembly\tmp\9FCFTQTM
C:\Windows\assembly\tmp\9FD746G2
C:\Windows\assembly\tmp\9FF4OHZE
C:\Windows\assembly\tmp\9FRK87RV
C:\Windows\assembly\tmp\9G76C1G8
C:\Windows\assembly\tmp\9G8LDTAC
C:\Windows\assembly\tmp\9GD3737J
C:\Windows\assembly\tmp\9GX127KN
C:\Windows\assembly\tmp\9HW2N7KR
C:\Windows\assembly\tmp\9HWTJPBE
C:\Windows\assembly\tmp\9I69ZVLQ
C:\Windows\assembly\tmp\9J2S9KSM
C:\Windows\assembly\tmp\9K0JRCZ3
C:\Windows\assembly\tmp\9K7MYRBT
C:\Windows\assembly\tmp\9KYTJG94
C:\Windows\assembly\tmp\9LETTMTL
C:\Windows\assembly\tmp\9LGWTR9A
C:\Windows\assembly\tmp\9LMFDJNL
C:\Windows\assembly\tmp\9M4GT552
C:\Windows\assembly\tmp\9N1TY0CO
C:\Windows\assembly\tmp\9P676Z8O
C:\Windows\assembly\tmp\9PLE84VE
C:\Windows\assembly\tmp\9PX2CT6U
C:\Windows\assembly\tmp\9S0Z0JT2
C:\Windows\assembly\tmp\9SVZZ3F6
C:\Windows\assembly\tmp\9T0BQEEP
C:\Windows\assembly\tmp\9TFRFAKB
C:\Windows\assembly\tmp\9TIPRXMJ
C:\Windows\assembly\tmp\9UDKTPAE
C:\Windows\assembly\tmp\9V6GNI7J
C:\Windows\assembly\tmp\9VQA9OM6
C:\Windows\assembly\tmp\9VTQBAGU
C:\Windows\assembly\tmp\9XKG7HMZ
C:\Windows\assembly\tmp\9XPMSKG9
C:\Windows\assembly\tmp\9XQAY63V
C:\Windows\assembly\tmp\9YM1JK2S
C:\Windows\assembly\tmp\9YX1W6N6
C:\Windows\assembly\tmp\9ZRPTV3I
C:\Windows\assembly\tmp\A01CL9CE
C:\Windows\assembly\tmp\A076A15L
C:\Windows\assembly\tmp\A0QH76BZ
C:\Windows\assembly\tmp\A1E9R1F4
C:\Windows\assembly\tmp\A21MZ3YG
C:\Windows\assembly\tmp\A2K1LZH1
C:\Windows\assembly\tmp\A42D3A26
C:\Windows\assembly\tmp\A5GHJ9AL
C:\Windows\assembly\tmp\A5UFLKZD
C:\Windows\assembly\tmp\A61Z8N6Y
C:\Windows\assembly\tmp\A814QEJ3
C:\Windows\assembly\tmp\A82JVMYI
C:\Windows\assembly\tmp\A88BFYOT
C:\Windows\assembly\tmp\A8QT6VNA
C:\Windows\assembly\tmp\A8V3RAFQ
C:\Windows\assembly\tmp\A9XNUK7X
C:\Windows\assembly\tmp\AA60SBMG
C:\Windows\assembly\tmp\AAL949KQ
C:\Windows\assembly\tmp\AAPWYAN4
C:\Windows\assembly\tmp\ACQVYKUQ
C:\Windows\assembly\tmp\AD8KECFJ
C:\Windows\assembly\tmp\ADKCJD4K
C:\Windows\assembly\tmp\ADMENA40
C:\Windows\assembly\tmp\ADP0C4QQ
C:\Windows\assembly\tmp\AEE7T8FV
C:\Windows\assembly\tmp\AFUXXPFJ
C:\Windows\assembly\tmp\AGRV78IZ
C:\Windows\assembly\tmp\AGUJDAO8
C:\Windows\assembly\tmp\AHM2N3RH
C:\Windows\assembly\tmp\AI1AINAF
C:\Windows\assembly\tmp\AIA6KYN9
C:\Windows\assembly\tmp\AJFQGPK3
C:\Windows\assembly\tmp\AK3ZTU27
C:\Windows\assembly\tmp\AMIONYFI
C:\Windows\assembly\tmp\AN4KKGGC
C:\Windows\assembly\tmp\AN57HF2U
C:\Windows\assembly\tmp\AN74N0P8
C:\Windows\assembly\tmp\ANPB5IQS
C:\Windows\assembly\tmp\ANQOGX8H
C:\Windows\assembly\tmp\ANZYB6JJ
C:\Windows\assembly\tmp\AOEUDDP0
C:\Windows\assembly\tmp\AOGMPGJX
C:\Windows\assembly\tmp\AOOGOAD2
C:\Windows\assembly\tmp\AOPWF3FM
C:\Windows\assembly\tmp\AP29UDOF
C:\Windows\assembly\tmp\AP7OD5NW
C:\Windows\assembly\tmp\APGI9702
C:\Windows\assembly\tmp\APZ0GOK7
C:\Windows\assembly\tmp\AQ8L1CI0
C:\Windows\assembly\tmp\AQVHDV5Y
C:\Windows\assembly\tmp\AQYGI7ED
C:\Windows\assembly\tmp\ARIPCS14
C:\Windows\assembly\tmp\ARROZNJ1
C:\Windows\assembly\tmp\AS4QQW51
C:\Windows\assembly\tmp\AV0BNCRX
C:\Windows\assembly\tmp\AX9QAOH6
C:\Windows\assembly\tmp\AXGNM36S
C:\Windows\assembly\tmp\AYF6XC80
C:\Windows\assembly\tmp\AYFBRRVY
C:\Windows\assembly\tmp\AYKALEPI
C:\Windows\assembly\tmp\AYL5K8K0
C:\Windows\assembly\tmp\AYP949V7
C:\Windows\assembly\tmp\AYP9VLQO
C:\Windows\assembly\tmp\AZA469K0
C:\Windows\assembly\tmp\B034W37A
C:\Windows\assembly\tmp\B10XDK8D
C:\Windows\assembly\tmp\B1N9MMG0
C:\Windows\assembly\tmp\B1PQNWTM
C:\Windows\assembly\tmp\B25UIDG5
C:\Windows\assembly\tmp\B2QW90NU
C:\Windows\assembly\tmp\B3738T0V
C:\Windows\assembly\tmp\B4FVUMC5
C:\Windows\assembly\tmp\B4WKM7V1
C:\Windows\assembly\tmp\B6BT80GU
C:\Windows\assembly\tmp\B6VFDRPI
C:\Windows\assembly\tmp\B8BWKWB1
C:\Windows\assembly\tmp\B8JEFO8U
C:\Windows\assembly\tmp\B9JMLEAJ
C:\Windows\assembly\tmp\BA8M7BY1
C:\Windows\assembly\tmp\BC3DP6B1
C:\Windows\assembly\tmp\BDE6D4UP
C:\Windows\assembly\tmp\BDL1RKBG
C:\Windows\assembly\tmp\BDOVXMNN
C:\Windows\assembly\tmp\BDTRBJZG
C:\Windows\assembly\tmp\BEN4K8TW
C:\Windows\assembly\tmp\BEVYYBFC
C:\Windows\assembly\tmp\BGB8Y9VV
C:\Windows\assembly\tmp\BGKF2LD9
C:\Windows\assembly\tmp\BH07QWXY
C:\Windows\assembly\tmp\BHCYHS4U
C:\Windows\assembly\tmp\BI6E7TZY
C:\Windows\assembly\tmp\BI9C0TE9
C:\Windows\assembly\tmp\BJ6L2FGB
C:\Windows\assembly\tmp\BJIQV47E
C:\Windows\assembly\tmp\BJOBDIYT
C:\Windows\assembly\tmp\BJZI9GEK
C:\Windows\assembly\tmp\BKMUEIXG
C:\Windows\assembly\tmp\BKS3EQQ6
C:\Windows\assembly\tmp\BLHWACNA
C:\Windows\assembly\tmp\BMFAWDJ8
C:\Windows\assembly\tmp\BMPZJFTS
C:\Windows\assembly\tmp\BNFUKGC7
C:\Windows\assembly\tmp\BNUXBHPK
C:\Windows\assembly\tmp\BOWPT4PL
C:\Windows\assembly\tmp\BQ6TUUBH
C:\Windows\assembly\tmp\BQAHF5R1
C:\Windows\assembly\tmp\BQD0946G
C:\Windows\assembly\tmp\BQJ6AM5O
C:\Windows\assembly\tmp\BRNNOHTQ
C:\Windows\assembly\tmp\BSQ79C2S
C:\Windows\assembly\tmp\BSYPKS20
C:\Windows\assembly\tmp\BTD1UG4C
C:\Windows\assembly\tmp\BTVXPPCA
C:\Windows\assembly\tmp\BU7179YG
C:\Windows\assembly\tmp\BUQMZSP1
C:\Windows\assembly\tmp\BUT84CI3
C:\Windows\assembly\tmp\BUUZG4UM
C:\Windows\assembly\tmp\BUWGXO9O
C:\Windows\assembly\tmp\BVHS53IB
C:\Windows\assembly\tmp\BVM0U1GN
C:\Windows\assembly\tmp\BVXISSAS
C:\Windows\assembly\tmp\BW1H2G2C
C:\Windows\assembly\tmp\BWC69BBV
C:\Windows\assembly\tmp\BX1MOCFQ
C:\Windows\assembly\tmp\BXKHKY4J
C:\Windows\assembly\tmp\BXNBKGNW
C:\Windows\assembly\tmp\BXYBFR2Z
C:\Windows\assembly\tmp\BYM02TOH
C:\Windows\assembly\tmp\BZBGATEU
C:\Windows\assembly\tmp\BZDHLDQG
C:\Windows\assembly\tmp\BZE9XS7Y
C:\Windows\assembly\tmp\C08QJYMU
C:\Windows\assembly\tmp\C0A1WBUQ
C:\Windows\assembly\tmp\C225UJVI
C:\Windows\assembly\tmp\C2A1O6SA
C:\Windows\assembly\tmp\C2ENO0DC
C:\Windows\assembly\tmp\C2L8SPJH
C:\Windows\assembly\tmp\C2QZKQPZ
C:\Windows\assembly\tmp\C40H11Y0
C:\Windows\assembly\tmp\C4C3J9EL
C:\Windows\assembly\tmp\C4TAWJ8D
C:\Windows\assembly\tmp\C5MPXT25
C:\Windows\assembly\tmp\C5TFMVZZ
C:\Windows\assembly\tmp\C697EFUF
C:\Windows\assembly\tmp\C6GYJJP0
C:\Windows\assembly\tmp\C867ADJ8
C:\Windows\assembly\tmp\C9YSAFXJ
C:\Windows\assembly\tmp\CA71F3BG
C:\Windows\assembly\tmp\CASWTAI0
C:\Windows\assembly\tmp\CBA1GX4A
C:\Windows\assembly\tmp\CBIVYYQP
C:\Windows\assembly\tmp\CBRG0DEK
C:\Windows\assembly\tmp\CCPR7TD0
C:\Windows\assembly\tmp\CCZK05YK
C:\Windows\assembly\tmp\CFQIEBLR
C:\Windows\assembly\tmp\CGG9B3QF
C:\Windows\assembly\tmp\CH2QJMT7
C:\Windows\assembly\tmp\CHFIM67E
C:\Windows\assembly\tmp\CHK3J92E
C:\Windows\assembly\tmp\CI4GSXMZ
C:\Windows\assembly\tmp\CK64YMRX
C:\Windows\assembly\tmp\CLLF57UD
C:\Windows\assembly\tmp\CLPI85BO
C:\Windows\assembly\tmp\CMGZPAZI
C:\Windows\assembly\tmp\CNI8UNSE
C:\Windows\assembly\tmp\CNMRG4CZ
C:\Windows\assembly\tmp\COPKVXRA
C:\Windows\assembly\tmp\CPPY8RET
C:\Windows\assembly\tmp\CPYL1OBW
C:\Windows\assembly\tmp\CQOPMDUF
C:\Windows\assembly\tmp\CQP55CIB
C:\Windows\assembly\tmp\CQRZS5Y5
C:\Windows\assembly\tmp\CR9ZHY5I
C:\Windows\assembly\tmp\CRQU1PVO
C:\Windows\assembly\tmp\CRUMIF85
C:\Windows\assembly\tmp\CT6D3236
C:\Windows\assembly\tmp\CTWDNC1P
C:\Windows\assembly\tmp\CV88AOV7
C:\Windows\assembly\tmp\CW6J2I43
C:\Windows\assembly\tmp\CWCEQ3KP
C:\Windows\assembly\tmp\CWJ4WGVR
C:\Windows\assembly\tmp\CWN7ZSRA
C:\Windows\assembly\tmp\CWOG44Z6
C:\Windows\assembly\tmp\CYZEZAS9
C:\Windows\assembly\tmp\D0349NUX
C:\Windows\assembly\tmp\D09QQ4KM
C:\Windows\assembly\tmp\D0EC2NS7
C:\Windows\assembly\tmp\D0S2DT8L
C:\Windows\assembly\tmp\D13AN75Z
C:\Windows\assembly\tmp\D13YZI02
C:\Windows\assembly\tmp\D18EWR8Z
C:\Windows\assembly\tmp\D2SRXVK9
C:\Windows\assembly\tmp\D34FRHBF
C:\Windows\assembly\tmp\D3RWOCTI
C:\Windows\assembly\tmp\D3VKZILN
C:\Windows\assembly\tmp\D40NSDXZ
C:\Windows\assembly\tmp\D4C1MUIP
C:\Windows\assembly\tmp\D4I7RHJB
C:\Windows\assembly\tmp\D4SN3AAE
C:\Windows\assembly\tmp\D556T664
C:\Windows\assembly\tmp\D55Z6I0D
C:\Windows\assembly\tmp\D5HJQIX6
C:\Windows\assembly\tmp\D5QWC9Y1
C:\Windows\assembly\tmp\D6NQVZ5I
C:\Windows\assembly\tmp\D7J5KS0O
C:\Windows\assembly\tmp\D7SUX5KH
C:\Windows\assembly\tmp\D8231A1D
C:\Windows\assembly\tmp\D88GFRV8
C:\Windows\assembly\tmp\D8PAXX9F
C:\Windows\assembly\tmp\D9MDIP1D
C:\Windows\assembly\tmp\D9OHZWWP
C:\Windows\assembly\tmp\DA89MEPF
C:\Windows\assembly\tmp\DAV2VTZG
C:\Windows\assembly\tmp\DBKTAURY
C:\Windows\assembly\tmp\DCZ29X5L
C:\Windows\assembly\tmp\DD12BGJR
C:\Windows\assembly\tmp\DDXV33II
C:\Windows\assembly\tmp\DDY5PC14
C:\Windows\assembly\tmp\DE6NGE65
C:\Windows\assembly\tmp\DE97YBOL
C:\Windows\assembly\tmp\DFVCBHF7
C:\Windows\assembly\tmp\DG9DT61R
C:\Windows\assembly\tmp\DGEV424W
C:\Windows\assembly\tmp\DGKWDFFV
C:\Windows\assembly\tmp\DJ06HAWC
C:\Windows\assembly\tmp\DJ41X6GY
C:\Windows\assembly\tmp\DKOFB3VZ
C:\Windows\assembly\tmp\DLFFIFL0
C:\Windows\assembly\tmp\DMPS4A7W
C:\Windows\assembly\tmp\DNT7M2YU
C:\Windows\assembly\tmp\DNWGG0CV
C:\Windows\assembly\tmp\DPL8UVAA
C:\Windows\assembly\tmp\DQCE3WVC
C:\Windows\assembly\tmp\DQHYSNF4
C:\Windows\assembly\tmp\DR46TGNU
C:\Windows\assembly\tmp\DS9YDI4K
C:\Windows\assembly\tmp\DSM957JA
C:\Windows\assembly\tmp\DSP4RQMC
C:\Windows\assembly\tmp\DT0TX51R
C:\Windows\assembly\tmp\DU3OAZHP
C:\Windows\assembly\tmp\DU7WE6JF
C:\Windows\assembly\tmp\DU8Z85YS
C:\Windows\assembly\tmp\DULFKR9X
C:\Windows\assembly\tmp\DUTZ4N2U
C:\Windows\assembly\tmp\DVBJA49D
C:\Windows\assembly\tmp\DXG70FQF
C:\Windows\assembly\tmp\E00OX9AG
C:\Windows\assembly\tmp\E0D6TZMV
C:\Windows\assembly\tmp\E16IN3NH
C:\Windows\assembly\tmp\E1PZ82EF
C:\Windows\assembly\tmp\E37AUK01
C:\Windows\assembly\tmp\E3FM91WO
C:\Windows\assembly\tmp\E3U71UEK
C:\Windows\assembly\tmp\E4N2ASXF
C:\Windows\assembly\tmp\E55BUAVI
C:\Windows\assembly\tmp\E55GEX8A
C:\Windows\assembly\tmp\E571TEI4
C:\Windows\assembly\tmp\E5EDFULS
C:\Windows\assembly\tmp\E62I7AD2
C:\Windows\assembly\tmp\E6C4D3M3
C:\Windows\assembly\tmp\E72JYVZ1
C:\Windows\assembly\tmp\E7EKOYKO
C:\Windows\assembly\tmp\E7VO5W7G
C:\Windows\assembly\tmp\E9OB3HG4
C:\Windows\assembly\tmp\EA1LVJMU
C:\Windows\assembly\tmp\EB1NBUCZ
C:\Windows\assembly\tmp\EB5MSA9R
C:\Windows\assembly\tmp\EC6DJIWC
C:\Windows\assembly\tmp\EC7CI1MG
C:\Windows\assembly\tmp\ECIUUY1M
C:\Windows\assembly\tmp\ECV5ROIT
C:\Windows\assembly\tmp\EDG9DAZC
C:\Windows\assembly\tmp\EDJKL7TK
C:\Windows\assembly\tmp\EDKY4HK1
C:\Windows\assembly\tmp\EE7B4OUG
C:\Windows\assembly\tmp\EEOQUIRS
C:\Windows\assembly\tmp\EF0WVTNW
C:\Windows\assembly\tmp\EFF6IKHW
C:\Windows\assembly\tmp\EFOT2405
C:\Windows\assembly\tmp\EGZOF8V6
C:\Windows\assembly\tmp\EHKDAZ4A
C:\Windows\assembly\tmp\EI6BP0PJ
C:\Windows\assembly\tmp\EIHXIBZQ
C:\Windows\assembly\tmp\EIOENJUS
C:\Windows\assembly\tmp\EJDU1Z6C
C:\Windows\assembly\tmp\EJHAMQSD
C:\Windows\assembly\tmp\EK41UMRO
C:\Windows\assembly\tmp\ELO3LW2P
C:\Windows\assembly\tmp\ELWJA681
C:\Windows\assembly\tmp\EMXTHKE5
C:\Windows\assembly\tmp\ENTBJGKO
C:\Windows\assembly\tmp\EO3LTWH2
C:\Windows\assembly\tmp\EO3Y50K0
C:\Windows\assembly\tmp\EPLDNWRI
C:\Windows\assembly\tmp\EPP8DOA9
C:\Windows\assembly\tmp\EQ71FIPC
C:\Windows\assembly\tmp\EQF27DCT
C:\Windows\assembly\tmp\EQK1INKJ
C:\Windows\assembly\tmp\EQLBGQ14
C:\Windows\assembly\tmp\EQX7H4C2
C:\Windows\assembly\tmp\ES0O8R3I
C:\Windows\assembly\tmp\ESDK6HEN
C:\Windows\assembly\tmp\ESJOLWCC
C:\Windows\assembly\tmp\ESL9HBIA
C:\Windows\assembly\tmp\ETERKDH8
C:\Windows\assembly\tmp\ETXGA8B5
C:\Windows\assembly\tmp\ETYIB5HO
C:\Windows\assembly\tmp\EU60J6DA
C:\Windows\assembly\tmp\EU7XFG46
C:\Windows\assembly\tmp\EUZZKZ2D
C:\Windows\assembly\tmp\EVDSG574
C:\Windows\assembly\tmp\EVVQ8519
C:\Windows\assembly\tmp\EWH0ZZYM
C:\Windows\assembly\tmp\EWY907R8
C:\Windows\assembly\tmp\EXXUK6D1
C:\Windows\assembly\tmp\EXYEUXLK
C:\Windows\assembly\tmp\EZ02GNBY
C:\Windows\assembly\tmp\F0XY8E6R
C:\Windows\assembly\tmp\F2H8WZ5A
C:\Windows\assembly\tmp\F36WMH4I
C:\Windows\assembly\tmp\F37JQKHJ
C:\Windows\assembly\tmp\F38CI4SY
C:\Windows\assembly\tmp\F3LJKEKD
C:\Windows\assembly\tmp\F5F1YE12
C:\Windows\assembly\tmp\F61YZSKF
C:\Windows\assembly\tmp\F6RUO2QH
C:\Windows\assembly\tmp\F6VW67ET
C:\Windows\assembly\tmp\F6ZLE53C
C:\Windows\assembly\tmp\F72UO98I
C:\Windows\assembly\tmp\F7BSRK7V
C:\Windows\assembly\tmp\F7HB1QRC
C:\Windows\assembly\tmp\F83N5ZY0
C:\Windows\assembly\tmp\F8D9HKZG
C:\Windows\assembly\tmp\F8EZLIEY
C:\Windows\assembly\tmp\F96KSD7Y
C:\Windows\assembly\tmp\FA5TAAKF
C:\Windows\assembly\tmp\FAIZX5P1
C:\Windows\assembly\tmp\FBE41O8A
C:\Windows\assembly\tmp\FD4CRHXG
C:\Windows\assembly\tmp\FDBIU6F1
C:\Windows\assembly\tmp\FDJV0SPZ
C:\Windows\assembly\tmp\FE4RR6KB
C:\Windows\assembly\tmp\FE9N44UU
C:\Windows\assembly\tmp\FED2RT5N
C:\Windows\assembly\tmp\FEOIUT08
C:\Windows\assembly\tmp\FEQUUUUE
C:\Windows\assembly\tmp\FFHVNH45
C:\Windows\assembly\tmp\FFQ93ACB
C:\Windows\assembly\tmp\FFUPWEQ1
C:\Windows\assembly\tmp\FFW6269K
C:\Windows\assembly\tmp\FG0F3CIF
C:\Windows\assembly\tmp\FGBIBNSA
C:\Windows\assembly\tmp\FIO2R7T7
C:\Windows\assembly\tmp\FIR9ALUK
C:\Windows\assembly\tmp\FITETCT8
C:\Windows\assembly\tmp\FJBDFOHO
C:\Windows\assembly\tmp\FJJ4VV5B
C:\Windows\assembly\tmp\FLBL0WT7
C:\Windows\assembly\tmp\FM2XYT7L
C:\Windows\assembly\tmp\FMHSCHYV
C:\Windows\assembly\tmp\FMMG6YF5
C:\Windows\assembly\tmp\FMYAHX4U
C:\Windows\assembly\tmp\FNDXKXC4
C:\Windows\assembly\tmp\FNIIP2W5
C:\Windows\assembly\tmp\FNWUJP4Z
C:\Windows\assembly\tmp\FO0DQP1T
C:\Windows\assembly\tmp\FQB5I8UM
C:\Windows\assembly\tmp\FQR1NHRA
C:\Windows\assembly\tmp\FRR9MBE2
C:\Windows\assembly\tmp\FS0NY8EV
C:\Windows\assembly\tmp\FSYI5D29
C:\Windows\assembly\tmp\FUSVWQKL
C:\Windows\assembly\tmp\FVGIGUH7
C:\Windows\assembly\tmp\FVJ4AZRD
C:\Windows\assembly\tmp\FVVDBMOA
C:\Windows\assembly\tmp\FWJM9E0X
C:\Windows\assembly\tmp\FWN8ZXNN
C:\Windows\assembly\tmp\FWT4ML4X
C:\Windows\assembly\tmp\FX4DYXE7
C:\Windows\assembly\tmp\FXION6I1
C:\Windows\assembly\tmp\FXVOUS6Q
C:\Windows\assembly\tmp\FYJ2CNSK
C:\Windows\assembly\tmp\FYR0VYHD
C:\Windows\assembly\tmp\G0XS94L8
C:\Windows\assembly\tmp\G0Z1DHBN
C:\Windows\assembly\tmp\G26WV39P
C:\Windows\assembly\tmp\G2Z950CQ
C:\Windows\assembly\tmp\G3GSPKNJ
C:\Windows\assembly\tmp\G3PCB168
C:\Windows\assembly\tmp\G3RNPR9V
C:\Windows\assembly\tmp\G4ASHD73
C:\Windows\assembly\tmp\G4EODIFF
C:\Windows\assembly\tmp\G4TFLBVI
C:\Windows\assembly\tmp\G5AALN5Y
C:\Windows\assembly\tmp\G89UFYZ7
C:\Windows\assembly\tmp\G8TTM7K5
C:\Windows\assembly\tmp\G9CR1V2O
C:\Windows\assembly\tmp\GC5ZENQ7
C:\Windows\assembly\tmp\GCGWB4RT
C:\Windows\assembly\tmp\GCK3AW2B
C:\Windows\assembly\tmp\GD1U8JP5
C:\Windows\assembly\tmp\GEQ2KDUT
C:\Windows\assembly\tmp\GG6HMGUB
C:\Windows\assembly\tmp\GG93ZOM1
C:\Windows\assembly\tmp\GGDIOT2Q
C:\Windows\assembly\tmp\GGKS7M2T
C:\Windows\assembly\tmp\GH6KGIJI
C:\Windows\assembly\tmp\GHBAWUG8
C:\Windows\assembly\tmp\GHHOHOE8
C:\Windows\assembly\tmp\GI1KGR30
C:\Windows\assembly\tmp\GIKLIRSH
C:\Windows\assembly\tmp\GKRHIKOO
C:\Windows\assembly\tmp\GLG6ZOQT
C:\Windows\assembly\tmp\GLMS0YLP
C:\Windows\assembly\tmp\GMNQQJKV
C:\Windows\assembly\tmp\GMWTJ54D
C:\Windows\assembly\tmp\GN6GTD0N
C:\Windows\assembly\tmp\GNA5ZBZL
C:\Windows\assembly\tmp\GNQSPXUD
C:\Windows\assembly\tmp\GOLRRY3C
C:\Windows\assembly\tmp\GP9JXBXK
C:\Windows\assembly\tmp\GR644RET
C:\Windows\assembly\tmp\GR96ADR7
C:\Windows\assembly\tmp\GRP44XJK
C:\Windows\assembly\tmp\GTZMWX7C
C:\Windows\assembly\tmp\GU575DOY
C:\Windows\assembly\tmp\GVHODZ02
C:\Windows\assembly\tmp\GVLDW0CJ
C:\Windows\assembly\tmp\GW3R5XZH
C:\Windows\assembly\tmp\GWA2M5BC
C:\Windows\assembly\tmp\GXBWJM99
C:\Windows\assembly\tmp\GXW6KB8E
C:\Windows\assembly\tmp\GY94CBZ4
C:\Windows\assembly\tmp\GZ49C9XP
C:\Windows\assembly\tmp\GZLNW6NP
C:\Windows\assembly\tmp\GZM8BJX0
C:\Windows\assembly\tmp\H14DJ238
C:\Windows\assembly\tmp\H16CE8J5
C:\Windows\assembly\tmp\H1E9V3P2
C:\Windows\assembly\tmp\H25SJQSS
C:\Windows\assembly\tmp\H2KR6DIZ
C:\Windows\assembly\tmp\H2X7373T
C:\Windows\assembly\tmp\H3EVR4CC
C:\Windows\assembly\tmp\H3I3V4AK
C:\Windows\assembly\tmp\H46J98ZQ
C:\Windows\assembly\tmp\H5KUE5EF
C:\Windows\assembly\tmp\H5RX2V9H
C:\Windows\assembly\tmp\H79MK5M3
C:\Windows\assembly\tmp\H82TUG2X
C:\Windows\assembly\tmp\H8SJSC1O
C:\Windows\assembly\tmp\H94XMBBA
C:\Windows\assembly\tmp\H97SY945
C:\Windows\assembly\tmp\H9SA1SDN
C:\Windows\assembly\tmp\HAFPPL1X
C:\Windows\assembly\tmp\HB4U3L9T
C:\Windows\assembly\tmp\HB6BI58E
C:\Windows\assembly\tmp\HBA7324Y
C:\Windows\assembly\tmp\HBRKY4BF
C:\Windows\assembly\tmp\HCHJ1JHJ
C:\Windows\assembly\tmp\HCZHGXJE
C:\Windows\assembly\tmp\HDDCEBJ7
C:\Windows\assembly\tmp\HEKYYV38
C:\Windows\assembly\tmp\HGGXRZKC
C:\Windows\assembly\tmp\HGXVY7MY
C:\Windows\assembly\tmp\HH0J2X5H
C:\Windows\assembly\tmp\HHA5FYJN
C:\Windows\assembly\tmp\HIIIB3FE
C:\Windows\assembly\tmp\HIVVCDLZ
C:\Windows\assembly\tmp\HJ22XMWT
C:\Windows\assembly\tmp\HJ3GZP3B
C:\Windows\assembly\tmp\HL348WXQ
C:\Windows\assembly\tmp\HL3GXO5P
C:\Windows\assembly\tmp\HL4SPG0X
C:\Windows\assembly\tmp\HLLFSDPG
C:\Windows\assembly\tmp\HLP6CTQJ
C:\Windows\assembly\tmp\HM0R17R3
C:\Windows\assembly\tmp\HN9PSS8U
C:\Windows\assembly\tmp\HOCHF5R8
C:\Windows\assembly\tmp\HPIP5X26
C:\Windows\assembly\tmp\HPLGBK3J
C:\Windows\assembly\tmp\HQJB54GH
C:\Windows\assembly\tmp\HQOU30T9
C:\Windows\assembly\tmp\HR4HAPV9
C:\Windows\assembly\tmp\HRT1EM09
C:\Windows\assembly\tmp\HS9A8I72
C:\Windows\assembly\tmp\HSE1FH97
C:\Windows\assembly\tmp\HTB8TR8F
C:\Windows\assembly\tmp\HU7DW0VE
C:\Windows\assembly\tmp\HUMHSMYA
C:\Windows\assembly\tmp\HUV84BV4
C:\Windows\assembly\tmp\HUWHSTC0
C:\Windows\assembly\tmp\HV0CNZ8U
C:\Windows\assembly\tmp\HVVIYIVV
C:\Windows\assembly\tmp\HWO6FVBU
C:\Windows\assembly\tmp\HXIGHNH4
C:\Windows\assembly\tmp\HYL14J1E
C:\Windows\assembly\tmp\HZ6GQQPA
C:\Windows\assembly\tmp\HZQ52WEG
C:\Windows\assembly\tmp\I0LI9MJ4
C:\Windows\assembly\tmp\I0USZ4DU
C:\Windows\assembly\tmp\I17XGGK3
C:\Windows\assembly\tmp\I1BUD1OR
C:\Windows\assembly\tmp\I1X8FZ3T
C:\Windows\assembly\tmp\I2C7MQNA
C:\Windows\assembly\tmp\I2QP5WT7
C:\Windows\assembly\tmp\I2ZM96FE
C:\Windows\assembly\tmp\I3PH0KDN
C:\Windows\assembly\tmp\I44H55CZ
C:\Windows\assembly\tmp\I5I89K03
C:\Windows\assembly\tmp\I5U3WEWO
C:\Windows\assembly\tmp\I64GT7ZY
C:\Windows\assembly\tmp\I6QAZ3LI
C:\Windows\assembly\tmp\I79QPH9Y
C:\Windows\assembly\tmp\I7A2DVLP
C:\Windows\assembly\tmp\I9U2SW9E
C:\Windows\assembly\tmp\I9YZVULL
C:\Windows\assembly\tmp\IA4OJQRL
C:\Windows\assembly\tmp\IAKOH8J8
C:\Windows\assembly\tmp\IAV4JL6E
C:\Windows\assembly\tmp\IB1AMOL7
C:\Windows\assembly\tmp\IB7XGGHM
C:\Windows\assembly\tmp\IBWTP0BW
C:\Windows\assembly\tmp\ICNN3CZ9
C:\Windows\assembly\tmp\ICRMF3YD
C:\Windows\assembly\tmp\ID98W447
C:\Windows\assembly\tmp\IFEU35J7
C:\Windows\assembly\tmp\IFL7YGKA
C:\Windows\assembly\tmp\IHNY5TAF
C:\Windows\assembly\tmp\IJD54BEF
C:\Windows\assembly\tmp\IKG128SW
C:\Windows\assembly\tmp\IL6AUZBI
C:\Windows\assembly\tmp\ILNE72V9
C:\Windows\assembly\tmp\IM2CHPWR
C:\Windows\assembly\tmp\IM65091Y
C:\Windows\assembly\tmp\IMIB9ITM
C:\Windows\assembly\tmp\IMK5XH9I
C:\Windows\assembly\tmp\INFX814D
C:\Windows\assembly\tmp\INK1CQWU
C:\Windows\assembly\tmp\INV1KA6J
C:\Windows\assembly\tmp\IP0K20CF
C:\Windows\assembly\tmp\IP9U8K7H
C:\Windows\assembly\tmp\IPLDIX3S
C:\Windows\assembly\tmp\IPUZS8KX
C:\Windows\assembly\tmp\IPZTWGUN
C:\Windows\assembly\tmp\IQL049TT
C:\Windows\assembly\tmp\IRW0QY1Z
C:\Windows\assembly\tmp\ISJC00J8
C:\Windows\assembly\tmp\ISMVTSWG
C:\Windows\assembly\tmp\ISQR1MWY
C:\Windows\assembly\tmp\IT0BUSAW
C:\Windows\assembly\tmp\IU1E6GCY
C:\Windows\assembly\tmp\IVP9ESK3
C:\Windows\assembly\tmp\IX69LVY9
C:\Windows\assembly\tmp\IX6W32XG
C:\Windows\assembly\tmp\IXZHYSJU
C:\Windows\assembly\tmp\IYL32EOE
C:\Windows\assembly\tmp\IYZAILHT
C:\Windows\assembly\tmp\IZN3EKTU
C:\Windows\assembly\tmp\J0AUA037
C:\Windows\assembly\tmp\J0D5RH4F
C:\Windows\assembly\tmp\J0QGL6WE
C:\Windows\assembly\tmp\J0Z3NAKT
C:\Windows\assembly\tmp\J0ZSEYU5
C:\Windows\assembly\tmp\J19PLVYN
C:\Windows\assembly\tmp\J1ZYOMTN
C:\Windows\assembly\tmp\J2ESNOAH
C:\Windows\assembly\tmp\J2HRR1JX
C:\Windows\assembly\tmp\J43T8WL8
C:\Windows\assembly\tmp\J4MQKOXD
C:\Windows\assembly\tmp\J5UVL8ZA
C:\Windows\assembly\tmp\J6QVSZOM
C:\Windows\assembly\tmp\J6SKKGTC
C:\Windows\assembly\tmp\J6TM3ZCY
C:\Windows\assembly\tmp\J71MMJ2I
C:\Windows\assembly\tmp\J8FGR8JQ
C:\Windows\assembly\tmp\J97248TG
C:\Windows\assembly\tmp\JAMNXM6A
C:\Windows\assembly\tmp\JBHZOHHB
C:\Windows\assembly\tmp\JBWMGKFC
C:\Windows\assembly\tmp\JDO34FUJ
C:\Windows\assembly\tmp\JEBNRDRK
C:\Windows\assembly\tmp\JF5E0Y95
C:\Windows\assembly\tmp\JG488H11
C:\Windows\assembly\tmp\JGNQD21J
C:\Windows\assembly\tmp\JHMBEZP8
C:\Windows\assembly\tmp\JI0CC75Z
C:\Windows\assembly\tmp\JI6ZSHDP
C:\Windows\assembly\tmp\JJ14OJSL
C:\Windows\assembly\tmp\JJYK9PMT
C:\Windows\assembly\tmp\JJZQ7SF3
C:\Windows\assembly\tmp\JKDZTKZA
C:\Windows\assembly\tmp\JLBRBUM2
C:\Windows\assembly\tmp\JMC5HBS5
C:\Windows\assembly\tmp\JMD53GWU
C:\Windows\assembly\tmp\JMUDLN56
C:\Windows\assembly\tmp\JN1LD8ZG
C:\Windows\assembly\tmp\JN607TMN
C:\Windows\assembly\tmp\JN67JYPT
C:\Windows\assembly\tmp\JNNIK9ZG
C:\Windows\assembly\tmp\JP84VIII
C:\Windows\assembly\tmp\JQGAU92O
C:\Windows\assembly\tmp\JQKJTGUK
C:\Windows\assembly\tmp\JQLS42VV
C:\Windows\assembly\tmp\JRM7GP8X
C:\Windows\assembly\tmp\JS9I9S78
C:\Windows\assembly\tmp\JUFAF3X1
C:\Windows\assembly\tmp\JUG09KJ1
C:\Windows\assembly\tmp\JUMJDZJP
C:\Windows\assembly\tmp\JUW9R51F
C:\Windows\assembly\tmp\JXYX4O4U
C:\Windows\assembly\tmp\JYAAJ3YZ
C:\Windows\assembly\tmp\JZGD7A8X
C:\Windows\assembly\tmp\K050KCI8
C:\Windows\assembly\tmp\K0LVUTBZ
C:\Windows\assembly\tmp\K16R6LHL
C:\Windows\assembly\tmp\K245GNHU
C:\Windows\assembly\tmp\K2FB74M4
C:\Windows\assembly\tmp\K2Q9IBJG
C:\Windows\assembly\tmp\K33YO86F
C:\Windows\assembly\tmp\K3LJM3JH
C:\Windows\assembly\tmp\K4H4EM7Z
C:\Windows\assembly\tmp\K4L6OBTK
C:\Windows\assembly\tmp\K5JITS4V
C:\Windows\assembly\tmp\K5YDUFXV
C:\Windows\assembly\tmp\K6ETCR85
C:\Windows\assembly\tmp\K9Q14Q9Z
C:\Windows\assembly\tmp\KA09PNKB
C:\Windows\assembly\tmp\KAC5L1N1
C:\Windows\assembly\tmp\KAFIY9O8
C:\Windows\assembly\tmp\KAO4Q24G
C:\Windows\assembly\tmp\KB3GU5VX
C:\Windows\assembly\tmp\KB5UCF5K
C:\Windows\assembly\tmp\KCYGA09J
C:\Windows\assembly\tmp\KCYXP4FB
C:\Windows\assembly\tmp\KDYSZNGH
C:\Windows\assembly\tmp\KDZD1Q3T
C:\Windows\assembly\tmp\KE4KTKBQ
C:\Windows\assembly\tmp\KEU09E7U
C:\Windows\assembly\tmp\KEXN3OR8
C:\Windows\assembly\tmp\KF1BS6DX
C:\Windows\assembly\tmp\KFPAPZO3
C:\Windows\assembly\tmp\KGGB9W13
C:\Windows\assembly\tmp\KGHIXX3P
C:\Windows\assembly\tmp\KGP9H4JL
C:\Windows\assembly\tmp\KH37BZ4M
C:\Windows\assembly\tmp\KH7O1ZPP
C:\Windows\assembly\tmp\KIBNLD7O
C:\Windows\assembly\tmp\KJ5ICAYJ
C:\Windows\assembly\tmp\KK0T35JV
C:\Windows\assembly\tmp\KK9I4N7C
C:\Windows\assembly\tmp\KL7W70TA
C:\Windows\assembly\tmp\KNHF0TZZ
C:\Windows\assembly\tmp\KNIZXXKP
C:\Windows\assembly\tmp\KP9EDNUO
C:\Windows\assembly\tmp\KS0EVX5E
C:\Windows\assembly\tmp\KTBC9RUU
C:\Windows\assembly\tmp\KTEYY7YH
C:\Windows\assembly\tmp\KTZGYHX6
C:\Windows\assembly\tmp\KUGPEDBG
C:\Windows\assembly\tmp\KUXLQEKK
C:\Windows\assembly\tmp\KV2CJZGP
C:\Windows\assembly\tmp\KVJQ5I23
C:\Windows\assembly\tmp\KVVU6QA3
C:\Windows\assembly\tmp\KW5CAZ79
C:\Windows\assembly\tmp\KWQZCVBE
C:\Windows\assembly\tmp\KXTZWXY1
C:\Windows\assembly\tmp\KZX8S9IG
C:\Windows\assembly\tmp\L12MQ2SA
C:\Windows\assembly\tmp\L2AS5OJL
C:\Windows\assembly\tmp\L3KSDWJC
C:\Windows\assembly\tmp\L4ZDKK2M
C:\Windows\assembly\tmp\L4ZKV7ZE
C:\Windows\assembly\tmp\L5IKYS7H
C:\Windows\assembly\tmp\L5L6DWQN
C:\Windows\assembly\tmp\L7BLPM4B
C:\Windows\assembly\tmp\L7DPT2EA
C:\Windows\assembly\tmp\L8ISX86H
C:\Windows\assembly\tmp\L97REDIV
C:\Windows\assembly\tmp\L9DEK0WO
C:\Windows\assembly\tmp\LA3NY3XJ
C:\Windows\assembly\tmp\LBF4JG8E
C:\Windows\assembly\tmp\LD8YVPDJ
C:\Windows\assembly\tmp\LDBH6S5W
C:\Windows\assembly\tmp\LDFPJRJN
C:\Windows\assembly\tmp\LDOMXVNE
C:\Windows\assembly\tmp\LDXJPBNQ
C:\Windows\assembly\tmp\LE3TYL9I
C:\Windows\assembly\tmp\LEIPW23W
C:\Windows\assembly\tmp\LF2C4ROH
C:\Windows\assembly\tmp\LH63OLEK
C:\Windows\assembly\tmp\LHNQ9ODF
C:\Windows\assembly\tmp\LI8D5O7K
C:\Windows\assembly\tmp\LIII89F1
C:\Windows\assembly\tmp\LIUW06NR
C:\Windows\assembly\tmp\LJ4GTBQX
C:\Windows\assembly\tmp\LJN4J02Z
C:\Windows\assembly\tmp\LJSJHPWU
C:\Windows\assembly\tmp\LK8BY7VE
C:\Windows\assembly\tmp\LKJ9N5VQ
C:\Windows\assembly\tmp\LMCREAB2
C:\Windows\assembly\tmp\LN9W7WA2
C:\Windows\assembly\tmp\LNIOW777
C:\Windows\assembly\tmp\LNO1PKAY
C:\Windows\assembly\tmp\LNSR44K6
C:\Windows\assembly\tmp\LOUHOV5X
C:\Windows\assembly\tmp\LPBKL2HS
C:\Windows\assembly\tmp\LPTV9ME9
C:\Windows\assembly\tmp\LQ5WJESF
C:\Windows\assembly\tmp\LQDIXF78
C:\Windows\assembly\tmp\LQUMWTFC
C:\Windows\assembly\tmp\LQWHZNVF
C:\Windows\assembly\tmp\LRCWLPUP
C:\Windows\assembly\tmp\LS740KFF
C:\Windows\assembly\tmp\LSZ69WRA
C:\Windows\assembly\tmp\LT4T6EKQ
C:\Windows\assembly\tmp\LT5OXEBE
C:\Windows\assembly\tmp\LT61P6AN
C:\Windows\assembly\tmp\LT6BTCQB
C:\Windows\assembly\tmp\LTOOLLQ1
C:\Windows\assembly\tmp\LTPBGHZ1
C:\Windows\assembly\tmp\LTYBF9A8
C:\Windows\assembly\tmp\LV5HWR7T
C:\Windows\assembly\tmp\LW0OM979
C:\Windows\assembly\tmp\LWNNB7PA
C:\Windows\assembly\tmp\LYAKSEW0
C:\Windows\assembly\tmp\LZAM6NFU
C:\Windows\assembly\tmp\LZKZ6XN8
C:\Windows\assembly\tmp\M0OSOHKM
C:\Windows\assembly\tmp\M1CTZXI8
C:\Windows\assembly\tmp\M24FOTF2
C:\Windows\assembly\tmp\M24J9VSR
C:\Windows\assembly\tmp\M3INCB4S
C:\Windows\assembly\tmp\M3SB17Y4
C:\Windows\assembly\tmp\M3T3QQ6A
C:\Windows\assembly\tmp\M3ZBGMIL
C:\Windows\assembly\tmp\M48V0KRS
C:\Windows\assembly\tmp\M4AR7M86
C:\Windows\assembly\tmp\M4OPEGY8
C:\Windows\assembly\tmp\M580OYGD
C:\Windows\assembly\tmp\M5J7DT54
C:\Windows\assembly\tmp\M61YHUVC
C:\Windows\assembly\tmp\M65G4MUD
C:\Windows\assembly\tmp\M6EUW7FM
C:\Windows\assembly\tmp\M6XBMHRK
C:\Windows\assembly\tmp\M7R3W63B
C:\Windows\assembly\tmp\M92Y8RJN
C:\Windows\assembly\tmp\M9DH7414
C:\Windows\assembly\tmp\M9L65EK1
C:\Windows\assembly\tmp\M9YEMA56
C:\Windows\assembly\tmp\M9Z5QTPK
C:\Windows\assembly\tmp\MA7O588L
C:\Windows\assembly\tmp\MALUB3CH
C:\Windows\assembly\tmp\MBNHMGEC
C:\Windows\assembly\tmp\MBTANYQM
C:\Windows\assembly\tmp\MC2FLMBO
C:\Windows\assembly\tmp\MCD5KFML
C:\Windows\assembly\tmp\MCVKN1FZ
C:\Windows\assembly\tmp\MD3ZKXSR
C:\Windows\assembly\tmp\MD73C6GX
C:\Windows\assembly\tmp\MFD1RVMS
C:\Windows\assembly\tmp\MFH7BL5P
C:\Windows\assembly\tmp\MFTI751G
C:\Windows\assembly\tmp\MGGBLXAO
C:\Windows\assembly\tmp\MGKSVHBA
C:\Windows\assembly\tmp\MGVOI91M
C:\Windows\assembly\tmp\MH22OUPU
C:\Windows\assembly\tmp\MH8DJ901
C:\Windows\assembly\tmp\MHMX04HS
C:\Windows\assembly\tmp\MHQ8SHAT
C:\Windows\assembly\tmp\MHSEX38X
C:\Windows\assembly\tmp\MIN7R545
C:\Windows\assembly\tmp\MKAHT9O7
C:\Windows\assembly\tmp\MKIN87U3
C:\Windows\assembly\tmp\MKWER0F0
C:\Windows\assembly\tmp\MKZUVMLX
C:\Windows\assembly\tmp\MM0CI8H2
C:\Windows\assembly\tmp\MM1K2U5Z
C:\Windows\assembly\tmp\MOXU1NBZ
C:\Windows\assembly\tmp\MRRZJDP8
C:\Windows\assembly\tmp\MS405OOY
C:\Windows\assembly\tmp\MS61NT7U
C:\Windows\assembly\tmp\MSGGBH9N
C:\Windows\assembly\tmp\MTROWIWO
C:\Windows\assembly\tmp\MV2THKU5
C:\Windows\assembly\tmp\MVDNIMGQ
C:\Windows\assembly\tmp\MY1FZ05G
C:\Windows\assembly\tmp\MYGJ2W74
C:\Windows\assembly\tmp\MYQDO08P
C:\Windows\assembly\tmp\MZ0R0QE2
C:\Windows\assembly\tmp\MZ2LJ91J
C:\Windows\assembly\tmp\MZHVIK1Z
C:\Windows\assembly\tmp\MZYMVNTL
C:\Windows\assembly\tmp\N03GH4II
C:\Windows\assembly\tmp\N197VMRY
C:\Windows\assembly\tmp\N1BCX2NO
C:\Windows\assembly\tmp\N1T3SF8M
C:\Windows\assembly\tmp\N1THAEYA
C:\Windows\assembly\tmp\N2WHLUC6
C:\Windows\assembly\tmp\N2XTZYC1
C:\Windows\assembly\tmp\N3PFUUD2
C:\Windows\assembly\tmp\N3Z2OVSH
C:\Windows\assembly\tmp\N4BUUBN2
C:\Windows\assembly\tmp\N4PYGEZ0
C:\Windows\assembly\tmp\N4QGCK62
C:\Windows\assembly\tmp\N550FR9M
C:\Windows\assembly\tmp\N5R7SLUI
C:\Windows\assembly\tmp\N6JQG94U
C:\Windows\assembly\tmp\N76XXSUA
C:\Windows\assembly\tmp\N7C066SF
C:\Windows\assembly\tmp\N7S7UG6W
C:\Windows\assembly\tmp\N855QUBW
C:\Windows\assembly\tmp\N85IKFDI
C:\Windows\assembly\tmp\N8YO4W8S
C:\Windows\assembly\tmp\N92T3RKK
C:\Windows\assembly\tmp\NA0IOLON
C:\Windows\assembly\tmp\NAEXD5ZA
C:\Windows\assembly\tmp\NAS7HLU8
C:\Windows\assembly\tmp\NATIMUSZ
C:\Windows\assembly\tmp\NAWYFBQK
C:\Windows\assembly\tmp\NAXUUZV0
C:\Windows\assembly\tmp\NC44YT54
C:\Windows\assembly\tmp\NCQ4G7QP
C:\Windows\assembly\tmp\NCVX720H
C:\Windows\assembly\tmp\NCWW4RQ7
C:\Windows\assembly\tmp\NCXY4NSS
C:\Windows\assembly\tmp\NF4M41PG
C:\Windows\assembly\tmp\NGWJMLGF
C:\Windows\assembly\tmp\NH5IS5CR
C:\Windows\assembly\tmp\NI8XG9OC
C:\Windows\assembly\tmp\NIEWKIVA
C:\Windows\assembly\tmp\NJNWZT6X
C:\Windows\assembly\tmp\NKF8V69L
C:\Windows\assembly\tmp\NKJ61S9F
C:\Windows\assembly\tmp\NMOEXWYJ
C:\Windows\assembly\tmp\NP6MDTYS
C:\Windows\assembly\tmp\NQ2DTM3F
C:\Windows\assembly\tmp\NQHQLU7B
C:\Windows\assembly\tmp\NQI61D5U
C:\Windows\assembly\tmp\NQZS0XKQ
C:\Windows\assembly\tmp\NRNZUV7T
C:\Windows\assembly\tmp\NS77BUJQ
C:\Windows\assembly\tmp\NSMX7YT9
C:\Windows\assembly\tmp\NTE9196V
C:\Windows\assembly\tmp\NTGBL3HX
C:\Windows\assembly\tmp\NTGO9ESO
C:\Windows\assembly\tmp\NTKVD0OJ
C:\Windows\assembly\tmp\NUF8965T
C:\Windows\assembly\tmp\NULEBI1P
C:\Windows\assembly\tmp\NUVNHI3L
C:\Windows\assembly\tmp\NV0JSENE
C:\Windows\assembly\tmp\NWBALH75
C:\Windows\assembly\tmp\NXR517UL
C:\Windows\assembly\tmp\NY2BS69W
C:\Windows\assembly\tmp\NZ3OERCD
C:\Windows\assembly\tmp\NZEU00F2
C:\Windows\assembly\tmp\NZMX3LDN
C:\Windows\assembly\tmp\O02J5OQ6
C:\Windows\assembly\tmp\O1U12W5O
C:\Windows\assembly\tmp\O32JTAQU
C:\Windows\assembly\tmp\O33FYTYR
C:\Windows\assembly\tmp\O3TF3I6Q
C:\Windows\assembly\tmp\O4U1GA2Z
C:\Windows\assembly\tmp\O55F9TP4
C:\Windows\assembly\tmp\O57J6E2K
C:\Windows\assembly\tmp\O5VTFAK4
C:\Windows\assembly\tmp\O6EGJQNK
C:\Windows\assembly\tmp\O6KT7NDG
C:\Windows\assembly\tmp\O7522S4Q
C:\Windows\assembly\tmp\O7HD95O6
C:\Windows\assembly\tmp\OA0M4TW3
C:\Windows\assembly\tmp\OAIHWRHT
C:\Windows\assembly\tmp\OAIXC44P
C:\Windows\assembly\tmp\OATCXZHK
C:\Windows\assembly\tmp\OAVDGTFB
C:\Windows\assembly\tmp\OB5GU76O
C:\Windows\assembly\tmp\OC75BJAH
C:\Windows\assembly\tmp\OCUR6R22
C:\Windows\assembly\tmp\ODKU962Q
C:\Windows\assembly\tmp\ODWC8N9A
C:\Windows\assembly\tmp\OEBLBKXC
C:\Windows\assembly\tmp\OEJAYQI9
C:\Windows\assembly\tmp\OFWFVKPJ
C:\Windows\assembly\tmp\OGNT74W9
C:\Windows\assembly\tmp\OI94S9BU
C:\Windows\assembly\tmp\OKQC1BI7
C:\Windows\assembly\tmp\OKS7EHJ8
C:\Windows\assembly\tmp\OL55ZVME
C:\Windows\assembly\tmp\ON70PFYA
C:\Windows\assembly\tmp\OOCVT139
C:\Windows\assembly\tmp\OP98XTEG
C:\Windows\assembly\tmp\OP9Z9H3M
C:\Windows\assembly\tmp\OPJ46NU5
C:\Windows\assembly\tmp\OQ0FSHWD
C:\Windows\assembly\tmp\OQ6EP25G
C:\Windows\assembly\tmp\OQDG42UU
C:\Windows\assembly\tmp\OSBFF08O
C:\Windows\assembly\tmp\OSNLG9BR
C:\Windows\assembly\tmp\OSOLVU86
C:\Windows\assembly\tmp\OSPY1V3Q
C:\Windows\assembly\tmp\OTB8EGTO
C:\Windows\assembly\tmp\OU5UYY90
C:\Windows\assembly\tmp\OUHEICL1
C:\Windows\assembly\tmp\OV4Z8UU1
C:\Windows\assembly\tmp\OW25XHJ1
C:\Windows\assembly\tmp\OXP0B35J
C:\Windows\assembly\tmp\OXQA54NM
C:\Windows\assembly\tmp\OY2GPTK0
C:\Windows\assembly\tmp\P0O7J8YD
C:\Windows\assembly\tmp\P0TH4TYG
C:\Windows\assembly\tmp\P0ZS7HAP
C:\Windows\assembly\tmp\P1OKBM6X
C:\Windows\assembly\tmp\P1PB2E2V
C:\Windows\assembly\tmp\P1TA1OC8
C:\Windows\assembly\tmp\P210Z4KP
C:\Windows\assembly\tmp\P2N5FQFA
C:\Windows\assembly\tmp\P3E3JMPZ
C:\Windows\assembly\tmp\P4RP0NQX
C:\Windows\assembly\tmp\P529DYLJ
C:\Windows\assembly\tmp\P5DSPUOH
C:\Windows\assembly\tmp\P5FIWRR8
C:\Windows\assembly\tmp\P6IMNDAZ
C:\Windows\assembly\tmp\P6PKB116
C:\Windows\assembly\tmp\P7KNNLVY
C:\Windows\assembly\tmp\P9LJFG24
C:\Windows\assembly\tmp\PA8GX61Z
C:\Windows\assembly\tmp\PA9RTOVW
C:\Windows\assembly\tmp\PAHKZR8T
C:\Windows\assembly\tmp\PATR4JR9
C:\Windows\assembly\tmp\PBK9Q536
C:\Windows\assembly\tmp\PC750QNO
C:\Windows\assembly\tmp\PDF0YQMF
C:\Windows\assembly\tmp\PDVZP51A
C:\Windows\assembly\tmp\PDXPZ673
C:\Windows\assembly\tmp\PEGOZREG
C:\Windows\assembly\tmp\PFMO3965
C:\Windows\assembly\tmp\PGMJGCUM
C:\Windows\assembly\tmp\PGT8BVKV
C:\Windows\assembly\tmp\PGWZQEXL
C:\Windows\assembly\tmp\PHV0M0OV
C:\Windows\assembly\tmp\PI0AK8IG
C:\Windows\assembly\tmp\PIDXVGUR
C:\Windows\assembly\tmp\PIMVONX1
C:\Windows\assembly\tmp\PIOCB321
C:\Windows\assembly\tmp\PJZTI9XO
C:\Windows\assembly\tmp\PKBFN80T
C:\Windows\assembly\tmp\PKEGTEDD
C:\Windows\assembly\tmp\PKQ33S1H
C:\Windows\assembly\tmp\PKX2KIHD
C:\Windows\assembly\tmp\PLMLRTP9
C:\Windows\assembly\tmp\PNKS3KMA
C:\Windows\assembly\tmp\PNNZ0WWU
C:\Windows\assembly\tmp\PNYLUVY6
C:\Windows\assembly\tmp\PNZZ28WB
C:\Windows\assembly\tmp\PO6P4EGU
C:\Windows\assembly\tmp\POL2E6A1
C:\Windows\assembly\tmp\PP3D76UF
C:\Windows\assembly\tmp\PPDKG404
C:\Windows\assembly\tmp\PQWMJ6HW
C:\Windows\assembly\tmp\PSO3WCI8
C:\Windows\assembly\tmp\PTJKPNBF
C:\Windows\assembly\tmp\PU67FMZB
C:\Windows\assembly\tmp\PV9H2I45
C:\Windows\assembly\tmp\PWH2DANX
C:\Windows\assembly\tmp\PXN5C87D
C:\Windows\assembly\tmp\PXQ3R5QO
C:\Windows\assembly\tmp\PZ50BHSU
C:\Windows\assembly\tmp\Q07UA852
C:\Windows\assembly\tmp\Q0GB6JH1
C:\Windows\assembly\tmp\Q3H1BA46
C:\Windows\assembly\tmp\Q3KCGL56
C:\Windows\assembly\tmp\Q4ICS14Z
C:\Windows\assembly\tmp\Q4TAL7Y0
C:\Windows\assembly\tmp\Q6215SEQ
C:\Windows\assembly\tmp\Q64YMJCF
C:\Windows\assembly\tmp\Q6HN9LMT
C:\Windows\assembly\tmp\Q6XGJ3NX
C:\Windows\assembly\tmp\Q767JSLF
C:\Windows\assembly\tmp\Q820FQCQ
C:\Windows\assembly\tmp\Q8IIC50I
C:\Windows\assembly\tmp\Q9A7DBB6
C:\Windows\assembly\tmp\QA36VMWJ
C:\Windows\assembly\tmp\QA5F4CCJ
C:\Windows\assembly\tmp\QA5VIQDA
C:\Windows\assembly\tmp\QANKKP8P
C:\Windows\assembly\tmp\QB3BML56
C:\Windows\assembly\tmp\QBEQN004
C:\Windows\assembly\tmp\QC32PI6S
C:\Windows\assembly\tmp\QCOOZZXI
C:\Windows\assembly\tmp\QCWS22AE
C:\Windows\assembly\tmp\QD0LX5LN
C:\Windows\assembly\tmp\QDBXQPOI
C:\Windows\assembly\tmp\QDSO7P0A
C:\Windows\assembly\tmp\QE2IGX9X
C:\Windows\assembly\tmp\QEZGCX8V
C:\Windows\assembly\tmp\QFAG3PDA
C:\Windows\assembly\tmp\QFXFVO7K
C:\Windows\assembly\tmp\QHEK63NX
C:\Windows\assembly\tmp\QIH7O4AU
C:\Windows\assembly\tmp\QIOAHE4E
C:\Windows\assembly\tmp\QION7NOI
C:\Windows\assembly\tmp\QJAT3AWT
C:\Windows\assembly\tmp\QJRE76NI
C:\Windows\assembly\tmp\QJSMS8HB
C:\Windows\assembly\tmp\QK5XAKJY
C:\Windows\assembly\tmp\QLO2ITBT
C:\Windows\assembly\tmp\QMZBIJEF
C:\Windows\assembly\tmp\QN4FNU6J
C:\Windows\assembly\tmp\QN9R7GLH
C:\Windows\assembly\tmp\QNFXOG4U
C:\Windows\assembly\tmp\QNPSSU0N
C:\Windows\assembly\tmp\QO2CW23Z
C:\Windows\assembly\tmp\QOQNNJ0W
C:\Windows\assembly\tmp\QPF6TM2R
C:\Windows\assembly\tmp\QPGYXX48
C:\Windows\assembly\tmp\QPOEJ6QT
C:\Windows\assembly\tmp\QQ2DKT3R
C:\Windows\assembly\tmp\QQ3FFDNV
C:\Windows\assembly\tmp\QQIMU3D3
C:\Windows\assembly\tmp\QR06NK9M
C:\Windows\assembly\tmp\QR4CH8CN
C:\Windows\assembly\tmp\QRJXV5CP
C:\Windows\assembly\tmp\QSEGH4W6
C:\Windows\assembly\tmp\QTCJ172C
C:\Windows\assembly\tmp\QTP3J7T2
C:\Windows\assembly\tmp\QU82BFRY
C:\Windows\assembly\tmp\QXGFWR84
C:\Windows\assembly\tmp\QY1Q5N7N
C:\Windows\assembly\tmp\QYV93WXF
C:\Windows\assembly\tmp\QZ45S5HH
C:\Windows\assembly\tmp\R10P2O0M
C:\Windows\assembly\tmp\R1CS0LO6
C:\Windows\assembly\tmp\R1JWHFZG
C:\Windows\assembly\tmp\R1XFV3AZ
C:\Windows\assembly\tmp\R289SBEM
C:\Windows\assembly\tmp\R2CCA6Q4
C:\Windows\assembly\tmp\R2RZANQM
C:\Windows\assembly\tmp\R3ZCK8PO
C:\Windows\assembly\tmp\R40YZO71
C:\Windows\assembly\tmp\R4SLEKI3
C:\Windows\assembly\tmp\R6LENSTI
C:\Windows\assembly\tmp\R7BRN3L3
C:\Windows\assembly\tmp\R7M3NH46
C:\Windows\assembly\tmp\R89E98PP
C:\Windows\assembly\tmp\R8ETRCAU
C:\Windows\assembly\tmp\R8JLLBVP
C:\Windows\assembly\tmp\R9SDHHRG
C:\Windows\assembly\tmp\RAX885Y1
C:\Windows\assembly\tmp\RBXL2P0Z
C:\Windows\assembly\tmp\RC7LCGG9
C:\Windows\assembly\tmp\RCB984BK
C:\Windows\assembly\tmp\RCW8APPN
C:\Windows\assembly\tmp\RDOYLUKH
C:\Windows\assembly\tmp\RFWKO32M
C:\Windows\assembly\tmp\RGAXP7C2
C:\Windows\assembly\tmp\RH5KDSZI
C:\Windows\assembly\tmp\RHAKMFO8
C:\Windows\assembly\tmp\RHGE64H5
C:\Windows\assembly\tmp\RIETWJQX
C:\Windows\assembly\tmp\RJ3R6JHY
C:\Windows\assembly\tmp\RJHGGHMO
C:\Windows\assembly\tmp\RJJ9OH8I
C:\Windows\assembly\tmp\RKXL61XZ
C:\Windows\assembly\tmp\RL6FH69M
C:\Windows\assembly\tmp\RLSQ2PH6
C:\Windows\assembly\tmp\RLZA795V
C:\Windows\assembly\tmp\RM8D1UQE
C:\Windows\assembly\tmp\RN6VJZO1
C:\Windows\assembly\tmp\ROIMFSLP
C:\Windows\assembly\tmp\ROSMS57C
C:\Windows\assembly\tmp\RP7DNRWH
C:\Windows\assembly\tmp\RQF13HQ7
C:\Windows\assembly\tmp\RQGFY5XF
C:\Windows\assembly\tmp\RQOYB3GD
C:\Windows\assembly\tmp\RSRVBX1R
C:\Windows\assembly\tmp\RTELMKYT
C:\Windows\assembly\tmp\RTSAJWLL
C:\Windows\assembly\tmp\RUAHLT7B
C:\Windows\assembly\tmp\RURYH2B6
C:\Windows\assembly\tmp\RVD9EOE9
C:\Windows\assembly\tmp\RVMC75US
C:\Windows\assembly\tmp\RWK81URA
C:\Windows\assembly\tmp\RYHT8FK5
C:\Windows\assembly\tmp\RYS3GOR6
C:\Windows\assembly\tmp\RZ7G7ISN
C:\Windows\assembly\tmp\RZGTE37Z
C:\Windows\assembly\tmp\S0B355J7
C:\Windows\assembly\tmp\S0LYM7O2
C:\Windows\assembly\tmp\S10SV8NB
C:\Windows\assembly\tmp\S2EO5XDU
C:\Windows\assembly\tmp\S2OUIO7Q
C:\Windows\assembly\tmp\S2P5MZU5
C:\Windows\assembly\tmp\S2WROPWN
C:\Windows\assembly\tmp\S3K2ERNL
C:\Windows\assembly\tmp\S3NZPT93
C:\Windows\assembly\tmp\S4N6US3A
C:\Windows\assembly\tmp\S566MMQ2
C:\Windows\assembly\tmp\S5VEAGJV
C:\Windows\assembly\tmp\S5Y3FM8C
C:\Windows\assembly\tmp\S60AHMIU
C:\Windows\assembly\tmp\S6KYK9OB
C:\Windows\assembly\tmp\S7B3S16M
C:\Windows\assembly\tmp\S7OUKVHW
C:\Windows\assembly\tmp\S7RT3BFN
C:\Windows\assembly\tmp\S8K50PCA
C:\Windows\assembly\tmp\S90LVGTD
C:\Windows\assembly\tmp\S9FOXDZO
C:\Windows\assembly\tmp\S9ZODF11
C:\Windows\assembly\tmp\SA21S5ZL
C:\Windows\assembly\tmp\SA7ZMIJ9
C:\Windows\assembly\tmp\SAE21PSI
C:\Windows\assembly\tmp\SASCD2W7
C:\Windows\assembly\tmp\SBTD47YS
C:\Windows\assembly\tmp\SD0KPOK1
C:\Windows\assembly\tmp\SDXJK2KF
C:\Windows\assembly\tmp\SE3ERGX4
C:\Windows\assembly\tmp\SF20WAIU
C:\Windows\assembly\tmp\SFC4DD98
C:\Windows\assembly\tmp\SFE9OTIM
C:\Windows\assembly\tmp\SGB6WHM3
C:\Windows\assembly\tmp\SGPOGLND
C:\Windows\assembly\tmp\SGQGK5ML
C:\Windows\assembly\tmp\SGZIBRNN
C:\Windows\assembly\tmp\SH4OWKT3
C:\Windows\assembly\tmp\SHSFDRPJ
C:\Windows\assembly\tmp\SI621DBU
C:\Windows\assembly\tmp\SIHKF4TV
C:\Windows\assembly\tmp\SJGDBI2Y
C:\Windows\assembly\tmp\SJOUALJA
C:\Windows\assembly\tmp\SKCZ6KIJ
C:\Windows\assembly\tmp\SL0AV08O
C:\Windows\assembly\tmp\SN8FS4TQ
C:\Windows\assembly\tmp\SO3L7K4C
C:\Windows\assembly\tmp\SO6ZG7C0
C:\Windows\assembly\tmp\SONIJO8Y
C:\Windows\assembly\tmp\SOOEX0SM
C:\Windows\assembly\tmp\SOVI757T
C:\Windows\assembly\tmp\SQS9QBNR
C:\Windows\assembly\tmp\SS626UOG
C:\Windows\assembly\tmp\SS6TEK45
C:\Windows\assembly\tmp\STH7JEVL
C:\Windows\assembly\tmp\STWOA02V
C:\Windows\assembly\tmp\STZO29CO
C:\Windows\assembly\tmp\SV0HKI1V
C:\Windows\assembly\tmp\SVLQYRD4
C:\Windows\assembly\tmp\SVWAN3LL
C:\Windows\assembly\tmp\SW0ABYEA
C:\Windows\assembly\tmp\SW1Z5Z1W
C:\Windows\assembly\tmp\SW4I6J2F
C:\Windows\assembly\tmp\SXHE3I70
C:\Windows\assembly\tmp\SXXXTSST
C:\Windows\assembly\tmp\SYN8WJBL
C:\Windows\assembly\tmp\SYXQLRI8
C:\Windows\assembly\tmp\SZLUJOS9
C:\Windows\assembly\tmp\SZMUYFNH
C:\Windows\assembly\tmp\T03PE3KZ
C:\Windows\assembly\tmp\T05O634V
C:\Windows\assembly\tmp\T0SHZK8Q
C:\Windows\assembly\tmp\T3TKCI1I
C:\Windows\assembly\tmp\T5IEFSJO
C:\Windows\assembly\tmp\T82OT0BN
C:\Windows\assembly\tmp\T9TGFH7U
C:\Windows\assembly\tmp\T9ZAOJO4
C:\Windows\assembly\tmp\TBLN33NB
C:\Windows\assembly\tmp\TC3IVGCD
C:\Windows\assembly\tmp\TC5IF61J
C:\Windows\assembly\tmp\TEA7DKEM
C:\Windows\assembly\tmp\TEJG75IM
C:\Windows\assembly\tmp\TFF6K5HQ
C:\Windows\assembly\tmp\TGGCV25R
C:\Windows\assembly\tmp\THSTY9TV
C:\Windows\assembly\tmp\TI1GLLJ5
C:\Windows\assembly\tmp\TJ2SK9U2
C:\Windows\assembly\tmp\TK3IJ0QX
C:\Windows\assembly\tmp\TKFTTK4G
C:\Windows\assembly\tmp\TLC8G2DD
C:\Windows\assembly\tmp\TLFU2HUZ
C:\Windows\assembly\tmp\TMNF56QZ
C:\Windows\assembly\tmp\TNE6RTJA
C:\Windows\assembly\tmp\TOH21HCJ
C:\Windows\assembly\tmp\TOHQM67W
C:\Windows\assembly\tmp\TOW1R8YT
C:\Windows\assembly\tmp\TP388BRZ
C:\Windows\assembly\tmp\TPX5XAJM
C:\Windows\assembly\tmp\TR4F954H
C:\Windows\assembly\tmp\TRT1DVYL
C:\Windows\assembly\tmp\TSG4W5NV
C:\Windows\assembly\tmp\TSUIX6VL
C:\Windows\assembly\tmp\TSVSAMDI
C:\Windows\assembly\tmp\TT20V2NI
C:\Windows\assembly\tmp\TT52K387
C:\Windows\assembly\tmp\TT5M8VJM
C:\Windows\assembly\tmp\TT789O9O
C:\Windows\assembly\tmp\TUHHWS6X
C:\Windows\assembly\tmp\TUP7S3DF
C:\Windows\assembly\tmp\TV9GY152
C:\Windows\assembly\tmp\TWA6JOCX
C:\Windows\assembly\tmp\TX72YMHU
C:\Windows\assembly\tmp\TX7E0AR7
C:\Windows\assembly\tmp\TXLV6ZF0
C:\Windows\assembly\tmp\TXMNAHUA
C:\Windows\assembly\tmp\TY5NECS5
C:\Windows\assembly\tmp\TYH9C5NK
C:\Windows\assembly\tmp\TZ53ZYNK
C:\Windows\assembly\tmp\TZ5PR90C
C:\Windows\assembly\tmp\U
C:\Windows\assembly\tmp\U09GS5M0
C:\Windows\assembly\tmp\U0JGA1AE
C:\Windows\assembly\tmp\U11RNXP6
C:\Windows\assembly\tmp\U12IVPLB
C:\Windows\assembly\tmp\U173GF4P
C:\Windows\assembly\tmp\U1CE21EM
C:\Windows\assembly\tmp\U1CUSE46
C:\Windows\assembly\tmp\U1Z8EHR8
C:\Windows\assembly\tmp\U1ZJC7JW
C:\Windows\assembly\tmp\U2J3PLBJ
C:\Windows\assembly\tmp\U2NYMMA9
C:\Windows\assembly\tmp\U2U9TEJP
C:\Windows\assembly\tmp\U3A49O16
C:\Windows\assembly\tmp\U469Z39Y
C:\Windows\assembly\tmp\U4MOE4SO
C:\Windows\assembly\tmp\U4URTD1Z
C:\Windows\assembly\tmp\U5Z7P6KA
C:\Windows\assembly\tmp\U6ZO10SE
C:\Windows\assembly\tmp\U7KJBIRU
C:\Windows\assembly\tmp\U7ZFJA3H
C:\Windows\assembly\tmp\U87HA5PU
C:\Windows\assembly\tmp\U8BDAN3C
C:\Windows\assembly\tmp\U8D3RHGY
C:\Windows\assembly\tmp\U8SX0K6G
C:\Windows\assembly\tmp\U9CHH55W
C:\Windows\assembly\tmp\U9CJ0ZG4
C:\Windows\assembly\tmp\UACVFPAR
C:\Windows\assembly\tmp\UAYANVOW
C:\Windows\assembly\tmp\UB3G3NW7
C:\Windows\assembly\tmp\UBPJ56UP
C:\Windows\assembly\tmp\UC59TW3C
C:\Windows\assembly\tmp\UCEZ6HDL
C:\Windows\assembly\tmp\UE5R864K
C:\Windows\assembly\tmp\UEZ82QO0
C:\Windows\assembly\tmp\UFHELH97
C:\Windows\assembly\tmp\UG1YK5IK
C:\Windows\assembly\tmp\UG9C8XUH
C:\Windows\assembly\tmp\UHCIVKQF
C:\Windows\assembly\tmp\UHCQ2PC3
C:\Windows\assembly\tmp\UHW89YW4
C:\Windows\assembly\tmp\UIO3F9XA
C:\Windows\assembly\tmp\UJ3HQNNR
C:\Windows\assembly\tmp\UJHJ4HVH
C:\Windows\assembly\tmp\UK87JWJY
C:\Windows\assembly\tmp\UK98M8P6
C:\Windows\assembly\tmp\ULD1DWUH
C:\Windows\assembly\tmp\ULDU9AV5
C:\Windows\assembly\tmp\UMAT2F6T
C:\Windows\assembly\tmp\UMUNK8WR
C:\Windows\assembly\tmp\UN3Y05XS
C:\Windows\assembly\tmp\UN9IC74J
C:\Windows\assembly\tmp\UNBFEFFN
C:\Windows\assembly\tmp\UNOMOKA5
C:\Windows\assembly\tmp\UNPPK18N
C:\Windows\assembly\tmp\UO2BOFFJ
C:\Windows\assembly\tmp\UOQTF8EG
C:\Windows\assembly\tmp\UPQ1U1UA
C:\Windows\assembly\tmp\UPWLR8EF
C:\Windows\assembly\tmp\UQBCNGZG
C:\Windows\assembly\tmp\UQEFP48B
C:\Windows\assembly\tmp\UQNAH45P
C:\Windows\assembly\tmp\UQYAYKUB
C:\Windows\assembly\tmp\URC6DO3P
C:\Windows\assembly\tmp\USVDX8QB
C:\Windows\assembly\tmp\UT08L9ZX
C:\Windows\assembly\tmp\UV2SKNUV
C:\Windows\assembly\tmp\UVGY44U1
C:\Windows\assembly\tmp\UWBTAE7E
C:\Windows\assembly\tmp\UWCXO2GS
C:\Windows\assembly\tmp\UWQ8Y1MO
C:\Windows\assembly\tmp\UWW12ZUE
C:\Windows\assembly\tmp\UXC2W7XL
C:\Windows\assembly\tmp\UXYWCDW2
C:\Windows\assembly\tmp\UYISF6M5
C:\Windows\assembly\tmp\UYQLNJKL
C:\Windows\assembly\tmp\UYTPV0R3
C:\Windows\assembly\tmp\UYY0T9E0
C:\Windows\assembly\tmp\UZ9UZAST
C:\Windows\assembly\tmp\V0Q7NHG4
C:\Windows\assembly\tmp\V19DH54Z
C:\Windows\assembly\tmp\V2GX0FL4
C:\Windows\assembly\tmp\V37KZ67Q
C:\Windows\assembly\tmp\V425CYWJ
C:\Windows\assembly\tmp\V55HNBGD
C:\Windows\assembly\tmp\V63HT55B
C:\Windows\assembly\tmp\V675SQIO
C:\Windows\assembly\tmp\V6ALW690
C:\Windows\assembly\tmp\V6FPXVT8
C:\Windows\assembly\tmp\V6NNMHGM
C:\Windows\assembly\tmp\V72OFK61
C:\Windows\assembly\tmp\V7ZQR9VS
C:\Windows\assembly\tmp\V8H0387S
C:\Windows\assembly\tmp\V8PGVFJR
C:\Windows\assembly\tmp\V99HHLSZ
C:\Windows\assembly\tmp\V9HG9YXO
C:\Windows\assembly\tmp\VB4K7MXI
C:\Windows\assembly\tmp\VBF4KAXU
C:\Windows\assembly\tmp\VCM3FFOO
C:\Windows\assembly\tmp\VD1RRLJ8
C:\Windows\assembly\tmp\VD2THCKK
C:\Windows\assembly\tmp\VEA49E64
C:\Windows\assembly\tmp\VEC6H787
C:\Windows\assembly\tmp\VEDCSDE1
C:\Windows\assembly\tmp\VEPMUCTV
C:\Windows\assembly\tmp\VEZPLW1F
C:\Windows\assembly\tmp\VF9NGNMZ
C:\Windows\assembly\tmp\VFCX16KQ
C:\Windows\assembly\tmp\VG3T48SS
C:\Windows\assembly\tmp\VGVT685N
C:\Windows\assembly\tmp\VHH1UHTA
C:\Windows\assembly\tmp\VHKLMH15
C:\Windows\assembly\tmp\VJ00W3FM
C:\Windows\assembly\tmp\VJGRW7LK
C:\Windows\assembly\tmp\VKE0LGML
C:\Windows\assembly\tmp\VLFWWRMQ
C:\Windows\assembly\tmp\VMCSIXYE
C:\Windows\assembly\tmp\VMEZ6KNA
C:\Windows\assembly\tmp\VMJ6VVBT
C:\Windows\assembly\tmp\VMNNUGLO
C:\Windows\assembly\tmp\VMUX2C3J
C:\Windows\assembly\tmp\VNFHWYLB
C:\Windows\assembly\tmp\VNR4MIV9
C:\Windows\assembly\tmp\VNXYA0AG
C:\Windows\assembly\tmp\VO1KH7UP
C:\Windows\assembly\tmp\VOCBELSJ
C:\Windows\assembly\tmp\VORQUFCA
C:\Windows\assembly\tmp\VOSXWNR0
C:\Windows\assembly\tmp\VOVCEN19
C:\Windows\assembly\tmp\VP0I0GPN
C:\Windows\assembly\tmp\VP7LDAL6
C:\Windows\assembly\tmp\VQ4A6TC7
C:\Windows\assembly\tmp\VQ6711OA
C:\Windows\assembly\tmp\VQL41DT1
C:\Windows\assembly\tmp\VR078YFA
C:\Windows\assembly\tmp\VRH4VJ2N
C:\Windows\assembly\tmp\VTF7RXVQ
C:\Windows\assembly\tmp\VTJ6IORY
C:\Windows\assembly\tmp\VUBQUYGM
C:\Windows\assembly\tmp\VUN6Z539
C:\Windows\assembly\tmp\VW52EHZQ
C:\Windows\assembly\tmp\VWIXE25X
C:\Windows\assembly\tmp\VWPGN9LW
C:\Windows\assembly\tmp\VWX6HDL8
C:\Windows\assembly\tmp\VYXR1C85
C:\Windows\assembly\tmp\W0YZL341
C:\Windows\assembly\tmp\W1FPY7FE
C:\Windows\assembly\tmp\W1SCE759
C:\Windows\assembly\tmp\W23HKNI3
C:\Windows\assembly\tmp\W2E0S9VB
C:\Windows\assembly\tmp\W2E9Z6BB
C:\Windows\assembly\tmp\W36K00S2
C:\Windows\assembly\tmp\W37U75FZ
C:\Windows\assembly\tmp\W38LC59Y
C:\Windows\assembly\tmp\W3T6BKOI
C:\Windows\assembly\tmp\W49XQEX5
C:\Windows\assembly\tmp\W4VK8ZYK
C:\Windows\assembly\tmp\W4WRPPDA
C:\Windows\assembly\tmp\W4ZTRS27
C:\Windows\assembly\tmp\W60GEQMV
C:\Windows\assembly\tmp\W6TITOC0
C:\Windows\assembly\tmp\W7XOM2S7
C:\Windows\assembly\tmp\W8SU4WNA
C:\Windows\assembly\tmp\W9EAFRK9
C:\Windows\assembly\tmp\W9SRA19B
C:\Windows\assembly\tmp\WA7E75FH
C:\Windows\assembly\tmp\WAA94F0N
C:\Windows\assembly\tmp\WAGZRRZ3
C:\Windows\assembly\tmp\WAMD2XBM
C:\Windows\assembly\tmp\WB24POI6
C:\Windows\assembly\tmp\WBH83YU4
C:\Windows\assembly\tmp\WBO0WFDX
C:\Windows\assembly\tmp\WBQOGOSQ
C:\Windows\assembly\tmp\WC1URUYK
C:\Windows\assembly\tmp\WC5EW1TN
C:\Windows\assembly\tmp\WCA10PTJ
C:\Windows\assembly\tmp\WCOVOBCO
C:\Windows\assembly\tmp\WF9E13IZ
C:\Windows\assembly\tmp\WFVY7J2L
C:\Windows\assembly\tmp\WFYMHL4Q
C:\Windows\assembly\tmp\WGDE9HN9
C:\Windows\assembly\tmp\WGXWOKNY
C:\Windows\assembly\tmp\WH7D09UH
C:\Windows\assembly\tmp\WH8NADO8
C:\Windows\assembly\tmp\WH9N6NVO
C:\Windows\assembly\tmp\WIM1CS85
C:\Windows\assembly\tmp\WJBA9OOS
C:\Windows\assembly\tmp\WL1H4FZY
C:\Windows\assembly\tmp\WL2TJSST
C:\Windows\assembly\tmp\WL5TKLF1
C:\Windows\assembly\tmp\WLI06WWU
C:\Windows\assembly\tmp\WLLO80LZ
C:\Windows\assembly\tmp\WLOGDTZJ
C:\Windows\assembly\tmp\WM4FXU8D
C:\Windows\assembly\tmp\WN3N3RA6
C:\Windows\assembly\tmp\WNCPE7EN
C:\Windows\assembly\tmp\WNXIR4JY
C:\Windows\assembly\tmp\WO38V3N9
C:\Windows\assembly\tmp\WOHQ2NO2
C:\Windows\assembly\tmp\WOTKOSM4
C:\Windows\assembly\tmp\WP0FP67N
C:\Windows\assembly\tmp\WP4K7B7W
C:\Windows\assembly\tmp\WP8VMGEV
C:\Windows\assembly\tmp\WPRGNR4N
C:\Windows\assembly\tmp\WQ11HO34
C:\Windows\assembly\tmp\WR16COZT
C:\Windows\assembly\tmp\WRR8H13J
C:\Windows\assembly\tmp\WS6MH29T
C:\Windows\assembly\tmp\WS7725M4
C:\Windows\assembly\tmp\WTIGPTA5
C:\Windows\assembly\tmp\WTIUP4RG
C:\Windows\assembly\tmp\WURPUWPX
C:\Windows\assembly\tmp\WV080UB4
C:\Windows\assembly\tmp\WVZJFIHK
C:\Windows\assembly\tmp\WW40OM3C
C:\Windows\assembly\tmp\WW765MMV
C:\Windows\assembly\tmp\WX3OLO5F
C:\Windows\assembly\tmp\WXRB2N1F
C:\Windows\assembly\tmp\WXWS7BGW
C:\Windows\assembly\tmp\WYRVNMSZ
C:\Windows\assembly\tmp\X006664B
C:\Windows\assembly\tmp\X1NAVWJE
C:\Windows\assembly\tmp\X2XALIE0
C:\Windows\assembly\tmp\X4ZHT486
C:\Windows\assembly\tmp\X5LWP82W
C:\Windows\assembly\tmp\X6R6YOQN
C:\Windows\assembly\tmp\X6XWU3R7
C:\Windows\assembly\tmp\X75NR0UT
C:\Windows\assembly\tmp\X7LUOLI2
C:\Windows\assembly\tmp\X873X9NA
C:\Windows\assembly\tmp\X8ISV7ZZ
C:\Windows\assembly\tmp\X8RBGA5Z
C:\Windows\assembly\tmp\X9TMEN99
C:\Windows\assembly\tmp\X9V2KYV0
C:\Windows\assembly\tmp\XA751IH5
C:\Windows\assembly\tmp\XADQVQX8
C:\Windows\assembly\tmp\XB05CHPR
C:\Windows\assembly\tmp\XD1INNVN
C:\Windows\assembly\tmp\XD2WLBXM
C:\Windows\assembly\tmp\XEK5S4TV
C:\Windows\assembly\tmp\XEN3ZDC5
C:\Windows\assembly\tmp\XEO02SBG
C:\Windows\assembly\tmp\XESUMY0S
C:\Windows\assembly\tmp\XF1T4NNO
C:\Windows\assembly\tmp\XFJHVX3D
C:\Windows\assembly\tmp\XGI1FOJB
C:\Windows\assembly\tmp\XGNEC5XB
C:\Windows\assembly\tmp\XGNG3XAR
C:\Windows\assembly\tmp\XHOW86XE
C:\Windows\assembly\tmp\XI8X72PS
C:\Windows\assembly\tmp\XISFQG6Z
C:\Windows\assembly\tmp\XK9O7YTZ
C:\Windows\assembly\tmp\XLC300YT
C:\Windows\assembly\tmp\XLVFRZ55
C:\Windows\assembly\tmp\XMF0O4SO
C:\Windows\assembly\tmp\XN0Q4MGV
C:\Windows\assembly\tmp\XNHOCN80
C:\Windows\assembly\tmp\XO4S7IV2
C:\Windows\assembly\tmp\XPAXZP8Y
C:\Windows\assembly\tmp\XQ1Z3Q6C
C:\Windows\assembly\tmp\XQXFVFK4
C:\Windows\assembly\tmp\XR3QHAVK
C:\Windows\assembly\tmp\XROOE35T
C:\Windows\assembly\tmp\XSAVQ8WN
C:\Windows\assembly\tmp\XSW9K0DL
C:\Windows\assembly\tmp\XSWR1WE3
C:\Windows\assembly\tmp\XT7IADVF
C:\Windows\assembly\tmp\XU31IHD3
C:\Windows\assembly\tmp\XUJQ9ENJ
C:\Windows\assembly\tmp\XUMEE4FW
C:\Windows\assembly\tmp\XWDJ0Z3E
C:\Windows\assembly\tmp\XWKY71KD
C:\Windows\assembly\tmp\XX3ZMETR
C:\Windows\assembly\tmp\XXFMWTEC
C:\Windows\assembly\tmp\XXXTA0IJ
C:\Windows\assembly\tmp\XY10LF03
C:\Windows\assembly\tmp\XY76EBHF
C:\Windows\assembly\tmp\XYNG51Q9
C:\Windows\assembly\tmp\XYVAYVDX
C:\Windows\assembly\tmp\XZ2JV4Z1
C:\Windows\assembly\tmp\XZDOD819
C:\Windows\assembly\tmp\Y0S64RKZ
C:\Windows\assembly\tmp\Y17IE711
C:\Windows\assembly\tmp\Y1OZHS0O
C:\Windows\assembly\tmp\Y1WEP56Z
C:\Windows\assembly\tmp\Y372XSFR
C:\Windows\assembly\tmp\Y4XHQZYM
C:\Windows\assembly\tmp\Y50NPNVN
C:\Windows\assembly\tmp\Y51PD7HA
C:\Windows\assembly\tmp\Y5Q95VC1
C:\Windows\assembly\tmp\Y6BTM8YV
C:\Windows\assembly\tmp\Y70WYEKX
C:\Windows\assembly\tmp\Y7VRLWZQ
C:\Windows\assembly\tmp\Y86PQZHB
C:\Windows\assembly\tmp\Y8GNOG8Z
C:\Windows\assembly\tmp\Y9Q3IR84
C:\Windows\assembly\tmp\YA27JOVF
C:\Windows\assembly\tmp\YA283RCP
C:\Windows\assembly\tmp\YA33VHU0
C:\Windows\assembly\tmp\YAV5NCFK
C:\Windows\assembly\tmp\YC0CG21F
C:\Windows\assembly\tmp\YC51R3CM
C:\Windows\assembly\tmp\YCIC72JC
C:\Windows\assembly\tmp\YCJV4P2K
C:\Windows\assembly\tmp\YD3DK787
C:\Windows\assembly\tmp\YD56TGCO
C:\Windows\assembly\tmp\YD57MOYN
C:\Windows\assembly\tmp\YDDGE7J3
C:\Windows\assembly\tmp\YDZHJ09A
C:\Windows\assembly\tmp\YERWSZ3C
C:\Windows\assembly\tmp\YF0E7XYL
C:\Windows\assembly\tmp\YFB23740
C:\Windows\assembly\tmp\YG0SJPO3
C:\Windows\assembly\tmp\YH16I5HK
C:\Windows\assembly\tmp\YI2927KF
C:\Windows\assembly\tmp\YJ20G91J
C:\Windows\assembly\tmp\YJETFJEQ
C:\Windows\assembly\tmp\YJHS1A6U
C:\Windows\assembly\tmp\YJJCMZ6F
C:\Windows\assembly\tmp\YLLSN8DN
C:\Windows\assembly\tmp\YM5XH712
C:\Windows\assembly\tmp\YM6PD8EN
C:\Windows\assembly\tmp\YMG47SXW
C:\Windows\assembly\tmp\YMWZA53B
C:\Windows\assembly\tmp\YNNLVQVZ
C:\Windows\assembly\tmp\YPGBOU5H
C:\Windows\assembly\tmp\YRR14CSQ
C:\Windows\assembly\tmp\YSTDP4HB
C:\Windows\assembly\tmp\YSVGFYQF
C:\Windows\assembly\tmp\YT505NSQ
C:\Windows\assembly\tmp\YTE8EOIX
C:\Windows\assembly\tmp\YTGHKX6C
C:\Windows\assembly\tmp\YTMMDXLU
C:\Windows\assembly\tmp\YU2DIBTZ
C:\Windows\assembly\tmp\YUR2ZLWF
C:\Windows\assembly\tmp\YURYNND4
C:\Windows\assembly\tmp\YVIQVV7V
C:\Windows\assembly\tmp\YVRDIKR2
C:\Windows\assembly\tmp\YVTN22LL
C:\Windows\assembly\tmp\YWLRYNKE
C:\Windows\assembly\tmp\YX109ZAY
C:\Windows\assembly\tmp\YXIOCMN9
C:\Windows\assembly\tmp\YY44K0BO
C:\Windows\assembly\tmp\YY56F4WX
C:\Windows\assembly\tmp\YY8OC0KN
C:\Windows\assembly\tmp\YYK0P6Q4
C:\Windows\assembly\tmp\YZO02Z1U
C:\Windows\assembly\tmp\YZSLG14C
C:\Windows\assembly\tmp\YZXYLGPK
C:\Windows\assembly\tmp\YZZ2167B
C:\Windows\assembly\tmp\Z04QJPED
C:\Windows\assembly\tmp\Z0IG2FB5
C:\Windows\assembly\tmp\Z0ZNXK29
C:\Windows\assembly\tmp\Z2AT5Y4K
C:\Windows\assembly\tmp\Z2I2A3I9
C:\Windows\assembly\tmp\Z34FM3UQ
C:\Windows\assembly\tmp\Z3BZJXOU
C:\Windows\assembly\tmp\Z3O76M2V
C:\Windows\assembly\tmp\Z4B6MFAY
C:\Windows\assembly\tmp\Z4M6258X
C:\Windows\assembly\tmp\Z5237NQE
C:\Windows\assembly\tmp\Z52I8VDN
C:\Windows\assembly\tmp\Z5HN2FAC
C:\Windows\assembly\tmp\Z5PA5XVH
C:\Windows\assembly\tmp\Z6I2962A
C:\Windows\assembly\tmp\Z6O7J9XE
C:\Windows\assembly\tmp\Z6RTKFA1
C:\Windows\assembly\tmp\Z7FLNU14
C:\Windows\assembly\tmp\Z7YFCU4B
C:\Windows\assembly\tmp\Z7ZMA8E3
C:\Windows\assembly\tmp\Z8AK7WIF
C:\Windows\assembly\tmp\Z8ZMGSSN
C:\Windows\assembly\tmp\Z95I23SO
C:\Windows\assembly\tmp\Z9JNFOKH
C:\Windows\assembly\tmp\ZA6XUNXD
C:\Windows\assembly\tmp\ZB4V9P8Y
C:\Windows\assembly\tmp\ZB8BBOI9
C:\Windows\assembly\tmp\ZBNFS9J9
C:\Windows\assembly\tmp\ZCD9A2FD
C:\Windows\assembly\tmp\ZD5XBZ0T
C:\Windows\assembly\tmp\ZDI6O6BG
C:\Windows\assembly\tmp\ZDSP4TWK
C:\Windows\assembly\tmp\ZEFY9IX7
C:\Windows\assembly\tmp\ZEPNN3XP
C:\Windows\assembly\tmp\ZETX8ZG9
C:\Windows\assembly\tmp\ZFRP6BRU
C:\Windows\assembly\tmp\ZGH6NDB8
C:\Windows\assembly\tmp\ZI82NWWX
C:\Windows\assembly\tmp\ZIOSY2RR
C:\Windows\assembly\tmp\ZJ3GGAL9
C:\Windows\assembly\tmp\ZJ7UBF2L
C:\Windows\assembly\tmp\ZJJGEAHL
C:\Windows\assembly\tmp\ZK9WX5TC
C:\Windows\assembly\tmp\ZKLCZE5P
C:\Windows\assembly\tmp\ZKXT8GTN
C:\Windows\assembly\tmp\ZKZE6S4A
C:\Windows\assembly\tmp\ZMSNENRK
C:\Windows\assembly\tmp\ZO9VIJOD
C:\Windows\assembly\tmp\ZOFPEDL5
C:\Windows\assembly\tmp\ZPAFFI32
C:\Windows\assembly\tmp\ZROG2ID2
C:\Windows\assembly\tmp\ZS0QCDF5
C:\Windows\assembly\tmp\ZSY2ZEO3
C:\Windows\assembly\tmp\ZT26RIJJ
C:\Windows\assembly\tmp\ZTHZZ6YD
C:\Windows\assembly\tmp\ZUEDHQ6T
C:\Windows\assembly\tmp\ZUSJAR9V
C:\Windows\assembly\tmp\ZV88SH6U
C:\Windows\assembly\tmp\ZVHRP3HZ
C:\Windows\assembly\tmp\ZW57IT8F
C:\Windows\assembly\tmp\ZW6TJ35S
C:\Windows\assembly\tmp\ZW9RAOEM
C:\Windows\assembly\tmp\ZWGODMEU
C:\Windows\assembly\tmp\ZWNTTFH3
C:\Windows\assembly\tmp\ZXCBTBTN
C:\Windows\assembly\tmp\ZY6IMMBE
C:\Windows\assembly\tmp\ZZE62AVC
C:\Windows\assembly\tmp\ZZWX1WQJ
C:\Windows\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-06-23 01:16

==================== End Of Log ============================

--- --- ---

Nein, keine Probleme mehr, vielen vielen Dank für die nette und schnelle Hilfe

schrauber · 01.07.2013, 08:26

Hi,

Fertig

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

DeniseBö · 02.07.2013, 11:07

Hallo,
alles geschafft.
Nochmals vielen Dank für die nette Hilfe

Denise

schrauber · 02.07.2013, 13:26

Gern Geschehen

DeniseBö · 18.07.2013, 15:43

Hallo,
Wochen nach der Entfernung des Trojaners erscheint beim Hochfahren des Laptops ein Fenster mit der Überschrift Administrator cmd.exe
Ich habe keinen Zugriff auf meinen Benutzer, auch nicht im abgesicherten Modus.
Ich hoffe, dieser Beitrag wird noch gelesen, auch wenn der Beitrag eigentlich geschlossen ist.
Liebe Grüße,
Denise Böhle

29.06.2013, 18:00	#2
schrauber /// the machine /// TB-Ausbilder	GVU Trojaner 2.12 Windows 7 Hi, dann poste bitte das OTL log. __________________ __________________

30.06.2013, 16:00	#6
schrauber /// the machine /// TB-Ausbilder	GVU Trojaner 2.12 Windows 7 Neu booten? __________________ --> GVU Trojaner 2.12 Windows 7

02.07.2013, 13:26	#14
schrauber /// the machine /// TB-Ausbilder	GVU Trojaner 2.12 Windows 7 Gern Geschehen __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

GVU Trojaner 2.12 Windows 7

Log-Analyse und Auswertung: GVU Trojaner 2.12 Windows 7