Windows 11: Mögliche RAT-Infektion

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 12-08.2024
durchgeführt von ALB (Administrator) auf PC-80-BOES (Dell Inc. Inspiron 3910) (13-08-2024 08:27:26)
Gestartet von C:\Verdacht_RAT\FRST64.exe
Geladene Profile: ALB
Plattform: Microsoft Windows 11 Pro Version 23H2 22631.3958 (X64) Sprache: Deutsch (Deutschland)
Standard-Browser: Edge
Start-Modus: Normal

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe ->) (Malwarebytes Inc. -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
(C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe ->) (Malwarebytes Inc. -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe
(C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe ->) (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA app\CEF\NVIDIA Overlay.exe <3>
(C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe ->) (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA app\ShadowPlay\nvsphelper64.exe
(C:\Program Files\WindowsApps\MSTeams_24193.1805.3040.8975_x64__8wekyb3d8bbwe\ms-teams.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft\EdgeWebView\Application\127.0.2651.98\msedgewebview2.exe <8>
(DriverStore\FileRepository\ipf_cpu.inf_amd64_bca8bb2217972264\ipf_uf.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\ipf_cpu.inf_amd64_bca8bb2217972264\ipf_helper.exe
(explorer.exe ->) (Cylance, Inc. -> Cylance, Inc.) C:\Program Files\Cylance\Desktop\CylanceUI.exe
(explorer.exe ->) (Marti Climent -> ) C:\Program Files\UniGetUI\UniGetUI.exe
(explorer.exe ->) (ownCloud GmbH -> ) C:\Program Files\ownCloud\owncloud.exe
(explorer.exe ->) (Swyx Solutions AG -> Swyx Solutions GmbH) C:\Program Files (x86)\SwyxIt!\SwyxIt!.exe
(explorer.exe ->) (Veeam Software Group GmbH -> Veeam Software Group GmbH) C:\Program Files\Veeam\Endpoint Backup\Veeam.EndPoint.Tray.exe
(explorer.exe ->) (Waves Inc -> Waves Audio Ltd.) C:\Windows\System32\DriverStore\FileRepository\wavesapo10de.inf_amd64_e306bdf9c02213dc\WavesSvc64.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\WindowsApps\MSTeams_24193.1805.3040.8975_x64__8wekyb3d8bbwe\ms-teams.exe <2>
(OpenVPN Inc. -> OpenVPN) C:\Program Files\OpenVPN Connect\OpenVPNConnect.exe <4>
(services.exe ->) (Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
(services.exe ->) (Cylance, Inc. -> Cylance, Inc.) C:\Program Files\Cylance\Desktop\CylanceSvc.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\dal.inf_amd64_64d7fcfcde9b9c10\jhi_service.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\ipf_cpu.inf_amd64_bca8bb2217972264\ipf_uf.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\mewmiprov.inf_amd64_f3c201b4c28c14d0\WMIRegistrationService.exe
(services.exe ->) (Malwarebytes Inc. -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Phone Tools\CoreCon\11.0\bin\IpOverUsbSvc.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(services.exe ->) (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe <3>
(services.exe ->) (NVIDIA Corporation -> NVIDIA Corporation) C:\Windows\System32\DriverStore\FileRepository\nvddi.inf_amd64_b740ade77f86efb0\Display.NvContainer\NVDisplay.Container.exe <2>
(services.exe ->) (OpenVPN Inc. -> ) C:\Program Files\OpenVPN Connect\agent_ovpnconnect_1706702535874.exe
(services.exe ->) (OpenVPN Inc. -> ) C:\Program Files\OpenVPN Connect\ovpnhelper_service.exe
(services.exe ->) (Veeam Software Group GmbH -> Veeam Software Group GmbH) C:\Program Files\Veeam\Endpoint Backup\Veeam.EndPoint.Service.exe
(services.exe ->) (Waves Inc -> Waves Audio Ltd) C:\Windows\System32\DriverStore\FileRepository\wavesapo10de.inf_amd64_e306bdf9c02213dc\WavesAudioService.exe
(services.exe ->) (Waves Inc -> Waves Audio Ltd.) C:\Windows\System32\DriverStore\FileRepository\wavesapo10de.inf_amd64_e306bdf9c02213dc\WavesSysSvc64.exe
(svchost.exe ->) (Microsoft Corporation -> ) C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.23.1911.0_x64__8wekyb3d8bbwe\WindowsPackageManagerServer.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_524.18500.10.0_x64__cw5n1h2txyewy\Dashboard\WidgetService.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe <2>
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\UUS\Packages\Preview\amd64\MoUsoCoreWorker.exe
(svchost.exe ->) (Swyx Solutions AG -> Swyx Solutions GmbH) C:\Program Files (x86)\SwyxIt!\CLMgr.exe
konnte nicht auf den Prozess zugreifen -> vmmemCmZygote

==================== Registry (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [WavesSvc] => C:\WINDOWS\System32\DriverStore\FileRepository\wavesapo10de.inf_amd64_e306bdf9c02213dc\WavesSvc64.exe [4585280 2022-05-18] (Waves Inc -> Waves Audio Ltd.)
HKLM\...\Run: [Veeam.EndPoint.Tray.exe] => C:\Program Files\Veeam\Endpoint Backup\Veeam.EndPoint.Tray.exe [932000 2024-04-28] (Veeam Software Group GmbH -> Veeam Software Group GmbH)
HKLM\...\Run: [svStartSignaturClient6] => "\\dc-data\gruppen\tech. Abteilung\Lesen\Freigegebene VB Programme\startsignaturClient.exe" (Keine Datei)
HKLM\...\Policies\Explorer: [NoWelcomeScreen] 1
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Beschränkung <==== ACHTUNG
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Beschränkung <==== ACHTUNG
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Beschränkung <==== ACHTUNG
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center: Beschränkung <==== ACHTUNG
HKU\S-1-5-21-3087490873-3835733739-2015806437-2967\...\Run: [WingetUI] => C:\Program Files\UniGetUI\UniGetUI.exe [730432 2024-07-28] (Marti Climent -> )
HKU\S-1-5-21-3087490873-3835733739-2015806437-2967\...\Run: [Duo Desktop.exe] => C:\Program Files (x86)\Duo Desktop\Duo Desktop.exe (Keine Datei)
HKU\S-1-5-21-3087490873-3835733739-2015806437-2967\...\Run: [org.openvpn.client] => C:\Program Files\OpenVPN Connect\OpenVPNConnect.exe [157689448 2024-01-31] (OpenVPN Inc. -> OpenVPN)
HKU\S-1-5-21-3087490873-3835733739-2015806437-2967\...\Run: [Docker Desktop] => C:\Program Files\Docker\Docker\Docker Desktop.exe [3833928 2024-07-16] (Docker Inc -> Docker Inc.)
HKU\S-1-5-21-3087490873-3835733739-2015806437-2967\...\Run: [ownCloud] => C:\Program Files\ownCloud\owncloud.exe [2057968 2024-06-11] (ownCloud GmbH -> )
HKU\S-1-5-21-3087490873-3835733739-2015806437-2967\Software\Policies\...\system: [GroupPolicyRefreshTime] 30
HKU\S-1-5-21-3087490873-3835733739-2015806437-2967\Software\Policies\...\system: [GroupPolicyRefreshTimeOffset] 30
HKLM\...\Print\Monitors\PDF-XChange Lite Port Monitor: C:\Windows\system32\pxcpmL.dll [719848 2022-04-13] (TRACKER SOFTWARE PRODUCTS (CANADA) LIMITED -> Tracker Software Products (Canada) Ltd.)
HKLM\...\Print\Monitors\VFP: C:\Windows\system32\spool\DRIVERS\x64\Vfpmu.dll [440456 2019-07-25] (Swyx Solutions AG -> Swyx Solutions GmbH)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{401C381F-E0DE-4B85-8BD8-4F3F14FBDA57}] -> C:\Program Files (x86)\Microsoft\Edge Dev\Application\129.0.2752.4\Installer\setup.exe [2024-08-09] (Microsoft Corporation -> Microsoft Corporation)
Startup: C:\Users\ALB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Cylance Desktop.lnk [2024-06-25]
ShortcutTarget: Cylance Desktop.lnk -> C:\Program Files\Cylance\Desktop\CylanceUI.exe (Cylance, Inc. -> Cylance, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SwyxIt!.lnk [2022-08-19]
ShortcutTarget: SwyxIt!.lnk -> C:\Program Files (x86)\SwyxIt!\SwyxIt!.exe (Swyx Solutions AG -> Swyx Solutions GmbH)
GroupPolicy: Beschränkung ? <==== ACHTUNG
GroupPolicy\User: Beschränkung ? <==== ACHTUNG
Policies: C:\ProgramData\NTUSER.pol: Beschränkung <==== ACHTUNG

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {84A93A95-DF5A-41B8-ADC6-B47D22F12E99} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1563080 2024-07-31] (Adobe Inc. -> Adobe Inc.)
Task: {5E83F030-61C3-4F0F-807E-579ACD262FC8} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe  (Keine Datei)
Task: {68BA12D3-DA55-4C7C-8994-C5D484E6F31F} - System32\Tasks\CreateExplorerShellUnelevatedTask => C:\Windows\explorer.exe [5526008 2024-07-26] (Microsoft Windows -> Microsoft Corporation)
Task: {1D4DF0D3-0B25-46D4-8976-0A1ED8FB4AF3} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [1626328 2014-01-23] (Microsoft Corporation -> Microsoft Corporation)
Task: {6CDE00B9-667F-4C81-AC17-503E4BAD47ED} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [376496 2014-01-23] (Microsoft Corporation -> Microsoft Corporation)
Task: {9FDE6C1B-D479-41BC-ACFC-DF0AF1AE42D7} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [376496 2014-01-23] (Microsoft Corporation -> Microsoft Corporation)
Task: {FF4551D0-BCCA-42B5-9FA7-CADCFEDB6EB2} - System32\Tasks\Microsoft\VisualStudio\Updates\BackgroundDownload => C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\BackgroundDownload.exe [255040 2024-07-16] (Microsoft Corporation -> Microsoft)
Task: {9FCDD6A8-D851-4E42-BA09-A89F33D93ABE} - System32\Tasks\Microsoft\Windows\GroupPolicy\{3E0A038B-D834-4930-9981-E89C9BFF83AA} => C:\WINDOWS\system32\gpupdate.exe [53248 2024-03-12] (Microsoft Windows -> Microsoft Corporation)
Task: {61782E4E-3784-4731-8651-E30E13AC78DE} - System32\Tasks\Microsoft\Windows\GroupPolicy\{A7719E0F-10DB-4640-AD8C-490CC6AD5202} => C:\WINDOWS\system32\gpupdate.exe [53248 2024-03-12] (Microsoft Windows -> Microsoft Corporation)
Task: {E0F10DCF-44AD-40E8-9370-FB5DA59F93FB} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe  (Keine Datei)
Task: {2E184AF9-09DE-4EB3-B3CA-5A5D10A33B1D} - System32\Tasks\npcapwatchdog => C:\Program Files\Npcap\CheckStatus.bat [815 2022-11-22] () [Datei ist nicht signiert]
Task: {BEA97042-12C5-4D18-90C2-E464BB2D67E8} - System32\Tasks\NVIDIA App SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NVIDIA app\CEF\NVIDIA App.exe [3822632 2024-06-18] (NVIDIA Corporation -> NVIDIA Corporation)
Task: {F4ED5C02-8138-41F8-BFEA-592D0857D89C} - System32\Tasks\OneDrive Reporting Task-S-1-5-21-1706817784-3290820598-1487956214-1001 => %localappdata%\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe  /reporting (Keine Datei)
Task: {0A9F65D0-FA5E-407F-813F-0AC354E6D323} - System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-1706817784-3290820598-1487956214-1001 => %localappdata%\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe  (Keine Datei)
Task: {1841E373-CD06-4730-9F55-51B4ECB2E431} - System32\Tasks\TrackerAutoUpdate => C:\Program Files\Tracker Software\Update\TrackerUpdate.exe [6045672 2022-04-13] (TRACKER SOFTWARE PRODUCTS (CANADA) LIMITED -> Tracker Software Products (Canada) Ltd.)
Task: {70AB71EC-3C1D-470D-B1EB-7B596B24A63B} - System32\Tasks\ZoomUpdateTaskUser-S-1-5-21-3087490873-3835733739-2015806437-2967 => C:\Users\ALB\AppData\Roaming\Zoom\bin\Zoom.exe [432456 2024-07-05] (Zoom Video Communications, Inc. -> Zoom Video Communications, Inc.)

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\WINDOWS\Tasks\TrackerAutoUpdate.job => C:\Program Files\Tracker Software\Update\TrackerUpdate.exe-CheckUpdate(Tracker Software Products (Canada) Ltd.Kee

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Hosts: Es ist mehr als ein Eintrag in der Hosts Datei zu finden. Siehe Hosts-Bereich in Addition.txt
Tcpip\..\Interfaces\{ad470f77-ee02-4095-9049-9f29cc74f9c9}: [DhcpNameServer] 192.168.158.243
Tcpip\..\Interfaces\{e5e8155c-d85a-46cb-9407-e9262e9bbd64}: [NameServer] 192.168.168.249,192.168.168.247

Edge: 
=======
StartMenuInternet: Microsoft Edge Dev - C:\Program Files (x86)\Microsoft\Edge Dev\Application\msedge.exe

FireFox:
========
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x64.dll [2022-04-13] (TRACKER SOFTWARE PRODUCTS (CANADA) LIMITED -> Tracker Software Products (Canada) Ltd.)
FF Plugin: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/vnd.adobe.xfdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x64.dll [2022-04-13] (TRACKER SOFTWARE PRODUCTS (CANADA) LIMITED -> Tracker Software Products (Canada) Ltd.)
FF Plugin: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/vnd.fdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x64.dll [2022-04-13] (TRACKER SOFTWARE PRODUCTS (CANADA) LIMITED -> Tracker Software Products (Canada) Ltd.)
FF Plugin: Adobe Acrobat -> C:\Program Files\Adobe\Acrobat DC\Acrobat\Air\nppdf32.dll [2024-08-03] (Adobe Inc. -> Adobe Systems Inc.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-21] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x86.dll [2022-04-13] (TRACKER SOFTWARE PRODUCTS (CANADA) LIMITED -> Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/vnd.adobe.xfdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x86.dll [2022-04-13] (TRACKER SOFTWARE PRODUCTS (CANADA) LIMITED -> Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/vnd.fdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x86.dll [2022-04-13] (TRACKER SOFTWARE PRODUCTS (CANADA) LIMITED -> Tracker Software Products (Canada) Ltd.)

Chrome: 
=======
CHR Profile: C:\Users\ALB\AppData\Local\Google\Chrome\User Data\Default [2024-07-02]
CHR Extension: (Google Docs Offline) - C:\Users\ALB\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2024-06-25]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\ALB\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2024-06-25]

==================== Dienste (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 AdobeARMservice; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [172992 2024-07-31] (Adobe Inc. -> Adobe Inc.)
R2 agent_ovpnconnect; C:\Program Files\OpenVPN Connect\agent_ovpnconnect_1706702535874.exe [4698216 2024-01-31] (OpenVPN Inc. -> )
S3 com.docker.service; C:\Program Files\Docker\Docker\com.docker.service [20072 2024-07-16] (Docker Inc -> Docker Inc.)
R2 CylanceSvc; C:\Program Files\Cylance\Desktop\CylanceSvc.exe [1574336 2022-02-26] (Cylance, Inc. -> Cylance, Inc.)
S2 Intel(R) Platform License Manager Service; C:\WINDOWS\System32\DriverStore\FileRepository\iclsclient.inf_amd64_367008a610747d24\lib\PlatformLicenseManagerService.exe [749048 2022-12-20] (Intel Corporation -> Intel(R) Corporation)
R2 ipfsvc; C:\WINDOWS\System32\DriverStore\FileRepository\ipf_cpu.inf_amd64_bca8bb2217972264\ipf_uf.exe [2416792 2021-09-28] (Intel Corporation -> Intel Corporation)
R2 IpOverUsbSvc; C:\Program Files (x86)\Common Files\Microsoft Shared\Phone Tools\CoreCon\11.0\bin\IpOverUsbSvc.exe [15480 2024-02-22] (Microsoft Corporation -> Microsoft Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [8965728 2024-08-13] (Malwarebytes Inc. -> Malwarebytes)
S3 MBVpnTunnelService; C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe [3073888 2024-08-13] (Malwarebytes Inc. -> Malwarebytes)
S3 MDCoreSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24070.5-0\MpDefenderCoreService.exe [1427024 2024-08-09] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 MicrosoftEdgeDevElevationService; C:\Program Files (x86)\Microsoft\Edge Dev\Application\129.0.2752.4\elevation_service.exe [1727544 2024-08-07] (Microsoft Corporation -> Microsoft Corporation)
R2 NVDisplay.ContainerLocalSystem; C:\WINDOWS\System32\DriverStore\FileRepository\nvddi.inf_amd64_b740ade77f86efb0\Display.NvContainer\NVDisplay.Container.exe [1275424 2024-07-11] (NVIDIA Corporation -> NVIDIA Corporation)
R2 ovpnhelper_service; C:\Program Files\OpenVPN Connect\ovpnhelper_service.exe [4534888 2024-01-31] (OpenVPN Inc. -> )
S3 postgresql-x64-16; C:\Program Files\PostgreSQL\16\bin\pg_ctl.exe [122368 2024-06-06] (PostgreSQL Global Development Group) [Datei ist nicht signiert]
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [522072 2024-07-26] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 VBoxSDS; C:\Program Files\Oracle\VirtualBox\VBoxSDS.exe [794544 2024-05-02] (Oracle America, Inc. -> Oracle and/or its affiliates)
R2 VeeamEndpointBackupSvc; C:\Program Files\Veeam\Endpoint Backup\Veeam.EndPoint.Service.exe [143520 2024-04-28] (Veeam Software Group GmbH -> Veeam Software Group GmbH)
S3 VSInstallerElevationService; C:\Program Files (x86)\Microsoft Visual Studio\Installer\VSInstallerElevationService.exe [42544 2024-07-16] (Microsoft Corporation -> Microsoft)
S3 VSStandardCollectorService150; C:\Program Files (x86)\Microsoft Visual Studio\Shared\Common\DiagnosticsHub.Collection.Service\StandardCollector.Service.exe [143480 2024-02-27] (Microsoft Corporation -> Microsoft Corporation)
R2 WavesAudioService; C:\WINDOWS\System32\DriverStore\FileRepository\wavesapo10de.inf_amd64_e306bdf9c02213dc\WavesAudioService.exe [158016 2022-05-18] (Waves Inc -> Waves Audio Ltd)
S3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24070.5-0\NisSrv.exe [3199648 2024-08-09] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 WinDefend; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24070.5-0\MsMpEng.exe [133704 2024-08-09] (Microsoft Windows Publisher -> Microsoft Corporation)
S2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [X]
S3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [X]
S2 WSLService; "C:\Program Files\WSL\wslservice.exe" [X]

===================== Treiber (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S3 BthA2dp; C:\WINDOWS\System32\drivers\BthA2dp.sys [544768 2024-01-25] (Microsoft Corporation) [Datei ist nicht signiert]
S3 BthHFEnum; C:\WINDOWS\System32\drivers\bthhfenum.sys [188416 2024-01-25] (Microsoft Corporation) [Datei ist nicht signiert]
S3 BTHMODEM; C:\WINDOWS\System32\drivers\bthmodem.sys [106496 2022-05-07] (Microsoft Corporation) [Datei ist nicht signiert]
R3 CirrusLFD; C:\WINDOWS\System32\DriverStore\FileRepository\cshda.inf_amd64_469419cbd4e184e8\CSLFD.sys [212096 2023-05-17] (Cirrus Logic, Inc -> Cirrus Logic, Inc.)
R3 CirrusUFD; C:\WINDOWS\System32\DriverStore\FileRepository\cshda.inf_amd64_469419cbd4e184e8\CSUFD.sys [101096 2023-05-17] (WDKTestCert driver dev,131877739977077075 -> Cirrus Logic, Inc.)
R1 ESProtectionDriver; C:\WINDOWS\system32\drivers\mbae64.sys [158640 2024-08-13] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R0 fse; C:\WINDOWS\System32\drivers\fse.sys [218608 2024-06-12] (Microsoft Windows -> Microsoft Corporation)
R3 ipf_acpi; C:\WINDOWS\System32\DriverStore\FileRepository\ipf_acpi.inf_amd64_3a6eb60f36ac95a7\ipf_acpi.sys [85656 2021-09-28] (Intel Corporation -> Intel Corporation)
R3 ipf_cpu; C:\WINDOWS\System32\DriverStore\FileRepository\ipf_cpu.inf_amd64_bca8bb2217972264\ipf_cpu.sys [79512 2021-09-28] (Intel Corporation -> Intel Corporation)
R3 ipf_lf; C:\WINDOWS\System32\DriverStore\FileRepository\ipf_cpu.inf_amd64_bca8bb2217972264\ipf_lf.sys [425112 2021-09-28] (Intel Corporation -> Intel Corporation)
R2 mbamchameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [231504 2024-08-13] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
S0 MbamElam; C:\WINDOWS\System32\DRIVERS\MbamElam.sys [21480 2024-08-13] (Microsoft Windows Early Launch Anti-Malware Publisher -> Malwarebytes)
R3 MBAMFarflt; C:\WINDOWS\system32\DRIVERS\farflt11.sys [234168 2024-08-13] (Malwarebytes Inc. -> Malwarebytes)
R3 MBAMProtection; C:\WINDOWS\system32\DRIVERS\mbam.sys [78800 2024-08-13] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [239568 2024-08-13] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R3 MBAMWebProtection; C:\WINDOWS\system32\DRIVERS\mwac.sys [189776 2024-08-13] (Malwarebytes Inc. -> Malwarebytes)
R1 npcap; C:\WINDOWS\system32\DRIVERS\npcap.sys [69984 2024-01-18] (WDKTestCert Nmap,133147429230506937 -> Insecure.Com LLC.)
R2 NPF; C:\WINDOWS\System32\drivers\npf.sys [36600 2024-07-23] (Riverbed Technology, Inc. -> Riverbed Technology, Inc.)
R3 ovpn-dco; C:\WINDOWS\System32\drivers\ovpn-dco.sys [91560 2023-03-31] (WDKTestCert lev,132435948852968539 -> OpenVPN, Inc)
S3 PCAN_USB; C:\WINDOWS\System32\drivers\PCAN_USB.sys [373808 2022-09-23] (Microsoft Windows Hardware Compatibility Publisher -> PEAK-System Technik GmbH, Darmstadt, Germany)
S3 rtucx22x64; C:\WINDOWS\System32\DriverStore\FileRepository\rtucx22x64.inf_amd64_a6eb3abe5befec7d\rtucx22x64.sys [1876424 2024-04-24] (Realtek Semiconductor Corp. -> Realtek Corporation)
S3 rtux64w10; C:\WINDOWS\System32\DriverStore\FileRepository\rtux64w10.inf_amd64_03831aeaaa2c730e\rtux64w10.sys [683520 2022-05-07] (Microsoft Windows -> Realtek Corporation)
R3 tap_ovpnconnect; C:\WINDOWS\System32\drivers\tap_ovpnconnect.sys [40448 2024-01-31] (Microsoft Windows Hardware Compatibility Publisher -> The OpenVPN Project)
R3 USBPcap; C:\WINDOWS\system32\DRIVERS\USBPcap.sys [52872 2020-05-22] (Tomasz Moń -> USBPcap)
S3 VBoxNetAdp; C:\WINDOWS\System32\drivers\VBoxNetAdp6.sys [254352 2024-05-02] (Oracle Corporation -> Oracle and/or its affiliates)
R1 VBoxNetLwf; C:\WINDOWS\system32\DRIVERS\VBoxNetLwf.sys [265224 2024-05-02] (Oracle Corporation -> Oracle and/or its affiliates)
R1 VBoxSup; C:\WINDOWS\system32\DRIVERS\VBoxSup.sys [1063752 2024-05-02] (Oracle Corporation -> Oracle and/or its affiliates)
R1 veracrypt; C:\WINDOWS\System32\drivers\veracrypt.sys [813112 2024-07-24] (Microsoft Windows Hardware Compatibility Publisher -> IDRIX)
S3 vmbusproxy; C:\WINDOWS\system32\drivers\vmbusproxy.sys [94208 2024-01-25] (Microsoft Windows -> )
S3 WdBoot; C:\WINDOWS\system32\drivers\wd\WdBoot.sys [22080 2024-08-09] (Microsoft Windows Early Launch Anti-Malware Publisher -> Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\wd\WdFilter.sys [602504 2024-08-09] (Microsoft Windows -> Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [105864 2024-08-09] (Microsoft Windows -> Microsoft Corporation)
S3 wfpcapture; C:\WINDOWS\System32\Drivers\wfpcapture.sys [64728 2016-03-22] (Microsoft Corporation -> Microsoft Corporation)
U4 npcap_wifi; kein ImagePath
S1 WinSetupMon; system32\DRIVERS\WinSetupMon.sys [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat (erstellte) (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2024-08-13 08:26 - 2024-08-13 08:26 - 000234168 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt11.sys
2024-08-13 08:26 - 2024-08-13 08:26 - 000189776 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
2024-08-13 08:26 - 2024-08-13 08:26 - 000012124 __RSH C:\ProgramData\ntuser.pol
2024-08-13 08:10 - 2024-08-13 08:27 - 000000000 ____D C:\FRST
2024-08-13 08:07 - 2024-08-13 08:27 - 000000000 ____D C:\Verdacht_RAT
2024-08-13 07:42 - 2024-08-13 07:55 - 000000000 ____D C:\Users\ALB\AppData\Local\Malwarebytes
2024-08-13 07:42 - 2024-08-13 07:42 - 000002093 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes.lnk
2024-08-13 07:42 - 2024-08-13 07:42 - 000002081 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2024-08-13 07:42 - 2024-08-13 07:42 - 000000000 ____D C:\ProgramData\Malwarebytes
2024-08-13 07:42 - 2024-08-13 07:42 - 000000000 ____D C:\Program Files\Malwarebytes
2024-08-13 07:41 - 2024-08-13 07:41 - 002596072 _____ (Malwarebytes) C:\Users\ALB\Downloads\MBSetup.exe
2024-08-13 07:37 - 2024-08-13 07:37 - 000726096 _____ C:\WINDOWS\system32\perfh007.dat
2024-08-13 07:37 - 2024-08-13 07:37 - 000150616 _____ C:\WINDOWS\system32\perfc007.dat
2024-08-12 16:29 - 2024-08-12 16:29 - 613127064 _____ C:\Users\ALB\Desktop\16.20-16.29_Anschauen.pcapng
2024-08-12 16:25 - 2024-08-12 16:26 - 000000000 ____D C:\Users\ALB\Desktop\1
2024-08-12 13:15 - 2024-08-12 14:42 - 000000000 ____D C:\Users\ALB\Desktop\Shots
2024-08-12 11:49 - 2024-08-12 11:49 - 003053819 _____ C:\Users\ALB\Desktop\2.json
2024-08-12 11:46 - 2024-08-12 11:46 - 007311491 _____ C:\Users\ALB\Desktop\Aufzeichnungverkerhr.json
2024-08-12 11:27 - 2024-08-12 11:27 - 000715780 _____ C:\Users\ALB\Desktop\Aufzeichnung1.txt
2024-08-12 11:23 - 2024-08-12 11:23 - 026633908 _____ C:\Users\ALB\Desktop\Aufzeichnung.pcapng
2024-08-12 11:18 - 2024-08-12 11:18 - 000029469 _____ C:\WINDOWS\system32\PktMon.etl
2024-08-12 11:17 - 2024-08-12 11:18 - 000264480 _____ C:\WINDOWS\system32\readable_output.txt
2024-08-12 09:20 - 2024-08-12 09:30 - 000000000 ____D C:\csv
2024-08-09 13:04 - 2024-08-09 13:05 - 000000000 ____D C:\wazuh-docker
2024-08-09 12:12 - 2024-08-09 12:12 - 000000000 ____D C:\Users\ALB\.chocolatey
2024-08-09 10:09 - 2024-08-09 10:09 - 000005367 _____ C:\Users\ALB\Downloads\Testhandbuch_Final.md
2024-08-09 10:05 - 2024-08-09 10:05 - 000005416 _____ C:\Users\ALB\Downloads\Testhandbuch_Updated.md
2024-08-09 10:02 - 2024-08-09 10:02 - 000004099 _____ C:\Users\ALB\Downloads\Testhandbuch.md
2024-08-09 08:26 - 2024-08-09 08:26 - 020386224 _____ (Famatech Corp. ) C:\Users\ALB\Downloads\Advanced_Port_Scanner_2.5.3869.exe
2024-08-08 10:35 - 2024-08-08 10:35 - 001446818 _____ C:\Users\ALB\Downloads\LicenseGenerator.zip
2024-08-08 10:31 - 2024-08-08 10:38 - 000000000 ____D C:\Users\ALB\Desktop\Romann Welker
2024-08-08 10:15 - 2024-08-08 10:15 - 000000000 ____D C:\WINDOWS\ABR
2024-08-08 10:14 - 2024-08-08 10:16 - 000000000 ____D C:\HiJackThis
2024-08-08 10:14 - 2024-08-08 10:14 - 004369651 _____ C:\Users\ALB\Downloads\HiJackThis.zip
2024-08-08 10:06 - 2024-08-08 10:06 - 009033217 _____ C:\Users\ALB\Downloads\RevoUninstaller_Portable.zip
2024-08-08 10:06 - 2024-08-08 10:06 - 000000000 ____D C:\Users\ALB\Downloads\RevoUninstaller_Portable
2024-08-08 09:19 - 2024-08-08 09:19 - 000005223 _____ C:\Users\ALB\docker-compose.yml
2024-08-08 09:18 - 2024-08-08 09:18 - 000000000 ____D C:\ProgramData\shimgen
2024-08-08 09:01 - 2024-08-08 09:01 - 000000000 ____D C:\ProgramData\ChocolateyHttpCache
2024-08-08 07:46 - 2024-08-08 07:46 - 000000000 _____ C:\Users\ALB\Desktop\Textdokument (neu).txt
2024-08-07 10:41 - 2024-08-07 10:41 - 000000000 ____D C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38
2024-08-07 10:15 - 2024-08-07 10:48 - 000000000 ____D C:\Users\ALB\Downloads\Sicherheit
2024-08-07 08:42 - 2024-08-08 07:47 - 000000000 ____D C:\Users\ALB\Desktop\Tickets
2024-08-06 16:08 - 2024-08-06 16:08 - 003459165 _____ C:\Users\ALB\Downloads\ProcessExplorer.zip
2024-08-06 16:08 - 2024-08-06 16:08 - 000000000 ____D C:\Users\ALB\Downloads\ProcessExplorer
2024-08-06 12:50 - 2024-08-06 12:50 - 000014852 _____ C:\Users\ALB\Downloads\Config.nlgc
2024-08-05 15:37 - 2024-08-05 15:37 - 000000062 _____ C:\Users\ALB\Downloads\error_event_log_2024-08-05.csv
2024-08-05 14:57 - 2024-08-05 14:57 - 002212676 _____ C:\Users\ALB\Desktop\8988303000004627620.pcapng
2024-08-05 13:25 - 2024-06-05 22:14 - 005545032 _____ (Intel Corporation) C:\WINDOWS\system32\Drivers\Netwtw14.sys
2024-08-05 13:25 - 2024-06-05 22:13 - 001496136 _____ (Intel Corporation) C:\WINDOWS\system32\IntelIHVRouter14.dll
2024-08-05 13:09 - 2024-08-05 13:09 - 000001519 _____ C:\Users\ALB\Downloads\gitattributes
2024-08-05 13:08 - 2024-08-05 13:08 - 000000000 ____D C:\Users\ALB\Downloads\mistralaiMamba-Codestral-7B-v0.1
2024-08-05 13:03 - 2024-08-05 13:29 - 000000000 ____D C:\Users\ALB\Downloads\Meta-Llama-3-8B-Instruct.Q8_0.llamafile
2024-08-05 08:06 - 2024-08-05 08:06 - 000008736 _____ C:\Users\ALB\Downloads\events_2024-08-05T06_06_58.708Z.csv
2024-08-05 07:57 - 2024-08-05 07:58 - 000000000 ____D C:\Users\ALB\Desktop\Verbesserungsvorschläge
2024-08-02 08:54 - 2024-08-02 10:31 - 000000000 ____D C:\Users\ALB\Downloads\llava-v1.5-7b-q4.llamafile
2024-08-01 13:00 - 2024-08-05 12:58 - 000000000 ____D C:\Users\ALB\Downloads\Meta-Llama-3-8B-Instruct.Q5_K_M.llamafile
2024-08-01 12:58 - 2024-08-01 12:58 - 000000000 ____D C:\Users\ALB\AppData\Local\Adaware
2024-08-01 11:57 - 2024-08-01 11:57 - 000000000 ____D C:\ProgramData\WinaeroTweaker
2024-08-01 09:53 - 2024-08-04 13:46 - 000000000 ____D C:\Users\ALB\Downloads\winaerotweaker
2024-08-01 09:53 - 2024-08-01 09:53 - 005471798 _____ C:\Users\ALB\Downloads\winaerotweaker.zip
2024-08-01 08:48 - 2024-08-01 08:48 - 000545233 _____ C:\Users\ALB\Downloads\cru-1.5.2.zip
2024-08-01 08:48 - 2024-08-01 08:48 - 000000000 ____D C:\Users\ALB\Downloads\cru-1.5.2
2024-08-01 08:38 - 2024-07-11 00:29 - 000121872 _____ (NVIDIA Corporation) C:\WINDOWS\system32\Drivers\nvhda64v.sys
2024-08-01 08:37 - 2024-07-11 21:32 - 002040576 _____ C:\WINDOWS\system32\vulkaninfo-1-999-0-0-0.exe
2024-08-01 08:37 - 2024-07-11 21:32 - 002040576 _____ C:\WINDOWS\system32\vulkaninfo.exe
2024-08-01 08:37 - 2024-07-11 21:32 - 001583872 _____ C:\WINDOWS\SysWOW64\vulkaninfo-1-999-0-0-0.exe
2024-08-01 08:37 - 2024-07-11 21:32 - 001583872 _____ C:\WINDOWS\SysWOW64\vulkaninfo.exe
2024-08-01 08:37 - 2024-07-11 21:32 - 001446656 _____ C:\WINDOWS\system32\vulkan-1-999-0-0-0.dll
2024-08-01 08:37 - 2024-07-11 21:32 - 001446656 _____ C:\WINDOWS\system32\vulkan-1.dll
2024-08-01 08:37 - 2024-07-11 21:32 - 001296640 _____ C:\WINDOWS\SysWOW64\vulkan-1-999-0-0-0.dll
2024-08-01 08:37 - 2024-07-11 21:32 - 001296640 _____ C:\WINDOWS\SysWOW64\vulkan-1.dll
2024-08-01 08:37 - 2024-07-11 21:32 - 000477704 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.dll
2024-08-01 08:37 - 2024-07-11 21:32 - 000374288 _____ (Khronos Group) C:\WINDOWS\SysWOW64\OpenCL.dll
2024-08-01 08:37 - 2024-07-11 21:29 - 000669816 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvofapi64.dll
2024-08-01 08:37 - 2024-07-11 21:29 - 000505992 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvofapi.dll
2024-08-01 08:37 - 2024-07-11 21:28 - 002178160 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvFBC64.dll
2024-08-01 08:37 - 2024-07-11 21:28 - 001629832 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvFBC.dll
2024-08-01 08:37 - 2024-07-11 21:28 - 001546760 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvIFR64.dll
2024-08-01 08:37 - 2024-07-11 21:28 - 001202704 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvIFR.dll
2024-08-01 08:37 - 2024-07-11 21:28 - 001079432 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvml.dll
2024-08-01 08:37 - 2024-07-11 21:28 - 001034360 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvEncodeAPI64.dll
2024-08-01 08:37 - 2024-07-11 21:28 - 000856584 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvidia-smi.exe
2024-08-01 08:37 - 2024-07-11 21:28 - 000797320 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvEncodeAPI.dll
2024-08-01 08:37 - 2024-07-11 21:27 - 016199688 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuvid.dll
2024-08-01 08:37 - 2024-07-11 21:27 - 014270072 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuvid.dll
2024-08-01 08:37 - 2024-07-11 21:27 - 006914056 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuda.dll
2024-08-01 08:37 - 2024-07-11 21:27 - 005910664 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcpl.dll
2024-08-01 08:37 - 2024-07-11 21:27 - 005349408 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcudadebugger.dll
2024-08-01 08:37 - 2024-07-11 21:27 - 003788400 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuda.dll
2024-08-01 08:37 - 2024-07-11 21:27 - 000461432 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdebugdump.exe
2024-08-01 08:37 - 2024-07-11 21:26 - 007133048 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvapi64.dll
2024-08-01 08:37 - 2024-07-11 21:26 - 000853112 _____ (NVIDIA Corporation) C:\WINDOWS\system32\MCU.exe
2024-08-01 08:37 - 2024-07-11 21:25 - 006211816 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvapi.dll
2024-08-01 08:37 - 2024-07-11 00:29 - 000128301 _____ C:\WINDOWS\system32\nvinfo.pb
2024-07-31 15:32 - 2024-07-31 15:32 - 063239646 _____ C:\Users\ALB\Downloads\llamafile-0.8.12.zip
2024-07-31 15:32 - 2024-07-31 15:32 - 000000000 ____D C:\Users\ALB\Downloads\llamafile-0.8.12
2024-07-31 13:43 - 2024-07-31 14:00 - 000000000 ____D C:\Uebrwachung
2024-07-31 13:39 - 2024-07-31 13:39 - 000195040 _____ C:\Users\ALB\Downloads\USBPcapSetup-1.5.4.0.exe
2024-07-31 13:08 - 2024-07-31 13:42 - 000000000 ____D C:\Users\ALB\.zenmap
2024-07-31 09:13 - 2024-07-31 09:13 - 001912412 _____ C:\Users\ALB\Desktop\2.pdf
2024-07-31 09:12 - 2024-07-31 09:12 - 001836388 _____ C:\Users\ALB\Desktop\1.pdf
2024-07-31 08:09 - 2024-07-31 08:09 - 000003181 _____ C:\Users\ALB\Downloads\alloy-voice-assistant-main pop2pop3.zip
2024-07-31 08:06 - 2024-07-31 08:06 - 000003965 _____ C:\Users\ALB\Downloads\alloy-voice-assistant-main ishaqahmad41455 DOCKER.zip
2024-07-31 08:03 - 2024-07-31 08:03 - 000004152 _____ C:\Users\ALB\Downloads\A-voice-assistant-main.zip
2024-07-31 08:02 - 2024-07-31 08:02 - 000004820 _____ C:\Users\ALB\Downloads\alloy-voice-assistant-main he-huang-1982.zip
2024-07-31 07:59 - 2024-07-31 07:59 - 000004185 _____ C:\Users\ALB\Downloads\alloy-voice-assistant-main shiv19.zip
2024-07-31 07:56 - 2024-07-31 07:56 - 000004888 _____ C:\Users\ALB\Downloads\alloy-voice-assistant-main kemmeny.zip
2024-07-30 16:09 - 2024-07-30 16:09 - 000000945 _____ C:\Users\ALB\Desktop\Projekte - Verknüpfung.lnk
2024-07-29 16:17 - 2024-07-29 16:17 - 012716101 _____ C:\Users\ALB\Downloads\netscan_portable.zip
2024-07-29 16:17 - 2024-07-29 16:17 - 000000000 ____D C:\Users\ALB\Downloads\netscan_portable
2024-07-29 16:03 - 2024-07-29 16:03 - 000000000 ____D C:\Users\ALB\AppData\Roaming\Suchtool
2024-07-29 11:12 - 2024-07-29 11:13 - 000000000 ____D C:\Users\ALB\Downloads\ffmpeg-7.0.1-full_build
2024-07-29 11:12 - 2024-07-29 11:12 - 051939996 _____ C:\Users\ALB\Downloads\ffmpeg-7.0.1-full_build.7z
2024-07-29 10:45 - 2024-07-29 10:45 - 000006723 _____ C:\Users\ALB\Downloads\AI-Assistant-with-Webcam-and-Desktop-Integration-main_wildownes.zip
2024-07-29 10:44 - 2024-07-29 10:44 - 000004647 _____ C:\Users\ALB\Downloads\dan-voice-assistant-main.zip
2024-07-29 10:36 - 2024-07-29 10:36 - 001943154 _____ C:\Users\ALB\Downloads\alloy-voice-assistant-main QIN2DIM.zip
2024-07-29 10:30 - 2024-07-29 10:30 - 000014280 _____ C:\Users\ALB\Downloads\alloy-voice-assistant-main KevinBean.zip
2024-07-29 10:23 - 2024-07-29 10:23 - 000049915 _____ C:\Users\ALB\Downloads\alloy-voice-assistant-main Paul Cutcliffe.zip
2024-07-29 10:19 - 2024-07-29 10:19 - 000004152 _____ C:\Users\ALB\Downloads\A-voice-assistant-main OLIMIEMMA.zip
2024-07-29 09:54 - 2024-07-29 09:54 - 000004149 _____ C:\Users\ALB\Downloads\Katie_Paxton-Fear_Tools.md
2024-07-29 09:25 - 2024-08-13 08:26 - 000000000 ___SD C:\Users\ALB\ownCloud
2024-07-29 09:25 - 2024-07-29 09:25 - 000000000 ____D C:\Users\ALB\AppData\Local\ownCloud
2024-07-29 09:24 - 2024-08-13 08:26 - 000000000 ____D C:\Users\ALB\AppData\Roaming\ownCloud
2024-07-29 09:24 - 2024-07-29 09:24 - 022024192 _____ C:\Users\ALB\Downloads\ownCloud-5.3.1.14018.x64.msi
2024-07-29 09:24 - 2024-07-29 09:24 - 000001872 _____ C:\Users\Public\Desktop\ownCloud.lnk
2024-07-29 09:24 - 2024-07-29 09:24 - 000001024 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ownCloud.lnk
2024-07-29 09:24 - 2024-07-29 09:24 - 000000000 ____D C:\Program Files\ownCloud
2024-07-29 08:58 - 2024-07-29 08:58 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Veeam
2024-07-29 08:58 - 2024-07-29 08:58 - 000000000 ____D C:\Program Files\Common Files\Veeam
2024-07-26 10:15 - 2024-07-26 10:15 - 000001237 _____ C:\Users\Public\Desktop\Synology Assistant.lnk
2024-07-26 10:15 - 2024-07-26 10:15 - 000000000 ____D C:\ProgramData\Synology
2024-07-26 10:15 - 2024-07-26 10:15 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Synology
2024-07-26 10:14 - 2024-07-26 10:14 - 051380072 _____ C:\Users\ALB\Downloads\SynologyAssistantSetup-4.2-3179.exe
2024-07-26 10:14 - 2024-07-26 10:14 - 000000000 ____D C:\Program Files (x86)\Synology
2024-07-26 05:04 - 2024-07-26 05:04 - 000026169 _____ C:\WINDOWS\SysWOW64\IntegratedServicesRegionPolicySet.json
2024-07-26 05:04 - 2024-07-26 05:04 - 000026169 _____ C:\WINDOWS\system32\IntegratedServicesRegionPolicySet.json
2024-07-25 16:46 - 2024-07-25 16:47 - 013009435 _____ C:\Users\ALB\Desktop\view-source_192.168.168.164_new_service_index.php_service=pam#.html
2024-07-25 11:29 - 2024-07-25 11:29 - 006082635 _____ C:\Users\ALB\Downloads\AI mit Arnie · ChatBots bauen & Technik (1).html
2024-07-25 11:29 - 2024-07-25 11:29 - 004873198 _____ C:\Users\ALB\Downloads\AI mit Arnie · ChatBots bauen & Technik.html
2024-07-24 16:36 - 2024-07-24 16:36 - 000027216 _____ C:\Users\ALB\Downloads\obs-websocket-tester.html
2024-07-24 16:12 - 2024-07-24 16:12 - 000000016 _____ C:\Users\ALB\AppData\Roaming\obs-virtualcam.txt
2024-07-24 15:55 - 2024-07-24 15:55 - 000970767 _____ C:\Users\ALB\Downloads\IMG-20220703-WA0007.jpeg
2024-07-24 14:45 - 2024-08-09 13:15 - 000000000 ____D C:\Users\ALB\AppData\Roaming\Code
2024-07-24 14:45 - 2024-08-09 12:10 - 000000000 ____D C:\Microsoft VS Code
2024-07-24 14:45 - 2024-08-08 18:35 - 000000000 ____D C:\Users\ALB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Visual Studio Code
2024-07-24 14:45 - 2024-07-26 07:58 - 000000783 _____ C:\Users\ALB\Desktop\Visual Studio Code.lnk
2024-07-24 14:45 - 2024-07-24 14:45 - 000000000 ____D C:\Users\ALB\.vscode
2024-07-24 14:27 - 2024-07-24 14:27 - 000000141 _____ C:\Users\ALB\Desktop\lange pfade.reg
2024-07-24 14:26 - 2024-07-24 14:26 - 000000606 _____ C:\Users\ALB\Desktop\zeichen probleme beheben.reg
2024-07-24 14:25 - 2024-07-24 14:25 - 000000603 _____ C:\Users\ALB\Desktop\zurück.reg
2024-07-24 14:06 - 2024-07-24 14:06 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Git
2024-07-24 14:06 - 2024-07-24 14:06 - 000000000 ____D C:\Program Files\Git
2024-07-24 14:05 - 2024-07-24 14:05 - 068131584 _____ (The Git Development Community ) C:\Users\ALB\Downloads\Git-2.45.2-64-bit.exe
2024-07-24 13:44 - 2024-07-24 13:44 - 000001489 _____ C:\Users\ALB\Desktop\Shared - Verknüpfung.lnk
2024-07-24 13:30 - 2024-07-24 13:30 - 000000000 _____ C:\Users\ALB\.gitconfig
2024-07-24 13:27 - 2024-07-24 13:27 - 000000000 ____D C:\Users\ALB\source
2024-07-24 11:30 - 2024-08-09 03:12 - 000002359 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge Dev.lnk
2024-07-24 11:30 - 2024-08-09 03:12 - 000002318 _____ C:\Users\Public\Desktop\Microsoft Edge Dev.lnk
2024-07-24 11:14 - 2024-07-24 11:14 - 000000915 _____ C:\Users\ALB\Desktop\KeePass (2).lnk
2024-07-24 11:12 - 2024-07-24 11:13 - 000000174 _____ C:\Users\ALB\Desktop\SYMLINK EDGE.txt
2024-07-24 11:07 - 2024-07-24 11:07 - 000553313 _____ C:\Users\ALB\Downloads\Symlink.Creator.1.2.7.zip
2024-07-24 11:07 - 2024-07-24 11:07 - 000000000 ____D C:\Users\ALB\Downloads\Symlink.Creator.1.2.7
2024-07-24 11:07 - 2024-03-06 00:45 - 003440128 _____ (Arnob Paul) C:\Users\ALB\Downloads\SymlinkCreator.exe
2024-07-24 10:13 - 2024-07-24 10:47 - 000000000 ____D C:\Users\ALB\AppData\Roaming\VeraCrypt
2024-07-24 10:13 - 2024-07-24 10:19 - 000000000 ____D C:\DATEN_B
2024-07-24 10:11 - 2024-07-24 10:11 - 000000888 _____ C:\Users\Public\Desktop\VeraCrypt.lnk
2024-07-24 10:11 - 2024-07-24 10:11 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VeraCrypt
2024-07-24 10:11 - 2024-07-24 10:11 - 000000000 ____D C:\Program Files\VeraCrypt
2024-07-24 10:10 - 2024-07-24 10:11 - 035282192 _____ (IDRIX) C:\Users\ALB\Downloads\VeraCrypt Setup 1.26.7.exe
2024-07-24 10:09 - 2024-07-24 10:09 - 031213802 _____ C:\Users\ALB\Downloads\VeraCrypt_1.26.7.zip
2024-07-24 10:09 - 2024-07-24 10:09 - 000000000 ____D C:\Users\ALB\Downloads\VeraCrypt_1.26.7
2024-07-24 09:16 - 2024-07-26 05:29 - 000000000 ____D C:\Program Files\Hyper-V
2024-07-24 09:16 - 2024-07-24 09:16 - 000000000 ____D C:\WINDOWS\system32\BestPractices
2024-07-24 08:14 - 2024-07-24 08:14 - 075968440 _____ (Piriform Software Ltd) C:\Users\ALB\Downloads\ccsetup626.exe
2024-07-23 14:57 - 2024-07-23 14:57 - 000000000 ____D C:\Users\ALB\Downloads\VIGI Configuration Tools V1.1.4
2024-07-23 14:57 - 2024-07-23 14:57 - 000000000 ____D C:\ProgramData\Oracle
2024-07-23 14:54 - 2024-07-24 08:49 - 000000000 ____D C:\Users\ALB\AppData\Roaming\TP-Link
2024-07-23 14:54 - 2024-07-23 14:57 - 000000000 ____D C:\Users\ALB\Documents\TP-Link
2024-07-23 14:54 - 2024-07-23 14:53 - 000036600 _____ (Riverbed Technology, Inc.) C:\WINDOWS\system32\Drivers\npf.sys
2024-07-23 14:53 - 2024-07-24 08:49 - 000000000 ____D C:\Program Files (x86)\TP-Link
2024-07-23 14:53 - 2024-07-23 14:54 - 289655972 _____ C:\Users\ALB\Downloads\VIGI Configuration Tools V1.1.4.zip
2024-07-23 14:53 - 2024-07-23 14:53 - 093569542 _____ C:\Users\ALB\Downloads\VIGI Security Manager_setup_1.6.85.zip
2024-07-23 14:53 - 2024-07-23 14:53 - 000000000 ____D C:\Users\ALB\Downloads\VIGI Security Manager_setup_1.6.85
2024-07-23 14:35 - 2024-07-23 15:04 - 000000084 _____ C:\Users\ALB\advanced_ip_scanner_MAC.bin
2024-07-23 14:35 - 2024-07-23 15:04 - 000000015 _____ C:\Users\ALB\advanced_ip_scanner_Comments.bin
2024-07-23 14:35 - 2024-07-23 15:04 - 000000015 _____ C:\Users\ALB\advanced_ip_scanner_Aliases.bin
2024-07-23 13:28 - 2024-07-23 13:28 - 000000000 ____D C:\Users\ALB\AppData\Roaming\Microsoft\MessageAnalyzer
2024-07-23 13:28 - 2024-07-23 13:28 - 000000000 ____D C:\Users\ALB\AppData\Local\IsolatedStorage
2024-07-23 13:27 - 2024-07-23 13:27 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Message Analyzer
2024-07-23 13:25 - 2024-07-23 13:31 - 000000000 ____D C:\Users\ALB\Documents\MessageAnalyzer
2024-07-23 13:25 - 2024-07-23 13:25 - 000000000 ____H C:\WINDOWS\system32\Drivers\Msft_Kernel_wfpcapture_01011.Wdf
2024-07-23 13:25 - 2024-07-23 13:25 - 000000000 ____D C:\Program Files\Microsoft Message Analyzer
2024-07-23 10:24 - 2024-07-23 10:24 - 000440481 _____ C:\Users\ALB\Downloads\Übersicht.html
2024-07-23 10:22 - 2024-07-23 10:23 - 000213868 _____ C:\Users\ALB\Downloads\Home Office Januar.html
2024-07-23 10:22 - 2024-07-23 10:23 - 000210539 _____ C:\Users\ALB\Downloads\Home Office Februar.html
2024-07-23 10:22 - 2024-07-23 10:23 - 000209725 _____ C:\Users\ALB\Downloads\Home Office März.html
2024-07-23 10:22 - 2024-07-23 10:22 - 000211401 _____ C:\Users\ALB\Downloads\Home Office MAI.html
2024-07-23 10:22 - 2024-07-23 10:22 - 000210363 _____ C:\Users\ALB\Downloads\Home Office April.html
2024-07-23 10:20 - 2024-07-23 10:20 - 000211387 _____ C:\Users\ALB\Downloads\Home Offfice Juni.html
2024-07-23 10:19 - 2024-07-23 10:19 - 000207966 _____ C:\Users\ALB\Downloads\Home Office Juli.html
2024-07-22 15:33 - 2024-07-22 15:33 - 000307667 _____ C:\Users\ALB\Downloads\Steuerung.pdf
2024-07-22 15:27 - 2024-07-22 15:27 - 001063586 _____ C:\Users\ALB\Downloads\Home Office (2).html
2024-07-22 14:08 - 2024-07-22 14:07 - 000996656 _____ (Simon Tatham) C:\Users\ALB\Downloads\plink (1) - Kopie.exe
2024-07-22 14:07 - 2024-07-22 14:07 - 000996656 _____ (Simon Tatham) C:\Users\ALB\Downloads\plink (1).exe
2024-07-22 13:17 - 2024-07-22 13:17 - 000002232 _____ C:\Users\ALB\Desktop\Nmap - Zenmap GUI.lnk
2024-07-22 13:17 - 2024-07-22 13:17 - 000000000 ____D C:\Users\ALB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Nmap
2024-07-22 13:16 - 2024-07-22 13:17 - 000000000 ____D C:\Program Files (x86)\Nmap
2024-07-22 13:16 - 2024-07-22 13:16 - 000003460 _____ C:\WINDOWS\system32\Tasks\npcapwatchdog
2024-07-22 13:16 - 2024-07-22 13:16 - 000000000 ____D C:\WINDOWS\SysWOW64\Npcap
2024-07-22 13:15 - 2024-07-22 13:15 - 033969480 _____ (Insecure.org) C:\Users\ALB\Downloads\nmap-7.95-setup.exe
2024-07-22 13:12 - 2024-07-22 13:12 - 001882953 _____ C:\Users\ALB\Downloads\rustscan-2.3.0-x86_64-windows.zip
2024-07-22 13:12 - 2024-07-22 13:12 - 000000000 ____D C:\Users\ALB\Downloads\rustscan-2.3.0-x86_64-windows
2024-07-19 09:25 - 2024-07-19 09:25 - 000000000 ____D C:\Users\ALB\unifi
2024-07-19 09:10 - 2024-07-19 09:10 - 000000000 ____D C:\Users\ALB\AppData\Local\fanal
2024-07-17 11:59 - 2024-07-17 11:59 - 000007177 _____ C:\Users\ALB\Downloads\f4-e2-c6-67-6e-e8.json
2024-07-16 14:58 - 2024-07-23 13:31 - 000000128 _____ C:\Users\ALB\AppData\Local\PUTTY.RND
2024-07-16 14:55 - 2024-07-16 14:55 - 003431424 _____ C:\Users\ALB\Downloads\putty-0.81-installer.msi
2024-07-16 14:55 - 2024-07-16 14:55 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PuTTY
2024-07-16 14:55 - 2024-07-16 14:55 - 000000000 ____D C:\Program Files (x86)\PuTTY
2024-07-16 14:54 - 2024-07-16 14:54 - 000001676 _____ C:\Users\ALB\Desktop\UNIFISSH.lnk
2024-07-16 13:17 - 2024-07-16 13:17 - 000002146 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Docker Desktop.lnk
2024-07-16 13:17 - 2024-07-16 13:17 - 000002140 _____ C:\Users\ALB\Desktop\Docker Desktop.lnk
2024-07-16 13:15 - 2024-07-16 13:17 - 000000000 ____D C:\Program Files\Docker
2024-07-16 13:13 - 2024-07-16 13:13 - 000000000 ____D C:\Users\ALB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\docker-desktop
2024-07-16 13:13 - 2024-07-16 13:13 - 000000000 ____D C:\Users\ALB\.azure
2024-07-16 13:13 - 2024-07-16 13:13 - 000000000 ____D C:\Users\ALB\.aws
2024-07-16 13:12 - 2024-08-12 16:40 - 000000000 ____D C:\Users\ALB\AppData\Roaming\Docker Desktop
2024-07-16 13:12 - 2024-08-12 16:39 - 000000000 ____D C:\Users\ALB\.docker
2024-07-16 13:08 - 2024-08-12 16:39 - 000000000 ____D C:\Users\ALB\AppData\Roaming\Docker
2024-07-16 13:08 - 2024-08-09 11:27 - 000000000 ____D C:\ProgramData\DockerDesktop
2024-07-16 13:08 - 2024-07-16 13:17 - 000000000 ____D C:\Users\ALB\AppData\Local\Docker
2024-07-16 09:15 - 2024-07-16 10:22 - 000000000 ____D C:\Users\ALB\AppData\Roaming\AVG
2024-07-16 09:14 - 2024-07-16 10:22 - 000000000 ____D C:\ProgramData\AVG
2024-07-16 09:13 - 2024-07-24 08:15 - 000003936 _____ C:\WINDOWS\system32\Tasks\CCleaner Update
2024-07-16 08:01 - 2024-07-16 08:01 - 000001757 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Visual Studio 2022.lnk
2024-07-15 14:01 - 2024-07-15 14:01 - 000698686 _____ C:\WINDOWS\system32\gpreport.html
2024-07-15 14:01 - 2024-07-15 14:01 - 000009739 _____ C:\WINDOWS\system32\ics_diagnose_log.txt
2024-07-15 07:39 - 2024-08-08 10:59 - 000000000 ____D C:\Users\ALB\AppData\Roaming\AnyDesk

==================== Ein Monat (geänderte) ==================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2024-08-13 08:27 - 2022-05-07 07:24 - 000000000 ____D C:\WINDOWS\SystemTemp
2024-08-13 08:26 - 2024-07-04 14:20 - 000000000 ____D C:\Users\ALB\AppData\Roaming\OpenVPN Connect
2024-08-13 08:26 - 2024-07-02 14:38 - 000000523 _____ C:\WINDOWS\system32\Drivers\etc\hosts.ics
2024-08-13 08:26 - 2024-01-25 14:56 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2024-08-13 08:26 - 2024-01-25 14:53 - 000001623 _____ C:\WINDOWS\system32\config\VSMIDK
2024-08-13 08:26 - 2024-01-22 11:01 - 000000000 ____D C:\ProgramData\Veeam
2024-08-13 08:26 - 2022-08-19 07:21 - 000000128 _____ C:\WINDOWS\system32\config\netlogon.ftl
2024-08-13 08:26 - 2022-08-18 09:05 - 000000000 ____D C:\ProgramData\NVIDIA
2024-08-13 08:26 - 2022-08-18 08:47 - 000012288 ___SH C:\DumpStack.log.tmp
2024-08-13 08:26 - 2022-05-07 07:24 - 000000000 ____D C:\WINDOWS\ServiceState
2024-08-13 08:26 - 2022-05-07 07:24 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2024-08-13 08:25 - 2022-05-07 07:17 - 000786432 _____ C:\WINDOWS\system32\config\BBI
2024-08-13 07:42 - 2022-05-07 07:24 - 000000000 ___HD C:\WINDOWS\ELAMBKUP
2024-08-13 07:42 - 2022-05-07 07:22 - 000000000 ____D C:\WINDOWS\INF
2024-08-13 07:41 - 2022-05-07 07:24 - 000000000 ____D C:\WINDOWS\AppReadiness
2024-08-13 07:37 - 2024-01-25 14:55 - 001671852 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2024-08-13 07:30 - 2022-05-07 07:24 - 000000000 ___HD C:\Program Files\WindowsApps
2024-08-13 07:29 - 2024-01-25 14:53 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2024-08-12 16:45 - 2024-07-02 09:16 - 000000000 ____D C:\Users\ALB\AppData\Roaming\obs-studio
2024-08-12 16:20 - 2024-06-25 10:27 - 000000000 ____D C:\Users\ALB\AppData\Local\D3DSCache
2024-08-12 07:56 - 2022-08-18 08:47 - 000002438 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
2024-08-09 13:28 - 2022-09-05 15:29 - 000000000 ____D C:\ProgramData\VMware
2024-08-09 13:28 - 2022-09-05 15:29 - 000000000 ____D C:\Program Files (x86)\VMware
2024-08-09 13:23 - 2022-05-07 07:17 - 000000000 ____D C:\WINDOWS\CbsTemp
2024-08-09 13:21 - 2022-05-07 07:24 - 000000000 ___SD C:\WINDOWS\SysWOW64\lxss
2024-08-09 13:21 - 2022-05-07 07:24 - 000000000 ___SD C:\WINDOWS\system32\lxss
2024-08-09 13:18 - 2022-08-18 08:56 - 000000000 ____D C:\ProgramData\Packages
2024-08-09 13:11 - 2024-07-10 13:41 - 000000000 ____D C:\Users\ALB\AppData\Local\CrashDumps
2024-08-09 13:04 - 2024-06-25 10:25 - 000000000 ____D C:\Users\ALB
2024-08-09 12:26 - 2024-01-25 14:56 - 000004562 _____ C:\WINDOWS\system32\Tasks\Adobe Acrobat Update Task
2024-08-09 12:26 - 2022-10-13 11:55 - 000002073 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat.lnk
2024-08-09 12:26 - 2022-10-13 11:55 - 000002061 _____ C:\Users\Public\Desktop\Adobe Acrobat.lnk
2024-08-09 12:15 - 2022-08-18 08:47 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd
2024-08-07 08:39 - 2024-06-25 10:50 - 000000000 ____D C:\Users\ALB\AppData\Roaming\Microsoft\Excel
2024-08-06 16:47 - 2024-06-25 10:26 - 000000000 ____D C:\Users\ALB\AppData\Roaming\Microsoft\Word
2024-08-01 11:31 - 2024-07-02 13:50 - 000000000 ____D C:\Python311
2024-08-01 11:01 - 2022-05-07 07:24 - 000000000 ____D C:\WINDOWS\LiveKernelReports
2024-08-01 09:56 - 2024-06-25 10:23 - 000003636 _____ C:\WINDOWS\system32\Tasks\CreateExplorerShellUnelevatedTask
2024-08-01 08:39 - 2024-07-04 08:53 - 000000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2024-08-01 08:35 - 2024-07-04 08:53 - 000000000 ____D C:\Users\ALB\AppData\Local\NVIDIA Corporation
2024-07-31 12:22 - 2024-06-25 10:25 - 000000000 ____D C:\Users\ALB\AppData\Local\Packages
2024-07-29 15:46 - 2023-04-28 09:53 - 000000000 ____D C:\Program Files (x86)\Dia
2024-07-29 15:44 - 2022-08-19 07:24 - 000000000 ____D C:\WINDOWS\system32\appmgmt
2024-07-29 09:25 - 2024-06-25 10:25 - 000000000 ___SD C:\Users\ALB\AppData\Roaming\Microsoft\Credentials
2024-07-28 17:32 - 2024-07-02 16:26 - 000000859 _____ C:\ProgramData\Microsoft\Windows\Start Menu\UniGetUI (formerly WingetUI).lnk
2024-07-28 17:32 - 2024-07-02 16:26 - 000000853 _____ C:\Users\Public\Desktop\UniGetUI (formerly WingetUI).lnk
2024-07-28 17:32 - 2024-07-02 16:26 - 000000000 ____D C:\Program Files\UniGetUI
2024-07-28 15:06 - 2024-01-25 14:56 - 000003756 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA
2024-07-28 15:06 - 2024-01-25 14:56 - 000003632 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore
2024-07-26 07:31 - 2024-07-02 16:40 - 000000000 ____D C:\Users\ALB\AppData\Roaming\TortoiseHg
2024-07-26 05:47 - 2022-05-07 07:24 - 000000000 ____D C:\ProgramData\USOPrivate
2024-07-26 05:30 - 2024-01-25 14:53 - 000495104 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2024-07-26 05:29 - 2022-05-07 12:39 - 000000000 __SHD C:\WINDOWS\BitLockerDiscoveryVolumeContents
2024-07-26 05:29 - 2022-05-07 12:39 - 000000000 ____D C:\Program Files\Windows Defender Advanced Threat Protection
2024-07-26 05:29 - 2022-05-07 07:24 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2024-07-26 05:29 - 2022-05-07 07:24 - 000000000 ____D C:\WINDOWS\WUModels
2024-07-26 05:29 - 2022-05-07 07:24 - 000000000 ____D C:\WINDOWS\UUS
2024-07-26 05:29 - 2022-05-07 07:24 - 000000000 ____D C:\WINDOWS\SysWOW64\WinMetadata
2024-07-26 05:29 - 2022-05-07 07:24 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2024-07-26 05:29 - 2022-05-07 07:24 - 000000000 ____D C:\WINDOWS\SystemResources
2024-07-26 05:29 - 2022-05-07 07:24 - 000000000 ____D C:\WINDOWS\SystemApps
2024-07-26 05:29 - 2022-05-07 07:24 - 000000000 ____D C:\WINDOWS\system32\WinMetadata
2024-07-26 05:29 - 2022-05-07 07:24 - 000000000 ____D C:\WINDOWS\system32\SecureBootUpdates
2024-07-26 05:29 - 2022-05-07 07:24 - 000000000 ____D C:\WINDOWS\system32\oobe
2024-07-26 05:29 - 2022-05-07 07:24 - 000000000 ____D C:\WINDOWS\system32\Dism
2024-07-26 05:29 - 2022-05-07 07:24 - 000000000 ____D C:\WINDOWS\system32\appraiser
2024-07-26 05:29 - 2022-05-07 07:24 - 000000000 ____D C:\WINDOWS\ShellExperiences
2024-07-26 05:29 - 2022-05-07 07:24 - 000000000 ____D C:\WINDOWS\ShellComponents
2024-07-26 05:29 - 2022-05-07 07:24 - 000000000 ____D C:\WINDOWS\Provisioning
2024-07-26 05:29 - 2022-05-07 07:24 - 000000000 ____D C:\WINDOWS\PolicyDefinitions
2024-07-26 05:29 - 2022-05-07 07:24 - 000000000 ____D C:\WINDOWS\bcastdvr
2024-07-24 14:57 - 2024-07-03 15:16 - 000000000 ____D C:\Users\ALB\.cache
2024-07-24 13:56 - 2024-07-02 16:58 - 000000000 ____D C:\Users\ALB\Documents\Visual Studio 2022
2024-07-24 13:54 - 2024-07-02 16:41 - 000000000 ____D C:\Users\ALB\AppData\Roaming\Visual Studio Setup
2024-07-24 13:54 - 2022-11-22 10:41 - 000001433 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Visual Studio Installer.lnk
2024-07-24 13:36 - 2022-08-19 07:57 - 000000000 ____D C:\ProgramData\Package Cache
2024-07-24 13:30 - 2024-07-02 16:58 - 000000000 ____D C:\Users\ALB\AppData\Roaming\Microsoft\VisualStudio
2024-07-24 13:27 - 2024-07-02 16:58 - 000000000 ____D C:\Users\ALB\AppData\Local\.IdentityService
2024-07-24 11:20 - 2024-06-25 10:25 - 000000000 ____D C:\Users\ALB\AppData\Local\ConnectedDevicesPlatform
2024-07-24 11:18 - 2024-06-25 10:26 - 000002444 _____ C:\Users\ALB\Desktop\Geschäftlich - Edge.lnk
2024-07-24 09:17 - 2024-07-04 08:12 - 000000000 ____D C:\WINDOWS\system32\Npcap
2024-07-24 09:16 - 2022-05-07 07:24 - 000000000 ____D C:\WINDOWS\schemas
2024-07-24 09:14 - 2024-07-10 16:19 - 000000000 ____D C:\Users\ALB\appdaten
2024-07-24 08:50 - 2022-08-19 07:53 - 000000000 ____D C:\Program Files (x86)\Google
2024-07-24 08:11 - 2024-07-11 08:58 - 000000000 ____D C:\Users\ALB\AppData\Roaming\draw.io
2024-07-22 13:16 - 2024-07-04 08:12 - 000000000 ____D C:\Program Files\Npcap
2024-07-16 14:05 - 2024-06-25 10:26 - 000000000 ____D C:\Users\ALB\AppData\Roaming\Microsoft\Office
2024-07-16 10:03 - 2024-07-02 16:26 - 000000000 ____D C:\Users\ALB\.dotnet
2024-07-16 08:04 - 2024-07-04 08:13 - 000001827 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wireshark.lnk
2024-07-16 08:04 - 2024-07-04 08:13 - 000001815 _____ C:\Users\Public\Desktop\Wireshark.lnk
2024-07-16 08:04 - 2024-07-04 08:12 - 000000000 ____D C:\Program Files\Wireshark
2024-07-16 08:02 - 2022-11-22 11:00 - 000000000 ____D C:\Program Files\dotnet
2024-07-16 08:01 - 2024-07-02 16:46 - 000000000 ____D C:\Program Files (x86)\dotnet
2024-07-16 08:00 - 2022-11-22 10:41 - 000000000 ____D C:\Program Files (x86)\Microsoft Visual Studio
2024-07-16 07:58 - 2024-06-25 10:50 - 000000000 ____D C:\Users\ALB\AppData\Roaming\Notepad++
2024-07-16 07:58 - 2022-12-12 12:00 - 000000877 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++.lnk
2024-07-15 13:48 - 2022-05-07 07:24 - 000000000 ____D C:\WINDOWS\system32\ias
2024-07-15 08:39 - 2024-06-25 10:26 - 000000000 ____D C:\Users\ALB\AppData\Local\PlaceholderTileLogoFolder

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse ========

2024-07-03 15:16 - 2024-07-03 15:19 - 000000840 _____ () C:\Users\ALB\AppData\Roaming\jd-gui.cfg
2024-07-24 16:12 - 2024-07-24 16:12 - 000000016 _____ () C:\Users\ALB\AppData\Roaming\obs-virtualcam.txt
2024-07-16 14:58 - 2024-07-23 13:31 - 000000128 _____ () C:\Users\ALB\AppData\Local\PUTTY.RND

==================== SigCheckExt =========================

2015-06-26 14:51 - 2015-06-26 14:51 - 000003072 _____ C:\WINDOWS\system32\Microsoft-Pef-WebProxy.dll
2022-06-23 22:48 - 2022-06-23 22:48 - 000332800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D2D1Debug2.dll
2022-06-23 22:53 - 2022-06-23 22:53 - 000575488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11sdklayers.dll
2022-06-23 22:53 - 2022-06-23 22:53 - 000698368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11_1sdklayers.dll
2022-06-23 22:53 - 2022-06-23 22:53 - 000936960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11_2sdklayers.dll
2024-07-03 15:26 - 2024-07-03 15:26 - 001620576 _____ (Igor Pavlov) C:\Users\ALB\Downloads\7z2407-x64.exe
2024-07-24 11:07 - 2024-03-06 00:45 - 003440128 _____ (Arnob Paul) C:\Users\ALB\Downloads\SymlinkCreator.exe
2024-07-26 10:14 - 2024-07-26 10:14 - 051380072 _____ C:\Users\ALB\Downloads\SynologyAssistantSetup-4.2-3179.exe
2023-04-28 09:52 - 2023-04-28 09:52 - 019620143 _____ (The Dia Developers) C:\Users\JSO\Downloads\dia-setup-0.97.2-2-unsigned.exe
2022-11-22 15:03 - 2022-11-22 15:03 - 000340221 _____ C:\Users\JSO\Downloads\termite-3.4.exe

==================== SigCheck ============================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)


==================== BCD ================================

Start-Manager für Firmware
--------------------------
Bezeichner              {fwbootmgr}
displayorder            {bootmgr}
                        {8780fd6e-1ec9-11ed-a68c-d90444aa4305}
                        {8780fd6b-1ec9-11ed-a68c-d90444aa4305}
                        {8780fd6c-1ec9-11ed-a68c-d90444aa4305}
                        {8780fd6d-1ec9-11ed-a68c-d90444aa4305}
                        {06e60891-2b90-11ee-8235-806e6f6e6963}
                        {1a0be224-386d-11ef-8265-806e6f6e6963}
                        {1a0be225-386d-11ef-8265-806e6f6e6963}
                        {1a0be226-386d-11ef-8265-806e6f6e6963}
timeout                 0

Windows-Start-Manager
---------------------
Bezeichner              {bootmgr}
device                  partition=\Device\HarddiskVolume3
path                    \EFI\Microsoft\Boot\bootmgfw.efi
description             Windows Boot Manager
locale                  de-DE
inherit                 {globalsettings}
default                 {current}
resumeobject            {8780fd75-1ec9-11ed-a68c-d90444aa4305}
displayorder            {current}
toolsdisplayorder       {memdiag}
timeout                 30

Firmwareanwendung (101fffff)
----------------------------
Bezeichner              {06e60891-2b90-11ee-8235-806e6f6e6963}
description             UEFI HTTPs Boot (MAC:00BE43DE7BA1)

Firmwareanwendung (101fffff)
----------------------------
Bezeichner              {1a0be224-386d-11ef-8265-806e6f6e6963}
description             USB NIC (IPV4)

Firmwareanwendung (101fffff)
----------------------------
Bezeichner              {1a0be225-386d-11ef-8265-806e6f6e6963}
description             USB NIC (IPV6)

Firmwareanwendung (101fffff)
----------------------------
Bezeichner              {1a0be226-386d-11ef-8265-806e6f6e6963}
description             UEFI HTTPs Boot (MAC:00E04C681207)

Firmwareanwendung (101fffff)
----------------------------
Bezeichner              {8780fd6b-1ec9-11ed-a68c-d90444aa4305}
description             ONBOARD NIC (IPV4)

Firmwareanwendung (101fffff)
----------------------------
Bezeichner              {8780fd6c-1ec9-11ed-a68c-d90444aa4305}
description             ONBOARD NIC (IPV6)

Firmwareanwendung (101fffff)
----------------------------
Bezeichner              {8780fd6d-1ec9-11ed-a68c-d90444aa4305}
description             UEFI HTTPs Boot

Firmwareanwendung (101fffff)
----------------------------
Bezeichner              {8780fd6e-1ec9-11ed-a68c-d90444aa4305}
device                  partition=\Device\HarddiskVolume3
path                    \EFI\Boot\BootX64.efi
description             UEFI Samsung SSD 990 EVO 2TB S7GDNS0X101746D 1

Windows-Startladeprogramm
-------------------------
Bezeichner              {8780fd73-1ec9-11ed-a68c-d90444aa4305}
device                  ramdisk=[unknown]\Recovery\WindowsRE\Winre.wim,{8780fd74-1ec9-11ed-a68c-d90444aa4305}
path                    \windows\system32\winload.efi
description             Windows Recovery Environment
locale                  de-de
inherit                 {bootloadersettings}
displaymessage          Recovery
osdevice                ramdisk=[unknown]\Recovery\WindowsRE\Winre.wim,{8780fd74-1ec9-11ed-a68c-d90444aa4305}
systemroot              \windows
nx                      OptIn
bootmenupolicy          Standard
winpe                   Yes

Windows-Startladeprogramm
-------------------------
Bezeichner              {current}
device                  partition=C:
path                    \WINDOWS\system32\winload.efi
description             Windows 11
locale                  de-DE
inherit                 {bootloadersettings}
recoverysequence        {8780fd78-1ec9-11ed-a68c-d90444aa4305}
displaymessageoverride  Recovery
recoveryenabled         Yes
isolatedcontext         Yes
allowedinmemorysettings 0x15000075
osdevice                partition=C:
systemroot              \WINDOWS
resumeobject            {8780fd75-1ec9-11ed-a68c-d90444aa4305}
nx                      OptIn
bootmenupolicy          Standard
hypervisorlaunchtype    Auto

Windows-Startladeprogramm
-------------------------
Bezeichner              {8780fd78-1ec9-11ed-a68c-d90444aa4305}
device                  ramdisk=[\Device\HarddiskVolume5]\Recovery\WindowsRE\Winre.wim,{8780fd79-1ec9-11ed-a68c-d90444aa4305}
path                    \windows\system32\winload.efi
description             Windows Recovery Environment
locale                  de-DE
inherit                 {bootloadersettings}
displaymessage          Recovery
osdevice                ramdisk=[\Device\HarddiskVolume5]\Recovery\WindowsRE\Winre.wim,{8780fd79-1ec9-11ed-a68c-d90444aa4305}
systemroot              \windows
nx                      OptIn
bootmenupolicy          Standard
winpe                   Yes

Wiederaufnahme aus dem Ruhezustand
----------------------------------
Bezeichner              {8780fd75-1ec9-11ed-a68c-d90444aa4305}
device                  partition=C:
path                    \WINDOWS\system32\winresume.efi
description             Windows Resume Application
locale                  de-DE
inherit                 {resumeloadersettings}
recoverysequence        {8780fd78-1ec9-11ed-a68c-d90444aa4305}
recoveryenabled         Yes
isolatedcontext         Yes
allowedinmemorysettings 0x15000075
filedevice              partition=C:
custom:21000026         partition=C:
filepath                \hiberfil.sys
bootmenupolicy          Standard
debugoptionenabled      No

Windows-Speichertestprogramm
----------------------------
Bezeichner              {memdiag}
device                  partition=\Device\HarddiskVolume3
path                    \EFI\Microsoft\Boot\memtest.efi
description             Windows-Speicherdiagnose
locale                  de-DE
inherit                 {globalsettings}
badmemoryaccess         Yes

EMS-Einstellungen
-----------------
Bezeichner              {emssettings}
bootems                 No

Debuggereinstellungen
---------------------
Bezeichner              {dbgsettings}
debugtype               Local

RAM-Defekte
-----------
Bezeichner              {badmemory}

Globale Einstellungen
---------------------
Bezeichner              {globalsettings}
inherit                 {dbgsettings}
                        {emssettings}
                        {badmemory}

Startladeprogramm-Einstellungen
-------------------------------
Bezeichner              {bootloadersettings}
inherit                 {globalsettings}
                        {hypervisorsettings}

Hypervisoreinstellungen
-----------------------
Bezeichner              {hypervisorsettings}
hypervisordebugtype     Serial
hypervisordebugport     1
hypervisorbaudrate      115200

Einstellungen zur Ladeprogrammfortsetzung
-----------------------------------------
Bezeichner              {resumeloadersettings}
inherit                 {globalsettings}

Geräteoptionen
--------------
Bezeichner              {8780fd79-1ec9-11ed-a68c-d90444aa4305}
description             Windows Recovery
ramdisksdidevice        partition=\Device\HarddiskVolume5
ramdisksdipath          \Recovery\WindowsRE\boot.sdi

==================== Ende von FRST.txt ========================