Trojaner-Board - Windows 7 Bootmanager verändert, Prozessorkerne werden abgezweigt, Rootkit, Bootmanagertool?

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Windows 7 Bootmanager verändert, Prozessorkerne werden abgezweigt, Rootkit, Bootmanagertool? (https://www.trojaner-board.de/147775-windows-7-bootmanager-veraendert-prozessorkerne-abgezweigt-rootkit-bootmanagertool.html)

Windows 7 Bootmanager verändert, Prozessorkerne werden abgezweigt, Rootkit, Bootmanagertool?

Hallo Freunde,

ich hatte gestern das Problem, das mein 4 Kern Prozessor nur mit 2 Kernen lief. Daraufhin habe ich einiges ausprobiert um den Fehler zu lokalisieren. Mein 1. Verdacht war, das ich ihn mir beim Übertakten zerschossen habe. Im abgesicherten Modus konnte ich alle 4 Kerne sehen, der Gerätemanager zeigt mir auch 4 reibungslos laufende Kerne an. Ich habe aber festgestellt, das in meiner Registry und an anderen stellen gravierende Änderungen vorgenommen worden sind. Ich habe mein ganzes Laihenwissen angewendet. Scans mit Rootkittools, Malwarebytes und allem anderen funktionieren nicht beziehungsweise zeigen keinerlei Resultate. FRST64 gibt mir auch kurz nach dem Start eine Fehlermeldung raus und wird beendet. Ich bin echt verzweifelt. Könnt ihr mir, mal wieder, helfen?

LG B3AM3R

Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

http://www.trojaner-board.de/picture...&pictureid=307

Hallo Schrauber, es ist natürlich nicht mein Ziel, Dir die Arbeit zu erschweren. Entschuldige. Hier nochmal richtig:

Code:

OTL Extras logfile created on: 11.01.2014 01:23:57 - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Raubtier\Desktop

64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.11.9600.16428)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

7,98 Gb Total Physical Memory | 6,26 Gb Available Physical Memory | 78,39% Memory free

15,96 Gb Paging File | 13,93 Gb Available in Paging File | 87,27% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 146,48 Gb Total Space | 91,49 Gb Free Space | 62,46% Space Free | Partition Type: NTFS

Drive D: | 488,28 Gb Total Space | 263,52 Gb Free Space | 53,97% Space Free | Partition Type: NTFS

Drive E: | 443,10 Gb Total Space | 289,63 Gb Free Space | 65,36% Space Free | Partition Type: NTFS

Drive G: | 341,80 Gb Total Space | 164,28 Gb Free Space | 48,06% Space Free | Partition Type: NTFS

Drive H: | 443,23 Gb Total Space | 43,33 Gb Free Space | 9,78% Space Free | Partition Type: NTFS

 

Computer Name: RAUBTIER-PC | User Name: Raubtier | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

 

[HKEY_USERS\S-1-5-21-199586521-2663480010-3892174971-1000\SOFTWARE\Classes\<extension>]

.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

 
 ========== Shell Spawning ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htmlfile [edit] -- Reg Error: Key error.

htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"

http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)

InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Programme\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [PlayWithVLC] -- "C:\Programme\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htmlfile [edit] -- Reg Error: Key error.

htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"

http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Programme\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [PlayWithVLC] -- "C:\Programme\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.

 
 ========== Security Center Settings ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 
 ========== Authorized Applications List ==========

 

 
 ========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{12F00C8C-082D-4996-BEDA-EE8D7C235D86}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{17C35AFD-586C-4BF2-8047-982E66C9852B}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 

"{1980AF02-AD78-434F-BB65-34561D807A4D}" = rport=139 | protocol=6 | dir=out | app=system | 

"{2D7C8FDD-E4C4-4380-A4C1-B264035C8C92}" = lport=137 | protocol=17 | dir=in | app=system | 

"{351E2128-21F1-4AC1-975A-DA509E97B44D}" = rport=137 | protocol=17 | dir=out | app=system | 

"{369D9D66-5A6C-42ED-A871-375E52CB6727}" = rport=138 | protocol=17 | dir=out | app=system | 

"{4E7C99EE-EB83-4C56-9C7C-A36BA1AB1B0B}" = lport=445 | protocol=6 | dir=in | app=system | 

"{57A5D731-16EE-4114-AAEE-6B875BDA6CC8}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{8E436780-53D2-474E-854D-C8F87CAF46AB}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 

"{9674B0AE-3E51-4372-A379-11235DFABF08}" = rport=445 | protocol=6 | dir=out | app=system | 

"{B3A69312-6355-4001-8A48-0B6F798A806D}" = lport=138 | protocol=17 | dir=in | app=system | 

"{E2601526-EC9E-4177-99C3-117165E314D8}" = lport=139 | protocol=6 | dir=in | app=system | 

 
 ========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{1D1DA6CB-9AD8-4749-9204-6BBB181DCEFB}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{2910EAA1-A18D-4B08-B79A-08ADAC3CE47D}" = protocol=6 | dir=in | app=e:\origin games\battlefield 4\bf4_x86.exe | 

"{46766C2C-DFCF-4E40-8A93-D59246795D1A}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 

"{5986A102-4EED-4CFA-B986-B530686BA442}" = protocol=6 | dir=in | app=e:\steam games\steamapps\common\nmrih\sdk\bin\hammer.bat | 

"{60A16F41-BE72-40E4-A155-9B9C0A6AAF23}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 

"{66D82D21-D66F-4EEA-8BB8-A02A588A675B}" = protocol=17 | dir=in | app=e:\origin games\battlefield 4\bf4.exe | 

"{6FCD2361-7279-4DC0-8B9D-707267CDDA5B}" = protocol=17 | dir=in | app=e:\steam games\steamapps\common\nmrih\sdk\hl2.exe | 

"{799111C2-644B-464A-A5C1-1CF838B15CA7}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 

"{7C959157-89EA-4A6A-A2E8-EE4AD45A6608}" = protocol=6 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe | 

"{8CB75ECC-7D24-412A-8214-79965279A9E0}" = protocol=17 | dir=in | app=e:\steam games\steamapps\common\nmrih\sdk\bin\hammer.bat | 

"{8E0A014F-C432-454B-9224-49EDAA83262C}" = protocol=6 | dir=in | app=e:\steam games\steamapps\common\nmrih\sdk\hl2.exe | 

"{9742D0D5-7D07-44E9-B39E-168DB88FB1D3}" = protocol=6 | dir=in | app=c:\program files\messenger\yahoomessenger.exe | 

"{99CE370D-851C-40D1-836E-20D3DB2248AE}" = protocol=17 | dir=in | app=c:\program files\steam\steam.exe | 

"{99E9532F-4674-4557-B153-D7504B2DE547}" = protocol=17 | dir=in | app=e:\gamesgecrackt\nba2k14\nba2k14.exe | 

"{A4485D88-0F2C-4675-9E21-734B59830199}" = protocol=17 | dir=in | app=c:\program files\messenger\yahoomessenger.exe | 

"{A45C5040-EDF4-4047-9061-512D1C2873E4}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 

"{BB349E5C-FFE1-4839-AA6F-141248DE7E88}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 

"{BFF589D3-BE8C-4682-BADF-237B0533C107}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 

"{C485850E-2440-4845-B791-E3B9B55DD664}" = protocol=6 | dir=in | app=c:\program files\steam\steam.exe | 

"{CAB5DF8D-A095-437F-984E-45FD1B9AE4C2}" = protocol=17 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe | 

"{CFE032A0-3609-4996-A2E0-E49027EB30C7}" = protocol=17 | dir=in | app=e:\origin games\battlefield 4\bf4_x86.exe | 

"{E08D2824-E712-4F3A-B3EB-1520A9790BFC}" = protocol=6 | dir=in | app=e:\origin games\battlefield 4\bf4.exe | 

"{E6F14EA7-7099-4C26-B588-489D23C93408}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 

"{EAC9D300-5DC3-45CC-A2C4-2D7C792072FF}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 

"{F621EB0A-488C-4E57-BCB9-49D779F4E784}" = protocol=6 | dir=in | app=e:\gamesgecrackt\nba2k14\nba2k14.exe | 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{14297226-E0A0-3781-8911-E9D529552663}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729

"{2EDC2FA3-1F34-34E5-9085-588C9EFD1CC6}" = Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610

"{308051DA-0048-7A07-FE8B-9B6EC119A9E8}" = AMD Catalyst Install Manager

"{44AAA767-F540-F091-4571-ADCBC10B0C92}" = AMD Fuel

"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime

"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

"{678A75C7-5953-B109-57EE-46C7BA4C29C1}" = AMD Drag and Drop Transcoding

"{764384C5-BCA9-307C-9AAC-FD443662686A}" = Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610

"{7DEBE4EB-6B40-3766-BB35-5CBBC385DA37}" = Microsoft .NET Framework 4.5.1

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" = Microsoft .NET Framework 4.5.1

"{AEF57B06-B494-8180-AFC7-05EFB1DB2B64}" = ccc-utility64

"{B3B750C0-8C22-439D-B7CE-67F3ED99CC2B}" = Microsoft Xbox 360 Accessories 1.2

"{BD1BCEF8-5CD6-D8ED-7D36-31C2172076EA}" = AMD Media Foundation Decoders

"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319

"{E102B843-786A-4F58-AF75-6504570E207B}" = Microsoft Security Client

"{ED273D26-E354-1A5B-A0D0-CB5258D43BD2}" = AMD Wireless Display v3.0

"{FCC4426F-0296-D30D-729C-E76C8E7252C7}" = AMD Accelerated Video Transcoding

"Microsoft Security Client" = Microsoft Security Essentials

"TeamSpeak 3 Client" = TeamSpeak 3 Client

"WinRAR archiver" = WinRAR 5.00 (64-Bit)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{046B79EE-7ED3-37A4-621A-FE297EF484C2}" = CCC Help Greek

"{0D78BEE2-F8FF-4498-AF1A-3FF81CED8AC6}" = Razer Synapse 2.0

"{10CB5DDD-38E1-2EB2-F62C-C1948A99943E}" = AMD Catalyst Control Center

"{1194740D-0DB8-A508-31BA-E722597B4516}" = Catalyst Control Center Graphics Previews Common

"{1FB16E3B-3AFB-46CB-6E83-2F5A0CF4ED16}" = Catalyst Control Center Localization All

"{2E3A81FB-7952-F8CB-9AD5-50544E2F4838}" = CCC Help Czech

"{3D6AD258-61EA-35F5-812C-B7A02152996E}" = Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610

"{4172E797-CE12-AC47-05B7-0E48BDB33E75}" = CCC Help Russian

"{4428AEE6-FA5E-2913-8D12-B410E85E11AA}" = CCC Help Spanish

"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.11

"{4FE0545A-1BF3-4B9B-A044-6E1EE719E197}" = NBA 2K14

"{4FF1533E-FF2C-A04A-25DD-A8AEC6FA106B}" = CCC Help Chinese Standard

"{519C4DB6-B53B-4F5C-8297-89B2BE949FA5}_is1" = Data Lifeguard Diagnostic for Windows 1.24

"{5449FB4F-1802-4D5B-A6D8-087DB1142147}" = Realtek HDMI Audio Driver for ATI

"{6071CB80-DABC-B10D-F244-7F410FB3B150}" = CCC Help Polish

"{6343B6BA-F97F-B336-9ED8-FFD43776E84D}" = CCC Help Finnish

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver

"{8D3A11D0-D925-FA0F-43F3-242E49975CD2}" = CCC Help Danish

"{8EF39A9F-6A57-9706-86A5-9312D9ED8016}" = CCC Help Portuguese

"{92352C97-C657-DB89-5F3A-E8C3789D9C89}" = CCC Help Chinese Traditional

"{95545E55-3309-1929-FF41-2908A9706742}" = CCC Help Turkish

"{95716cce-fc71-413f-8ad5-56c2892d4b3a}" = Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610

"{9CA5F712-9CAA-B3CB-02D3-7134DFC8801E}" = CCC Help French

"{A128A816-FD3F-990E-DD80-E1735BD718AE}" = CCC Help Italian

"{a1909659-0a08-4554-8af1-2175904903a1}" = Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{ABADE36E-EC37-413B-8179-B432AD3FACE7}" = Battlefield 4™

"{AFC9ECA9-6A4E-1370-98F3-002B63B5AF8E}" = CCC Help Thai

"{B88F2045-CF9A-996C-1670-6F7D65F1D18A}" = CCC Help Norwegian

"{BED96D0C-7743-3CE3-F7DF-A0A4475FBF2F}" = CCC Help Hungarian

"{CB79256B-C0E0-40C6-8EB7-BDD796203581}" = Catalyst Control Center - Branding

"{DFBB738C-71D8-4DC5-B8D2-D65C37680E27}" = Etron USB3.0 Host Controller

"{E297492A-E114-CAE0-502E-5F36C386DD30}" = CCC Help Dutch

"{E6533A85-ED92-F897-2B68-58AC3BD87F94}" = CCC Help English

"{E7D4E834-93EB-351F-B8FB-82CDAE623003}" = Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610

"{EBAC163A-588E-1E5A-3CE8-826E9A449244}" = CCC Help Korean

"{ED4108A9-60FD-4F18-AF42-122219977773}" = Razer Naga

"{ED65BD75-CEF3-C0C2-9E9C-FA567484FF60}" = CCC Help Japanese

"{EEB34D84-92A1-7BE3-6DB7-ABD1C4912D6B}" = Catalyst Control Center InstallProxy

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"{F1289D68-1C48-930F-51CF-577BDB371252}" = CCC Help Swedish

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F3F340A5-64EC-AEEC-4BDF-DC537D390BF5}" = CCC Help German

"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX

"Battlelog Web Plugins" = Battlelog Web Plugins

"DAEMON Tools Lite" = DAEMON Tools Lite

"ESN Sonar-0.70.4" = ESN Sonar

"Google Chrome" = Google Chrome

"InstallShield_{DFBB738C-71D8-4DC5-B8D2-D65C37680E27}" = Etron USB3.0 Host Controller

"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.75.0.1300

"Origin" = Origin

"PunkBusterSvc" = PunkBuster Services

"QmF0bWFuQXJraGFtT3JpZ2lucw==_is1" = Batman Arkham Origins

"Steam" = Steam

"Steam App 224260" = No More Room in Hell

"Usenet.nl_is1" = Usenet.nl

"VGhlQnVyZWF1WENPTURlY2xhc3NpZmllZA==_is1" = The Bureau: XCOM Declassified

"VirtualCloneDrive" = VirtualCloneDrive

"VLC media player" = VLC media player 2.1.2

"Yahoo! Messenger" = Yahoo! Messenger

 
 ========== Last 20 Event Log Errors ==========

 

[ Application Events ]

Error - 10.01.2014 16:21:18 | Computer Name = Raubtier-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 10.01.2014 16:36:11 | Computer Name = Raubtier-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 10.01.2014 17:03:25 | Computer Name = Raubtier-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 10.01.2014 17:24:02 | Computer Name = Raubtier-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 10.01.2014 17:34:39 | Computer Name = Raubtier-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 10.01.2014 17:42:07 | Computer Name = Raubtier-PC | Source = Microsoft-Windows-CAPI2 | ID = 512

Description = Vom Kryptografiedienst konnte das VSS-Sicherungsobjekt "System Writer"

 nicht initialisiert werden.  Details: Could not query the status of the EventSystem

 service.  System Error: Der Computer wird heruntergefahren.  .

 

Error - 10.01.2014 17:46:54 | Computer Name = Raubtier-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 10.01.2014 17:52:32 | Computer Name = Raubtier-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 10.01.2014 19:51:06 | Computer Name = Raubtier-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 10.01.2014 20:03:53 | Computer Name = Raubtier-PC | Source = WinMgmt | ID = 10

Description = 

 

[ System Events ]

Error - 10.01.2014 19:58:39 | Computer Name = Raubtier-PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "Heimnetzgruppen-Anbieter" wurde aufgrund folgenden Fehlers

 nicht gestartet:   %%1053

 

Error - 10.01.2014 19:58:52 | Computer Name = Raubtier-PC | Source = Service Control Manager | ID = 7032

Description = Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden

 des Dienstes "RPC-Endpunktzuordnung" Korrekturmaßnahmen (Neustart des Diensts) 

durchzuführen, ist fehlgeschlagen. Fehler:   %%1056

 

Error - 10.01.2014 19:59:39 | Computer Name = Raubtier-PC | Source = Service Control Manager | ID = 7009

Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst

 DHCP-Client erreicht.

 

Error - 10.01.2014 19:59:39 | Computer Name = Raubtier-PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "DHCP-Client" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%1053

 

Error - 10.01.2014 19:59:39 | Computer Name = Raubtier-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Remoteprozeduraufruf (RPC)" ist vom Dienst "RPC-Endpunktzuordnung"

 abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1062

 

Error - 10.01.2014 19:59:39 | Computer Name = Raubtier-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Sicherheitscenter" ist vom Dienst "Windows-Verwaltungsinstrumentation"

 abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 10.01.2014 20:02:11 | Computer Name = Raubtier-PC | Source = EventLog | ID = 6008

Description = Das System wurde zuvor am ?11.?01.?2014 um 00:57:29 unerwartet heruntergefahren.

 

Error - 10.01.2014 20:02:17 | Computer Name = Raubtier-PC | Source = Service Control Manager | ID = 7003

Description = Der Dienst "Net.Msmq Listener Adapter" ist von folgendem Dienst abhängig:

 msmq. Dieser Dienst ist eventuell nicht installiert.

 

Error - 10.01.2014 20:02:17 | Computer Name = Raubtier-PC | Source = Service Control Manager | ID = 7003

Description = Der Dienst "Net.Pipe Listener Adapter" ist von folgendem Dienst abhängig:

 was. Dieser Dienst ist eventuell nicht installiert.

 

Error - 10.01.2014 20:02:17 | Computer Name = Raubtier-PC | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Net.Tcp Listener Adapter" ist vom Dienst "Net.Tcp Port

 Sharing Service" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:

   %%1058

 

 

< End of report >

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-01-2014 02

Ran by Raubtier (administrator) on RAUBTIER-PC on 11-01-2014 13:24:15

Running from C:\Users\Raubtier\Desktop

Windows 7 Ultimate Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe

(AMD) C:\Windows\System32\atiesrxx.exe

(AMD) C:\Windows\System32\atieclxx.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(Advanced Micro Devices, Inc.) C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe

() C:\Windows\SysWOW64\PnkBstrA.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe

(Microsoft Corporation) C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe

(Razer USA Ltd) C:\Programme\Razer\Naga\RazerNagaSysTray.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe

(Elaborate Bytes AG) C:\ProgrammeVirtualCloneDrive\VCDDaemon.exe

(Advanced Micro Devices Inc.) C:\Programme\AMD\ATI.ACE\Core-Static\MOM.exe

(Yahoo! Inc.) C:\Program Files\Messenger\Ymsgr_tray.exe

(ATI Technologies Inc.) C:\Programme\AMD\ATI.ACE\Core-Static\CCC.exe

Code:

OTL logfile created on: 11.01.2014 01:23:57 - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Raubtier\Desktop

64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.11.9600.16428)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

7,98 Gb Total Physical Memory | 6,26 Gb Available Physical Memory | 78,39% Memory free

15,96 Gb Paging File | 13,93 Gb Available in Paging File | 87,27% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 146,48 Gb Total Space | 91,49 Gb Free Space | 62,46% Space Free | Partition Type: NTFS

Drive D: | 488,28 Gb Total Space | 263,52 Gb Free Space | 53,97% Space Free | Partition Type: NTFS

Drive E: | 443,10 Gb Total Space | 289,63 Gb Free Space | 65,36% Space Free | Partition Type: NTFS

Drive G: | 341,80 Gb Total Space | 164,28 Gb Free Space | 48,06% Space Free | Partition Type: NTFS

Drive H: | 443,23 Gb Total Space | 43,33 Gb Free Space | 9,78% Space Free | Partition Type: NTFS

 

Computer Name: RAUBTIER-PC | User Name: Raubtier | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Users\Raubtier\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()

PRC - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)

PRC - C:\Users\Raubtier\Desktop\Process Explorer.exe (Sysinternals - www.sysinternals.com)

PRC - C:\Programme\Razer\Naga\RazerNagaSysTray.exe (Razer USA Ltd)

 

 
 ========== Modules (No Company Name) ==========

 

MOD - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll ()

MOD - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\pdf.dll ()

MOD - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\libglesv2.dll ()

MOD - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\libegl.dll ()

MOD - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ffmpegsumo.dll ()

 

 
 ========== Services (SafeList) ==========

 

SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)

SRV:64bit: - (IEEtwCollectorService) -- C:\Windows\SysNative\IEEtwCollector.exe (Microsoft Corporation)

SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe ()

SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)

SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)

SRV - (AMD FUEL Service) -- C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe (Advanced Micro Devices, Inc.)

SRV - (NisSrv) -- C:\Programme\Microsoft Security Client\NisSrv.exe (Microsoft Corporation)

SRV - (MsMpSvc) -- C:\Programme\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)

SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)

SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)

SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - (dtsoftbus01) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys (Disc Soft Ltd)

DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)

DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)

DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)

DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)

DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)

DRV:64bit: - (NisDrv) -- C:\Windows\SysNative\drivers\NisDrvWFP.sys (Microsoft Corporation)

DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices)

DRV:64bit: - (VClone) -- C:\Windows\SysNative\drivers\VClone.sys (Elaborate Bytes AG)

DRV:64bit: - (ElbyCDIO) -- C:\Windows\SysNative\drivers\ElbyCDIO.sys (Elaborate Bytes AG)

DRV:64bit: - (EtronXHCI) -- C:\Windows\SysNative\drivers\EtronXHCI.sys (Etron Technology Inc)

DRV:64bit: - (EtronHub3) -- C:\Windows\SysNative\drivers\EtronHub3.sys (Etron Technology Inc)

DRV:64bit: - (RTHDMIAzAudService) -- C:\Windows\SysNative\drivers\RtHDMIVX.sys (Realtek Semiconductor Corp.)

DRV:64bit: - (usbfilter) -- C:\Windows\SysNative\drivers\usbfilter.sys (Advanced Micro Devices)

DRV:64bit: - (RzSynapse) -- C:\Windows\SysNative\drivers\RzSynapse.sys (Razer USA Ltd)

DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )

DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)

DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)

DRV:64bit: - (tsusbhub) -- C:\Windows\SysNative\drivers\tsusbhub.sys (Microsoft Corporation)

DRV:64bit: - (Synth3dVsc) -- C:\Windows\SysNative\drivers\Synth3dVsc.sys (Microsoft Corporation)

DRV:64bit: - (dmvsc) -- C:\Windows\SysNative\drivers\dmvsc.sys (Microsoft Corporation)

DRV:64bit: - (terminpt) -- C:\Windows\SysNative\drivers\terminpt.sys (Microsoft Corporation)

DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)

DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)

DRV:64bit: - (xusb21) -- C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation)

DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)

DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)

DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)

DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)

DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)

DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)

DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)

DRV - (AODDriver4.2.0) -- C:\Programme\AMD\ATI.ACE\Fuel\amd64\aoddriver2.sys (Advanced Micro Devices)

DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

 

 

 

 

 

 

IE - HKU\S-1-5-21-199586521-2663480010-3892174971-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/

IE - HKU\S-1-5-21-199586521-2663480010-3892174971-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE

IE - HKU\S-1-5-21-199586521-2663480010-3892174971-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E0 57 29 FF 8B 04 CF 01  [binary data]

IE - HKU\S-1-5-21-199586521-2663480010-3892174971-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKU\S-1-5-21-199586521-2663480010-3892174971-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR

IE - HKU\S-1-5-21-199586521-2663480010-3892174971-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 
 ========== FireFox ==========

 

FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)

FF - HKLM\Software\MozillaPlugins\@esn/npbattlelog,version=2.3.2: C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB)

FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.1.2: C:\Programme\VLC\npvlc.dll (VideoLAN)

 

 

 
 ========== Chrome  ==========

 

CHR - default_search_provider: Google (Enabled)

CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}

CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter},

CHR - homepage: 

CHR - Extension: ProxTube = C:\Users\Raubtier\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek\1.2.7_0\

CHR - Extension: Google Docs = C:\Users\Raubtier\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\

CHR - Extension: Google Drive = C:\Users\Raubtier\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\

CHR - Extension: YouTube = C:\Users\Raubtier\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\

CHR - Extension: Adblock Plus = C:\Users\Raubtier\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.7.2_0\

CHR - Extension: Google-Suche = C:\Users\Raubtier\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\

CHR - Extension: AdBlock = C:\Users\Raubtier\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.16_0\

CHR - Extension: Google Wallet = C:\Users\Raubtier\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\

CHR - Extension: Google Mail = C:\Users\Raubtier\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\

 

O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O4:64bit: - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)

O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)

O4 - HKLM..\Run: []  File not found

O4 - HKLM..\Run: [Razer Naga Driver] C:\Programme\Razer\Naga\RazerNagaSysTray.exe (Razer USA Ltd)

O4 - HKLM..\Run: [StartCCC] C:\Programme\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6284728D-E2A5-4CC3-B834-D361ECA5AAF5}: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6284728D-E2A5-4CC3-B834-D361ECA5AAF5}: NameServer = 8.8.8.8,8.8.4.4

O18:64bit: - Protocol\Handler\skype4com - No CLSID value found

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O33 - MountPoints2\{6bc5735a-707c-11e3-bfca-b0487a86f527}\Shell - "" = AutoRun

O33 - MountPoints2\{6bc5735a-707c-11e3-bfca-b0487a86f527}\Shell\AutoRun\command - "" = K:\setup.exe

O33 - MountPoints2\{775807df-7076-11e3-83df-b0487a86f527}\Shell - "" = AutoRun

O33 - MountPoints2\{775807df-7076-11e3-83df-b0487a86f527}\Shell\AutoRun\command - "" = J:\setup.exe

O33 - MountPoints2\{a13df7ad-7075-11e3-bae0-806e6f6e6963}\Shell - "" = AutoRun

O33 - MountPoints2\{a13df7ad-7075-11e3-bae0-806e6f6e6963}\Shell\AutoRun\command - "" = I:\setup.exe

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2014.01.11 01:23:17 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Raubtier\Desktop\OTL.exe

[2014.01.10 22:04:58 | 000,791,552 | ---- | C] (AMD) -- C:\Users\Raubtier\Desktop\amddriverdownloader.exe

[2014.01.10 21:40:14 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\Desktop\cpu-z-168

[2014.01.07 20:43:47 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\Tracing

[2014.01.07 12:56:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft SQL Server Compact Edition

[2014.01.07 12:55:37 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH

[2014.01.07 12:55:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Windows Live

[2014.01.07 12:51:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft SkyDrive

[2014.01.07 12:50:57 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Local\Windows Live

[2014.01.07 12:50:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Windows Live

[2014.01.07 12:50:35 | 001,245,168 | ---- | C] (Microsoft Corporation) -- C:\Users\Raubtier\Desktop\wlsetup-web.exe

[2014.01.07 00:57:54 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\Documents\Usenet.nl

[2014.01.07 00:57:53 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Roaming\Usenet.nl

[2014.01.07 00:57:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Usenet.nl

[2014.01.07 00:57:49 | 000,000,000 | ---D | C] -- C:\Program Files\Usenet.nl

[2014.01.03 21:18:56 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Roaming\Malwarebytes

[2014.01.03 21:18:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2014.01.03 21:18:41 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys

[2014.01.03 21:18:41 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2014.01.02 23:15:21 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\Documents\WB Games

[2014.01.02 23:11:14 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Roaming\2K Sports

[2014.01.02 00:30:30 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Local\Microsoft Games

[2014.01.01 22:35:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Xbox 360 Accessories

[2014.01.01 22:35:47 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Xbox 360 Accessories

[2014.01.01 21:18:04 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Roaming\Skype

[2014.01.01 21:17:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

[2014.01.01 21:17:57 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype

[2014.01.01 21:17:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype

[2014.01.01 21:17:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype

[2014.01.01 20:53:03 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Local\ESN Sonar

[2013.12.31 01:25:42 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Roaming\vlc

[2013.12.30 22:20:28 | 000,000,000 | ---D | C] -- C:\Windows\pss

[2013.12.30 20:47:48 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Roaming\TS3Client

[2013.12.30 19:28:51 | 000,000,000 | ---D | C] -- C:\Program Files\HDDGURU LLF Tool

[2013.12.30 12:34:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Data Lifeguard Diagnostic for Windows

[2013.12.30 12:34:08 | 000,000,000 | ---D | C] -- C:\Program Files\Data Lifeguard Diagnostic for Windows

[2013.12.30 06:36:02 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollectorres.dll

[2013.12.30 06:36:01 | 000,574,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll

[2013.12.30 06:36:01 | 000,440,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll

[2013.12.30 06:36:01 | 000,218,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe

[2013.12.30 06:36:01 | 000,139,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe

[2013.12.30 06:36:01 | 000,066,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll

[2013.12.30 06:36:01 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwproxystub.dll

[2013.12.30 06:36:01 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll

[2013.12.30 06:36:00 | 000,817,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll

[2013.12.30 06:36:00 | 000,708,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9diag.dll

[2013.12.30 06:36:00 | 000,703,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll

[2013.12.30 06:36:00 | 000,553,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript9diag.dll

[2013.12.30 06:36:00 | 000,111,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollector.exe

[2013.12.30 06:35:58 | 001,995,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl

[2013.12.30 06:35:58 | 001,928,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl

[2013.12.30 06:35:56 | 005,769,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll

[2013.12.30 06:28:12 | 000,088,832 | ---- | C] (Etron Technology Inc) -- C:\Windows\SysNative\drivers\EtronXHCI.sys

[2013.12.30 06:28:12 | 000,065,152 | ---- | C] (Etron Technology Inc) -- C:\Windows\SysNative\drivers\EtronHub3.sys

[2013.12.30 06:28:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Etron Technology

[2013.12.30 06:20:31 | 000,000,000 | ---D | C] -- C:\Windows\Migration

[2013.12.30 06:19:15 | 000,028,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\IEUDINIT.EXE

[2013.12.30 06:15:14 | 000,940,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.exe

[2013.12.30 06:15:14 | 000,194,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\elshyph.dll

[2013.12.30 06:15:10 | 000,645,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jsIntl.dll

[2013.12.30 06:15:10 | 000,616,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dat

[2013.12.30 06:15:10 | 000,337,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec

[2013.12.30 06:15:10 | 000,235,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\elshyph.dll

[2013.12.30 06:15:10 | 000,233,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll

[2013.12.30 06:15:10 | 000,164,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll

[2013.12.30 06:15:10 | 000,083,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inseng.dll

[2013.12.30 06:15:10 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe

[2013.12.30 06:15:10 | 000,069,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\icardie.dll

[2013.12.30 06:15:10 | 000,062,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\tdc.ocx

[2013.12.30 06:15:10 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll

[2013.12.30 06:15:10 | 000,034,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll

[2013.12.30 06:15:10 | 000,032,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll

[2013.12.30 06:15:10 | 000,024,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll

[2013.12.30 06:15:09 | 001,051,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmlmedia.dll

[2013.12.30 06:15:09 | 000,942,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jsIntl.dll

[2013.12.30 06:15:09 | 000,610,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll

[2013.12.30 06:15:09 | 000,151,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iexpress.exe

[2013.12.30 06:15:09 | 000,139,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wextract.exe

[2013.12.30 06:15:09 | 000,127,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\occache.dll

[2013.12.30 06:15:09 | 000,116,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll

[2013.12.30 06:15:09 | 000,112,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe

[2013.12.30 06:15:09 | 000,111,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\IEAdvpack.dll

[2013.12.30 06:15:09 | 000,086,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll

[2013.12.30 06:15:09 | 000,074,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\SetIEInstalledDate.exe

[2013.12.30 06:15:09 | 000,069,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll

[2013.12.30 06:15:09 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MshtmlDac.dll

[2013.12.30 06:15:09 | 000,056,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\pngfilt.dll

[2013.12.30 06:15:09 | 000,051,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieetwproxystub.dll

[2013.12.30 06:15:09 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmler.dll

[2013.12.30 06:15:09 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe

[2013.12.30 06:15:08 | 001,228,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmlmedia.dll

[2013.12.30 06:15:08 | 000,616,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dat

[2013.12.30 06:15:08 | 000,453,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll

[2013.12.30 06:15:08 | 000,413,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec

[2013.12.30 06:15:08 | 000,296,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtrans.dll

[2013.12.30 06:15:08 | 000,247,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msls31.dll

[2013.12.30 06:15:08 | 000,235,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll

[2013.12.30 06:15:08 | 000,195,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll

[2013.12.30 06:15:08 | 000,131,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\IEAdvpack.dll

[2013.12.30 06:15:08 | 000,105,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll

[2013.12.30 06:15:08 | 000,090,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SetIEInstalledDate.exe

[2013.12.30 06:15:08 | 000,086,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe

[2013.12.30 06:15:08 | 000,081,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\icardie.dll

[2013.12.30 06:15:08 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tdc.ocx

[2013.12.30 06:15:08 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmler.dll

[2013.12.30 06:15:08 | 000,040,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\JavaScriptCollectionAgent.dll

[2013.12.30 06:15:08 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedssync.exe

[2013.12.30 06:15:07 | 000,774,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll

[2013.12.30 06:15:07 | 000,626,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll

[2013.12.30 06:15:07 | 000,548,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll

[2013.12.30 06:15:07 | 000,167,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iexpress.exe

[2013.12.30 06:15:07 | 000,147,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\occache.dll

[2013.12.30 06:15:07 | 000,143,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wextract.exe

[2013.12.30 06:15:07 | 000,135,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll

[2013.12.30 06:15:07 | 000,101,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inseng.dll

[2013.12.30 06:15:07 | 000,084,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll

[2013.12.30 06:15:07 | 000,083,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MshtmlDac.dll

[2013.12.30 06:15:07 | 000,062,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\pngfilt.dll

[2013.12.30 06:15:07 | 000,048,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\imgutil.dll

[2013.12.30 06:15:07 | 000,030,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\licmgr10.dll

[2013.12.30 06:15:07 | 000,013,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshta.exe

[2013.12.30 06:13:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight

[2013.12.30 06:02:35 | 000,294,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\browserchoice.exe

[2013.12.30 05:56:43 | 000,081,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\imagehlp.dll

[2013.12.30 05:56:38 | 001,474,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll

[2013.12.30 05:56:29 | 000,230,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\portcls.sys

[2013.12.30 05:56:28 | 000,116,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\drmk.sys

[2013.12.30 05:56:26 | 001,447,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\lsasrv.dll

[2013.12.30 05:56:26 | 000,307,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll

[2013.12.30 05:56:26 | 000,135,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sspicli.dll

[2013.12.30 05:56:26 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sspisrv.dll

[2013.12.30 05:56:26 | 000,028,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\secur32.dll

[2013.12.30 05:56:11 | 000,142,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\poqexec.exe

[2013.12.30 05:56:11 | 000,123,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\poqexec.exe

[2013.12.30 05:56:10 | 000,404,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\gdi32.dll

[2013.12.30 05:53:21 | 000,150,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wshom.ocx

[2013.12.30 05:53:21 | 000,121,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wshom.ocx

[2013.12.30 05:53:20 | 000,202,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\scrrun.dll

[2013.12.30 05:53:20 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\scrrun.dll

[2013.12.30 05:53:20 | 000,156,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cscript.exe

[2013.12.30 05:53:20 | 000,126,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cscript.exe

[2013.12.30 05:53:19 | 000,830,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\nshwfp.dll

[2013.12.30 05:53:19 | 000,656,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\nshwfp.dll

[2013.12.30 05:53:19 | 000,324,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\FWPUCLNT.DLL

[2013.12.30 05:53:19 | 000,216,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\FWPUCLNT.DLL

[2013.12.30 05:49:26 | 002,622,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wucltux.dll

[2013.12.30 05:49:26 | 000,057,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuauclt.exe

[2013.12.30 05:49:26 | 000,044,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups2.dll

[2013.12.30 05:49:16 | 000,701,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapi.dll

[2013.12.30 05:49:16 | 000,099,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wudriver.dll

[2013.12.30 05:49:16 | 000,038,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups.dll

[2013.12.30 05:49:00 | 000,186,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuwebv.dll

[2013.12.30 05:49:00 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapp.exe

[2013.12.29 23:14:23 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Local\Diagnostics

[2013.12.29 23:11:52 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Local\ElevatedDiagnostics

[2013.12.29 22:42:51 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Local\MigWiz

[2013.12.29 22:28:36 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight

[2013.12.29 22:28:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight

[2013.12.29 22:25:11 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\MRT

[2013.12.29 22:05:42 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Roaming\WinRAR

[2013.12.29 21:28:00 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Local\PunkBuster

[2013.12.29 21:06:28 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\Documents\Battlefield 4

[2013.12.29 20:34:41 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Local\Razer

[2013.12.29 20:26:33 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Local\Abelssoft

[2013.12.29 20:26:30 | 000,000,000 | ---D | C] -- C:\Program Files\CheckDrive

[2013.12.29 20:15:18 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Local\ESN

[2013.12.29 16:14:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Steam

[2013.12.29 16:04:50 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\Common Files\EAInstaller

[2013.12.29 16:04:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Battlelog Web Plugins

[2013.12.29 16:02:27 | 000,527,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_7.dll

[2013.12.29 16:02:27 | 000,518,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_7.dll

[2013.12.29 16:02:27 | 000,239,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_7.dll

[2013.12.29 16:02:27 | 000,176,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_7.dll

[2013.12.29 16:02:27 | 000,077,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_5.dll

[2013.12.29 16:02:27 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_5.dll

[2013.12.29 16:02:26 | 002,526,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_43.dll

[2013.12.29 16:02:26 | 002,106,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_43.dll

[2013.12.29 16:02:26 | 001,907,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dcsx_43.dll

[2013.12.29 16:02:26 | 001,868,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dcsx_43.dll

[2013.12.29 16:02:26 | 000,511,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_43.dll

[2013.12.29 16:02:26 | 000,470,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_43.dll

[2013.12.29 16:02:26 | 000,276,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx11_43.dll

[2013.12.29 16:02:26 | 000,248,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx11_43.dll

[2013.12.29 16:02:25 | 002,401,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_43.dll

[2013.12.29 16:02:25 | 001,998,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_43.dll

[2013.12.29 16:02:25 | 000,530,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_6.dll

[2013.12.29 16:02:25 | 000,528,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_6.dll

[2013.12.29 16:02:25 | 000,078,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_4.dll

[2013.12.29 16:02:25 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_4.dll

[2013.12.29 16:02:24 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_6.dll

[2013.12.29 16:02:24 | 000,176,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_6.dll

[2013.12.29 16:02:24 | 000,024,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_7.dll

[2013.12.29 16:02:24 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_7.dll

[2013.12.29 16:02:22 | 000,517,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_5.dll

[2013.12.29 16:02:22 | 000,515,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_5.dll

[2013.12.29 16:02:21 | 002,582,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_42.dll

[2013.12.29 16:02:21 | 001,974,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_42.dll

[2013.12.29 16:02:21 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_5.dll

[2013.12.29 16:02:21 | 000,176,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_5.dll

[2013.12.29 16:02:20 | 005,554,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dcsx_42.dll

[2013.12.29 16:02:20 | 005,501,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dcsx_42.dll

[2013.12.29 16:02:20 | 000,285,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx11_42.dll

[2013.12.29 16:02:20 | 000,235,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx11_42.dll

[2013.12.29 16:02:19 | 002,475,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_42.dll

[2013.12.29 16:02:19 | 002,430,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_41.dll

[2013.12.29 16:02:19 | 001,892,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_42.dll

[2013.12.29 16:02:19 | 001,846,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_41.dll

[2013.12.29 16:02:19 | 000,523,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_42.dll

[2013.12.29 16:02:19 | 000,520,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_41.dll

[2013.12.29 16:02:19 | 000,453,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_42.dll

[2013.12.29 16:02:19 | 000,453,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_41.dll

[2013.12.29 16:02:18 | 005,425,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_41.dll

[2013.12.29 16:02:18 | 004,178,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_41.dll

[2013.12.29 16:02:18 | 000,521,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_4.dll

[2013.12.29 16:02:18 | 000,517,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_4.dll

[2013.12.29 16:02:18 | 000,073,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_3.dll

[2013.12.29 16:02:18 | 000,069,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_3.dll

[2013.12.29 16:02:17 | 002,605,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_40.dll

[2013.12.29 16:02:17 | 002,036,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_40.dll

[2013.12.29 16:02:17 | 000,519,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_40.dll

[2013.12.29 16:02:17 | 000,452,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_40.dll

[2013.12.29 16:02:17 | 000,235,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_4.dll

[2013.12.29 16:02:17 | 000,174,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_4.dll

[2013.12.29 16:02:17 | 000,024,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_6.dll

[2013.12.29 16:02:17 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_6.dll

[2013.12.29 16:02:16 | 005,631,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_40.dll

[2013.12.29 16:02:16 | 004,379,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_40.dll

[2013.12.29 16:02:15 | 000,518,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_3.dll

[2013.12.29 16:02:15 | 000,514,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_3.dll

[2013.12.29 16:02:15 | 000,074,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_2.dll

[2013.12.29 16:02:15 | 000,070,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_2.dll

[2013.12.29 16:02:14 | 000,513,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_2.dll

[2013.12.29 16:02:14 | 000,509,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_2.dll

[2013.12.29 16:02:14 | 000,235,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_3.dll

[2013.12.29 16:02:14 | 000,175,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_3.dll

[2013.12.29 16:02:14 | 000,072,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_1.dll

[2013.12.29 16:02:14 | 000,068,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_1.dll

[2013.12.29 16:02:14 | 000,025,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_5.dll

[2013.12.29 16:02:14 | 000,023,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_5.dll

[2013.12.29 16:02:13 | 004,992,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_39.dll

[2013.12.29 16:02:13 | 003,851,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_39.dll

[2013.12.29 16:02:13 | 001,942,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_39.dll

[2013.12.29 16:02:13 | 001,493,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_39.dll

[2013.12.29 16:02:13 | 000,540,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_39.dll

[2013.12.29 16:02:13 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_39.dll

[2013.12.29 16:02:13 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_2.dll

[2013.12.29 16:02:13 | 000,177,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_2.dll

[2013.12.29 16:02:12 | 001,941,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_38.dll

[2013.12.29 16:02:12 | 001,491,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_38.dll

[2013.12.29 16:02:12 | 000,540,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_38.dll

[2013.12.29 16:02:12 | 000,511,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_1.dll

[2013.12.29 16:02:12 | 000,507,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_1.dll

[2013.12.29 16:02:12 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_38.dll

[2013.12.29 16:02:12 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_1.dll

[2013.12.29 16:02:12 | 000,177,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_1.dll

[2013.12.29 16:02:12 | 000,068,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_0.dll

[2013.12.29 16:02:12 | 000,065,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_0.dll

[2013.12.29 16:02:12 | 000,028,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_4.dll

[2013.12.29 16:02:12 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_4.dll

[2013.12.29 16:02:11 | 004,991,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_38.dll

[2013.12.29 16:02:11 | 003,850,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_38.dll

[2013.12.29 16:02:11 | 000,489,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_0.dll

[2013.12.29 16:02:11 | 000,479,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_0.dll

[2013.12.29 16:02:11 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_0.dll

[2013.12.29 16:02:11 | 000,177,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_0.dll

[2013.12.29 16:02:11 | 000,028,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_3.dll

[2013.12.29 16:02:11 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_3.dll

[2013.12.29 16:02:10 | 004,910,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_37.dll

[2013.12.29 16:02:10 | 003,786,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_37.dll

[2013.12.29 16:02:10 | 001,860,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_37.dll

[2013.12.29 16:02:10 | 001,420,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_37.dll

[2013.12.29 16:02:10 | 000,529,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_37.dll

[2013.12.29 16:02:10 | 000,462,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_37.dll

[2013.12.29 16:02:10 | 000,411,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_10.dll

[2013.12.29 16:02:10 | 000,267,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_10.dll

[2013.12.29 16:02:09 | 005,081,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_36.dll

[2013.12.29 16:02:09 | 003,734,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_36.dll

[2013.12.29 16:02:09 | 002,006,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_36.dll

[2013.12.29 16:02:09 | 001,374,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_36.dll

[2013.12.29 16:02:09 | 000,508,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_36.dll

[2013.12.29 16:02:09 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_36.dll

[2013.12.29 16:02:08 | 000,411,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_9.dll

[2013.12.29 16:02:08 | 000,267,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_9.dll

[2013.12.29 16:02:07 | 005,073,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_35.dll

[2013.12.29 16:02:07 | 003,727,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_35.dll

[2013.12.29 16:02:07 | 001,985,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_35.dll

[2013.12.29 16:02:07 | 001,358,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_35.dll

[2013.12.29 16:02:07 | 000,508,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_35.dll

[2013.12.29 16:02:07 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_35.dll

[2013.12.29 16:02:07 | 000,409,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_8.dll

[2013.12.29 16:02:07 | 000,266,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_8.dll

[2013.12.29 16:02:07 | 000,021,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_2.dll

[2013.12.29 16:02:07 | 000,017,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_2.dll

[2013.12.29 16:02:06 | 004,496,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_34.dll

[2013.12.29 16:02:06 | 003,497,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_34.dll

[2013.12.29 16:02:06 | 001,401,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_34.dll

[2013.12.29 16:02:06 | 001,124,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_34.dll

[2013.12.29 16:02:06 | 000,506,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_34.dll

[2013.12.29 16:02:06 | 000,443,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_34.dll

[2013.12.29 16:02:06 | 000,107,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xinput1_3.dll

[2013.12.29 16:02:06 | 000,081,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xinput1_3.dll

[2013.12.29 16:02:04 | 004,494,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_33.dll

[2013.12.29 16:02:04 | 003,495,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_33.dll

[2013.12.29 16:02:04 | 001,400,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_33.dll

[2013.12.29 16:02:04 | 001,123,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_33.dll

[2013.12.29 16:02:04 | 000,506,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_33.dll

[2013.12.29 16:02:04 | 000,443,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_33.dll

[2013.12.29 16:02:04 | 000,403,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_7.dll

[2013.12.29 16:02:04 | 000,261,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_7.dll

[2013.12.29 16:02:02 | 000,393,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_6.dll

[2013.12.29 16:02:02 | 000,390,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_5.dll

[2013.12.29 16:02:02 | 000,255,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_6.dll

[2013.12.29 16:02:02 | 000,251,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_5.dll

[2013.12.29 16:02:01 | 004,398,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_32.dll

[2013.12.29 16:02:01 | 003,426,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_32.dll

[2013.12.29 16:02:01 | 000,469,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10.dll

[2013.12.29 16:02:01 | 000,440,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10.dll

[2013.12.29 16:02:00 | 003,977,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_31.dll

[2013.12.29 16:02:00 | 002,414,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_31.dll

[2013.12.29 16:02:00 | 000,364,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_4.dll

[2013.12.29 16:02:00 | 000,363,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_3.dll

[2013.12.29 16:02:00 | 000,237,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_4.dll

[2013.12.29 16:02:00 | 000,236,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_3.dll

[2013.12.29 16:02:00 | 000,083,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xinput1_2.dll

[2013.12.29 16:02:00 | 000,062,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xinput1_2.dll

[2013.12.29 16:02:00 | 000,017,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\x3daudio1_1.dll

[2013.12.29 16:02:00 | 000,015,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\x3daudio1_1.dll

[2013.12.29 16:01:59 | 000,354,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_2.dll

[2013.12.29 16:01:59 | 000,230,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_2.dll

[2013.12.29 16:01:59 | 000,083,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xinput1_1.dll

[2013.12.29 16:01:59 | 000,062,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xinput1_1.dll

[2013.12.29 16:01:58 | 000,352,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_1.dll

[2013.12.29 16:01:58 | 000,229,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_1.dll

[2013.12.29 16:01:56 | 003,927,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_30.dll

[2013.12.29 16:01:56 | 002,388,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_30.dll

[2013.12.29 16:01:55 | 003,830,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_29.dll

[2013.12.29 16:01:55 | 003,815,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_28.dll

[2013.12.29 16:01:55 | 002,332,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_29.dll

[2013.12.29 16:01:55 | 002,323,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_28.dll

[2013.12.29 16:01:55 | 000,355,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_0.dll

[2013.12.29 16:01:55 | 000,230,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_0.dll

[2013.12.29 16:01:55 | 000,016,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\x3daudio1_0.dll

[2013.12.29 16:01:55 | 000,014,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\x3daudio1_0.dll

[2013.12.29 16:01:54 | 003,823,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_25.dll

[2013.12.29 16:01:54 | 003,807,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_27.dll

[2013.12.29 16:01:54 | 003,767,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_26.dll

[2013.12.29 16:01:54 | 002,337,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_25.dll

[2013.12.29 16:01:54 | 002,319,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_27.dll

[2013.12.29 16:01:54 | 002,297,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_26.dll

[2013.12.29 16:01:53 | 003,544,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_24.dll

[2013.12.29 16:01:53 | 002,222,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_24.dll

[2013.12.29 15:30:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite

[2013.12.29 15:29:58 | 000,283,064 | ---- | C] (Disc Soft Ltd) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys

[2013.12.29 15:29:56 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Roaming\DAEMON Tools Lite

[2013.12.29 15:29:53 | 000,000,000 | ---D | C] -- C:\Program Files\DAEMON Tools Lite

[2013.12.29 15:28:39 | 000,000,000 | ---D | C] -- C:\ProgramData\DAEMON Tools Lite

[2013.12.29 14:23:19 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Local\Programs

[2013.12.29 13:11:02 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Roaming\Yahoo!

[2013.12.29 13:10:40 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Roaming\Macromedia

[2013.12.29 13:09:49 | 000,419,488 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe

[2013.12.29 13:09:49 | 000,070,304 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

[2013.12.29 13:09:49 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Macromed

[2013.12.29 13:09:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Yahoo! Messenger

[2013.12.29 13:09:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Yahoo!

[2013.12.29 13:09:32 | 000,000,000 | ---D | C] -- C:\Program Files\Messenger

[2013.12.29 13:07:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Yahoo!

[2013.12.29 13:05:58 | 000,000,000 | -HSD | C] -- C:\Config.Msi

[2013.12.29 13:05:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Razer

[2013.12.29 13:02:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Razer

[2013.12.29 13:02:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Razer

[2013.12.29 13:02:50 | 000,000,000 | ---D | C] -- C:\Program Files\Razer

[2013.12.29 12:57:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client

[2013.12.29 12:57:30 | 000,000,000 | ---D | C] -- C:\Program Files\TeamSpeak 3 Client

[2013.12.29 12:51:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

[2013.12.29 12:49:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google

[2013.12.29 12:49:47 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Local\Google

[2013.12.29 12:49:33 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Local\Deployment

[2013.12.29 12:49:33 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Local\Apps

[2013.12.29 12:32:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam

[2013.12.29 12:30:42 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Local\AMD

[2013.12.29 12:30:18 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Roaming\ATI

[2013.12.29 12:30:18 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Local\ATI

[2013.12.29 12:30:18 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI

[2013.12.29 12:23:32 | 002,738,264 | ---- | C] (Sysinternals - www.sysinternals.com) -- C:\Users\Raubtier\Desktop\Process Explorer.exe

[2013.12.29 12:22:44 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Roaming\Origin

[2013.12.29 12:22:43 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Local\Origin

[2013.12.29 12:21:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Steam

[2013.12.29 12:21:54 | 000,000,000 | ---D | C] -- C:\Program Files\Steam

[2013.12.29 12:21:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Origin

[2013.12.29 12:21:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin

[2013.12.29 12:21:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Electronic Arts

[2013.12.29 12:20:50 | 000,000,000 | ---D | C] -- C:\Program Files\Origin

[2013.12.29 12:19:38 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR

[2013.12.29 12:19:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR

[2013.12.29 12:18:52 | 000,000,000 | ---D | C] -- C:\ProgrammeVirtualCloneDrive

[2013.12.29 12:18:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Elaborate Bytes

[2013.12.29 12:18:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN

[2013.12.29 12:18:22 | 000,000,000 | ---D | C] -- C:\Program Files\VLC

[2013.12.29 12:17:51 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR

[2013.12.29 12:13:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD APP

[2013.12.29 12:13:41 | 000,056,448 | ---- | C] (Advanced Micro Devices) -- C:\Windows\SysNative\drivers\usbfilter.sys

[2013.12.29 12:13:40 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\DRVSTORE

[2013.12.29 12:12:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Security Client

[2013.12.29 12:12:46 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client

[2013.12.29 12:08:20 | 000,646,248 | ---- | C] (Realtek                                            ) -- C:\Windows\SysNative\drivers\Rt64win7.sys

[2013.12.29 12:08:20 | 000,107,552 | ---- | C] (Realtek Semiconductor Corporation) -- C:\Windows\SysNative\RTNUninst64.dll

[2013.12.29 12:07:38 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\RTCOM

[2013.12.29 12:07:38 | 000,000,000 | ---D | C] -- C:\Program Files\Realtek

[2013.12.29 12:07:30 | 007,163,744 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EEP64H.dll

[2013.12.29 12:07:30 | 003,746,408 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtkHDM64.dll

[2013.12.29 12:07:30 | 002,526,824 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RHDMEx64.dll

[2013.12.29 12:07:30 | 000,433,504 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EED64H.dll

[2013.12.29 12:07:30 | 000,372,056 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEP64H.dll

[2013.12.29 12:07:30 | 000,310,104 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RH3DHT64.dll

[2013.12.29 12:07:30 | 000,310,104 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RH3DAA64.dll

[2013.12.29 12:07:30 | 000,237,968 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\drivers\RtHDMIVX.sys

[2013.12.29 12:07:30 | 000,204,120 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEED64H.dll

[2013.12.29 12:07:30 | 000,141,152 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EEL64H.dll

[2013.12.29 12:07:30 | 000,123,744 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EEA64H.dll

[2013.12.29 12:07:30 | 000,097,624 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEL64H.dll

[2013.12.29 12:07:30 | 000,092,264 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RHCoInst64.dll

[2013.12.29 12:07:30 | 000,078,680 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEG64H.dll

[2013.12.29 12:07:30 | 000,074,592 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EEG64H.dll

[2013.12.29 12:07:29 | 003,615,888 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtkAPO64.dll

[2013.12.29 12:07:29 | 002,674,320 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtPgEx64.dll

[2013.12.29 12:07:29 | 002,605,400 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\WavesGUILib.dll

[2013.12.29 12:07:29 | 001,560,168 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RTSnMg64.cpl

[2013.12.29 12:07:29 | 000,869,520 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtkApi64.dll

[2013.12.29 12:07:29 | 000,518,896 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSX64.dll

[2013.12.29 12:07:29 | 000,375,128 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEP64A.dll

[2013.12.29 12:07:29 | 000,331,880 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtlCPAPI64.dll

[2013.12.29 12:07:29 | 000,211,184 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSH64.dll

[2013.12.29 12:07:29 | 000,198,896 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSHP64.dll

[2013.12.29 12:07:29 | 000,155,888 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSWOW64.dll

[2013.12.29 12:07:29 | 000,149,608 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtkCfg64.dll

[2013.12.29 12:07:29 | 000,014,952 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtkCoLDR64.dll

[2013.12.29 12:07:28 | 002,533,952 | ---- | C] (Fortemedia Corporation) -- C:\Windows\SysNative\FMAPO64.dll

[2013.12.29 12:07:28 | 002,131,288 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioEQ.dll

[2013.12.29 12:07:28 | 001,262,696 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RTCOM64.dll

[2013.12.29 12:07:28 | 001,015,640 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPOShell64.dll

[2013.12.29 12:07:28 | 000,897,152 | ---- | C] (Creative Technology Ltd.) -- C:\Windows\SysNative\MBAPO64.dll

[2013.12.29 12:07:28 | 000,753,280 | ---- | C] (Creative Technology Ltd.) -- C:\Windows\SysWow64\MBAPO32.dll

[2013.12.29 12:07:28 | 000,318,808 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPO20.dll

[2013.12.29 12:07:28 | 000,310,104 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DHT64.dll

[2013.12.29 12:07:28 | 000,310,104 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DAA64.dll

[2013.12.29 12:07:28 | 000,204,120 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEED64A.dll

[2013.12.29 12:07:28 | 000,105,616 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RCoInstII64.dll

[2013.12.29 12:07:28 | 000,101,208 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEL64A.dll

[2013.12.29 12:07:28 | 000,083,072 | ---- | C] (Creative Technology Ltd.) -- C:\Windows\SysNative\MBWrp64.dll

[2013.12.29 12:07:28 | 000,078,680 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEG64A.dll

[2013.12.29 12:07:28 | 000,065,112 | ---- | C] (Creative Technology Ltd.) -- C:\Windows\SysNative\MBppld64.dll

[2013.12.29 12:07:28 | 000,060,504 | ---- | C] (Creative Technology Ltd.) -- C:\Windows\SysNative\MBPPCn64.dll

[2013.12.29 12:07:27 | 000,202,336 | ---- | C] (Andrea Electronics Corporation) -- C:\Windows\SysNative\AERTAC64.dll

[2013.12.29 12:07:27 | 000,108,640 | ---- | C] (Andrea Electronics Corporation) -- C:\Windows\SysNative\AERTAR64.dll

[2013.12.29 12:07:27 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\InstallShield Installation Information

[2013.12.29 12:07:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Realtek

[2013.12.29 12:07:24 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\Temp

[2013.12.29 12:07:23 | 001,706,640 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\RtlExUpd.dll

[2013.12.29 12:07:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\InstallShield

[2013.12.29 12:07:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD AVT

[2013.12.29 12:07:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\ATI Technologies

[2013.12.29 12:06:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center

[2013.12.29 12:06:07 | 000,000,000 | ---D | C] -- C:\ProgramData\AMD

[2013.12.29 12:05:32 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ATI Technologies

[2013.12.29 12:03:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Package Cache

[2013.12.29 12:03:20 | 000,000,000 | ---D | C] -- C:\Program Files\ATI

[2013.12.29 12:02:34 | 000,000,000 | ---D | C] -- C:\Program Files\AMD

[2013.12.29 11:58:57 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Roaming\Adobe

[2013.12.29 11:58:56 | 000,000,000 | R--D | C] -- C:\Users\Raubtier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

[2013.12.29 11:58:56 | 000,000,000 | R--D | C] -- C:\Users\Raubtier\Searches

[2013.12.29 11:58:56 | 000,000,000 | R--D | C] -- C:\Users\Raubtier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

[2013.12.29 11:58:45 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Roaming\Identities

[2013.12.29 11:58:43 | 000,000,000 | R--D | C] -- C:\Users\Raubtier\Contacts

[2013.12.29 11:58:41 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Local\VirtualStore

[2013.12.29 11:58:32 | 000,000,000 | -HSD | C] -- C:\Users\Raubtier\Vorlagen

[2013.12.29 11:58:32 | 000,000,000 | -HSD | C] -- C:\Users\Raubtier\AppData\Local\Verlauf

[2013.12.29 11:58:32 | 000,000,000 | -HSD | C] -- C:\Users\Raubtier\AppData\Local\Temporary Internet Files

[2013.12.29 11:58:32 | 000,000,000 | -HSD | C] -- C:\Users\Raubtier\Startmenü

[2013.12.29 11:58:32 | 000,000,000 | -HSD | C] -- C:\Users\Raubtier\SendTo

[2013.12.29 11:58:32 | 000,000,000 | -HSD | C] -- C:\Users\Raubtier\Recent

[2013.12.29 11:58:32 | 000,000,000 | -HSD | C] -- C:\Users\Raubtier\Netzwerkumgebung

[2013.12.29 11:58:32 | 000,000,000 | -HSD | C] -- C:\Users\Raubtier\Lokale Einstellungen

[2013.12.29 11:58:32 | 000,000,000 | -HSD | C] -- C:\Users\Raubtier\Documents\Eigene Videos

[2013.12.29 11:58:32 | 000,000,000 | -HSD | C] -- C:\Users\Raubtier\Documents\Eigene Musik

[2013.12.29 11:58:32 | 000,000,000 | -HSD | C] -- C:\Users\Raubtier\Eigene Dateien

[2013.12.29 11:58:32 | 000,000,000 | -HSD | C] -- C:\Users\Raubtier\Documents\Eigene Bilder

[2013.12.29 11:58:32 | 000,000,000 | -HSD | C] -- C:\Users\Raubtier\Druckumgebung

[2013.12.29 11:58:32 | 000,000,000 | -HSD | C] -- C:\Users\Raubtier\Cookies

[2013.12.29 11:58:32 | 000,000,000 | -HSD | C] -- C:\Users\Raubtier\AppData\Local\Anwendungsdaten

[2013.12.29 11:58:32 | 000,000,000 | -HSD | C] -- C:\Users\Raubtier\Anwendungsdaten

[2013.12.29 11:58:31 | 000,000,000 | --SD | C] -- C:\Users\Raubtier\AppData\Roaming\Microsoft

[2013.12.29 11:58:31 | 000,000,000 | R--D | C] -- C:\Users\Raubtier\Videos

[2013.12.29 11:58:31 | 000,000,000 | R--D | C] -- C:\Users\Raubtier\Saved Games

[2013.12.29 11:58:31 | 000,000,000 | R--D | C] -- C:\Users\Raubtier\Pictures

[2013.12.29 11:58:31 | 000,000,000 | R--D | C] -- C:\Users\Raubtier\Music

[2013.12.29 11:58:31 | 000,000,000 | R--D | C] -- C:\Users\Raubtier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

[2013.12.29 11:58:31 | 000,000,000 | R--D | C] -- C:\Users\Raubtier\Links

[2013.12.29 11:58:31 | 000,000,000 | R--D | C] -- C:\Users\Raubtier\Favorites

[2013.12.29 11:58:31 | 000,000,000 | R--D | C] -- C:\Users\Raubtier\Downloads

[2013.12.29 11:58:31 | 000,000,000 | R--D | C] -- C:\Users\Raubtier\Documents

[2013.12.29 11:58:31 | 000,000,000 | R--D | C] -- C:\Users\Raubtier\Desktop

[2013.12.29 11:58:31 | 000,000,000 | R--D | C] -- C:\Users\Raubtier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

[2013.12.29 11:58:31 | 000,000,000 | -H-D | C] -- C:\Users\Raubtier\AppData

[2013.12.29 11:58:31 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Local\Temp

[2013.12.29 11:58:31 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Local\Microsoft

[2013.12.29 11:58:31 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Roaming\Media Center Programs

[2013.12.29 11:58:25 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen

[2013.12.29 11:58:25 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü

[2013.12.29 11:58:25 | 000,000,000 | -HSD | C] -- C:\Recovery

[2013.12.29 11:58:25 | 000,000,000 | -HSD | C] -- C:\Programme

[2013.12.29 11:58:25 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien

[2013.12.29 11:58:25 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten

[2013.12.29 11:58:25 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos

[2013.12.29 11:58:25 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik

[2013.12.29 11:58:25 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder

[2013.12.29 11:58:25 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen

[2013.12.29 11:58:25 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente

[2013.12.29 11:58:25 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten

[2013.12.29 11:48:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET

[2013.12.29 11:47:30 | 000,000,000 | -HSD | C] -- C:\Windows\Installer

[2013.12.29 11:43:36 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution

[2013.12.29 11:41:25 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch

[2013.12.29 11:40:41 | 000,000,000 | -HSD | C] -- C:\System Volume Information

[2013.12.29 11:39:47 | 000,000,000 | ---D | C] -- C:\Windows\Panther

[2013.12.29 11:39:32 | 000,000,000 | -HSD | C] -- C:\Boot

[2013.12.29 11:17:37 | 008,287,008 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atiumdva.dll

[2013.12.29 11:17:37 | 000,143,304 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atiuxp64.dll

[2013.12.29 11:17:37 | 000,129,536 | ---- | C] (AMD) -- C:\Windows\SysNative\coinst_13.251.dll

[2013.12.29 11:17:37 | 000,126,336 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atiuxpag.dll

[2013.12.29 11:17:37 | 000,110,080 | ---- | C] (TODO: <Company name>) -- C:\Windows\SysNative\DelayAPO.dll

[2013.12.29 11:17:37 | 000,099,840 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysNative\OpenVideo64.dll

[2013.12.29 11:17:37 | 000,094,208 | ---- | C] (Advanced Micro Devices) -- C:\Windows\SysNative\drivers\AtihdW76.sys

[2013.12.29 11:17:37 | 000,086,528 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysNative\OVDecode64.dll

[2013.12.29 11:17:37 | 000,083,968 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysWow64\OpenVideo.dll

[2013.12.29 11:17:37 | 000,073,728 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysWow64\OVDecode.dll

[2013.12.29 11:17:36 | 022,157,824 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysWow64\atioglxx.dll

[2013.12.29 11:17:36 | 008,927,704 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atiumd6a.dll

[2013.12.29 11:17:36 | 007,751,920 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atiumd64.dll

[2013.12.29 11:17:36 | 006,630,232 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atiumdag.dll

[2013.12.29 11:17:36 | 000,190,976 | ---- | C] (AMD) -- C:\Windows\SysNative\atitmm64.dll

[2013.12.29 11:17:36 | 000,115,512 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atiu9p64.dll

[2013.12.29 11:17:36 | 000,098,496 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atiu9pag.dll

[2013.12.29 11:17:35 | 026,352,128 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\atio6axx.dll

[2013.12.29 11:17:35 | 013,207,552 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\drivers\atikmdag.sys

[2013.12.29 11:17:35 | 009,753,752 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atidxx64.dll

[2013.12.29 11:17:35 | 008,406,024 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atidxx32.dll

[2013.12.29 11:17:35 | 001,318,552 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\aticfx64.dll

[2013.12.29 11:17:35 | 001,100,216 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\aticfx32.dll

[2013.12.29 11:17:35 | 000,626,176 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\drivers\atikmpag.sys

[2013.12.29 11:17:35 | 000,588,288 | ---- | C] (AMD) -- C:\Windows\SysNative\atieclxx.exe

[2013.12.29 11:17:35 | 000,442,368 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\atidemgy.dll

[2013.12.29 11:17:35 | 000,332,800 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\ATIODE.exe

[2013.12.29 11:17:35 | 000,239,616 | ---- | C] (AMD) -- C:\Windows\SysNative\atiesrxx.exe

[2013.12.29 11:17:35 | 000,100,352 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atig6txx.dll

[2013.12.29 11:17:35 | 000,096,768 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atigktxx.dll

[2013.12.29 11:17:35 | 000,078,432 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atimpc64.dll

[2013.12.29 11:17:35 | 000,078,432 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\amdpcom64.dll

[2013.12.29 11:17:35 | 000,074,752 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atig6pxx.dll

[2013.12.29 11:17:35 | 000,071,704 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atimpc32.dll

[2013.12.29 11:17:35 | 000,071,704 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\amdpcom32.dll

[2013.12.29 11:17:35 | 000,069,632 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atiglpxx.dll

[2013.12.29 11:17:35 | 000,069,632 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atiglpxx.dll

[2013.12.29 11:17:35 | 000,062,464 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysNative\aticalrt64.dll

[2013.12.29 11:17:35 | 000,052,224 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysWow64\aticalrt.dll

[2013.12.29 11:17:35 | 000,051,200 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\ATIODCLI.exe

[2013.12.29 11:17:35 | 000,031,232 | ---- | C] (AMD) -- C:\Windows\SysNative\atimuixx.dll

[2013.12.29 11:17:34 | 015,716,352 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysNative\aticaldd64.dll

[2013.12.29 11:17:34 | 014,302,208 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysWow64\aticaldd.dll

[2013.12.29 11:17:34 | 001,144,320 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\atiadlxx.dll

[2013.12.29 11:17:34 | 000,825,344 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysWow64\atiadlxy.dll

[2013.12.29 11:17:34 | 000,368,640 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\atiapfxx.exe

[2013.12.29 11:17:34 | 000,118,784 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\atibtmon.exe

[2013.12.29 11:17:34 | 000,063,488 | ---- | C] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll

[2013.12.29 11:17:34 | 000,057,344 | ---- | C] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll

[2013.12.29 11:17:34 | 000,055,808 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysNative\aticalcl64.dll

[2013.12.29 11:17:34 | 000,049,152 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysWow64\aticalcl.dll

[2013.12.29 11:17:34 | 000,043,520 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\drivers\ati2erec.dll

[2013.12.29 11:17:32 | 029,382,144 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysNative\amdocl64.dll

[2013.12.29 11:17:31 | 024,860,160 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysWow64\amdocl.dll

 
 ========== Files - Modified Within 30 Days ==========

 

[2014.01.11 01:23:18 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Raubtier\Desktop\OTL.exe

[2014.01.11 01:21:20 | 000,001,114 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2014.01.11 01:09:26 | 000,026,352 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2014.01.11 01:09:26 | 000,026,352 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2014.01.11 01:06:29 | 001,618,320 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2014.01.11 01:06:29 | 000,698,688 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2014.01.11 01:06:29 | 000,653,526 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2014.01.11 01:06:29 | 000,148,828 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2014.01.11 01:06:29 | 000,121,398 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2014.01.11 01:02:27 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2014.01.11 01:02:09 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2014.01.11 01:02:05 | 2132,877,311 | -HS- | M] () -- C:\hiberfil.sys

[2014.01.11 00:58:39 | 000,007,603 | ---- | M] () -- C:\Users\Raubtier\AppData\Local\Resmon.ResmonCfg

[2014.01.11 00:52:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2014.01.10 22:04:59 | 000,791,552 | ---- | M] (AMD) -- C:\Users\Raubtier\Desktop\amddriverdownloader.exe

[2014.01.10 21:38:42 | 001,994,222 | ---- | M] () -- C:\Users\Raubtier\Desktop\cpu-z-168.zip

[2014.01.07 12:50:35 | 001,245,168 | ---- | M] (Microsoft Corporation) -- C:\Users\Raubtier\Desktop\wlsetup-web.exe

[2014.01.07 00:57:49 | 000,001,682 | ---- | M] () -- C:\Users\Raubtier\Desktop\Usenet.nl.lnk

[2014.01.07 00:57:16 | 007,457,256 | ---- | M] (                                                            ) -- C:\Users\Raubtier\Desktop\UsenetNLSetup.exe

[2014.01.03 21:18:44 | 000,000,914 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2014.01.02 23:11:00 | 000,001,520 | ---- | M] () -- C:\Users\Raubtier\Desktop\TheBureau.lnk

[2014.01.02 23:10:26 | 000,001,045 | ---- | M] () -- C:\Users\Raubtier\Desktop\nba2k14.lnk

[2014.01.02 23:09:35 | 000,001,669 | ---- | M] () -- C:\Users\Raubtier\Desktop\BatmanOrigins.lnk

[2014.01.01 22:35:01 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_xusb21_01009.Wdf

[2014.01.01 22:17:52 | 000,214,392 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe

[2014.01.01 22:02:14 | 000,214,392 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0

[2014.01.01 21:17:58 | 000,002,699 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk

[2014.01.01 03:02:41 | 000,000,857 | ---- | M] () -- C:\Users\Raubtier\Desktop\Yahoo! Messenger.lnk

[2013.12.30 19:29:01 | 000,000,001 | ---- | M] () -- C:\Users\Raubtier\AppData\Local\llftool.4.30.agreement

[2013.12.30 06:21:50 | 001,591,896 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2013.12.30 06:15:14 | 000,940,032 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.exe

[2013.12.30 06:15:14 | 000,194,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\elshyph.dll

[2013.12.30 06:15:10 | 001,051,136 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmlmedia.dll

[2013.12.30 06:15:10 | 000,645,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\jsIntl.dll

[2013.12.30 06:15:10 | 000,616,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dat

[2013.12.30 06:15:10 | 000,337,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec

[2013.12.30 06:15:10 | 000,235,008 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\elshyph.dll

[2013.12.30 06:15:10 | 000,233,472 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll

[2013.12.30 06:15:10 | 000,164,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll

[2013.12.30 06:15:10 | 000,083,456 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\inseng.dll

[2013.12.30 06:15:10 | 000,071,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe

[2013.12.30 06:15:10 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\icardie.dll

[2013.12.30 06:15:10 | 000,062,464 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\tdc.ocx

[2013.12.30 06:15:10 | 000,061,952 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll

[2013.12.30 06:15:10 | 000,034,816 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll

[2013.12.30 06:15:10 | 000,032,768 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll

[2013.12.30 06:15:10 | 000,024,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll

[2013.12.30 06:15:10 | 000,016,284 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf

[2013.12.30 06:15:09 | 000,942,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jsIntl.dll

[2013.12.30 06:15:09 | 000,610,304 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll

[2013.12.30 06:15:09 | 000,151,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iexpress.exe

[2013.12.30 06:15:09 | 000,139,264 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\wextract.exe

[2013.12.30 06:15:09 | 000,127,488 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\occache.dll

[2013.12.30 06:15:09 | 000,116,736 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll

[2013.12.30 06:15:09 | 000,112,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe

[2013.12.30 06:15:09 | 000,111,616 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\IEAdvpack.dll

[2013.12.30 06:15:09 | 000,086,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll

[2013.12.30 06:15:09 | 000,074,240 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\SetIEInstalledDate.exe

[2013.12.30 06:15:09 | 000,069,632 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll

[2013.12.30 06:15:09 | 000,061,952 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\MshtmlDac.dll

[2013.12.30 06:15:09 | 000,056,832 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\pngfilt.dll

[2013.12.30 06:15:09 | 000,051,200 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieetwproxystub.dll

[2013.12.30 06:15:09 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmler.dll

[2013.12.30 06:15:09 | 000,012,800 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe

[2013.12.30 06:15:08 | 001,228,800 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmlmedia.dll

[2013.12.30 06:15:08 | 000,616,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dat

[2013.12.30 06:15:08 | 000,453,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll

[2013.12.30 06:15:08 | 000,413,696 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec

[2013.12.30 06:15:08 | 000,296,960 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dxtrans.dll

[2013.12.30 06:15:08 | 000,247,808 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msls31.dll

[2013.12.30 06:15:08 | 000,235,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll

[2013.12.30 06:15:08 | 000,195,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll

[2013.12.30 06:15:08 | 000,131,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\IEAdvpack.dll

[2013.12.30 06:15:08 | 000,105,984 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll

[2013.12.30 06:15:08 | 000,090,112 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\SetIEInstalledDate.exe

[2013.12.30 06:15:08 | 000,086,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe

[2013.12.30 06:15:08 | 000,081,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\icardie.dll

[2013.12.30 06:15:08 | 000,077,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\tdc.ocx

[2013.12.30 06:15:08 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmler.dll

[2013.12.30 06:15:08 | 000,040,448 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\JavaScriptCollectionAgent.dll

[2013.12.30 06:15:08 | 000,016,284 | ---- | M] () -- C:\Windows\SysNative\ieuinit.inf

[2013.12.30 06:15:08 | 000,013,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedssync.exe

[2013.12.30 06:15:07 | 000,774,144 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll

[2013.12.30 06:15:07 | 000,626,176 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll

[2013.12.30 06:15:07 | 000,548,352 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll

[2013.12.30 06:15:07 | 000,167,424 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iexpress.exe

[2013.12.30 06:15:07 | 000,147,968 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\occache.dll

[2013.12.30 06:15:07 | 000,143,872 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wextract.exe

[2013.12.30 06:15:07 | 000,135,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll

[2013.12.30 06:15:07 | 000,101,376 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\inseng.dll

[2013.12.30 06:15:07 | 000,084,992 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll

[2013.12.30 06:15:07 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\MshtmlDac.dll

[2013.12.30 06:15:07 | 000,062,464 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\pngfilt.dll

[2013.12.30 06:15:07 | 000,048,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\imgutil.dll

[2013.12.30 06:15:07 | 000,030,208 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\licmgr10.dll

[2013.12.30 06:15:07 | 000,013,824 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshta.exe

[2013.12.30 06:08:27 | 000,294,344 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2013.12.29 16:04:04 | 000,076,888 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrA.exe

[2013.12.29 15:29:58 | 000,283,064 | ---- | M] (Disc Soft Ltd) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys

[2013.12.29 13:09:49 | 000,419,488 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe

[2013.12.29 13:09:49 | 000,070,304 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

[2013.12.29 13:03:06 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_RzSynapse_01007.Wdf

[2013.12.29 12:57:34 | 000,000,909 | ---- | M] () -- C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk

[2013.12.29 12:29:22 | 000,000,000 | ---- | M] () -- C:\Windows\ativpsrm.bin

[2013.12.29 12:13:05 | 000,001,912 | ---- | M] () -- C:\Windows\epplauncher.mif

[2013.12.29 12:01:35 | 000,372,091 | RHS- | M] () -- C:\WOYBL

[2013.12.29 11:45:44 | 000,161,548 | ---- | M] () -- C:\Windows\SysWow64\license.rtf

[2013.12.29 11:45:44 | 000,161,548 | ---- | M] () -- C:\Windows\SysNative\license.rtf

[2013.12.29 11:39:34 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK

 
 ========== Files Created - No Company Name ==========

 

[2014.01.10 21:38:39 | 001,994,222 | ---- | C] () -- C:\Users\Raubtier\Desktop\cpu-z-168.zip

[2014.01.07 00:57:49 | 000,001,682 | ---- | C] () -- C:\Users\Raubtier\Desktop\Usenet.nl.lnk

[2014.01.07 00:57:10 | 007,457,256 | ---- | C] (                                                            ) -- C:\Users\Raubtier\Desktop\UsenetNLSetup.exe

[2014.01.03 21:18:44 | 000,000,914 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2014.01.02 23:11:00 | 000,001,520 | ---- | C] () -- C:\Users\Raubtier\Desktop\TheBureau.lnk

[2014.01.02 23:10:26 | 000,001,045 | ---- | C] () -- C:\Users\Raubtier\Desktop\nba2k14.lnk

[2014.01.02 23:09:35 | 000,001,669 | ---- | C] () -- C:\Users\Raubtier\Desktop\BatmanOrigins.lnk

[2014.01.01 22:35:01 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_xusb21_01009.Wdf

[2014.01.01 21:17:58 | 000,002,699 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk

[2014.01.01 03:02:41 | 000,000,857 | ---- | C] () -- C:\Users\Raubtier\Desktop\Yahoo! Messenger.lnk

[2013.12.30 23:09:13 | 000,007,603 | ---- | C] () -- C:\Users\Raubtier\AppData\Local\Resmon.ResmonCfg

[2013.12.30 19:29:01 | 000,000,001 | ---- | C] () -- C:\Users\Raubtier\AppData\Local\llftool.4.30.agreement

[2013.12.30 06:15:10 | 000,016,284 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf

[2013.12.30 06:15:08 | 000,016,284 | ---- | C] () -- C:\Windows\SysNative\ieuinit.inf

[2013.12.29 16:04:07 | 000,214,392 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe

[2013.12.29 16:04:07 | 000,214,392 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.ex0

[2013.12.29 16:04:04 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe

[2013.12.29 13:09:50 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2013.12.29 13:03:06 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_RzSynapse_01007.Wdf

[2013.12.29 12:57:34 | 000,000,909 | ---- | C] () -- C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk

[2013.12.29 12:49:54 | 000,001,114 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2013.12.29 12:49:53 | 000,001,110 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2013.12.29 12:29:22 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

[2013.12.29 12:13:05 | 000,001,912 | ---- | C] () -- C:\Windows\epplauncher.mif

[2013.12.29 12:13:01 | 000,002,117 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk

[2013.12.29 12:08:20 | 000,074,272 | ---- | C] () -- C:\Windows\SysNative\RtNicProp64.dll

[2013.12.29 12:07:28 | 000,293,889 | ---- | C] () -- C:\Windows\SysNative\drivers\RTAIODAT.DAT

[2013.12.29 12:01:34 | 000,372,091 | RHS- | C] () -- C:\WOYBL

[2013.12.29 11:58:57 | 000,001,421 | ---- | C] () -- C:\Users\Raubtier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

[2013.12.29 11:50:47 | 001,591,896 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2013.12.29 11:45:03 | 000,001,345 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk

[2013.12.29 11:44:49 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk

[2013.12.29 11:40:42 | 2132,877,311 | -HS- | C] () -- C:\hiberfil.sys

[2013.12.29 11:39:34 | 000,008,192 | RHS- | C] () -- C:\BOOTSECT.BAK

[2013.12.29 11:39:32 | 000,383,786 | RHS- | C] () -- C:\bootmgr

[2013.12.29 11:17:37 | 003,461,040 | ---- | C] () -- C:\Windows\SysWow64\atiumdva.cap

[2013.12.29 11:17:37 | 000,234,036 | ---- | C] () -- C:\Windows\SysNative\ativvaxy_cik.dat

[2013.12.29 11:17:37 | 000,233,776 | ---- | C] () -- C:\Windows\SysNative\ativvaxy_cik_nd.dat

[2013.12.29 11:17:37 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat

[2013.12.29 11:17:37 | 000,204,952 | ---- | C] () -- C:\Windows\SysNative\ativvsvl.dat

[2013.12.29 11:17:37 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat

[2013.12.29 11:17:37 | 000,157,144 | ---- | C] () -- C:\Windows\SysNative\ativvsva.dat

[2013.12.29 11:17:37 | 000,083,552 | ---- | C] () -- C:\Windows\SysNative\ativce02.dat

[2013.12.29 11:17:36 | 003,426,688 | ---- | C] () -- C:\Windows\SysNative\atiumd6a.cap

[2013.12.29 11:17:36 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat

[2013.12.29 11:17:36 | 000,003,917 | ---- | C] () -- C:\Windows\SysNative\atipblag.dat

[2013.12.29 11:17:35 | 000,721,296 | ---- | C] () -- C:\Windows\SysNative\atiicdxx.dat

[2013.12.29 11:17:35 | 000,047,887 | ---- | C] () -- C:\Windows\atiogl.xml

[2013.12.29 11:17:34 | 001,061,902 | ---- | C] () -- C:\Windows\SysNative\amdocl_ld64.exe

[2013.12.29 11:17:34 | 000,798,734 | ---- | C] () -- C:\Windows\SysWow64\amdocl_ld32.exe

[2013.12.29 11:17:34 | 000,550,456 | ---- | C] () -- C:\Windows\SysWow64\atiapfxx.blb

[2013.12.29 11:17:34 | 000,550,456 | ---- | C] () -- C:\Windows\SysNative\atiapfxx.blb

[2013.12.29 11:17:33 | 001,187,342 | ---- | C] () -- C:\Windows\SysNative\amdocl_as64.exe

[2013.12.29 11:17:33 | 000,995,342 | ---- | C] () -- C:\Windows\SysWow64\amdocl_as32.exe

[2013.12.06 16:44:26 | 000,038,912 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll

 
 ========== ZeroAccess Check ==========

 

[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

"" = C:\Windows\SysNative\shell32.dll -- [2013.10.10 02:11:05 | 014,172,672 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2013.10.10 02:11:05 | 012,872,704 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 04:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

 
 ========== LOP Check ==========

 

[2014.01.02 23:11:14 | 000,000,000 | ---D | M] -- C:\Users\Raubtier\AppData\Roaming\2K Sports

[2013.12.29 15:54:54 | 000,000,000 | ---D | M] -- C:\Users\Raubtier\AppData\Roaming\DAEMON Tools Lite

[2013.12.29 12:36:19 | 000,000,000 | ---D | M] -- C:\Users\Raubtier\AppData\Roaming\Origin

[2014.01.01 22:31:00 | 000,000,000 | ---D | M] -- C:\Users\Raubtier\AppData\Roaming\TS3Client

[2014.01.10 01:01:08 | 000,000,000 | ---D | M] -- C:\Users\Raubtier\AppData\Roaming\Usenet.nl

 
 ========== Purity Check ==========

 

 
 

< End of report >

Code:

GMER 2.1.19163 - hxxp://www.gmer.net

Rootkit scan 2014-01-11 13:32:17

Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 WDC_WD10EARS-67Y5B1 rev.80.00A80 931,51GB

Running: gmer_2.1.19163.exe; Driver: C:\Users\Raubtier\AppData\Local\Temp\fxddikog.sys
 
 

---- User code sections - GMER 2.1 ----
 

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                      0000000076da1360 5 bytes JMP 000000014a540460

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                               0000000076da13b0 5 bytes JMP 000000014a540450

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                               0000000076da1510 5 bytes JMP 000000014a540370

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                    0000000076da1560 5 bytes JMP 000000014a540470

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                          0000000076da1570 5 bytes JMP 000000014a5403e0

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                               0000000076da1620 5 bytes JMP 000000014a540320

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                        0000000076da1650 5 bytes JMP 000000014a5403b0

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                           0000000076da1670 5 bytes JMP 000000014a540390

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                 0000000076da16b0 5 bytes JMP 000000014a5402e0

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                               0000000076da1730 5 bytes JMP 000000014a5402d0

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                             0000000076da1750 5 bytes JMP 000000014a540310

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                              0000000076da1790 5 bytes JMP 000000014a5403c0

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                           0000000076da17e0 5 bytes JMP 000000014a5403f0

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                              0000000076da1940 5 bytes JMP 000000014a540230

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                   0000000076da1b00 5 bytes JMP 000000014a540480

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                  0000000076da1b30 5 bytes JMP 000000014a5403a0

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                           0000000076da1c10 5 bytes JMP 000000014a5402f0

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                        0000000076da1c20 5 bytes JMP 000000014a540350

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                              0000000076da1c80 5 bytes JMP 000000014a540290

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                           0000000076da1d10 5 bytes JMP 000000014a5402b0

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                            0000000076da1d30 5 bytes JMP 000000014a5403d0

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                               0000000076da1d40 5 bytes JMP 000000014a540330

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                        0000000076da1db0 5 bytes JMP 000000014a540410

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                           0000000076da1de0 5 bytes JMP 000000014a540240

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                0000000076da20a0 5 bytes JMP 000000014a5401e0

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                           0000000076da2160 5 bytes JMP 000000014a540250

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                           0000000076da2190 5 bytes JMP 000000014a540490

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                  0000000076da21a0 5 bytes JMP 000000014a5404a0

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                             0000000076da21d0 5 bytes JMP 000000014a540300

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                          0000000076da21e0 5 bytes JMP 000000014a540360

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                0000000076da2240 5 bytes JMP 000000014a5402a0

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                             0000000076da2290 5 bytes JMP 000000014a5402c0

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                0000000076da22c0 5 bytes JMP 000000014a540380

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                 0000000076da22d0 5 bytes JMP 000000014a540340

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                          0000000076da25c0 5 bytes JMP 000000014a540440

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                         0000000076da27c0 5 bytes JMP 000000014a540260

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                            0000000076da27d0 5 bytes JMP 000000014a540270

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                          0000000076da27e0 5 bytes JMP 000000014a540400

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                      0000000076da29a0 5 bytes JMP 000000014a5401f0

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                       0000000076da29b0 5 bytes JMP 000000014a540210

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                            0000000076da2a20 5 bytes JMP 000000014a540200

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                            0000000076da2a80 5 bytes JMP 000000014a540420

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                             0000000076da2a90 5 bytes JMP 000000014a540430

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                        0000000076da2aa0 5 bytes JMP 000000014a540220

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                0000000076da2b80 5 bytes JMP 000000014a540280

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                    0000000076da1360 5 bytes JMP 0000000076f00460

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                             0000000076da13b0 5 bytes JMP 0000000076f00450

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                             0000000076da1510 5 bytes JMP 0000000076f00370

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                  0000000076da1560 5 bytes JMP 0000000076f00470

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                        0000000076da1570 5 bytes JMP 0000000076f003e0

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                             0000000076da1620 5 bytes JMP 0000000076f00320

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                      0000000076da1650 5 bytes JMP 0000000076f003b0

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                         0000000076da1670 5 bytes JMP 0000000076f00390

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                               0000000076da16b0 5 bytes JMP 0000000076f002e0

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                             0000000076da1730 5 bytes JMP 0000000076f002d0

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                           0000000076da1750 5 bytes JMP 0000000076f00310

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                            0000000076da1790 5 bytes JMP 0000000076f003c0

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                         0000000076da17e0 5 bytes JMP 0000000076f003f0

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                            0000000076da1940 5 bytes JMP 0000000076f00230

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                 0000000076da1b00 5 bytes JMP 0000000076f00480

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                0000000076da1b30 5 bytes JMP 0000000076f003a0

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                         0000000076da1c10 5 bytes JMP 0000000076f002f0

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                      0000000076da1c20 5 bytes JMP 0000000076f00350

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                            0000000076da1c80 5 bytes JMP 0000000076f00290

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                         0000000076da1d10 5 bytes JMP 0000000076f002b0

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                          0000000076da1d30 5 bytes JMP 0000000076f003d0

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                             0000000076da1d40 5 bytes JMP 0000000076f00330

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                      0000000076da1db0 5 bytes JMP 0000000076f00410

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                         0000000076da1de0 5 bytes JMP 0000000076f00240

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                              0000000076da20a0 5 bytes JMP 0000000076f001e0

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                         0000000076da2160 5 bytes JMP 0000000076f00250

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                         0000000076da2190 5 bytes JMP 0000000076f00490

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                0000000076da21a0 5 bytes JMP 0000000076f004a0

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                           0000000076da21d0 5 bytes JMP 0000000076f00300

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                        0000000076da21e0 5 bytes JMP 0000000076f00360

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                              0000000076da2240 5 bytes JMP 0000000076f002a0

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                           0000000076da2290 5 bytes JMP 0000000076f002c0

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                              0000000076da22c0 5 bytes JMP 0000000076f00380

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                               0000000076da22d0 5 bytes JMP 0000000076f00340

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                        0000000076da25c0 5 bytes JMP 0000000076f00440

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                       0000000076da27c0 5 bytes JMP 0000000076f00260

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                          0000000076da27d0 5 bytes JMP 0000000076f00270

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                        0000000076da27e0 5 bytes JMP 0000000076f00400

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                    0000000076da29a0 5 bytes JMP 0000000076f001f0

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                     0000000076da29b0 5 bytes JMP 0000000076f00210

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                          0000000076da2a20 5 bytes JMP 0000000076f00200

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                          0000000076da2a80 5 bytes JMP 0000000076f00420

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                           0000000076da2a90 5 bytes JMP 0000000076f00430

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                      0000000076da2aa0 5 bytes JMP 0000000076f00220

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                              0000000076da2b80 5 bytes JMP 0000000076f00280

.text  C:\Windows\system32\wininit.exe[628] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                   0000000076b8eecd 1 byte [62]

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                      0000000076da1360 5 bytes JMP 000000014a540460

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                               0000000076da13b0 5 bytes JMP 000000014a540450

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                               0000000076da1510 5 bytes JMP 000000014a540370

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                    0000000076da1560 5 bytes JMP 000000014a540470

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                          0000000076da1570 5 bytes JMP 000000014a5403e0

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                               0000000076da1620 5 bytes JMP 000000014a540320

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                        0000000076da1650 5 bytes JMP 000000014a5403b0

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                           0000000076da1670 5 bytes JMP 000000014a540390

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                 0000000076da16b0 5 bytes JMP 000000014a5402e0

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                               0000000076da1730 5 bytes JMP 000000014a5402d0

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                             0000000076da1750 5 bytes JMP 000000014a540310

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                              0000000076da1790 5 bytes JMP 000000014a5403c0

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                           0000000076da17e0 5 bytes JMP 000000014a5403f0

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                              0000000076da1940 5 bytes JMP 000000014a540230

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                   0000000076da1b00 5 bytes JMP 000000014a540480

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                  0000000076da1b30 5 bytes JMP 000000014a5403a0

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                           0000000076da1c10 5 bytes JMP 000000014a5402f0

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                        0000000076da1c20 5 bytes JMP 000000014a540350

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                              0000000076da1c80 5 bytes JMP 000000014a540290

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                           0000000076da1d10 5 bytes JMP 000000014a5402b0

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                            0000000076da1d30 5 bytes JMP 000000014a5403d0

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                               0000000076da1d40 5 bytes JMP 000000014a540330

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                        0000000076da1db0 5 bytes JMP 000000014a540410

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                           0000000076da1de0 5 bytes JMP 000000014a540240

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                0000000076da20a0 5 bytes JMP 000000014a5401e0

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                           0000000076da2160 5 bytes JMP 000000014a540250

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                           0000000076da2190 5 bytes JMP 000000014a540490

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                  0000000076da21a0 5 bytes JMP 000000014a5404a0

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                             0000000076da21d0 5 bytes JMP 000000014a540300

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                          0000000076da21e0 5 bytes JMP 000000014a540360

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                0000000076da2240 5 bytes JMP 000000014a5402a0

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                             0000000076da2290 5 bytes JMP 000000014a5402c0

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                0000000076da22c0 5 bytes JMP 000000014a540380

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                 0000000076da22d0 5 bytes JMP 000000014a540340

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                          0000000076da25c0 5 bytes JMP 000000014a540440

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                         0000000076da27c0 5 bytes JMP 000000014a540260

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                            0000000076da27d0 5 bytes JMP 000000014a540270

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                          0000000076da27e0 5 bytes JMP 000000014a540400

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                      0000000076da29a0 5 bytes JMP 000000014a5401f0

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                       0000000076da29b0 5 bytes JMP 000000014a540210

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                            0000000076da2a20 5 bytes JMP 000000014a540200

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                            0000000076da2a80 5 bytes JMP 000000014a540420

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                             0000000076da2a90 5 bytes JMP 000000014a540430

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                        0000000076da2aa0 5 bytes JMP 000000014a540220

.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                0000000076da2b80 5 bytes JMP 000000014a540280

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                   0000000076da1360 5 bytes JMP 0000000076f00460

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                            0000000076da13b0 5 bytes JMP 0000000076f00450

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                            0000000076da1510 5 bytes JMP 0000000076f00370

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                 0000000076da1560 5 bytes JMP 0000000076f00470

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                       0000000076da1570 5 bytes JMP 0000000076f003e0

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                            0000000076da1620 5 bytes JMP 0000000076f00320

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                     0000000076da1650 5 bytes JMP 0000000076f003b0

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                        0000000076da1670 5 bytes JMP 0000000076f00390

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                              0000000076da16b0 5 bytes JMP 0000000076f002e0

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                            0000000076da1730 5 bytes JMP 0000000076f002d0

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                          0000000076da1750 5 bytes JMP 0000000076f00310

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                           0000000076da1790 5 bytes JMP 0000000076f003c0

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                        0000000076da17e0 5 bytes JMP 0000000076f003f0

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                           0000000076da1940 5 bytes JMP 0000000076f00230

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                0000000076da1b00 5 bytes JMP 0000000076f00480

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                               0000000076da1b30 5 bytes JMP 0000000076f003a0

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                        0000000076da1c10 5 bytes JMP 0000000076f002f0

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                     0000000076da1c20 5 bytes JMP 0000000076f00350

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                           0000000076da1c80 5 bytes JMP 0000000076f00290

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                        0000000076da1d10 5 bytes JMP 0000000076f002b0

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                         0000000076da1d30 5 bytes JMP 0000000076f003d0

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                            0000000076da1d40 5 bytes JMP 0000000076f00330

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                     0000000076da1db0 5 bytes JMP 0000000076f00410

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                        0000000076da1de0 5 bytes JMP 0000000076f00240

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                             0000000076da20a0 5 bytes JMP 0000000076f001e0

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                        0000000076da2160 5 bytes JMP 0000000076f00250

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                        0000000076da2190 5 bytes JMP 0000000076f00490

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                               0000000076da21a0 5 bytes JMP 0000000076f004a0

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                          0000000076da21d0 5 bytes JMP 0000000076f00300

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                       0000000076da21e0 5 bytes JMP 0000000076f00360

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                             0000000076da2240 5 bytes JMP 0000000076f002a0

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                          0000000076da2290 5 bytes JMP 0000000076f002c0

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                             0000000076da22c0 5 bytes JMP 0000000076f00380

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                              0000000076da22d0 5 bytes JMP 0000000076f00340

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                       0000000076da25c0 5 bytes JMP 0000000076f00440

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                      0000000076da27c0 5 bytes JMP 0000000076f00260

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                         0000000076da27d0 5 bytes JMP 0000000076f00270

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                       0000000076da27e0 5 bytes JMP 0000000076f00400

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                   0000000076da29a0 5 bytes JMP 0000000076f001f0

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                    0000000076da29b0 5 bytes JMP 0000000076f00210

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                         0000000076da2a20 5 bytes JMP 0000000076f00200

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                         0000000076da2a80 5 bytes JMP 0000000076f00420

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                          0000000076da2a90 5 bytes JMP 0000000076f00430

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                     0000000076da2aa0 5 bytes JMP 0000000076f00220

.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                             0000000076da2b80 5 bytes JMP 0000000076f00280

.text  C:\Windows\system32\services.exe[684] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                  0000000076b8eecd 1 byte [62]

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                      0000000076da1360 5 bytes JMP 0000000076f00460

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                               0000000076da13b0 5 bytes JMP 0000000076f00450

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                               0000000076da1510 5 bytes JMP 0000000076f00370

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                    0000000076da1560 5 bytes JMP 0000000076f00470

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                          0000000076da1570 5 bytes JMP 0000000076f003e0

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                               0000000076da1620 5 bytes JMP 0000000076f00320

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                        0000000076da1650 5 bytes JMP 0000000076f003b0

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                           0000000076da1670 5 bytes JMP 0000000076f00390

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                 0000000076da16b0 5 bytes JMP 0000000076f002e0

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                               0000000076da1730 5 bytes JMP 0000000076f002d0

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                             0000000076da1750 5 bytes JMP 0000000076f00310

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                              0000000076da1790 5 bytes JMP 0000000076f003c0

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                           0000000076da17e0 5 bytes JMP 0000000076f003f0

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                              0000000076da1940 5 bytes JMP 0000000076f00230

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                   0000000076da1b00 5 bytes JMP 0000000076f00480

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                  0000000076da1b30 5 bytes JMP 0000000076f003a0

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                           0000000076da1c10 5 bytes JMP 0000000076f002f0

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                        0000000076da1c20 5 bytes JMP 0000000076f00350

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                              0000000076da1c80 5 bytes JMP 0000000076f00290

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                           0000000076da1d10 5 bytes JMP 0000000076f002b0

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                            0000000076da1d30 5 bytes JMP 0000000076f003d0

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                               0000000076da1d40 5 bytes JMP 0000000076f00330

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                        0000000076da1db0 5 bytes JMP 0000000076f00410

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                           0000000076da1de0 5 bytes JMP 0000000076f00240

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                0000000076da20a0 5 bytes JMP 0000000076f001e0

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                           0000000076da2160 5 bytes JMP 0000000076f00250

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                           0000000076da2190 5 bytes JMP 0000000076f00490

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                  0000000076da21a0 5 bytes JMP 0000000076f004a0

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                             0000000076da21d0 5 bytes JMP 0000000076f00300

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                          0000000076da21e0 5 bytes JMP 0000000076f00360

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                0000000076da2240 5 bytes JMP 0000000076f002a0

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                             0000000076da2290 5 bytes JMP 0000000076f002c0

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                0000000076da22c0 5 bytes JMP 0000000076f00380

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                 0000000076da22d0 5 bytes JMP 0000000076f00340

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                          0000000076da25c0 5 bytes JMP 0000000076f00440

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                         0000000076da27c0 5 bytes JMP 0000000076f00260

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                            0000000076da27d0 5 bytes JMP 0000000076f00270

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                          0000000076da27e0 5 bytes JMP 0000000076f00400

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                      0000000076da29a0 5 bytes JMP 0000000076f001f0

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                       0000000076da29b0 5 bytes JMP 0000000076f00210

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                            0000000076da2a20 5 bytes JMP 0000000076f00200

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                            0000000076da2a80 5 bytes JMP 0000000076f00420

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                             0000000076da2a90 5 bytes JMP 0000000076f00430

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                        0000000076da2aa0 5 bytes JMP 0000000076f00220

.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                0000000076da2b80 5 bytes JMP 0000000076f00280

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                        0000000076da1360 5 bytes JMP 0000000100070460

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                 0000000076da13b0 5 bytes JMP 0000000100070450

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                 0000000076da1510 5 bytes JMP 0000000100070370

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                      0000000076da1560 5 bytes JMP 0000000100070470

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                            0000000076da1570 5 bytes JMP 00000001000703e0

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                 0000000076da1620 5 bytes JMP 0000000100070320

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                          0000000076da1650 5 bytes JMP 00000001000703b0

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                             0000000076da1670 5 bytes JMP 0000000100070390

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                   0000000076da16b0 5 bytes JMP 00000001000702e0

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                 0000000076da1730 5 bytes JMP 00000001000702d0

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                               0000000076da1750 5 bytes JMP 0000000100070310

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                0000000076da1790 5 bytes JMP 00000001000703c0

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                             0000000076da17e0 5 bytes JMP 00000001000703f0

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                0000000076da1940 5 bytes JMP 0000000100070230

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                     0000000076da1b00 5 bytes JMP 0000000100070480

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                    0000000076da1b30 5 bytes JMP 00000001000703a0

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                             0000000076da1c10 5 bytes JMP 00000001000702f0

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                          0000000076da1c20 5 bytes JMP 0000000100070350

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                0000000076da1c80 5 bytes JMP 0000000100070290

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                             0000000076da1d10 5 bytes JMP 00000001000702b0

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                              0000000076da1d30 5 bytes JMP 00000001000703d0

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                 0000000076da1d40 5 bytes JMP 0000000100070330

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                          0000000076da1db0 5 bytes JMP 0000000100070410

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                             0000000076da1de0 5 bytes JMP 0000000100070240

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                  0000000076da20a0 5 bytes JMP 00000001000701e0

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                             0000000076da2160 5 bytes JMP 0000000100070250

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                             0000000076da2190 5 bytes JMP 0000000100070490

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                    0000000076da21a0 5 bytes JMP 00000001000704a0

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                               0000000076da21d0 5 bytes JMP 0000000100070300

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                            0000000076da21e0 5 bytes JMP 0000000100070360

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                  0000000076da2240 5 bytes JMP 00000001000702a0

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                               0000000076da2290 5 bytes JMP 00000001000702c0

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                  0000000076da22c0 5 bytes JMP 0000000100070380

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                   0000000076da22d0 5 bytes JMP 0000000100070340

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                            0000000076da25c0 5 bytes JMP 0000000100070440

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                           0000000076da27c0 5 bytes JMP 0000000100070260

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                              0000000076da27d0 5 bytes JMP 0000000100070270

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                            0000000076da27e0 5 bytes JMP 0000000100070400

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                        0000000076da29a0 5 bytes JMP 00000001000701f0

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                         0000000076da29b0 5 bytes JMP 0000000100070210

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                              0000000076da2a20 5 bytes JMP 0000000100070200

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                              0000000076da2a80 5 bytes JMP 0000000100070420

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                               0000000076da2a90 5 bytes JMP 0000000100070430

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                          0000000076da2aa0 5 bytes JMP 0000000100070220

.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                  0000000076da2b80 5 bytes JMP 0000000100070280

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                   0000000076da1360 5 bytes JMP 0000000076f00460

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                            0000000076da13b0 5 bytes JMP 0000000076f00450

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                            0000000076da1510 5 bytes JMP 0000000076f00370

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                 0000000076da1560 5 bytes JMP 0000000076f00470

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                       0000000076da1570 5 bytes JMP 0000000076f003e0

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                            0000000076da1620 5 bytes JMP 0000000076f00320

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                     0000000076da1650 5 bytes JMP 0000000076f003b0

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                        0000000076da1670 5 bytes JMP 0000000076f00390

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                              0000000076da16b0 5 bytes JMP 0000000076f002e0

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                            0000000076da1730 5 bytes JMP 0000000076f002d0

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                          0000000076da1750 5 bytes JMP 0000000076f00310

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                           0000000076da1790 5 bytes JMP 0000000076f003c0

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                        0000000076da17e0 5 bytes JMP 0000000076f003f0

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                           0000000076da1940 5 bytes JMP 0000000076f00230

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                0000000076da1b00 5 bytes JMP 0000000076f00480

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                               0000000076da1b30 5 bytes JMP 0000000076f003a0

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                        0000000076da1c10 5 bytes JMP 0000000076f002f0

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                     0000000076da1c20 5 bytes JMP 0000000076f00350

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                           0000000076da1c80 5 bytes JMP 0000000076f00290

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                        0000000076da1d10 5 bytes JMP 0000000076f002b0

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                         0000000076da1d30 5 bytes JMP 0000000076f003d0

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                            0000000076da1d40 5 bytes JMP 0000000076f00330

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                     0000000076da1db0 5 bytes JMP 0000000076f00410

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                        0000000076da1de0 5 bytes JMP 0000000076f00240

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                             0000000076da20a0 5 bytes JMP 0000000076f001e0

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                        0000000076da2160 5 bytes JMP 0000000076f00250

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                        0000000076da2190 5 bytes JMP 0000000076f00490

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                               0000000076da21a0 5 bytes JMP 0000000076f004a0

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                          0000000076da21d0 5 bytes JMP 0000000076f00300

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                       0000000076da21e0 5 bytes JMP 0000000076f00360

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                             0000000076da2240 5 bytes JMP 0000000076f002a0

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                          0000000076da2290 5 bytes JMP 0000000076f002c0

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                             0000000076da22c0 5 bytes JMP 0000000076f00380

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                              0000000076da22d0 5 bytes JMP 0000000076f00340

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                       0000000076da25c0 5 bytes JMP 0000000076f00440

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                      0000000076da27c0 5 bytes JMP 0000000076f00260

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                         0000000076da27d0 5 bytes JMP 0000000076f00270

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                       0000000076da27e0 5 bytes JMP 0000000076f00400

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                   0000000076da29a0 5 bytes JMP 0000000076f001f0

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                    0000000076da29b0 5 bytes JMP 0000000076f00210

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                         0000000076da2a20 5 bytes JMP 0000000076f00200

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                         0000000076da2a80 5 bytes JMP 0000000076f00420

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                          0000000076da2a90 5 bytes JMP 0000000076f00430

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                     0000000076da2aa0 5 bytes JMP 0000000076f00220

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                             0000000076da2b80 5 bytes JMP 0000000076f00280

.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                  0000000076b8eecd 1 byte [62]

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                    0000000076da1360 5 bytes JMP 0000000076f00460

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                             0000000076da13b0 5 bytes JMP 0000000076f00450

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                             0000000076da1510 5 bytes JMP 0000000076f00370

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                  0000000076da1560 5 bytes JMP 0000000076f00470

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                        0000000076da1570 5 bytes JMP 0000000076f003e0

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                             0000000076da1620 5 bytes JMP 0000000076f00320

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                      0000000076da1650 5 bytes JMP 0000000076f003b0

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                         0000000076da1670 5 bytes JMP 0000000076f00390

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                               0000000076da16b0 5 bytes JMP 0000000076f002e0

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                             0000000076da1730 5 bytes JMP 0000000076f002d0

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                           0000000076da1750 5 bytes JMP 0000000076f00310

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                            0000000076da1790 5 bytes JMP 0000000076f003c0

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                         0000000076da17e0 5 bytes JMP 0000000076f003f0

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                            0000000076da1940 5 bytes JMP 0000000076f00230

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                 0000000076da1b00 5 bytes JMP 0000000076f00480

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                0000000076da1b30 5 bytes JMP 0000000076f003a0

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                         0000000076da1c10 5 bytes JMP 0000000076f002f0

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                      0000000076da1c20 5 bytes JMP 0000000076f00350

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                            0000000076da1c80 5 bytes JMP 0000000076f00290

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                         0000000076da1d10 5 bytes JMP 0000000076f002b0

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                          0000000076da1d30 5 bytes JMP 0000000076f003d0

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                             0000000076da1d40 5 bytes JMP 0000000076f00330

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                      0000000076da1db0 5 bytes JMP 0000000076f00410

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                         0000000076da1de0 5 bytes JMP 0000000076f00240

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                              0000000076da20a0 5 bytes JMP 0000000076f001e0

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                         0000000076da2160 5 bytes JMP 0000000076f00250

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                         0000000076da2190 5 bytes JMP 0000000076f00490

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                0000000076da21a0 5 bytes JMP 0000000076f004a0

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                           0000000076da21d0 5 bytes JMP 0000000076f00300

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                        0000000076da21e0 5 bytes JMP 0000000076f00360

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                              0000000076da2240 5 bytes JMP 0000000076f002a0

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                           0000000076da2290 5 bytes JMP 0000000076f002c0

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                              0000000076da22c0 5 bytes JMP 0000000076f00380

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                               0000000076da22d0 5 bytes JMP 0000000076f00340

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                        0000000076da25c0 5 bytes JMP 0000000076f00440

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                       0000000076da27c0 5 bytes JMP 0000000076f00260

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                          0000000076da27d0 5 bytes JMP 0000000076f00270

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                        0000000076da27e0 5 bytes JMP 0000000076f00400

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                    0000000076da29a0 5 bytes JMP 0000000076f001f0

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                     0000000076da29b0 5 bytes JMP 0000000076f00210

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                          0000000076da2a20 5 bytes JMP 0000000076f00200

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                          0000000076da2a80 5 bytes JMP 0000000076f00420

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                           0000000076da2a90 5 bytes JMP 0000000076f00430

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                      0000000076da2aa0 5 bytes JMP 0000000076f00220

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                              0000000076da2b80 5 bytes JMP 0000000076f00280

.text  C:\Windows\system32\svchost.exe[868] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                   0000000076b8eecd 1 byte [62]

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                    0000000076da1360 5 bytes JMP 0000000076f00460

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                             0000000076da13b0 5 bytes JMP 0000000076f00450

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                             0000000076da1510 5 bytes JMP 0000000076f00370

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                  0000000076da1560 5 bytes JMP 0000000076f00470

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                        0000000076da1570 5 bytes JMP 0000000076f003e0

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                             0000000076da1620 5 bytes JMP 0000000076f00320

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                      0000000076da1650 5 bytes JMP 0000000076f003b0

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                         0000000076da1670 5 bytes JMP 0000000076f00390

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                               0000000076da16b0 5 bytes JMP 0000000076f002e0

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                             0000000076da1730 5 bytes JMP 0000000076f002d0

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                           0000000076da1750 5 bytes JMP 0000000076f00310

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                            0000000076da1790 5 bytes JMP 0000000076f003c0

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                         0000000076da17e0 5 bytes JMP 0000000076f003f0

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                            0000000076da1940 5 bytes JMP 0000000076f00230

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                 0000000076da1b00 5 bytes JMP 0000000076f00480

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                0000000076da1b30 5 bytes JMP 0000000076f003a0

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                         0000000076da1c10 5 bytes JMP 0000000076f002f0

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                      0000000076da1c20 5 bytes JMP 0000000076f00350

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                            0000000076da1c80 5 bytes JMP 0000000076f00290

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                         0000000076da1d10 5 bytes JMP 0000000076f002b0

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                          0000000076da1d30 5 bytes JMP 0000000076f003d0

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                             0000000076da1d40 5 bytes JMP 0000000076f00330

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                      0000000076da1db0 5 bytes JMP 0000000076f00410

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                         0000000076da1de0 5 bytes JMP 0000000076f00240

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                              0000000076da20a0 5 bytes JMP 0000000076f001e0

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                         0000000076da2160 5 bytes JMP 0000000076f00250

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                         0000000076da2190 5 bytes JMP 0000000076f00490

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                0000000076da21a0 5 bytes JMP 0000000076f004a0

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                           0000000076da21d0 5 bytes JMP 0000000076f00300

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                        0000000076da21e0 5 bytes JMP 0000000076f00360

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                              0000000076da2240 5 bytes JMP 0000000076f002a0

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                           0000000076da2290 5 bytes JMP 0000000076f002c0

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                              0000000076da22c0 5 bytes JMP 0000000076f00380

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                               0000000076da22d0 5 bytes JMP 0000000076f00340

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                        0000000076da25c0 5 bytes JMP 0000000076f00440

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                       0000000076da27c0 5 bytes JMP 0000000076f00260

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                          0000000076da27d0 5 bytes JMP 0000000076f00270

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                        0000000076da27e0 5 bytes JMP 0000000076f00400

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                    0000000076da29a0 5 bytes JMP 0000000076f001f0

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                     0000000076da29b0 5 bytes JMP 0000000076f00210

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                          0000000076da2a20 5 bytes JMP 0000000076f00200

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                          0000000076da2a80 5 bytes JMP 0000000076f00420

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                           0000000076da2a90 5 bytes JMP 0000000076f00430

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                      0000000076da2aa0 5 bytes JMP 0000000076f00220

.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                              0000000076da2b80 5 bytes JMP 0000000076f00280

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort             0000000076da1360 5 bytes JMP 0000000076f00460

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                      0000000076da13b0 5 bytes JMP 0000000076f00450

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                      0000000076da1510 5 bytes JMP 0000000076f00370

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx           0000000076da1560 5 bytes JMP 0000000076f00470

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                 0000000076da1570 5 bytes JMP 0000000076f003e0

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                      0000000076da1620 5 bytes JMP 0000000076f00320

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory               0000000076da1650 5 bytes JMP 0000000076f003b0

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                  0000000076da1670 5 bytes JMP 0000000076f00390

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                        0000000076da16b0 5 bytes JMP 0000000076f002e0

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                      0000000076da1730 5 bytes JMP 0000000076f002d0

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                    0000000076da1750 5 bytes JMP 0000000076f00310

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                     0000000076da1790 5 bytes JMP 0000000076f003c0

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                  0000000076da17e0 5 bytes JMP 0000000076f003f0

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                     0000000076da1940 5 bytes JMP 0000000076f00230

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort          0000000076da1b00 5 bytes JMP 0000000076f00480

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject         0000000076da1b30 5 bytes JMP 0000000076f003a0

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                  0000000076da1c10 5 bytes JMP 0000000076f002f0

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion               0000000076da1c20 5 bytes JMP 0000000076f00350

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                     0000000076da1c80 5 bytes JMP 0000000076f00290

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                  0000000076da1d10 5 bytes JMP 0000000076f002b0

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                   0000000076da1d30 5 bytes JMP 0000000076f003d0

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                      0000000076da1d40 5 bytes JMP 0000000076f00330

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess               0000000076da1db0 5 bytes JMP 0000000076f00410

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                  0000000076da1de0 5 bytes JMP 0000000076f00240

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                       0000000076da20a0 5 bytes JMP 0000000076f001e0

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                  0000000076da2160 5 bytes JMP 0000000076f00250

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                  0000000076da2190 5 bytes JMP 0000000076f00490

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys         0000000076da21a0 5 bytes JMP 0000000076f004a0

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                    0000000076da21d0 5 bytes JMP 0000000076f00300

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                 0000000076da21e0 5 bytes JMP 0000000076f00360

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                       0000000076da2240 5 bytes JMP 0000000076f002a0

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                    0000000076da2290 5 bytes JMP 0000000076f002c0

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                       0000000076da22c0 5 bytes JMP 0000000076f00380

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                        0000000076da22d0 5 bytes JMP 0000000076f00340

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                 0000000076da25c0 5 bytes JMP 0000000076f00440

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                0000000076da27c0 5 bytes JMP 0000000076f00260

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                   0000000076da27d0 5 bytes JMP 0000000076f00270

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                 0000000076da27e0 5 bytes JMP 0000000076f00400

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation             0000000076da29a0 5 bytes JMP 0000000076f001f0

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState              0000000076da29b0 5 bytes JMP 0000000076f00210

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                   0000000076da2a20 5 bytes JMP 0000000076f00200

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                   0000000076da2a80 5 bytes JMP 0000000076f00420

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                    0000000076da2a90 5 bytes JMP 0000000076f00430

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl               0000000076da2aa0 5 bytes JMP 0000000076f00220

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                       0000000076da2b80 5 bytes JMP 0000000076f00280

.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189            0000000076b8eecd 1 byte [62]

.text  C:\Windows\system32\atiesrxx.exe[388] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                  0000000076b8eecd 1 byte [62]

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                    0000000076da1360 5 bytes JMP 0000000076f00460

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                             0000000076da13b0 5 bytes JMP 0000000076f00450

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                             0000000076da1510 5 bytes JMP 0000000076f00370

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                  0000000076da1560 5 bytes JMP 0000000076f00470

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                        0000000076da1570 5 bytes JMP 0000000076f003e0

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                             0000000076da1620 5 bytes JMP 0000000076f00320

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                      0000000076da1650 5 bytes JMP 0000000076f003b0

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                         0000000076da1670 5 bytes JMP 0000000076f00390

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                               0000000076da16b0 5 bytes JMP 0000000076f002e0

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                             0000000076da1730 5 bytes JMP 0000000076f002d0

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                           0000000076da1750 5 bytes JMP 0000000076f00310

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                            0000000076da1790 5 bytes JMP 0000000076f003c0

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                         0000000076da17e0 5 bytes JMP 0000000076f003f0

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                            0000000076da1940 5 bytes JMP 0000000076f00230

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                 0000000076da1b00 5 bytes JMP 0000000076f00480

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                0000000076da1b30 5 bytes JMP 0000000076f003a0

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                         0000000076da1c10 5 bytes JMP 0000000076f002f0

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                      0000000076da1c20 5 bytes JMP 0000000076f00350

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                            0000000076da1c80 5 bytes JMP 0000000076f00290

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                         0000000076da1d10 5 bytes JMP 0000000076f002b0

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                          0000000076da1d30 5 bytes JMP 0000000076f003d0

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                             0000000076da1d40 5 bytes JMP 0000000076f00330

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                      0000000076da1db0 5 bytes JMP 0000000076f00410

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                         0000000076da1de0 5 bytes JMP 0000000076f00240

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                              0000000076da20a0 5 bytes JMP 0000000076f001e0

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                         0000000076da2160 5 bytes JMP 0000000076f00250

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                         0000000076da2190 5 bytes JMP 0000000076f00490

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                0000000076da21a0 5 bytes JMP 0000000076f004a0

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                           0000000076da21d0 5 bytes JMP 0000000076f00300

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                        0000000076da21e0 5 bytes JMP 0000000076f00360

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                              0000000076da2240 5 bytes JMP 0000000076f002a0

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                           0000000076da2290 5 bytes JMP 0000000076f002c0

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                              0000000076da22c0 5 bytes JMP 0000000076f00380

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                               0000000076da22d0 5 bytes JMP 0000000076f00340

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                        0000000076da25c0 5 bytes JMP 0000000076f00440

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                       0000000076da27c0 5 bytes JMP 0000000076f00260

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                          0000000076da27d0 5 bytes JMP 0000000076f00270

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                        0000000076da27e0 5 bytes JMP 0000000076f00400

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                    0000000076da29a0 5 bytes JMP 0000000076f001f0

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                     0000000076da29b0 5 bytes JMP 0000000076f00210

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                          0000000076da2a20 5 bytes JMP 0000000076f00200

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                          0000000076da2a80 5 bytes JMP 0000000076f00420

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                           0000000076da2a90 5 bytes JMP 0000000076f00430

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                      0000000076da2aa0 5 bytes JMP 0000000076f00220

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                              0000000076da2b80 5 bytes JMP 0000000076f00280

.text  C:\Windows\System32\svchost.exe[376] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                   0000000076b8eecd 1 byte [62]

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                   0000000076da1360 5 bytes JMP 0000000100070460

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                            0000000076da13b0 5 bytes JMP 0000000100070450

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                            0000000076da1510 5 bytes JMP 0000000100070370

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                 0000000076da1560 5 bytes JMP 0000000100070470

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                       0000000076da1570 5 bytes JMP 00000001000703e0

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                            0000000076da1620 5 bytes JMP 0000000100070320

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                     0000000076da1650 5 bytes JMP 00000001000703b0

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                        0000000076da1670 5 bytes JMP 0000000100070390

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                              0000000076da16b0 5 bytes JMP 00000001000702e0

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                            0000000076da1730 5 bytes JMP 00000001000702d0

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                          0000000076da1750 5 bytes JMP 0000000100070310

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                           0000000076da1790 5 bytes JMP 00000001000703c0

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                        0000000076da17e0 5 bytes JMP 00000001000703f0

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                           0000000076da1940 5 bytes JMP 0000000100070230

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                0000000076da1b00 5 bytes JMP 0000000100070480

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                               0000000076da1b30 5 bytes JMP 00000001000703a0

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                        0000000076da1c10 5 bytes JMP 00000001000702f0

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                     0000000076da1c20 5 bytes JMP 0000000100070350

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                           0000000076da1c80 5 bytes JMP 0000000100070290

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                        0000000076da1d10 5 bytes JMP 00000001000702b0

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                         0000000076da1d30 5 bytes JMP 00000001000703d0

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                            0000000076da1d40 5 bytes JMP 0000000100070330

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                     0000000076da1db0 5 bytes JMP 0000000100070410

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                        0000000076da1de0 5 bytes JMP 0000000100070240

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                             0000000076da20a0 5 bytes JMP 00000001000701e0

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                        0000000076da2160 5 bytes JMP 0000000100070250

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                        0000000076da2190 5 bytes JMP 0000000100070490

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                               0000000076da21a0 5 bytes JMP 00000001000704a0

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                          0000000076da21d0 5 bytes JMP 0000000100070300

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                       0000000076da21e0 5 bytes JMP 0000000100070360

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                             0000000076da2240 5 bytes JMP 00000001000702a0

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                          0000000076da2290 5 bytes JMP 00000001000702c0

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                             0000000076da22c0 5 bytes JMP 0000000100070380

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                              0000000076da22d0 5 bytes JMP 0000000100070340

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                       0000000076da25c0 5 bytes JMP 0000000100070440

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                      0000000076da27c0 5 bytes JMP 0000000100070260

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                         0000000076da27d0 5 bytes JMP 0000000100070270

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                       0000000076da27e0 5 bytes JMP 0000000100070400

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                   0000000076da29a0 5 bytes JMP 00000001000701f0

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                    0000000076da29b0 5 bytes JMP 0000000100070210

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                         0000000076da2a20 5 bytes JMP 0000000100070200

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                         0000000076da2a80 5 bytes JMP 0000000100070420

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                          0000000076da2a90 5 bytes JMP 0000000100070430

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                     0000000076da2aa0 5 bytes JMP 0000000100070220

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                             0000000076da2b80 5 bytes JMP 0000000100070280

.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                  0000000076b8eecd 1 byte [62]

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                   0000000076da1360 5 bytes JMP 0000000076f00460

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                            0000000076da13b0 5 bytes JMP 0000000076f00450

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                            0000000076da1510 5 bytes JMP 0000000076f00370

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                 0000000076da1560 5 bytes JMP 0000000076f00470

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                       0000000076da1570 5 bytes JMP 0000000076f003e0

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                            0000000076da1620 5 bytes JMP 0000000076f00320

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                     0000000076da1650 5 bytes JMP 0000000076f003b0

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                        0000000076da1670 5 bytes JMP 0000000076f00390

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                              0000000076da16b0 5 bytes JMP 0000000076f002e0

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                            0000000076da1730 5 bytes JMP 0000000076f002d0

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                          0000000076da1750 5 bytes JMP 0000000076f00310

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                           0000000076da1790 5 bytes JMP 0000000076f003c0

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                        0000000076da17e0 5 bytes JMP 0000000076f003f0

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                           0000000076da1940 5 bytes JMP 0000000076f00230

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                0000000076da1b00 5 bytes JMP 0000000076f00480

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                               0000000076da1b30 5 bytes JMP 0000000076f003a0

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                        0000000076da1c10 5 bytes JMP 0000000076f002f0

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                     0000000076da1c20 5 bytes JMP 0000000076f00350

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                           0000000076da1c80 5 bytes JMP 0000000076f00290

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                        0000000076da1d10 5 bytes JMP 0000000076f002b0

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                         0000000076da1d30 5 bytes JMP 0000000076f003d0

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                            0000000076da1d40 5 bytes JMP 0000000076f00330

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                     0000000076da1db0 5 bytes JMP 0000000076f00410

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                        0000000076da1de0 5 bytes JMP 0000000076f00240

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                             0000000076da20a0 5 bytes JMP 0000000076f001e0

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                        0000000076da2160 5 bytes JMP 0000000076f00250

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                        0000000076da2190 5 bytes JMP 0000000076f00490

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                               0000000076da21a0 5 bytes JMP 0000000076f004a0

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                          0000000076da21d0 5 bytes JMP 0000000076f00300

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                       0000000076da21e0 5 bytes JMP 0000000076f00360

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                             0000000076da2240 5 bytes JMP 0000000076f002a0

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                          0000000076da2290 5 bytes JMP 0000000076f002c0

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                             0000000076da22c0 5 bytes JMP 0000000076f00380

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                              0000000076da22d0 5 bytes JMP 0000000076f00340

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                       0000000076da25c0 5 bytes JMP 0000000076f00440

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                      0000000076da27c0 5 bytes JMP 0000000076f00260

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                         0000000076da27d0 5 bytes JMP 0000000076f00270

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                       0000000076da27e0 5 bytes JMP 0000000076f00400

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                   0000000076da29a0 5 bytes JMP 0000000076f001f0

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                    0000000076da29b0 5 bytes JMP 0000000076f00210

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                         0000000076da2a20 5 bytes JMP 0000000076f00200

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                         0000000076da2a80 5 bytes JMP 0000000076f00420

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                          0000000076da2a90 5 bytes JMP 0000000076f00430

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                     0000000076da2aa0 5 bytes JMP 0000000076f00220

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                             0000000076da2b80 5 bytes JMP 0000000076f00280

.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                  0000000076b8eecd 1 byte [62]

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                   0000000076da1360 5 bytes JMP 0000000076f00460

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                            0000000076da13b0 5 bytes JMP 0000000076f00450

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                            0000000076da1510 5 bytes JMP 0000000076f00370

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                 0000000076da1560 5 bytes JMP 0000000076f00470

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                       0000000076da1570 5 bytes JMP 0000000076f003e0

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                            0000000076da1620 5 bytes JMP 0000000076f00320

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                     0000000076da1650 5 bytes JMP 0000000076f003b0

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                        0000000076da1670 5 bytes JMP 0000000076f00390

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                              0000000076da16b0 5 bytes JMP 0000000076f002e0

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                            0000000076da1730 5 bytes JMP 0000000076f002d0

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                          0000000076da1750 5 bytes JMP 0000000076f00310

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                           0000000076da1790 5 bytes JMP 0000000076f003c0

.text

Code:

C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                        0000000076da17e0 5 bytes JMP 0000000076f003f0

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                           0000000076da1940 5 bytes JMP 0000000076f00230

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                0000000076da1b00 5 bytes JMP 0000000076f00480

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                               0000000076da1b30 5 bytes JMP 0000000076f003a0

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                        0000000076da1c10 5 bytes JMP 0000000076f002f0

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                     0000000076da1c20 5 bytes JMP 0000000076f00350

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                           0000000076da1c80 5 bytes JMP 0000000076f00290

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                        0000000076da1d10 5 bytes JMP 0000000076f002b0

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                         0000000076da1d30 5 bytes JMP 0000000076f003d0

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                            0000000076da1d40 5 bytes JMP 0000000076f00330

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                     0000000076da1db0 5 bytes JMP 0000000076f00410

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                        0000000076da1de0 5 bytes JMP 0000000076f00240

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                             0000000076da20a0 5 bytes JMP 0000000076f001e0

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                        0000000076da2160 5 bytes JMP 0000000076f00250

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                        0000000076da2190 5 bytes JMP 0000000076f00490

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                               0000000076da21a0 5 bytes JMP 0000000076f004a0

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                          0000000076da21d0 5 bytes JMP 0000000076f00300

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                       0000000076da21e0 5 bytes JMP 0000000076f00360

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                             0000000076da2240 5 bytes JMP 0000000076f002a0

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                          0000000076da2290 5 bytes JMP 0000000076f002c0

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                             0000000076da22c0 5 bytes JMP 0000000076f00380

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                              0000000076da22d0 5 bytes JMP 0000000076f00340

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                       0000000076da25c0 5 bytes JMP 0000000076f00440

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                      0000000076da27c0 5 bytes JMP 0000000076f00260

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                         0000000076da27d0 5 bytes JMP 0000000076f00270

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                       0000000076da27e0 5 bytes JMP 0000000076f00400

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                   0000000076da29a0 5 bytes JMP 0000000076f001f0

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                    0000000076da29b0 5 bytes JMP 0000000076f00210

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                         0000000076da2a20 5 bytes JMP 0000000076f00200

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                         0000000076da2a80 5 bytes JMP 0000000076f00420

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                          0000000076da2a90 5 bytes JMP 0000000076f00430

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                     0000000076da2aa0 5 bytes JMP 0000000076f00220

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                             0000000076da2b80 5 bytes JMP 0000000076f00280

.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                  0000000076b8eecd 1 byte [62]

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                   0000000076da1360 5 bytes JMP 0000000100040460

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                            0000000076da13b0 5 bytes JMP 0000000100040450

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                            0000000076da1510 5 bytes JMP 0000000100040370

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                 0000000076da1560 5 bytes JMP 0000000100040470

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                       0000000076da1570 5 bytes JMP 00000001000403e0

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                            0000000076da1620 5 bytes JMP 0000000100040320

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                     0000000076da1650 5 bytes JMP 00000001000403b0

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                        0000000076da1670 5 bytes JMP 0000000100040390

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                              0000000076da16b0 5 bytes JMP 00000001000402e0

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                            0000000076da1730 5 bytes JMP 00000001000402d0

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                          0000000076da1750 5 bytes JMP 0000000100040310

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                           0000000076da1790 5 bytes JMP 00000001000403c0

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                        0000000076da17e0 5 bytes JMP 00000001000403f0

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                           0000000076da1940 5 bytes JMP 0000000100040230

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                0000000076da1b00 5 bytes JMP 0000000100040480

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                               0000000076da1b30 5 bytes JMP 00000001000403a0

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                        0000000076da1c10 5 bytes JMP 00000001000402f0

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                     0000000076da1c20 5 bytes JMP 0000000100040350

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                           0000000076da1c80 5 bytes JMP 0000000100040290

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                        0000000076da1d10 5 bytes JMP 00000001000402b0

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                         0000000076da1d30 5 bytes JMP 00000001000403d0

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                            0000000076da1d40 5 bytes JMP 0000000100040330

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                     0000000076da1db0 5 bytes JMP 0000000100040410

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                        0000000076da1de0 5 bytes JMP 0000000100040240

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                             0000000076da20a0 5 bytes JMP 00000001000401e0

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                        0000000076da2160 5 bytes JMP 0000000100040250

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                        0000000076da2190 5 bytes JMP 0000000100040490

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                               0000000076da21a0 5 bytes JMP 00000001000404a0

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                          0000000076da21d0 5 bytes JMP 0000000100040300

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                       0000000076da21e0 5 bytes JMP 0000000100040360

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                             0000000076da2240 5 bytes JMP 00000001000402a0

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                          0000000076da2290 5 bytes JMP 00000001000402c0

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                             0000000076da22c0 5 bytes JMP 0000000100040380

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                              0000000076da22d0 5 bytes JMP 0000000100040340

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                       0000000076da25c0 5 bytes JMP 0000000100040440

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                      0000000076da27c0 5 bytes JMP 0000000100040260

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                         0000000076da27d0 5 bytes JMP 0000000100040270

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                       0000000076da27e0 5 bytes JMP 0000000100040400

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                   0000000076da29a0 5 bytes JMP 00000001000401f0

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                    0000000076da29b0 5 bytes JMP 0000000100040210

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                         0000000076da2a20 5 bytes JMP 0000000100040200

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                         0000000076da2a80 5 bytes JMP 0000000100040420

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                          0000000076da2a90 5 bytes JMP 0000000100040430

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                     0000000076da2aa0 5 bytes JMP 0000000100040220

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                             0000000076da2b80 5 bytes JMP 0000000100040280

.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\System32\kernel32.dll!GetBinaryTypeW + 189                                  0000000076b8eecd 1 byte [62]

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                  0000000076da1360 5 bytes JMP 0000000076f00460

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                           0000000076da13b0 5 bytes JMP 0000000076f00450

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                           0000000076da1510 5 bytes JMP 0000000076f00370

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                0000000076da1560 5 bytes JMP 0000000076f00470

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                      0000000076da1570 5 bytes JMP 0000000076f003e0

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                           0000000076da1620 5 bytes JMP 0000000076f00320

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                    0000000076da1650 5 bytes JMP 0000000076f003b0

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                       0000000076da1670 5 bytes JMP 0000000076f00390

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                             0000000076da16b0 5 bytes JMP 0000000076f002e0

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                           0000000076da1730 5 bytes JMP 0000000076f002d0

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                         0000000076da1750 5 bytes JMP 0000000076f00310

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                          0000000076da1790 5 bytes JMP 0000000076f003c0

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                       0000000076da17e0 5 bytes JMP 0000000076f003f0

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                          0000000076da1940 5 bytes JMP 0000000076f00230

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                               0000000076da1b00 5 bytes JMP 0000000076f00480

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                              0000000076da1b30 5 bytes JMP 0000000076f003a0

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                       0000000076da1c10 5 bytes JMP 0000000076f002f0

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                    0000000076da1c20 5 bytes JMP 0000000076f00350

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                          0000000076da1c80 5 bytes JMP 0000000076f00290

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                       0000000076da1d10 5 bytes JMP 0000000076f002b0

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                        0000000076da1d30 5 bytes JMP 0000000076f003d0

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                           0000000076da1d40 5 bytes JMP 0000000076f00330

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                    0000000076da1db0 5 bytes JMP 0000000076f00410

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                       0000000076da1de0 5 bytes JMP 0000000076f00240

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                            0000000076da20a0 5 bytes JMP 0000000076f001e0

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                       0000000076da2160 5 bytes JMP 0000000076f00250

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                       0000000076da2190 5 bytes JMP 0000000076f00490

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                              0000000076da21a0 5 bytes JMP 0000000076f004a0

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                         0000000076da21d0 5 bytes JMP 0000000076f00300

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                      0000000076da21e0 5 bytes JMP 0000000076f00360

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                            0000000076da2240 5 bytes JMP 0000000076f002a0

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                         0000000076da2290 5 bytes JMP 0000000076f002c0

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                            0000000076da22c0 5 bytes JMP 0000000076f00380

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                             0000000076da22d0 5 bytes JMP 0000000076f00340

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                      0000000076da25c0 5 bytes JMP 0000000076f00440

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                     0000000076da27c0 5 bytes JMP 0000000076f00260

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                        0000000076da27d0 5 bytes JMP 0000000076f00270

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                      0000000076da27e0 5 bytes JMP 0000000076f00400

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                  0000000076da29a0 5 bytes JMP 0000000076f001f0

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                   0000000076da29b0 5 bytes JMP 0000000076f00210

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                        0000000076da2a20 5 bytes JMP 0000000076f00200

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                        0000000076da2a80 5 bytes JMP 0000000076f00420

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                         0000000076da2a90 5 bytes JMP 0000000076f00430

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                    0000000076da2aa0 5 bytes JMP 0000000076f00220

.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                            0000000076da2b80 5 bytes JMP 0000000076f00280

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                   0000000076da1360 5 bytes JMP 0000000076f00460

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                            0000000076da13b0 5 bytes JMP 0000000076f00450

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                            0000000076da1510 5 bytes JMP 0000000076f00370

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                 0000000076da1560 5 bytes JMP 0000000076f00470

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                       0000000076da1570 5 bytes JMP 0000000076f003e0

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                            0000000076da1620 5 bytes JMP 0000000076f00320

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                     0000000076da1650 5 bytes JMP 0000000076f003b0

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                        0000000076da1670 5 bytes JMP 0000000076f00390

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                              0000000076da16b0 5 bytes JMP 0000000076f002e0

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                            0000000076da1730 5 bytes JMP 0000000076f002d0

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                          0000000076da1750 5 bytes JMP 0000000076f00310

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                           0000000076da1790 5 bytes JMP 0000000076f003c0

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                        0000000076da17e0 5 bytes JMP 0000000076f003f0

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                           0000000076da1940 5 bytes JMP 0000000076f00230

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                0000000076da1b00 5 bytes JMP 0000000076f00480

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                               0000000076da1b30 5 bytes JMP 0000000076f003a0

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                        0000000076da1c10 5 bytes JMP 0000000076f002f0

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                     0000000076da1c20 5 bytes JMP 0000000076f00350

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                           0000000076da1c80 5 bytes JMP 0000000076f00290

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                        0000000076da1d10 5 bytes JMP 0000000076f002b0

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                         0000000076da1d30 5 bytes JMP 0000000076f003d0

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                            0000000076da1d40 5 bytes JMP 0000000076f00330

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                     0000000076da1db0 5 bytes JMP 0000000076f00410

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                        0000000076da1de0 5 bytes JMP 0000000076f00240

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                             0000000076da20a0 5 bytes JMP 0000000076f001e0

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                        0000000076da2160 5 bytes JMP 0000000076f00250

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                        0000000076da2190 5 bytes JMP 0000000076f00490

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                               0000000076da21a0 5 bytes JMP 0000000076f004a0

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                          0000000076da21d0 5 bytes JMP 0000000076f00300

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                       0000000076da21e0 5 bytes JMP 0000000076f00360

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                             0000000076da2240 5 bytes JMP 0000000076f002a0

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                          0000000076da2290 5 bytes JMP 0000000076f002c0

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                             0000000076da22c0 5 bytes JMP 0000000076f00380

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                              0000000076da22d0 5 bytes JMP 0000000076f00340

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                       0000000076da25c0 5 bytes JMP 0000000076f00440

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                      0000000076da27c0 5 bytes JMP 0000000076f00260

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                         0000000076da27d0 5 bytes JMP 0000000076f00270

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                       0000000076da27e0 5 bytes JMP 0000000076f00400

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                   0000000076da29a0 5 bytes JMP 0000000076f001f0

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                    0000000076da29b0 5 bytes JMP 0000000076f00210

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                         0000000076da2a20 5 bytes JMP 0000000076f00200

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                         0000000076da2a80 5 bytes JMP 0000000076f00420

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                          0000000076da2a90 5 bytes JMP 0000000076f00430

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                     0000000076da2aa0 5 bytes JMP 0000000076f00220

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                             0000000076da2b80 5 bytes JMP 0000000076f00280

.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                  0000000076b8eecd 1 byte [62]

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                   0000000076da1360 5 bytes JMP 0000000076f00460

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                            0000000076da13b0 5 bytes JMP 0000000076f00450

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                            0000000076da1510 5 bytes JMP 0000000076f00370

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                 0000000076da1560 5 bytes JMP 0000000076f00470

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                       0000000076da1570 5 bytes JMP 0000000076f003e0

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                            0000000076da1620 5 bytes JMP 0000000076f00320

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                     0000000076da1650 5 bytes JMP 0000000076f003b0

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                        0000000076da1670 5 bytes JMP 0000000076f00390

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                              0000000076da16b0 5 bytes JMP 0000000076f002e0

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                            0000000076da1730 5 bytes JMP 0000000076f002d0

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                          0000000076da1750 5 bytes JMP 0000000076f00310

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                           0000000076da1790 5 bytes JMP 0000000076f003c0

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                        0000000076da17e0 5 bytes JMP 0000000076f003f0

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                           0000000076da1940 5 bytes JMP 0000000076f00230

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                0000000076da1b00 5 bytes JMP 0000000076f00480

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                               0000000076da1b30 5 bytes JMP 0000000076f003a0

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                        0000000076da1c10 5 bytes JMP 0000000076f002f0

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                     0000000076da1c20 5 bytes JMP 0000000076f00350

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                           0000000076da1c80 5 bytes JMP 0000000076f00290

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                        0000000076da1d10 5 bytes JMP 0000000076f002b0

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                         0000000076da1d30 5 bytes JMP 0000000076f003d0

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                            0000000076da1d40 5 bytes JMP 0000000076f00330

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                     0000000076da1db0 5 bytes JMP 0000000076f00410

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                        0000000076da1de0 5 bytes JMP 0000000076f00240

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                             0000000076da20a0 5 bytes JMP 0000000076f001e0

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                        0000000076da2160 5 bytes JMP 0000000076f00250

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                        0000000076da2190 5 bytes JMP 0000000076f00490

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                               0000000076da21a0 5 bytes JMP 0000000076f004a0

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                          0000000076da21d0 5 bytes JMP 0000000076f00300

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                       0000000076da21e0 5 bytes JMP 0000000076f00360

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                             0000000076da2240 5 bytes JMP 0000000076f002a0

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                          0000000076da2290 5 bytes JMP 0000000076f002c0

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                             0000000076da22c0 5 bytes JMP 0000000076f00380

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                              0000000076da22d0 5 bytes JMP 0000000076f00340

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                       0000000076da25c0 5 bytes JMP 0000000076f00440

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                      0000000076da27c0 5 bytes JMP 0000000076f00260

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                         0000000076da27d0 5 bytes JMP 0000000076f00270

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                       0000000076da27e0 5 bytes JMP 0000000076f00400

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                   0000000076da29a0 5 bytes JMP 0000000076f001f0

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                    0000000076da29b0 5 bytes JMP 0000000076f00210

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                         0000000076da2a20 5 bytes JMP 0000000076f00200

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                         0000000076da2a80 5 bytes JMP 0000000076f00420

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                          0000000076da2a90 5 bytes JMP 0000000076f00430

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                     0000000076da2aa0 5 bytes JMP 0000000076f00220

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                             0000000076da2b80 5 bytes JMP 0000000076f00280

.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                  0000000076b8eecd 1 byte [62]

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                   0000000076da1360 5 bytes JMP 0000000076f00460

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                            0000000076da13b0 5 bytes JMP 0000000076f00450

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                            0000000076da1510 5 bytes JMP 0000000076f00370

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                 0000000076da1560 5 bytes JMP 0000000076f00470

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                       0000000076da1570 5 bytes JMP 0000000076f003e0

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                            0000000076da1620 5 bytes JMP 0000000076f00320

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                     0000000076da1650 5 bytes JMP 0000000076f003b0

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                        0000000076da1670 5 bytes JMP 0000000076f00390

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                              0000000076da16b0 5 bytes JMP 0000000076f002e0

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                            0000000076da1730 5 bytes JMP 0000000076f002d0

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                          0000000076da1750 5 bytes JMP 0000000076f00310

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                           0000000076da1790 5 bytes JMP 0000000076f003c0

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                        0000000076da17e0 5 bytes JMP 0000000076f003f0

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                           0000000076da1940 5 bytes JMP 0000000076f00230

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                0000000076da1b00 5 bytes JMP 0000000076f00480

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                               0000000076da1b30 5 bytes JMP 0000000076f003a0

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                        0000000076da1c10 5 bytes JMP 0000000076f002f0

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                     0000000076da1c20 5 bytes JMP 0000000076f00350

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                           0000000076da1c80 5 bytes JMP 0000000076f00290

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                        0000000076da1d10 5 bytes JMP 0000000076f002b0

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                         0000000076da1d30 5 bytes JMP 0000000076f003d0

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                            0000000076da1d40 5 bytes JMP 0000000076f00330

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                     0000000076da1db0 5 bytes JMP 0000000076f00410

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                        0000000076da1de0 5 bytes JMP 0000000076f00240

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                             0000000076da20a0 5 bytes JMP 0000000076f001e0

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                        0000000076da2160 5 bytes JMP 0000000076f00250

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                        0000000076da2190 5 bytes JMP 0000000076f00490

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                               0000000076da21a0 5 bytes JMP 0000000076f004a0

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                          0000000076da21d0 5 bytes JMP 0000000076f00300

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                       0000000076da21e0 5 bytes JMP 0000000076f00360

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                             0000000076da2240 5 bytes JMP 0000000076f002a0

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                          0000000076da2290 5 bytes JMP 0000000076f002c0

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                             0000000076da22c0 5 bytes JMP 0000000076f00380

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                              0000000076da22d0 5 bytes JMP 0000000076f00340

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                       0000000076da25c0 5 bytes JMP 0000000076f00440

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                      0000000076da27c0 5 bytes JMP 0000000076f00260

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                         0000000076da27d0 5 bytes JMP 0000000076f00270

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                       0000000076da27e0 5 bytes JMP 0000000076f00400

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                   0000000076da29a0 5 bytes JMP 0000000076f001f0

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                    0000000076da29b0 5 bytes JMP 0000000076f00210

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                         0000000076da2a20 5 bytes JMP 0000000076f00200

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                         0000000076da2a80 5 bytes JMP 0000000076f00420

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                          0000000076da2a90 5 bytes JMP 0000000076f00430

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                     0000000076da2aa0 5 bytes JMP 0000000076f00220

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                             0000000076da2b80 5 bytes JMP 0000000076f00280

.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                  0000000076b8eecd 1 byte [62]

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                    0000000076da1360 5 bytes JMP 0000000076f00460

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                             0000000076da13b0 5 bytes JMP 0000000076f00450

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                             0000000076da1510 5 bytes JMP 0000000076f00370

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                  0000000076da1560 5 bytes JMP 0000000076f00470

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                        0000000076da1570 5 bytes JMP 0000000076f003e0

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                             0000000076da1620 5 bytes JMP 0000000076f00320

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                      0000000076da1650 5 bytes JMP 0000000076f003b0

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                         0000000076da1670 5 bytes JMP 0000000076f00390

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                               0000000076da16b0 5 bytes JMP 0000000076f002e0

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                             0000000076da1730 5 bytes JMP 0000000076f002d0

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                           0000000076da1750 5 bytes JMP 0000000076f00310

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                            0000000076da1790 5 bytes JMP 0000000076f003c0

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                         0000000076da17e0 5 bytes JMP 0000000076f003f0

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                            0000000076da1940 5 bytes JMP 0000000076f00230

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                 0000000076da1b00 5 bytes JMP 0000000076f00480

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                0000000076da1b30 5 bytes JMP 0000000076f003a0

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                         0000000076da1c10 5 bytes JMP 0000000076f002f0

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                      0000000076da1c20 5 bytes JMP 0000000076f00350

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                            0000000076da1c80 5 bytes JMP 0000000076f00290

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                         0000000076da1d10 5 bytes JMP 0000000076f002b0

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                          0000000076da1d30 5 bytes JMP 0000000076f003d0

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                             0000000076da1d40 5 bytes JMP 0000000076f00330

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                      0000000076da1db0 5 bytes JMP 0000000076f00410

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                         0000000076da1de0 5 bytes JMP 0000000076f00240

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                              0000000076da20a0 5 bytes JMP 0000000076f001e0

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                         0000000076da2160 5 bytes JMP 0000000076f00250

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                         0000000076da2190 5 bytes JMP 0000000076f00490

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                0000000076da21a0 5 bytes JMP 0000000076f004a0

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                           0000000076da21d0 5 bytes JMP 0000000076f00300

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                        0000000076da21e0 5 bytes JMP 0000000076f00360

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                              0000000076da2240 5 bytes JMP 0000000076f002a0

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                           0000000076da2290 5 bytes JMP 0000000076f002c0

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                              0000000076da22c0 5 bytes JMP 0000000076f00380

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                               0000000076da22d0 5 bytes JMP 0000000076f00340

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                        0000000076da25c0 5 bytes JMP 0000000076f00440

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                       0000000076da27c0 5 bytes JMP 0000000076f00260

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                          0000000076da27d0 5 bytes JMP 0000000076f00270

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                        0000000076da27e0 5 bytes JMP 0000000076f00400

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                    0000000076da29a0 5 bytes JMP 0000000076f001f0

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                     0000000076da29b0 5 bytes JMP 0000000076f00210

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                          0000000076da2a20 5 bytes JMP 0000000076f00200

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                          0000000076da2a80 5 bytes JMP 0000000076f00420

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                           0000000076da2a90 5 bytes JMP 0000000076f00430

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                      0000000076da2aa0 5 bytes JMP 0000000076f00220

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                              0000000076da2b80 5 bytes JMP 0000000076f00280

.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                   0000000076b8eecd 1 byte [62]

.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                 0000000075dca2ba 1 byte [62]

.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322                                      00000000747d1a22 2 bytes [7D, 74]

.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496                                      00000000747d1ad0 2 bytes [7D, 74]

.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552                                      00000000747d1b08 2 bytes [7D, 74]

.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730                                      00000000747d1bba 2 bytes [7D, 74]

.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762                                      00000000747d1bda 2 bytes [7D, 74]

.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 18                               0000000074aa1402 1 byte [74]

.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 18                                 0000000074aa141a 1 byte [74]

.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 18                               0000000074aa1432 1 byte [74]

.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 43                               0000000074aa144b 1 byte [74]

.text  ...                                                                                                                          * 9

.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 18                                  0000000074aa14de 1 byte [74]

.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 18                           0000000074aa14f6 1 byte [74]

.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 18                                  0000000074aa150e 1 byte [74]

.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 18                           0000000074aa1526 1 byte [74]

.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 18                                 0000000074aa153e 1 byte [74]

.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 18                                      0000000074aa1556 1 byte [74]

.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 18                               0000000074aa156e 1 byte [74]

.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 18                                 0000000074aa1586 1 byte [74]

.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 18                                    0000000074aa159e 1 byte [74]

.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 18                                 0000000074aa15b6 1 byte [74]

.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 18                               0000000074aa15ce 1 byte [74]

.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 21                           0000000074aa16b3 1 byte [74]

.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 32                           0000000074aa16be 1 byte [74]

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                  0000000076da1360 5 bytes JMP 0000000076f00460

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                           0000000076da13b0 5 bytes JMP 0000000076f00450

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                           0000000076da1510 5 bytes JMP 0000000076f00370

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                0000000076da1560 5 bytes JMP 0000000076f00470

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                      0000000076da1570 5 bytes JMP 0000000076f003e0

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                           0000000076da1620 5 bytes JMP 0000000076f00320

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                    0000000076da1650 5 bytes JMP 0000000076f003b0

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                       0000000076da1670 5 bytes JMP 0000000076f00390

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                             0000000076da16b0 5 bytes JMP 0000000076f002e0

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                           0000000076da1730 5 bytes JMP 0000000076f002d0

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                         0000000076da1750 5 bytes JMP 0000000076f00310

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                          0000000076da1790 5 bytes JMP 0000000076f003c0

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                       0000000076da17e0 5 bytes JMP 0000000076f003f0

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                          0000000076da1940 5 bytes JMP 0000000076f00230

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                               0000000076da1b00 5 bytes JMP 0000000076f00480

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                              0000000076da1b30 5 bytes JMP 0000000076f003a0

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                       0000000076da1c10 5 bytes JMP 0000000076f002f0

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                    0000000076da1c20 5 bytes JMP 0000000076f00350

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                          0000000076da1c80 5 bytes JMP 0000000076f00290

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                       0000000076da1d10 5 bytes JMP 0000000076f002b0

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                        0000000076da1d30 5 bytes JMP 0000000076f003d0

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                           0000000076da1d40 5 bytes JMP 0000000076f00330

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                    0000000076da1db0 5 bytes JMP 0000000076f00410

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                       0000000076da1de0 5 bytes JMP 0000000076f00240

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                            0000000076da20a0 5 bytes JMP 0000000076f001e0

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                       0000000076da2160 5 bytes JMP 0000000076f00250

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                       0000000076da2190 5 bytes JMP 0000000076f00490

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                              0000000076da21a0 5 bytes JMP 0000000076f004a0

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                         0000000076da21d0 5 bytes JMP 0000000076f00300

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                      0000000076da21e0 5 bytes JMP 0000000076f00360

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                            0000000076da2240 5 bytes JMP 0000000076f002a0

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                         0000000076da2290 5 bytes JMP 0000000076f002c0

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                            0000000076da22c0 5 bytes JMP 0000000076f00380

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                             0000000076da22d0 5 bytes JMP 0000000076f00340

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                      0000000076da25c0 5 bytes JMP 0000000076f00440

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                     0000000076da27c0 5 bytes JMP 0000000076f00260

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                        0000000076da27d0 5 bytes JMP 0000000076f00270

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                      0000000076da27e0 5 bytes JMP 0000000076f00400

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                  0000000076da29a0 5 bytes JMP 0000000076f001f0

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                   0000000076da29b0 5 bytes JMP 0000000076f00210

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                        0000000076da2a20 5 bytes JMP 0000000076f00200

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                        0000000076da2a80 5 bytes JMP 0000000076f00420

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                         0000000076da2a90 5 bytes JMP 0000000076f00430

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                    0000000076da2aa0 5 bytes JMP 0000000076f00220

.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                            0000000076da2b80 5 bytes JMP 0000000076f00280

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                       0000000076da1360 5 bytes JMP 0000000076f00460

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                0000000076da13b0 5 bytes JMP 0000000076f00450

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                0000000076da1510 5 bytes JMP 0000000076f00370

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                     0000000076da1560 5 bytes JMP 0000000076f00470

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                           0000000076da1570 5 bytes JMP 0000000076f003e0

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                0000000076da1620 5 bytes JMP 0000000076f00320

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                         0000000076da1650 5 bytes JMP 0000000076f003b0

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                            0000000076da1670 5 bytes JMP 0000000076f00390

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                  0000000076da16b0 5 bytes JMP 0000000076f002e0

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                0000000076da1730 5 bytes JMP 0000000076f002d0

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                              0000000076da1750 5 bytes JMP 0000000076f00310

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                               0000000076da1790 5 bytes JMP 0000000076f003c0

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                            0000000076da17e0 5 bytes JMP 0000000076f003f0

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                               0000000076da1940 5 bytes JMP 0000000076f00230

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                    0000000076da1b00 5 bytes JMP 0000000076f00480

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                   0000000076da1b30 5 bytes JMP 0000000076f003a0

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                            0000000076da1c10 5 bytes JMP 0000000076f002f0

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                         0000000076da1c20 5 bytes JMP 0000000076f00350

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                               0000000076da1c80 5 bytes JMP 0000000076f00290

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                            0000000076da1d10 5 bytes JMP 0000000076f002b0

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                             0000000076da1d30 5 bytes JMP 0000000076f003d0

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                0000000076da1d40 5 bytes JMP 0000000076f00330

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                         0000000076da1db0 5 bytes JMP 0000000076f00410

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                            0000000076da1de0 5 bytes JMP 0000000076f00240

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                 0000000076da20a0 5 bytes JMP 0000000076f001e0

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                            0000000076da2160 5 bytes JMP 0000000076f00250

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                            0000000076da2190 5 bytes JMP 0000000076f00490

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                   0000000076da21a0 5 bytes JMP 0000000076f004a0

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                              0000000076da21d0 5 bytes JMP 0000000076f00300

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                           0000000076da21e0 5 bytes JMP 0000000076f00360

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                 0000000076da2240 5 bytes JMP 0000000076f002a0

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                              0000000076da2290 5 bytes JMP 0000000076f002c0

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                 0000000076da22c0 5 bytes JMP 0000000076f00380

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                  0000000076da22d0 5 bytes JMP 0000000076f00340

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                           0000000076da25c0 5 bytes JMP 0000000076f00440

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                          0000000076da27c0 5 bytes JMP 0000000076f00260

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                             0000000076da27d0 5 bytes JMP 0000000076f00270

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                           0000000076da27e0 5 bytes JMP 0000000076f00400

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                       0000000076da29a0 5 bytes JMP 0000000076f001f0

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                        0000000076da29b0 5 bytes JMP 0000000076f00210

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                             0000000076da2a20 5 bytes JMP 0000000076f00200

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                             0000000076da2a80 5 bytes JMP 0000000076f00420

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                              0000000076da2a90 5 bytes JMP 0000000076f00430

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                         0000000076da2aa0 5 bytes JMP 0000000076f00220

.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                 0000000076da2b80 5 bytes JMP 0000000076f00280

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                           0000000076da1360 5 bytes JMP 0000000076f00460

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                    0000000076da13b0 5 bytes JMP 0000000076f00450

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                    0000000076da1510 5 bytes JMP 0000000076f00370

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                         0000000076da1560 5 bytes JMP 0000000076f00470

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                               0000000076da1570 5 bytes JMP 0000000076f003e0

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                    0000000076da1620 5 bytes JMP 0000000076f00320

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                             0000000076da1650 5 bytes JMP 0000000076f003b0

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                0000000076da1670 5 bytes JMP 0000000076f00390

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                      0000000076da16b0 5 bytes JMP 0000000076f002e0

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                    0000000076da1730 5 bytes JMP 0000000076f002d0

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                  0000000076da1750 5 bytes JMP 0000000076f00310

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                   0000000076da1790 5 bytes JMP 0000000076f003c0

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                0000000076da17e0 5 bytes JMP 0000000076f003f0

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                   0000000076da1940 5 bytes JMP 0000000076f00230

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                        0000000076da1b00 5 bytes JMP 0000000076f00480

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                       0000000076da1b30 5 bytes JMP 0000000076f003a0

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                0000000076da1c10 5 bytes JMP 0000000076f002f0

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                             0000000076da1c20 5 bytes JMP 0000000076f00350

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                   0000000076da1c80 5 bytes JMP 0000000076f00290

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                0000000076da1d10 5 bytes JMP 0000000076f002b0

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                 0000000076da1d30 5 bytes JMP 0000000076f003d0

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                    0000000076da1d40 5 bytes JMP 0000000076f00330

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                             0000000076da1db0 5 bytes JMP 0000000076f00410

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                0000000076da1de0 5 bytes JMP 0000000076f00240

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                     0000000076da20a0 5 bytes JMP 0000000076f001e0

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                0000000076da2160 5 bytes JMP 0000000076f00250

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                0000000076da2190 5 bytes JMP 0000000076f00490

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                       0000000076da21a0 5 bytes JMP 0000000076f004a0

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                  0000000076da21d0 5 bytes JMP 0000000076f00300

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                               0000000076da21e0 5 bytes JMP 0000000076f00360

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                     0000000076da2240 5 bytes JMP 0000000076f002a0

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                  0000000076da2290 5 bytes JMP 0000000076f002c0

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                     0000000076da22c0 5 bytes JMP 0000000076f00380

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                      0000000076da22d0 5 bytes JMP 0000000076f00340

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                               0000000076da25c0 5 bytes JMP 0000000076f00440

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                              0000000076da27c0 5 bytes JMP 0000000076f00260

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                 0000000076da27d0 5 bytes JMP 0000000076f00270

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                               0000000076da27e0 5 bytes JMP 0000000076f00400

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                           0000000076da29a0 5 bytes JMP 0000000076f001f0

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                            0000000076da29b0 5 bytes JMP 0000000076f00210

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                 0000000076da2a20 5 bytes JMP 0000000076f00200

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                 0000000076da2a80 5 bytes JMP 0000000076f00420

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                  0000000076da2a90 5 bytes JMP 0000000076f00430

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                             0000000076da2aa0 5 bytes JMP 0000000076f00220

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                     0000000076da2b80 5 bytes JMP 0000000076f00280

.text  C:\Windows\Explorer.EXE[2476] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                          0000000076b8eecd 1 byte [62]

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                   0000000076da1360 5 bytes JMP 0000000076f00460

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                            0000000076da13b0 5 bytes JMP 0000000076f00450

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                            0000000076da1510 5 bytes JMP 0000000076f00370

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                 0000000076da1560 5 bytes JMP 0000000076f00470

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                       0000000076da1570 5 bytes JMP 0000000076f003e0

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                            0000000076da1620 5 bytes JMP 0000000076f00320

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                     0000000076da1650 5 bytes JMP 0000000076f003b0

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                        0000000076da1670 5 bytes JMP 0000000076f00390

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                              0000000076da16b0 5 bytes JMP 0000000076f002e0

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                            0000000076da1730 5 bytes JMP 0000000076f002d0

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                          0000000076da1750 5 bytes JMP 0000000076f00310

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                           0000000076da1790 5 bytes JMP 0000000076f003c0

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                        0000000076da17e0 5 bytes JMP 0000000076f003f0

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                           0000000076da1940 5 bytes JMP 0000000076f00230

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                0000000076da1b00 5 bytes JMP 0000000076f00480

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject               0000000076da1b30 5 bytes JMP 0000000076f003a0

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                        0000000076da1c10 5 bytes JMP 0000000076f002f0

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                     0000000076da1c20 5 bytes JMP 0000000076f00350

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                           0000000076da1c80 5 bytes JMP 0000000076f00290

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                        0000000076da1d10 5 bytes JMP 0000000076f002b0

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                         0000000076da1d30 5 bytes JMP 0000000076f003d0

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                            0000000076da1d40 5 bytes JMP 0000000076f00330

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                     0000000076da1db0 5 bytes JMP 0000000076f00410

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                        0000000076da1de0 5 bytes JMP 0000000076f00240

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                             0000000076da20a0 5 bytes JMP 0000000076f001e0

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                        0000000076da2160 5 bytes JMP 0000000076f00250

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                        0000000076da2190 5 bytes JMP 0000000076f00490

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys               0000000076da21a0 5 bytes JMP 0000000076f004a0

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                          0000000076da21d0 5 bytes JMP 0000000076f00300

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                       0000000076da21e0 5 bytes JMP 0000000076f00360

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                             0000000076da2240 5 bytes JMP 0000000076f002a0

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                          0000000076da2290 5 bytes JMP 0000000076f002c0

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                             0000000076da22c0 5 bytes JMP 0000000076f00380

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                              0000000076da22d0 5 bytes JMP 0000000076f00340

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                       0000000076da25c0 5 bytes JMP 0000000076f00440

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                      0000000076da27c0 5 bytes JMP 0000000076f00260

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                         0000000076da27d0 5 bytes JMP 0000000076f00270

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                       0000000076da27e0 5 bytes JMP 0000000076f00400

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                   0000000076da29a0 5 bytes JMP 0000000076f001f0

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                    0000000076da29b0 5 bytes JMP 0000000076f00210

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                         0000000076da2a20 5 bytes JMP 0000000076f00200

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                         0000000076da2a80 5 bytes JMP 0000000076f00420

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                          0000000076da2a90 5 bytes JMP 0000000076f00430

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                     0000000076da2aa0 5 bytes JMP 0000000076f00220

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                             0000000076da2b80 5 bytes JMP 0000000076f00280

.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                  0000000076b8eecd 1 byte [62]

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort            0000000076da1360 5 bytes JMP 0000000076f00460

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                     0000000076da13b0 5 bytes JMP 0000000076f00450

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                     0000000076da1510 5 bytes JMP 0000000076f00370

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx          0000000076da1560 5 bytes JMP 0000000076f00470

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                0000000076da1570 5 bytes JMP 0000000076f003e0

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                     0000000076da1620 5 bytes JMP 0000000076f00320

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory              0000000076da1650 5 bytes JMP 0000000076f003b0

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                 0000000076da1670 5 bytes JMP 0000000076f00390

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                       0000000076da16b0 5 bytes JMP 0000000076f002e0

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                     0000000076da1730 5 bytes JMP 0000000076f002d0

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                   0000000076da1750 5 bytes JMP 0000000076f00310

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                    0000000076da1790 5 bytes JMP 0000000076f003c0

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                 0000000076da17e0 5 bytes JMP 0000000076f003f0

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                    0000000076da1940 5 bytes JMP 0000000076f00230

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort         0000000076da1b00 5 bytes JMP 0000000076f00480

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject        0000000076da1b30 5 bytes JMP 0000000076f003a0

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                 0000000076da1c10 5 bytes JMP 0000000076f002f0

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion              0000000076da1c20 5 bytes JMP 0000000076f00350

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                    0000000076da1c80 5 bytes JMP 0000000076f00290

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                 0000000076da1d10 5 bytes JMP 0000000076f002b0

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                  0000000076da1d30 5 bytes JMP 0000000076f003d0

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                     0000000076da1d40 5 bytes JMP 0000000076f00330

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess              0000000076da1db0 5 bytes JMP 0000000076f00410

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                 0000000076da1de0 5 bytes JMP 0000000076f00240

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                      0000000076da20a0 5 bytes JMP 0000000076f001e0

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                 0000000076da2160 5 bytes JMP 0000000076f00250

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                 0000000076da2190 5 bytes JMP 0000000076f00490

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys        0000000076da21a0 5 bytes JMP 0000000076f004a0

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                   0000000076da21d0 5 bytes JMP 0000000076f00300

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                0000000076da21e0 5 bytes JMP 0000000076f00360

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                      0000000076da2240 5 bytes JMP 0000000076f002a0

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                   0000000076da2290 5 bytes JMP 0000000076f002c0

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                      0000000076da22c0 5 bytes JMP 0000000076f00380

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                       0000000076da22d0 5 bytes JMP 0000000076f00340

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                0000000076da25c0 5 bytes JMP 0000000076f00440

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder               0000000076da27c0 5 bytes JMP 0000000076f00260

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                  0000000076da27d0 5 bytes JMP 0000000076f00270

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                0000000076da27e0 5 bytes JMP 0000000076f00400

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation            0000000076da29a0 5 bytes JMP 0000000076f001f0

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState             0000000076da29b0 5 bytes JMP 0000000076f00210

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                  0000000076da2a20 5 bytes JMP 0000000076f00200

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                  0000000076da2a80 5 bytes JMP 0000000076f00420

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                   0000000076da2a90 5 bytes JMP 0000000076f00430

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl              0000000076da2aa0 5 bytes JMP 0000000076f00220

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                      0000000076da2b80 5 bytes JMP 0000000076f00280

.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189           0000000076b8eecd 1 byte [62]

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort      0000000076da1360 5 bytes JMP 0000000076f00460

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject               0000000076da13b0 5 bytes JMP 0000000076f00450

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess               0000000076da1510 5 bytes JMP 0000000076f00370

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx    0000000076da1560 5 bytes JMP 0000000076f00470

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess          0000000076da1570 5 bytes JMP 0000000076f003e0

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection               0000000076da1620 5 bytes JMP 0000000076f00320

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory        0000000076da1650 5 bytes JMP 0000000076f003b0

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject           0000000076da1670 5 bytes JMP 0000000076f00390

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                 0000000076da16b0 5 bytes JMP 0000000076f002e0

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent               0000000076da1730 5 bytes JMP 0000000076f002d0

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection             0000000076da1750 5 bytes JMP 0000000076f00310

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread              0000000076da1790 5 bytes JMP 0000000076f003c0

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread           0000000076da17e0 5 bytes JMP 0000000076f003f0

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry              0000000076da1940 5 bytes JMP 0000000076f00230

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort   0000000076da1b00 5 bytes JMP 0000000076f00480

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject  0000000076da1b30 5 bytes JMP 0000000076f003a0

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair           0000000076da1c10 5 bytes JMP 0000000076f002f0

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion        0000000076da1c20 5 bytes JMP 0000000076f00350

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant              0000000076da1c80 5 bytes JMP 0000000076f00290

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore           0000000076da1d10 5 bytes JMP 0000000076f002b0

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx            0000000076da1d30 5 bytes JMP 0000000076f003d0

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer               0000000076da1d40 5 bytes JMP 0000000076f00330

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess        0000000076da1db0 5 bytes JMP 0000000076f00410

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry           0000000076da1de0 5 bytes JMP 0000000076f00240

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                0000000076da20a0 5 bytes JMP 0000000076f001e0

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry           0000000076da2160 5 bytes JMP 0000000076f00250

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey           0000000076da2190 5 bytes JMP 0000000076f00490

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys  0000000076da21a0 5 bytes JMP 0000000076f004a0

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair             0000000076da21d0 5 bytes JMP 0000000076f00300

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion          0000000076da21e0 5 bytes JMP 0000000076f00360

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                0000000076da2240 5 bytes JMP 0000000076f002a0

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore             0000000076da2290 5 bytes JMP 0000000076f002c0

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                0000000076da22c0 5 bytes JMP 0000000076f00380

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                 0000000076da22d0 5 bytes JMP 0000000076f00340

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx          0000000076da25c0 5 bytes JMP 0000000076f00440

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder         0000000076da27c0 5 bytes JMP 0000000076f00260

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions            0000000076da27d0 5 bytes JMP 0000000076f00270

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread          0000000076da27e0 5 bytes JMP 0000000076f00400

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation      0000000076da29a0 5 bytes JMP 0000000076f001f0

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState       0000000076da29b0 5 bytes JMP 0000000076f00210

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem            0000000076da2a20 5 bytes JMP 0000000076f00200

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess            0000000076da2a80 5 bytes JMP 0000000076f00420

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread             0000000076da2a90 5 bytes JMP 0000000076f00430

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl        0000000076da2aa0 5 bytes JMP 0000000076f00220

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                0000000076da2b80 5 bytes JMP 0000000076f00280

.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189     0000000076b8eecd 1 byte [62]

.text  C:\Programme\Razer\Naga\RazerNagaSysTray.exe[3116] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                     0000000075dca2ba 1 byte [62]

.text  C:\Program Files\AVAST Software\Avast\AvastUI.exe[3124] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                0000000075dca2ba 1 byte [62]

.text  C:\ProgrammeVirtualCloneDrive\VCDDaemon.exe[3144] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                      0000000075dca2ba 1 byte [62]

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                             0000000076da1360 5 bytes JMP 0000000076f00460

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                      0000000076da13b0 5 bytes JMP 0000000076f00450

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                      0000000076da1510 5 bytes JMP 0000000076f00370

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                           0000000076da1560 5 bytes JMP 0000000076f00470

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                 0000000076da1570 5 bytes JMP 0000000076f003e0

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                      0000000076da1620 5 bytes JMP 0000000076f00320

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                               0000000076da1650 5 bytes JMP 0000000076f003b0

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                  0000000076da1670 5 bytes JMP 0000000076f00390

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                        0000000076da16b0 5 bytes JMP 0000000076f002e0

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                      0000000076da1730 5 bytes JMP 0000000076f002d0

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                    0000000076da1750 5 bytes JMP 0000000076f00310

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                     0000000076da1790 5 bytes JMP 0000000076f003c0

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                  0000000076da17e0 5 bytes JMP 0000000076f003f0

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                     0000000076da1940 5 bytes JMP 0000000076f00230

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                          0000000076da1b00 5 bytes JMP 0000000076f00480

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                         0000000076da1b30 5 bytes JMP 0000000076f003a0

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                  0000000076da1c10 5 bytes JMP 0000000076f002f0

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                               0000000076da1c20 5 bytes JMP 0000000076f00350

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                     0000000076da1c80 5 bytes JMP 0000000076f00290

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                  0000000076da1d10 5 bytes JMP 0000000076f002b0

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                   0000000076da1d30 5 bytes JMP 0000000076f003d0

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                      0000000076da1d40 5 bytes JMP 0000000076f00330

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                               0000000076da1db0 5 bytes JMP 0000000076f00410

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                  0000000076da1de0 5 bytes JMP 0000000076f00240

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                       0000000076da20a0 5 bytes JMP 0000000076f001e0

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                  0000000076da2160 5 bytes JMP 0000000076f00250

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                  0000000076da2190 5 bytes JMP 0000000076f00490

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                         0000000076da21a0 5 bytes JMP 0000000076f004a0

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                    0000000076da21d0 5 bytes JMP 0000000076f00300

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                 0000000076da21e0 5 bytes JMP 0000000076f00360

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                       0000000076da2240 5 bytes JMP 0000000076f002a0

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                    0000000076da2290 5 bytes JMP 0000000076f002c0

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                       0000000076da22c0 5 bytes JMP 0000000076f00380

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                        0000000076da22d0 5 bytes JMP 0000000076f00340

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                 0000000076da25c0 5 bytes JMP 0000000076f00440

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                0000000076da27c0 5 bytes JMP 0000000076f00260

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                   0000000076da27d0 5 bytes JMP 0000000076f00270

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                 0000000076da27e0 5 bytes JMP 0000000076f00400

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                             0000000076da29a0 5 bytes JMP 0000000076f001f0

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                              0000000076da29b0 5 bytes JMP 0000000076f00210

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                   0000000076da2a20 5 bytes JMP 0000000076f00200

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                   0000000076da2a80 5 bytes JMP 0000000076f00420

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                    0000000076da2a90 5 bytes JMP 0000000076f00430

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                               0000000076da2aa0 5 bytes JMP 0000000076f00220

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                       0000000076da2b80 5 bytes JMP 0000000076f00280

.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                            0000000076b8eecd 1 byte [62]

.text  C:\Users\Raubtier\Desktop\gmer_2.1.19163.exe[2536] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                     0000000075dca2ba 1 byte [62]
 

---- EOF - GMER 2.1 ----

Die Gmer text musste ich aufteilen in 2 posts. Hier noch die defogger log:

Code:

defogger_disable by jpshortstuff (23.02.10.1)

Log created at 13:21 on 11/01/2014 (Raubtier)
 

Checking for autostart values...

HKCU\~\Run values retrieved.

HKLM\~\Run values retrieved.

HKCU:DAEMON Tools Lite -> Removed
 

Checking for services/drivers...
 
 

-=E.O.F=-

Hoffentlich hab ich nichts vergessen. Vielen Dank.

LG

Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1

WICHTIG - Speichere Combofix auf deinem Desktop

Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Hallo Schrauber,

erstmal Danke für Deine Antwort. Ich konnte es mir ja nicht nehmen lassen, die halbe Nacht an meinem Rechner rumzuspielen. Habe Scans probiert, habe die Registry und auch mein System mal durchforstet. Ich habe mein System, also c: Ende Dezember mit win 7 neu aufgesetzt, also können dort ja auch nur Dateien mit einem Datum von frühestens 29.12.`13 glaube ich sein. Da sind aber auch ältere und merkwürdige Einträge. Als ob ich auf einem emulierten System arbeite und parrallel versteckt noch ein zweites läuft. Ich bin da nicht so versiert und das sind nur wage Vermutungen, aber ich bin doch nicht doof, irgendwas ist da doch.
Hier jetzt die combofix für Dich:

Code:

ComboFix 14-01-08.03 - Raubtier 12.01.2014  13:36:19.1.4 - x64

Microsoft Windows 7 Ultimate   6.1.7601.1.1252.49.1031.18.8173.6028 [GMT 1:00]

ausgeführt von:: c:\users\Raubtier\Desktop\ComboFix.exe

AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}

AV: Microsoft Security Essentials *Disabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}

SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

SP: Microsoft Security Essentials *Disabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

(((((((((((((((((((((((   Dateien erstellt von 2013-12-12 bis 2014-01-12  ))))))))))))))))))))))))))))))

.

.

2014-01-12 12:40 . 2014-01-12 12:40        --------        d-----w-        c:\users\Default\AppData\Local\temp

2014-01-11 23:13 . 2014-01-11 23:13        82744        ----a-w-        c:\windows\system32\drivers\aswStm.sys

2014-01-11 23:13 . 2014-01-11 23:13        207904        ----a-w-        c:\windows\system32\drivers\aswVmm.sys

2014-01-11 23:13 . 2014-01-11 23:13        65776        ----a-w-        c:\windows\system32\drivers\aswRvrt.sys

2014-01-11 23:13 . 2014-01-11 23:13        1034464        ----a-w-        c:\windows\system32\drivers\aswSnx.sys

2014-01-11 23:13 . 2014-01-11 23:13        78648        ----a-w-        c:\windows\system32\drivers\aswMonFlt.sys

2014-01-11 23:13 . 2014-01-11 23:13        422216        ----a-w-        c:\windows\system32\drivers\aswSP.sys

2014-01-11 23:13 . 2014-01-11 23:13        92544        ----a-w-        c:\windows\system32\drivers\aswRdr2.sys

2014-01-11 23:13 . 2014-01-11 23:13        334136        ----a-w-        c:\windows\system32\aswBoot.exe

2014-01-11 23:13 . 2014-01-11 23:13        43152        ----a-w-        c:\windows\avastSS.scr

2014-01-11 22:44 . 2014-01-11 22:44        --------        d-----w-        C:\Temp

2014-01-11 17:01 . 2009-06-18 11:54        6144        ------w-        c:\windows\system32\535E.tmp

2014-01-11 12:22 . 2014-01-11 12:22        --------        d-----w-        C:\FRST

2014-01-11 11:47 . 2014-01-11 11:47        --------        d-----w-        c:\program files (x86)\Sophos

2014-01-11 01:07 . 2014-01-11 01:07        --------        d-----w-        c:\program files\AVAST Software

2014-01-11 01:07 . 2014-01-11 01:07        --------        d-----w-        c:\programdata\AVAST Software

2014-01-10 21:13 . 2013-12-03 18:28        10315576        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A33A6787-DD79-4F95-875E-3F3EBB942972}\mpengine.dll

2014-01-10 21:01 . 2013-12-03 18:28        10315576        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2014-01-07 11:56 . 2014-01-07 11:56        --------        d-----w-        c:\program files (x86)\Microsoft SQL Server Compact Edition

2014-01-07 11:55 . 2014-01-07 11:55        --------        d-----w-        c:\windows\PCHEALTH

2014-01-07 11:55 . 2014-01-10 21:00        --------        d-----w-        c:\program files (x86)\Windows Live

2014-01-07 11:51 . 2014-01-07 11:51        --------        d-----w-        c:\programdata\Microsoft SkyDrive

2014-01-07 11:50 . 2014-01-07 11:50        --------        d-----w-        c:\program files (x86)\Common Files\Windows Live

2014-01-06 23:57 . 2014-01-06 23:57        --------        d-----w-        c:\program files\Usenet.nl

2014-01-03 20:18 . 2014-01-03 20:18        --------        d-----w-        c:\programdata\Malwarebytes

2014-01-03 20:18 . 2014-01-11 20:27        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2014-01-03 20:18 . 2013-04-04 13:50        25928        ----a-w-        c:\windows\system32\drivers\mbam.sys

2014-01-01 21:35 . 2014-01-01 21:35        --------        d-----w-        c:\program files\Microsoft Xbox 360 Accessories

2014-01-01 20:17 . 2014-01-01 20:17        --------        d-----r-        c:\program files (x86)\Skype

2014-01-01 20:17 . 2014-01-01 20:17        --------        d-----w-        c:\program files (x86)\Common Files\Skype

2014-01-01 20:17 . 2014-01-01 20:18        --------        d-----w-        c:\programdata\Skype

2013-12-30 18:28 . 2014-01-07 11:49        --------        d-----w-        c:\program files\HDDGURU LLF Tool

2013-12-30 11:34 . 2013-12-30 11:35        --------        d-----w-        c:\program files\Data Lifeguard Diagnostic for Windows

2013-12-30 05:35 . 2013-11-26 09:41        2764288        ----a-w-        c:\windows\system32\iertutil.dll

2013-12-30 05:28 . 2012-08-07 07:09        88832        ----a-w-        c:\windows\system32\drivers\EtronXHCI.sys

2013-12-30 05:28 . 2012-08-07 07:09        65152        ----a-w-        c:\windows\system32\drivers\EtronHub3.sys

2013-12-30 05:28 . 2013-12-30 05:28        --------        d-----w-        c:\program files (x86)\Etron Technology

2013-12-30 05:20 . 2013-12-30 05:20        --------        d-----w-        c:\windows\Migration

2013-12-30 05:19 . 2013-10-14 17:00        28368        ----a-w-        c:\windows\system32\IEUDINIT.EXE

2013-12-30 05:02 . 2010-02-23 08:16        294912        ----a-w-        c:\windows\system32\browserchoice.exe

2013-12-30 04:53 . 2013-10-12 02:32        150016        ----a-w-        c:\windows\system32\wshom.ocx

2013-12-30 04:53 . 2013-10-12 02:04        121856        ----a-w-        c:\windows\SysWow64\wshom.ocx

2013-12-30 04:53 . 2013-10-12 02:31        202752        ----a-w-        c:\windows\system32\scrrun.dll

2013-12-30 04:53 . 2013-10-12 02:03        163840        ----a-w-        c:\windows\SysWow64\scrrun.dll

2013-12-30 04:53 . 2013-10-12 01:33        156160        ----a-w-        c:\windows\system32\cscript.exe

2013-12-30 04:53 . 2013-10-12 01:33        168960        ----a-w-        c:\windows\system32\wscript.exe

2013-12-30 04:53 . 2013-10-12 01:15        141824        ----a-w-        c:\windows\SysWow64\wscript.exe

2013-12-30 04:53 . 2013-10-12 01:15        126976        ----a-w-        c:\windows\SysWow64\cscript.exe

2013-12-30 04:53 . 2013-10-12 02:30        830464        ----a-w-        c:\windows\system32\nshwfp.dll

2013-12-30 04:53 . 2013-10-12 02:29        859648        ----a-w-        c:\windows\system32\IKEEXT.DLL

2013-12-30 04:53 . 2013-10-12 02:29        324096        ----a-w-        c:\windows\system32\FWPUCLNT.DLL

2013-12-30 04:53 . 2013-10-12 02:03        656896        ----a-w-        c:\windows\SysWow64\nshwfp.dll

2013-12-30 04:53 . 2013-10-12 02:01        216576        ----a-w-        c:\windows\SysWow64\FWPUCLNT.DLL

2013-12-30 04:49 . 2012-06-02 22:19        2428952        ----a-w-        c:\windows\system32\wuaueng.dll

2013-12-30 04:49 . 2012-06-02 22:19        57880        ----a-w-        c:\windows\system32\wuauclt.exe

2013-12-30 04:49 . 2012-06-02 22:19        44056        ----a-w-        c:\windows\system32\wups2.dll

2013-12-30 04:49 . 2012-06-02 22:15        2622464        ----a-w-        c:\windows\system32\wucltux.dll

2013-12-30 04:49 . 2012-06-02 22:19        38424        ----a-w-        c:\windows\system32\wups.dll

2013-12-30 04:49 . 2012-06-02 22:19        701976        ----a-w-        c:\windows\system32\wuapi.dll

2013-12-30 04:49 . 2012-06-02 22:15        99840        ----a-w-        c:\windows\system32\wudriver.dll

2013-12-30 04:49 . 2012-06-02 14:19        186752        ----a-w-        c:\windows\system32\wuwebv.dll

2013-12-30 04:49 . 2012-06-02 14:15        36864        ----a-w-        c:\windows\system32\wuapp.exe

2013-12-29 21:28 . 2013-12-30 05:40        --------        d-----w-        c:\program files\Microsoft Silverlight

2013-12-29 21:28 . 2013-12-30 05:40        --------        d-----w-        c:\program files (x86)\Microsoft Silverlight

2013-12-29 21:25 . 2013-12-30 04:56        --------        d-----w-        c:\windows\system32\MRT

2013-12-29 19:26 . 2014-01-07 11:48        --------        d-----w-        c:\program files\CheckDrive

2013-12-29 15:14 . 2013-12-29 15:14        --------        d-----w-        c:\programdata\Steam

2013-12-29 15:04 . 2013-12-29 15:04        --------        d--h--w-        c:\program files (x86)\Common Files\EAInstaller

2013-12-29 15:04 . 2014-01-01 11:27        --------        d-----w-        c:\program files (x86)\Battlelog Web Plugins

2013-12-29 15:04 . 2014-01-01 21:17        214392        ----a-w-        c:\windows\SysWow64\PnkBstrB.exe

2013-12-29 15:04 . 2014-01-01 21:02        214392        ----a-w-        c:\windows\SysWow64\PnkBstrB.ex0

2013-12-29 15:04 . 2013-12-29 15:04        76888        ----a-w-        c:\windows\SysWow64\PnkBstrA.exe

2013-12-29 14:29 . 2013-12-29 14:29        283064        ----a-w-        c:\windows\system32\drivers\dtsoftbus01.sys

2013-12-29 14:29 . 2013-12-29 14:29        --------        d-----w-        c:\program files\DAEMON Tools Lite

2013-12-29 14:28 . 2013-12-29 14:54        --------        d-----w-        c:\programdata\DAEMON Tools Lite

2013-12-29 12:09 . 2013-12-29 12:09        70304        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2013-12-29 12:09 . 2013-12-29 12:09        419488        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2013-12-29 12:09 . 2013-12-29 12:09        --------        d-----w-        c:\windows\SysWow64\Macromed

2013-12-29 12:09 . 2013-12-29 12:09        --------        d-----w-        c:\programdata\Yahoo!

2013-12-29 12:09 . 2013-12-29 12:09        --------        d-----w-        c:\program files\Messenger

2013-12-29 12:07 . 2013-12-29 12:09        --------        d-----w-        c:\program files (x86)\Yahoo!

2013-12-29 12:05 . 2013-12-30 04:35        --------        d-----w-        c:\programdata\Razer

2013-12-29 12:02 . 2013-12-29 12:05        --------        d-----w-        c:\program files (x86)\Razer

2013-12-29 12:02 . 2013-12-29 12:02        --------        d-----w-        c:\program files\Razer

2013-12-29 11:57 . 2013-12-29 11:57        --------        d-----w-        c:\program files\TeamSpeak 3 Client

2013-12-29 11:49 . 2013-12-29 11:51        --------        d-----w-        c:\program files (x86)\Google

2013-12-29 11:30 . 2013-12-29 11:30        --------        d-----w-        c:\programdata\ATI

2013-12-29 11:29 . 2013-12-29 11:29        0        ----a-w-        c:\windows\ativpsrm.bin

2013-12-29 11:21 . 2014-01-10 21:00        --------        d-----w-        c:\program files (x86)\Common Files\Steam

2013-12-29 11:21 . 2014-01-10 21:00        --------        d-----w-        c:\program files\Steam

2013-12-29 11:21 . 2013-12-30 20:30        --------        d-----w-        c:\programdata\Origin

2013-12-29 11:21 . 2013-12-29 20:06        --------        d-----w-        c:\programdata\Electronic Arts

2013-12-29 11:20 . 2014-01-06 17:59        --------        d-----w-        c:\program files\Origin

2013-12-29 11:18 . 2013-12-29 11:18        --------        d-----w-        c:\program files\VLC

2013-12-29 11:17 . 2013-12-29 11:19        --------        d-----w-        c:\program files\WinRAR

2013-12-29 11:14 . 2013-12-29 11:14        965000        ------w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DA292B97-484F-4413-933C-B43DD988705D}\gapaengine.dll

2013-12-29 11:13 . 2013-12-29 11:13        --------        d-----w-        c:\program files (x86)\AMD APP

2013-12-29 11:13 . 2012-03-30 14:49        56448        ----a-w-        c:\windows\system32\drivers\usbfilter.sys

2013-12-29 11:13 . 2013-12-29 11:13        --------        dc----w-        c:\windows\system32\DRVSTORE

2013-12-29 11:12 . 2013-12-29 11:12        --------        d-----w-        c:\program files (x86)\Microsoft Security Client

2013-12-29 11:12 . 2013-12-29 11:13        --------        d-----w-        c:\program files\Microsoft Security Client

2013-12-29 11:08 . 2011-09-29 09:30        74272        ----a-w-        c:\windows\system32\RtNicProp64.dll

2013-12-29 11:08 . 2011-09-29 09:30        646248        ----a-w-        c:\windows\system32\drivers\Rt64win7.sys

2013-12-29 11:08 . 2011-09-29 09:30        107552        ----a-w-        c:\windows\system32\RTNUninst64.dll

2013-12-29 11:05 . 2013-12-29 11:05        --------        d-----w-        c:\program files\Common Files\ATI Technologies

2013-12-29 11:03 . 2013-12-29 15:04        --------        d-----w-        c:\programdata\Package Cache

2013-12-29 11:03 . 2013-12-29 11:03        --------        d-----w-        c:\program files\ATI

2013-12-29 11:02 . 2013-12-29 11:06        --------        d-----w-        c:\program files\AMD

2013-12-29 10:48 . 2013-12-29 10:48        --------        d-----w-        c:\program files (x86)\Microsoft.NET

2013-12-29 10:47 . 2014-01-10 21:00        --------        d-sh--w-        c:\windows\Installer

2013-12-29 10:39 . 2014-01-11 18:25        --------        d-----w-        c:\windows\Panther

2013-12-29 10:39 . 2014-01-11 22:44        --------        d-----w-        C:\Boot

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-12-06 15:49 . 2013-12-06 15:49        51200        ----a-w-        c:\windows\system32\kdbsdk64.dll

2013-12-06 15:44 . 2013-12-06 15:44        38912        ----a-w-        c:\windows\SysWow64\kdbsdk32.dll

2013-11-19 10:21 . 2010-11-21 03:27        267936        ------w-        c:\windows\system32\MpSigStub.exe

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"="c:\programme\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe" [2013-12-06 766208]

"Razer Naga Driver"="c:\programme\Razer\Naga\RazerNagaSysTray.exe" [2011-11-16 953232]

"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-01-11 3764024]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]

R3 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]

R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]

R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]

R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]

R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]

R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x]

R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys;c:\windows\SYSNATIVE\drivers\terminpt.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]

R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]

R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]

S0 aswRvrt;avast! Revert; [x]

S0 aswVmm;avast! VM Monitor; [x]

S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]

S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]

S2 AMD FUEL Service;AMD FUEL Service;c:\programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe;c:\programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe [x]

S2 AODDriver4.2.0;AODDriver4.2.0;c:\programme\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys;c:\programme\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys [x]

S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]

S3 EtronHub3;Etron USB 3.0 Extensible Hub Driver;c:\windows\system32\Drivers\EtronHub3.sys;c:\windows\SYSNATIVE\Drivers\EtronHub3.sys [x]

S3 EtronXHCI;Etron USB 3.0 Extensible Host Controller Driver;c:\windows\system32\Drivers\EtronXHCI.sys;c:\windows\SYSNATIVE\Drivers\EtronXHCI.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]

S3 RzSynapse;Razer Driver;c:\windows\system32\DRIVERS\RzSynapse.sys;c:\windows\SYSNATIVE\DRIVERS\RzSynapse.sys [x]

S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys;c:\windows\SYSNATIVE\DRIVERS\usbfilter.sys [x]

.

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2013-12-29 11:51        1210320        ----a-w-        c:\program files (x86)\Google\Chrome\Application\31.0.1650.63\Installer\chrmstp.exe

.

Inhalt des "geplante Tasks" Ordners

.

2014-01-12 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-29 12:09]

.

2014-01-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-12-29 11:49]

.

2014-01-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-12-29 11:49]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2014-01-11 23:13        287280        ----a-w-        c:\program files\AVAST Software\Avast\ashShA64.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-06-11 12503184]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-10-23 1266912]

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

TCP: DhcpNameServer = 192.168.2.1

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Wow6432Node-HKLM-Run-<NO NAME> - (no file)

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

AddRemove-Battlelog Web Plugins - c:\program files (x86)\Battlelog Web Plugins\uninstall.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2014-01-12  13:43:12

ComboFix-quarantined-files.txt  2014-01-12 12:43

.

Vor Suchlauf: 9 Verzeichnis(se), 99.185.618.944 Bytes frei

Nach Suchlauf: 14 Verzeichnis(se), 99.062.714.368 Bytes frei

.

- - End Of File - - 742D59DC396B8A00B23587C0FEAD0AB6

A36C5E4F47E84449FF07ED3517B43A31

Gruß,

B3AM3R

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Moin, moin, Schrauber,

hier mal die logs:

Code:

Malwarebytes Anti-Malware (Test) 1.75.0.1300

www.malwarebytes.org
 

Datenbank Version: v2014.01.12.05
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 11.0.9600.16476

Raubtier :: RAUBTIER-PC [Administrator]
 

Schutz: Aktiviert
 

13.01.2014 17:44:44

mbam-log-2014-01-13 (17-44-44).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|G:\|H:\|)

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM | P2P

Deaktivierte Suchlaufeinstellungen: 

Durchsuchte Objekte: 374013

Laufzeit: 36 Minute(n), 2 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Code:

# AdwCleaner v3.017 - Bericht erstellt am 14/01/2014 um 05:18:36

# Aktualisiert 12/01/2014 von Xplode

# Betriebssystem : Windows 7 Ultimate Service Pack 1 (64 bits)

# Benutzername : Raubtier - RAUBTIER-PC

# Gestartet von : C:\Users\Raubtier\Desktop\adwcleaner.exe

# Option : Suchen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 
 

***** [ Browser ] *****
 

-\\ Internet Explorer v11.0.9600.16428
 
 

-\\ Google Chrome v31.0.1650.63
 

[ Datei : C:\Users\Raubtier\AppData\Local\Google\Chrome\User Data\Default\preferences ]
 
 

*************************
 

AdwCleaner[R0].txt - [665 octets] - [14/01/2014 05:18:36]
 

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [724 octets] ##########

Code:

# AdwCleaner v3.017 - Bericht erstellt am 14/01/2014 um 05:22:18

# Aktualisiert 12/01/2014 von Xplode

# Betriebssystem : Windows 7 Ultimate Service Pack 1 (64 bits)

# Benutzername : Raubtier - RAUBTIER-PC

# Gestartet von : C:\Users\Raubtier\Desktop\adwcleaner.exe

# Option : Löschen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 
 

***** [ Browser ] *****
 

-\\ Internet Explorer v11.0.9600.16428
 
 

-\\ Google Chrome v31.0.1650.63
 

[ Datei : C:\Users\Raubtier\AppData\Local\Google\Chrome\User Data\Default\preferences ]
 
 

*************************
 

AdwCleaner[R0].txt - [803 octets] - [14/01/2014 05:18:36]

AdwCleaner[S0].txt - [725 octets] - [14/01/2014 05:22:18]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [784 octets] ##########

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.1.0 (01.07.2014:1)

OS: Windows 7 Ultimate x64

Ran by Raubtier on 14.01.2014 at  5:28:04,12

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 
 
 

~~~ Registry Keys
 
 
 

~~~ Files
 
 
 

~~~ Folders
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 14.01.2014 at  5:33:46,76

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Sag mal, bin ich nur paranoid und meine 2 Kerne sind tatsächlich kaputt oder ist da irgendwas? Process Explorer hat mir immer 4 Kerne angezeigt, jetzt nur noch zwei. Im System sagt er mir 2 logische, 2 virtuelle Kerne oder ähnlich. Ressourcenmonitor sagte 2 sind geparkt, habe aber 2 Microsoft updates installiert, die dies jetzt verhindern. Trotzdem nur 2 Kerne. Jedoch arbeiten laut Taskmanager, Leistung, alle 4 Kerne. Ich habe ein paar Bilder von fragwürdigen Windows Updates gemacht. Die kann ich dir aber erst heut Abend posten. Sonst komm ich zu spät zur Arbeit.

Vielen Dank an Dich und einen schönen Tach jewünscht.

LG B3AM3R

dann warte ich mal auf die Bilder :)

Hallo Schrauber,

hier die Bilder von denen ich geschrieben habe. Warum steht bei manchen Microsoft Corporation und bei manchen nicht? Und wie geht das, das ich am 29.12.´13 mein System neu gemacht habe und ich n Update von 2010 habe. Ich hatte auch viele ältere Registry-Einträge von 2010 und 2011, sogar 2006 gefunden gehabt. CCleaner hat aber ziemlich viele davon entfernt gehabt. Auch komisch: Das Update vom 21.11.2010 erscheint nicht in meinem Updateverlauf, jedoch in der Liste der installierten Updates.

Ich hoffe ich habe das mit den Bildern richtig gemacht.

Lieben Gruß

B3AM3R

Anhang 63802

Anhang 63803

Anhang 63804

Anhang 63805

Die frst Log hab ich total vergessen. Hier noch nachträglich. Sry. :headbang:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-01-2014 02

Ran by Raubtier (administrator) on RAUBTIER-PC on 14-01-2014 21:25:55

Running from C:\Users\Raubtier\Desktop

Windows 7 Ultimate Service Pack 1 (X64) OS Language: German Standard

Internet Explorer Version 11

Boot Mode: Normal
 

The only official downoad link fo FRST:

Farbar Recovery Scan Tool Download Link Download Now 32-Bit Version 

Farbar Recovery Scan Tool Download Link Download Now 32-Bit Version 

Any other download link is unpermitted or outdated.

The tutorial for FRST can be find here: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(AMD) C:\Windows\System32\atiesrxx.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Advanced Micro Devices, Inc.) C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe

() C:\Windows\SysWOW64\PnkBstrA.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Razer USA Ltd) C:\Programme\Razer\Naga\RazerNagaSysTray.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe

(Advanced Micro Devices Inc.) C:\Programme\AMD\ATI.ACE\Core-Static\MOM.exe

(ATI Technologies Inc.) C:\Programme\AMD\ATI.ACE\Core-Static\CCC.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)

HKLM-x32\...\Run: [] - [x]

HKLM-x32\...\Run: [StartCCC] - C:\Programme\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-12-06] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [Razer Naga Driver] - C:\Programme\Razer\Naga\RazerNagaSysTray.exe [953232 2011-11-16] (Razer USA Ltd)

HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3764024 2014-01-12] (AVAST Software)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xE05729FF8B04CF01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

Toolbar: HKLM - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

Toolbar: HKLM-x32 - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

Chrome: 

=======

CHR HomePage: 

CHR RestoreOnStartup: "hxxp://www.google.de/"

CHR Extension: (ProxTube) - C:\Users\Raubtier\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek\1.2.7_0 [2014-01-03]

CHR Extension: (Google Drive) - C:\Users\Raubtier\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0 [2013-12-29]

CHR Extension: (YouTube) - C:\Users\Raubtier\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0 [2013-12-29]

CHR Extension: (Adblock Plus) - C:\Users\Raubtier\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.7.2_0 [2013-12-29]

CHR Extension: (Google Search) - C:\Users\Raubtier\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0 [2013-12-29]

CHR Extension: (AdBlock) - C:\Users\Raubtier\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.16_0 [2013-12-29]

CHR Extension: () - C:\Users\Raubtier\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki\9.0.2011.70_0 [2014-01-11]

CHR Extension: (Google Wallet) - C:\Users\Raubtier\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0 [2013-12-29]

CHR Extension: (Gmail) - C:\Users\Raubtier\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1 [2013-12-29]

CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-01-11]
 

==================== Services (Whitelisted) =================
 

R2 AMD FUEL Service; C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-12-06] (Advanced Micro Devices, Inc.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-01-12] (AVAST Software)

S2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-12-29] ()
 

==================== Drivers (Whitelisted) ====================
 

R2 AODDriver4.2.0; C:\Programme\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys [59648 2013-09-19] (Advanced Micro Devices)

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [78648 2014-01-12] (AVAST Software)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2014-01-12] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-01-12] ()

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1034464 2014-01-12] (AVAST Software)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [422216 2014-01-12] (AVAST Software)

R3 aswStm; C:\Windows\system32\drivers\aswStm.sys [79672 2014-01-12] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [207904 2014-01-12] ()

S1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-12-29] (Disc Soft Ltd)

S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

R3 RzSynapse; C:\Windows\System32\DRIVERS\RzSynapse.sys [126464 2011-11-15] (Razer USA Ltd)

S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

S3 VGPU; System32\drivers\rdvgkmd.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-01-14 21:21 - 2014-01-14 21:21 - 02076160 _____ (Farbar) C:\Users\Raubtier\Desktop\FRST64.exe

2014-01-14 05:33 - 2014-01-14 05:33 - 00000624 _____ C:\Users\Raubtier\Desktop\JRT.txt

2014-01-14 05:28 - 2014-01-14 05:28 - 00000000 ____D C:\Windows\ERUNT

2014-01-14 05:27 - 2014-01-14 05:27 - 01037068 _____ (Thisisu) C:\Users\Raubtier\Desktop\JRT (1).exe

2014-01-14 05:17 - 2014-01-14 05:22 - 00000000 ____D C:\AdwCleaner

2014-01-14 05:15 - 2014-01-14 05:15 - 01037068 _____ (Thisisu) C:\Users\Raubtier\Desktop\JRT.exe

2014-01-14 05:14 - 2014-01-14 05:14 - 01236282 _____ C:\Users\Raubtier\Desktop\adwcleaner.exe

2014-01-13 17:38 - 2014-01-14 17:56 - 00000000 ____D C:\Users\Raubtier\Desktop\Updates

2014-01-12 20:26 - 2011-11-24 08:17 - 00166912 _____ (Microsoft Corporation) C:\Windows\system32\powrprof.dll

2014-01-12 20:26 - 2011-11-24 07:22 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\powrprof.dll

2014-01-12 20:25 - 2014-01-12 20:25 - 00000000 ____D C:\Patch2

2014-01-12 20:25 - 2014-01-12 20:25 - 00000000 ____D C:\patch1

2014-01-12 20:24 - 2014-01-12 20:24 - 04693832 _____ C:\Users\Raubtier\Desktop\441065_intl_x64_zip.exe

2014-01-12 20:23 - 2014-01-12 20:24 - 00316912 _____ C:\Users\Raubtier\Desktop\441280_intl_x64_zip.exe

2014-01-12 17:03 - 2014-01-12 17:04 - 00000000 ____D C:\Users\Raubtier\Desktop\Prime95

2014-01-12 17:03 - 2014-01-12 17:03 - 04277073 _____ C:\Users\Raubtier\Desktop\p95v279.win32.zip

2014-01-12 14:25 - 2014-01-12 14:31 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2014-01-12 14:25 - 2014-01-12 14:25 - 00089304 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-01-12 14:24 - 2014-01-12 14:25 - 00000000 ____D C:\Users\Raubtier\Desktop\mbar

2014-01-12 14:24 - 2014-01-12 14:24 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Raubtier\Desktop\mbar-1.07.0.1008.exe

2014-01-12 14:17 - 2014-01-12 14:17 - 00000914 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-01-12 14:17 - 2014-01-12 14:17 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware

2014-01-12 14:17 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-01-12 14:13 - 2014-01-12 14:13 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Raubtier\Desktop\mbam-setup-1.75.0.1300.exe

2014-01-12 13:43 - 2014-01-12 13:43 - 00021244 _____ C:\ComboFix.txt

2014-01-12 13:35 - 2014-01-12 13:43 - 00000000 ____D C:\Qoobox

2014-01-12 13:35 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe

2014-01-12 13:35 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe

2014-01-12 13:35 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-01-12 13:35 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-01-12 13:35 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-01-12 13:35 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe

2014-01-12 13:35 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe

2014-01-12 13:35 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe

2014-01-12 13:34 - 2014-01-12 13:41 - 00000000 ____D C:\Windows\erdnt

2014-01-12 13:32 - 2014-01-12 13:32 - 05162489 ____R (Swearware) C:\Users\Raubtier\Desktop\ComboFix.exe

2014-01-12 00:13 - 2014-01-14 00:36 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update

2014-01-12 00:13 - 2014-01-12 14:16 - 00079672 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys

2014-01-12 00:13 - 2014-01-12 00:13 - 01034464 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys

2014-01-12 00:13 - 2014-01-12 00:13 - 00422216 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys

2014-01-12 00:13 - 2014-01-12 00:13 - 00334136 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe

2014-01-12 00:13 - 2014-01-12 00:13 - 00207904 _____ C:\Windows\system32\Drivers\aswVmm.sys

2014-01-12 00:13 - 2014-01-12 00:13 - 00092544 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys

2014-01-12 00:13 - 2014-01-12 00:13 - 00078648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys

2014-01-12 00:13 - 2014-01-12 00:13 - 00065776 _____ C:\Windows\system32\Drivers\aswRvrt.sys

2014-01-12 00:13 - 2014-01-12 00:13 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr

2014-01-12 00:13 - 2014-01-12 00:13 - 00001966 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk

2014-01-11 21:28 - 2014-01-11 21:28 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdFs_01_09_00.Wdf

2014-01-11 18:34 - 2014-01-11 21:27 - 00000000 ____D C:\Users\Raubtier\Desktop\rootkit detektiv

2014-01-11 18:34 - 2014-01-11 17:56 - 01720705 _____ C:\Users\Raubtier\Desktop\McafeeRootkitDetective11.zip

2014-01-11 18:01 - 2009-06-18 12:54 - 00006144 ____N (Sophos Plc) C:\Windows\system32\535E.tmp

2014-01-11 17:59 - 2014-01-11 17:59 - 00000000 ____D C:\Users\Raubtier\Desktop\RootkitRevealer171

2014-01-11 14:00 - 2014-01-11 19:25 - 00000000 ____D C:\Windows\Minidump

2014-01-11 13:32 - 2014-01-11 13:32 - 00225630 _____ C:\Users\Raubtier\Desktop\Gmer.txt

2014-01-11 13:24 - 2014-01-14 21:26 - 00006989 _____ C:\Users\Raubtier\Desktop\FRST.txt

2014-01-11 13:22 - 2014-01-11 13:22 - 00000000 ____D C:\FRST

2014-01-11 13:21 - 2014-01-11 13:21 - 00000148 _____ C:\Users\Raubtier\defogger_reenable

2014-01-11 12:47 - 2014-01-11 12:47 - 00000000 ____D C:\Program Files (x86)\Sophos

2014-01-11 02:08 - 2014-01-11 02:08 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\AVAST Software

2014-01-11 02:07 - 2014-01-11 02:07 - 00000000 ____D C:\ProgramData\AVAST Software

2014-01-11 02:07 - 2014-01-11 02:07 - 00000000 ____D C:\Program Files\AVAST Software

2014-01-11 02:05 - 2014-01-11 02:06 - 91412976 _____ (AVAST Software) C:\Users\Raubtier\Desktop\avast_free_antivirus_setup.exe

2014-01-11 01:41 - 2014-01-11 01:41 - 04745728 _____ (AVAST Software) C:\Users\Raubtier\Desktop\aswMBR.exe

2014-01-11 01:28 - 2014-01-11 19:37 - 00050568 _____ C:\Users\Raubtier\Desktop\Extras.Txt

2014-01-11 01:27 - 2014-01-11 19:37 - 00217022 _____ C:\Users\Raubtier\Desktop\OTL.Txt

2014-01-11 01:23 - 2014-01-11 01:23 - 00602112 _____ (OldTimer Tools) C:\Users\Raubtier\Desktop\OTL.exe

2014-01-10 22:04 - 2014-01-10 22:04 - 00791552 _____ (AMD) C:\Users\Raubtier\Desktop\amddriverdownloader.exe

2014-01-10 21:40 - 2014-01-10 22:00 - 00000000 ____D C:\Users\Raubtier\Desktop\cpu-z-168

2014-01-10 21:38 - 2014-01-10 21:38 - 01994222 _____ C:\Users\Raubtier\Desktop\cpu-z-168.zip

2014-01-10 21:16 - 2014-01-10 21:16 - 00000010 _____ C:\csb.log

2014-01-07 20:43 - 2014-01-08 20:14 - 00000000 ____D C:\Users\Raubtier\Tracing

2014-01-07 12:56 - 2014-01-07 12:56 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server Compact Edition

2014-01-07 12:55 - 2014-01-10 22:00 - 00000000 ____D C:\Program Files (x86)\Windows Live

2014-01-07 12:55 - 2014-01-07 12:55 - 00000000 ____D C:\Windows\PCHEALTH

2014-01-07 12:51 - 2014-01-07 12:51 - 00000000 ____D C:\ProgramData\Microsoft SkyDrive

2014-01-07 12:50 - 2014-01-08 00:21 - 00000000 ____D C:\Users\Raubtier\AppData\Local\Windows Live

2014-01-07 12:50 - 2014-01-07 12:50 - 01245168 _____ (Microsoft Corporation) C:\Users\Raubtier\Desktop\wlsetup-web.exe

2014-01-07 00:57 - 2014-01-10 01:01 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\Usenet.nl

2014-01-07 00:57 - 2014-01-10 00:55 - 00000000 ____D C:\Users\Raubtier\Documents\Usenet.nl

2014-01-07 00:57 - 2014-01-07 00:57 - 07457256 _____ (                                                            ) C:\Users\Raubtier\Desktop\UsenetNLSetup.exe

2014-01-07 00:57 - 2014-01-07 00:57 - 00001682 _____ C:\Users\Raubtier\Desktop\Usenet.nl.lnk

2014-01-07 00:57 - 2014-01-07 00:57 - 00000000 ____D C:\Program Files\Usenet.nl

2014-01-03 21:18 - 2014-01-03 21:18 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\Malwarebytes

2014-01-03 21:18 - 2014-01-03 21:18 - 00000000 ____D C:\ProgramData\Malwarebytes

2014-01-02 23:15 - 2014-01-02 23:15 - 00000000 ____D C:\Users\Raubtier\Documents\WB Games

2014-01-02 23:11 - 2014-01-02 23:11 - 00001520 _____ C:\Users\Raubtier\Desktop\TheBureau.lnk

2014-01-02 23:11 - 2014-01-02 23:11 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\2K Sports

2014-01-02 23:10 - 2014-01-02 23:10 - 00001045 _____ C:\Users\Raubtier\Desktop\nba2k14.lnk

2014-01-02 23:09 - 2014-01-02 23:09 - 00001669 _____ C:\Users\Raubtier\Desktop\BatmanOrigins.lnk

2014-01-02 00:30 - 2014-01-07 00:39 - 00000000 ____D C:\Users\Raubtier\AppData\Local\Microsoft Games

2014-01-01 22:35 - 2014-01-01 22:35 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_xusb21_01009.Wdf

2014-01-01 22:35 - 2014-01-01 22:35 - 00000000 ____D C:\Program Files\Microsoft Xbox 360 Accessories

2014-01-01 21:18 - 2014-01-10 22:00 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\Skype

2014-01-01 21:17 - 2014-01-01 21:18 - 00000000 ____D C:\ProgramData\Skype

2014-01-01 21:17 - 2014-01-01 21:17 - 00002699 _____ C:\Users\Public\Desktop\Skype.lnk

2014-01-01 21:17 - 2014-01-01 21:17 - 00000000 ___RD C:\Program Files (x86)\Skype

2014-01-01 20:53 - 2014-01-01 22:52 - 00000000 ____D C:\Users\Raubtier\AppData\Local\ESN Sonar

2014-01-01 03:02 - 2014-01-01 03:02 - 00000857 _____ C:\Users\Raubtier\Desktop\Yahoo! Messenger.lnk

2013-12-31 01:25 - 2014-01-07 01:48 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\vlc

2013-12-31 01:07 - 2013-12-31 01:07 - 00000000 ____D C:\Windows\System32\Tasks\Games

2013-12-30 23:09 - 2014-01-14 21:19 - 00007607 _____ C:\Users\Raubtier\AppData\Local\Resmon.ResmonCfg

2013-12-30 22:20 - 2014-01-11 21:27 - 00000000 ____D C:\Windows\pss

2013-12-30 20:47 - 2014-01-14 21:19 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\TS3Client

2013-12-30 19:29 - 2013-12-30 19:29 - 00000001 _____ C:\Users\Raubtier\AppData\Local\llftool.4.30.agreement

2013-12-30 19:28 - 2014-01-07 12:49 - 00000000 ____D C:\Program Files\HDDGURU LLF Tool

2013-12-30 12:34 - 2013-12-30 12:35 - 00000000 ____D C:\Program Files\Data Lifeguard Diagnostic for Windows

2013-12-30 11:02 - 2014-01-07 12:48 - 00000000 ____D C:\Windows\System32\Tasks\Abelssoft

2013-12-30 06:36 - 2013-11-26 12:54 - 23183360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-12-30 06:36 - 2013-11-26 11:19 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2013-12-30 06:36 - 2013-11-26 11:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2013-12-30 06:36 - 2013-11-26 10:48 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2013-12-30 06:36 - 2013-11-26 10:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2013-12-30 06:36 - 2013-11-26 10:29 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2013-12-30 06:36 - 2013-11-26 10:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2013-12-30 06:36 - 2013-11-26 10:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-12-30 06:36 - 2013-11-26 10:21 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2013-12-30 06:36 - 2013-11-26 10:18 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2013-12-30 06:36 - 2013-11-26 10:18 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2013-12-30 06:36 - 2013-11-26 10:16 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2013-12-30 06:36 - 2013-11-26 09:57 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2013-12-30 06:36 - 2013-11-26 09:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2013-12-30 06:36 - 2013-11-26 09:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2013-12-30 06:36 - 2013-11-26 09:28 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2013-12-30 06:36 - 2013-11-26 07:34 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2013-12-30 06:36 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2013-12-30 06:35 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-12-30 06:35 - 2013-11-26 10:41 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-12-30 06:35 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-12-30 06:35 - 2013-11-26 09:35 - 05769216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-12-30 06:35 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-12-30 06:35 - 2013-11-26 09:02 - 01995264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2013-12-30 06:35 - 2013-11-26 08:48 - 12996608 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-12-30 06:35 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2013-12-30 06:35 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-12-30 06:35 - 2013-11-26 08:07 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-12-30 06:35 - 2013-11-26 07:40 - 01395200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-12-30 06:35 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-12-30 06:35 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-12-30 06:28 - 2013-12-30 06:28 - 00000000 ____D C:\Program Files (x86)\Etron Technology

2013-12-30 06:28 - 2012-08-07 08:09 - 00088832 _____ (Etron Technology Inc) C:\Windows\system32\Drivers\EtronXHCI.sys

2013-12-30 06:28 - 2012-08-07 08:09 - 00065152 _____ (Etron Technology Inc) C:\Windows\system32\Drivers\EtronHub3.sys

2013-12-30 06:19 - 2013-10-14 18:00 - 00028368 _____ (Microsoft Corporation) C:\Windows\system32\IEUDINIT.EXE

2013-12-30 06:15 - 2013-12-30 06:15 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2013-12-30 06:15 - 2013-12-30 06:15 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat

2013-12-30 06:15 - 2013-12-30 06:15 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat

2013-12-30 06:15 - 2013-12-30 06:15 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec

2013-12-30 06:15 - 2013-12-30 06:15 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec

2013-12-30 06:15 - 2013-12-30 06:15 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe

2013-12-30 06:15 - 2013-12-30 06:15 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe

2013-12-30 06:15 - 2013-12-30 06:15 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe

2013-12-30 06:15 - 2013-12-30 06:15 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe

2013-12-30 06:15 - 2013-12-30 06:15 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2013-12-30 06:15 - 2013-12-30 06:15 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe

2013-12-30 06:15 - 2013-12-30 06:15 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

2013-12-30 06:15 - 2013-12-30 06:15 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx

2013-12-30 06:15 - 2013-12-30 06:15 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe

2013-12-30 06:15 - 2013-12-30 06:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe

2013-12-30 06:15 - 2013-12-30 06:15 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx

2013-12-30 06:15 - 2013-12-30 06:15 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe

2013-12-30 06:15 - 2013-12-30 06:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe

2013-12-30 06:15 - 2013-12-30 06:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe

2013-12-30 06:15 - 2013-12-30 06:15 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe

2013-12-30 06:02 - 2010-02-23 09:16 - 00294912 _____ (Microsoft Corporation) C:\Windows\system32\browserchoice.exe

2013-12-30 05:57 - 2013-12-30 06:19 - 00015952 _____ C:\Windows\IE11_main.log

2013-12-30 05:56 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll

2013-12-30 05:56 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll

2013-12-30 05:56 - 2013-10-30 02:24 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2013-12-30 05:56 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll

2013-12-30 05:56 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll

2013-12-30 05:56 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll

2013-12-30 05:56 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll

2013-12-30 05:56 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys

2013-12-30 05:56 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys

2013-12-30 05:56 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll

2013-12-30 05:56 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll

2013-12-30 05:56 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys

2013-12-30 05:56 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys

2013-12-30 05:56 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys

2013-12-30 05:56 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll

2013-12-30 05:56 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll

2013-12-30 05:56 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll

2013-12-30 05:56 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2013-12-30 05:56 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2013-12-30 05:56 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll

2013-12-30 05:56 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2013-12-30 05:56 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2013-12-30 05:56 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2013-12-30 05:56 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll

2013-12-30 05:56 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe

2013-12-30 05:56 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys

2013-12-30 05:56 - 2011-04-09 07:58 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe

2013-12-30 05:56 - 2011-04-09 06:56 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe

2013-12-30 05:54 - 2013-12-01 14:42 - 90708896 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2013-12-30 05:53 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx

2013-12-30 05:53 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll

2013-12-30 05:53 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll

2013-12-30 05:53 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL

2013-12-30 05:53 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL

2013-12-30 05:53 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx

2013-12-30 05:53 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll

2013-12-30 05:53 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll

2013-12-30 05:53 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL

2013-12-30 05:53 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe

2013-12-30 05:53 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe

2013-12-30 05:53 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe

2013-12-30 05:53 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe

2013-12-30 05:49 - 2012-06-02 23:19 - 02428952 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll

2013-12-30 05:49 - 2012-06-02 23:19 - 00701976 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll

2013-12-30 05:49 - 2012-06-02 23:19 - 00057880 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe

2013-12-30 05:49 - 2012-06-02 23:19 - 00044056 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll

2013-12-30 05:49 - 2012-06-02 23:19 - 00038424 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll

2013-12-30 05:49 - 2012-06-02 23:15 - 02622464 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll

2013-12-30 05:49 - 2012-06-02 23:15 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll

2013-12-30 05:49 - 2012-06-02 15:19 - 00186752 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll

2013-12-30 05:49 - 2012-06-02 15:15 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe

2013-12-29 23:36 - 2013-12-29 23:37 - 00000000 ____D C:\Windows\System32\Tasks\Aufgaben der Ereignisanzeige

2013-12-29 22:42 - 2014-01-11 19:25 - 00000000 ___DC C:\Users\Raubtier\AppData\Local\MigWiz

2013-12-29 22:28 - 2013-12-30 06:40 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2013-12-29 22:28 - 2013-12-30 06:40 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight

2013-12-29 22:25 - 2013-12-30 05:56 - 00000000 ____D C:\Windows\system32\MRT

2013-12-29 22:05 - 2013-12-29 22:05 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\WinRAR

2013-12-29 21:28 - 2013-12-29 21:28 - 00000000 ____D C:\Users\Raubtier\AppData\Local\PunkBuster

2013-12-29 21:06 - 2013-12-29 21:06 - 00000000 ____D C:\Users\Raubtier\Documents\Battlefield 4

2013-12-29 20:34 - 2013-12-29 20:34 - 00000000 ____D C:\Users\Raubtier\AppData\Local\Razer

2013-12-29 20:26 - 2014-01-07 12:48 - 00000000 ____D C:\Program Files\CheckDrive

2013-12-29 20:26 - 2013-12-30 11:02 - 00000000 ____D C:\Users\Raubtier\AppData\Local\Abelssoft

2013-12-29 20:15 - 2013-12-29 20:15 - 00000000 ____D C:\Users\Raubtier\AppData\Local\ESN

2013-12-29 16:14 - 2013-12-29 16:14 - 00000000 ____D C:\ProgramData\Steam

2013-12-29 16:04 - 2014-01-01 22:17 - 00214392 _____ C:\Windows\SysWOW64\PnkBstrB.exe

2013-12-29 16:04 - 2014-01-01 22:02 - 00214392 _____ C:\Windows\SysWOW64\PnkBstrB.ex0

2013-12-29 16:04 - 2014-01-01 12:27 - 00000000 ____D C:\Program Files (x86)\Battlelog Web Plugins

2013-12-29 16:04 - 2013-12-29 16:04 - 00076888 _____ C:\Windows\SysWOW64\PnkBstrA.exe

2013-12-29 16:02 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll

2013-12-29 16:02 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll

2013-12-29 16:02 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll

2013-12-29 16:02 - 2010-06-02 04:55 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_7.dll

2013-12-29 16:02 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll

2013-12-29 16:02 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll

2013-12-29 16:02 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll

2013-12-29 16:02 - 2010-05-26 11:41 - 02401112 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_43.dll

2013-12-29 16:02 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll

2013-12-29 16:02 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_43.dll

2013-12-29 16:02 - 2010-05-26 11:41 - 01907552 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll

2013-12-29 16:02 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll

2013-12-29 16:02 - 2010-05-26 11:41 - 00511328 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_43.dll

2013-12-29 16:02 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_43.dll

2013-12-29 16:02 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll

2013-12-29 16:02 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll

2013-12-29 16:02 - 2010-02-04 10:01 - 00530776 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_6.dll

2013-12-29 16:02 - 2010-02-04 10:01 - 00528216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_6.dll

2013-12-29 16:02 - 2010-02-04 10:01 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_6.dll

2013-12-29 16:02 - 2010-02-04 10:01 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_6.dll

2013-12-29 16:02 - 2010-02-04 10:01 - 00078680 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_4.dll

2013-12-29 16:02 - 2010-02-04 10:01 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_4.dll

2013-12-29 16:02 - 2010-02-04 10:01 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_7.dll

2013-12-29 16:02 - 2010-02-04 10:01 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_7.dll

2013-12-29 16:02 - 2009-09-04 17:44 - 00517960 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_5.dll

2013-12-29 16:02 - 2009-09-04 17:44 - 00515416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_5.dll

2013-12-29 16:02 - 2009-09-04 17:44 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_5.dll

2013-12-29 16:02 - 2009-09-04 17:44 - 00176968 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_5.dll

2013-12-29 16:02 - 2009-09-04 17:44 - 00073544 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_3.dll

2013-12-29 16:02 - 2009-09-04 17:44 - 00069464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_3.dll

2013-12-29 16:02 - 2009-09-04 17:29 - 05554512 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_42.dll

2013-12-29 16:02 - 2009-09-04 17:29 - 05501792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_42.dll

2013-12-29 16:02 - 2009-09-04 17:29 - 02582888 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_42.dll

2013-12-29 16:02 - 2009-09-04 17:29 - 02475352 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_42.dll

2013-12-29 16:02 - 2009-09-04 17:29 - 01974616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_42.dll

2013-12-29 16:02 - 2009-09-04 17:29 - 01892184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_42.dll

2013-12-29 16:02 - 2009-09-04 17:29 - 00523088 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll

2013-12-29 16:02 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_42.dll

2013-12-29 16:02 - 2009-09-04 17:29 - 00285024 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_42.dll

2013-12-29 16:02 - 2009-09-04 17:29 - 00235344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_42.dll

2013-12-29 16:02 - 2009-03-16 14:18 - 00521560 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_4.dll

2013-12-29 16:02 - 2009-03-16 14:18 - 00517448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_4.dll

2013-12-29 16:02 - 2009-03-16 14:18 - 00235352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_4.dll

2013-12-29 16:02 - 2009-03-16 14:18 - 00174936 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_4.dll

2013-12-29 16:02 - 2009-03-16 14:18 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_6.dll

2013-12-29 16:02 - 2009-03-16 14:18 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_6.dll

2013-12-29 16:02 - 2009-03-09 15:27 - 05425496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_41.dll

2013-12-29 16:02 - 2009-03-09 15:27 - 04178264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_41.dll

2013-12-29 16:02 - 2009-03-09 15:27 - 02430312 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_41.dll

2013-12-29 16:02 - 2009-03-09 15:27 - 01846632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_41.dll

2013-12-29 16:02 - 2009-03-09 15:27 - 00520544 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_41.dll

2013-12-29 16:02 - 2009-03-09 15:27 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_41.dll

2013-12-29 16:02 - 2008-10-27 10:04 - 00518480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_3.dll

2013-12-29 16:02 - 2008-10-27 10:04 - 00514384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_3.dll

2013-12-29 16:02 - 2008-10-27 10:04 - 00235856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_3.dll

2013-12-29 16:02 - 2008-10-27 10:04 - 00175440 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_3.dll

2013-12-29 16:02 - 2008-10-27 10:04 - 00074576 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_2.dll

2013-12-29 16:02 - 2008-10-27 10:04 - 00070992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_2.dll

2013-12-29 16:02 - 2008-10-27 10:04 - 00025936 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_5.dll

2013-12-29 16:02 - 2008-10-27 10:04 - 00023376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_5.dll

2013-12-29 16:02 - 2008-10-15 06:22 - 05631312 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_40.dll

2013-12-29 16:02 - 2008-10-15 06:22 - 04379984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_40.dll

2013-12-29 16:02 - 2008-10-15 06:22 - 02605920 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_40.dll

2013-12-29 16:02 - 2008-10-15 06:22 - 02036576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_40.dll

2013-12-29 16:02 - 2008-10-15 06:22 - 00519000 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_40.dll

2013-12-29 16:02 - 2008-10-15 06:22 - 00452440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_40.dll

2013-12-29 16:02 - 2008-07-31 10:41 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_2.dll

2013-12-29 16:02 - 2008-07-31 10:41 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_2.dll

2013-12-29 16:02 - 2008-07-31 10:41 - 00072200 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_1.dll

2013-12-29 16:02 - 2008-07-31 10:41 - 00068616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_1.dll

2013-12-29 16:02 - 2008-07-31 10:40 - 00513544 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_2.dll

2013-12-29 16:02 - 2008-07-31 10:40 - 00509448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_2.dll

2013-12-29 16:02 - 2008-07-10 11:01 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_39.dll

2013-12-29 16:02 - 2008-07-10 11:00 - 04992520 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_39.dll

2013-12-29 16:02 - 2008-07-10 11:00 - 03851784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll

2013-12-29 16:02 - 2008-07-10 11:00 - 01942552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_39.dll

2013-12-29 16:02 - 2008-07-10 11:00 - 01493528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_39.dll

2013-12-29 16:02 - 2008-07-10 11:00 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_39.dll

2013-12-29 16:02 - 2008-05-30 14:19 - 00511496 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_1.dll

2013-12-29 16:02 - 2008-05-30 14:19 - 00507400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_1.dll

2013-12-29 16:02 - 2008-05-30 14:18 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_1.dll

2013-12-29 16:02 - 2008-05-30 14:18 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_1.dll

2013-12-29 16:02 - 2008-05-30 14:17 - 00068104 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_0.dll

2013-12-29 16:02 - 2008-05-30 14:17 - 00065032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_0.dll

2013-12-29 16:02 - 2008-05-30 14:17 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_4.dll

2013-12-29 16:02 - 2008-05-30 14:16 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_4.dll

2013-12-29 16:02 - 2008-05-30 14:11 - 04991496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_38.dll

2013-12-29 16:02 - 2008-05-30 14:11 - 03850760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_38.dll

2013-12-29 16:02 - 2008-05-30 14:11 - 01941528 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_38.dll

2013-12-29 16:02 - 2008-05-30 14:11 - 01491992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_38.dll

2013-12-29 16:02 - 2008-05-30 14:11 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_38.dll

2013-12-29 16:02 - 2008-05-30 14:11 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_38.dll

2013-12-29 16:02 - 2008-03-05 16:04 - 00489480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_0.dll

2013-12-29 16:02 - 2008-03-05 16:03 - 00479752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_0.dll

2013-12-29 16:02 - 2008-03-05 16:03 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_0.dll

2013-12-29 16:02 - 2008-03-05 16:03 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_0.dll

2013-12-29 16:02 - 2008-03-05 16:00 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_3.dll

2013-12-29 16:02 - 2008-03-05 16:00 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_3.dll

2013-12-29 16:02 - 2008-03-05 15:56 - 04910088 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_37.dll

2013-12-29 16:02 - 2008-03-05 15:56 - 03786760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_37.dll

2013-12-29 16:02 - 2008-03-05 15:56 - 01860120 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_37.dll

2013-12-29 16:02 - 2008-03-05 15:56 - 01420824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_37.dll

2013-12-29 16:02 - 2008-02-05 23:07 - 00529424 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_37.dll

2013-12-29 16:02 - 2008-02-05 23:07 - 00462864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_37.dll

2013-12-29 16:02 - 2007-10-22 03:40 - 00411656 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_10.dll

2013-12-29 16:02 - 2007-10-22 03:39 - 00267272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_10.dll

2013-12-29 16:02 - 2007-10-22 03:37 - 00021000 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_2.dll

2013-12-29 16:02 - 2007-10-22 03:37 - 00017928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_2.dll

2013-12-29 16:02 - 2007-10-12 15:14 - 05081608 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_36.dll

2013-12-29 16:02 - 2007-10-12 15:14 - 03734536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_36.dll

2013-12-29 16:02 - 2007-10-12 15:14 - 02006552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_36.dll

2013-12-29 16:02 - 2007-10-12 15:14 - 01374232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_36.dll

2013-12-29 16:02 - 2007-10-02 09:56 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_36.dll

2013-12-29 16:02 - 2007-10-02 09:56 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_36.dll

2013-12-29 16:02 - 2007-07-20 00:57 - 00411496 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_9.dll

2013-12-29 16:02 - 2007-07-20 00:57 - 00267112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_9.dll

2013-12-29 16:02 - 2007-07-19 18:14 - 05073256 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_35.dll

2013-12-29 16:02 - 2007-07-19 18:14 - 03727720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_35.dll

2013-12-29 16:02 - 2007-07-19 18:14 - 01985904 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_35.dll

2013-12-29 16:02 - 2007-07-19 18:14 - 01358192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_35.dll

2013-12-29 16:02 - 2007-07-19 18:14 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_35.dll

2013-12-29 16:02 - 2007-07-19 18:14 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_35.dll

2013-12-29 16:02 - 2007-06-20 20:49 - 00409960 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_8.dll

2013-12-29 16:02 - 2007-06-20 20:46 - 00266088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_8.dll

2013-12-29 16:02 - 2007-05-16 16:45 - 04496232 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_34.dll

2013-12-29 16:02 - 2007-05-16 16:45 - 03497832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_34.dll

2013-12-29 16:02 - 2007-05-16 16:45 - 01401200 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_34.dll

2013-12-29 16:02 - 2007-05-16 16:45 - 01124720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_34.dll

2013-12-29 16:02 - 2007-05-16 16:45 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_34.dll

2013-12-29 16:02 - 2007-05-16 16:45 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_34.dll

2013-12-29 16:02 - 2007-04-04 18:55 - 00403304 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_7.dll

2013-12-29 16:02 - 2007-04-04 18:55 - 00261480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_7.dll

2013-12-29 16:02 - 2007-04-04 18:54 - 00107368 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_3.dll

2013-12-29 16:02 - 2007-04-04 18:53 - 00081768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_3.dll

2013-12-29 16:02 - 2007-03-15 16:57 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_33.dll

2013-12-29 16:02 - 2007-03-15 16:57 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_33.dll

2013-12-29 16:02 - 2007-03-12 16:42 - 04494184 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_33.dll

2013-12-29 16:02 - 2007-03-12 16:42 - 03495784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_33.dll

2013-12-29 16:02 - 2007-03-12 16:42 - 01400176 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_33.dll

2013-12-29 16:02 - 2007-03-12 16:42 - 01123696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_33.dll

2013-12-29 16:02 - 2007-03-05 12:42 - 00017688 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_1.dll

2013-12-29 16:02 - 2007-03-05 12:42 - 00015128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_1.dll

2013-12-29 16:02 - 2007-01-24 15:27 - 00393576 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_6.dll

2013-12-29 16:02 - 2007-01-24 15:27 - 00255848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_6.dll

2013-12-29 16:02 - 2006-12-08 12:02 - 00251672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_5.dll

2013-12-29 16:02 - 2006-12-08 12:00 - 00390424 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_5.dll

2013-12-29 16:02 - 2006-11-29 13:06 - 04398360 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_32.dll

2013-12-29 16:02 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_32.dll

2013-12-29 16:02 - 2006-11-29 13:06 - 00469264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10.dll

2013-12-29 16:02 - 2006-11-29 13:06 - 00440080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10.dll

2013-12-29 16:02 - 2006-09-28 16:05 - 03977496 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_31.dll

2013-12-29 16:02 - 2006-09-28 16:05 - 02414360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_31.dll

2013-12-29 16:02 - 2006-09-28 16:05 - 00237848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_4.dll

2013-12-29 16:02 - 2006-09-28 16:04 - 00364824 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_4.dll

2013-12-29 16:02 - 2006-07-28 09:31 - 00083736 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_2.dll

2013-12-29 16:02 - 2006-07-28 09:30 - 00363288 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_3.dll

2013-12-29 16:02 - 2006-07-28 09:30 - 00236824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_3.dll

2013-12-29 16:02 - 2006-07-28 09:30 - 00062744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_2.dll

2013-12-29 16:01 - 2014-01-02 23:02 - 00074987 _____ C:\Windows\DirectX.log

2013-12-29 16:01 - 2006-05-31 07:24 - 00230168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_2.dll

2013-12-29 16:01 - 2006-05-31 07:22 - 00354072 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_2.dll

2013-12-29 16:01 - 2006-03-31 12:41 - 03927248 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_30.dll

2013-12-29 16:01 - 2006-03-31 12:40 - 02388176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_30.dll

2013-12-29 16:01 - 2006-03-31 12:40 - 00352464 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_1.dll

2013-12-29 16:01 - 2006-03-31 12:39 - 00229584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_1.dll

2013-12-29 16:01 - 2006-03-31 12:39 - 00083664 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_1.dll

2013-12-29 16:01 - 2006-03-31 12:39 - 00062672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_1.dll

2013-12-29 16:01 - 2006-02-03 08:43 - 03830992 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_29.dll

2013-12-29 16:01 - 2006-02-03 08:43 - 02332368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_29.dll

2013-12-29 16:01 - 2006-02-03 08:42 - 00355536 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_0.dll

2013-12-29 16:01 - 2006-02-03 08:42 - 00230096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_0.dll

2013-12-29 16:01 - 2006-02-03 08:41 - 00016592 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_0.dll

2013-12-29 16:01 - 2006-02-03 08:41 - 00014032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_0.dll

2013-12-29 16:01 - 2005-12-05 18:09 - 03815120 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_28.dll

2013-12-29 16:01 - 2005-12-05 18:09 - 02323664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_28.dll

2013-12-29 16:01 - 2005-07-22 19:59 - 03807440 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_27.dll

2013-12-29 16:01 - 2005-07-22 19:59 - 02319568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_27.dll

2013-12-29 16:01 - 2005-05-26 15:34 - 03767504 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_26.dll

2013-12-29 16:01 - 2005-05-26 15:34 - 02297552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_26.dll

2013-12-29 16:01 - 2005-03-18 17:19 - 03823312 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_25.dll

2013-12-29 16:01 - 2005-03-18 17:19 - 02337488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_25.dll

2013-12-29 16:01 - 2005-02-05 19:45 - 03544272 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_24.dll

2013-12-29 16:01 - 2005-02-05 19:45 - 02222800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_24.dll

2013-12-29 15:29 - 2014-01-11 21:27 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\DAEMON Tools Lite

2013-12-29 15:29 - 2013-12-29 15:29 - 00283064 _____ (Disc Soft Ltd) C:\Windows\system32\Drivers\dtsoftbus01.sys

2013-12-29 15:29 - 2013-12-29 15:29 - 00000000 ____D C:\Program Files\DAEMON Tools Lite

2013-12-29 15:28 - 2013-12-29 15:54 - 00000000 ____D C:\ProgramData\DAEMON Tools Lite

2013-12-29 13:11 - 2013-12-29 13:11 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\Yahoo!

2013-12-29 13:10 - 2013-12-29 13:10 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\Macromedia

2013-12-29 13:09 - 2014-01-14 20:52 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-12-29 13:09 - 2013-12-29 13:09 - 00419488 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2013-12-29 13:09 - 2013-12-29 13:09 - 00070304 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-12-29 13:09 - 2013-12-29 13:09 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2013-12-29 13:09 - 2013-12-29 13:09 - 00000000 ____D C:\Windows\SysWOW64\Macromed

2013-12-29 13:09 - 2013-12-29 13:09 - 00000000 ____D C:\ProgramData\Yahoo!

2013-12-29 13:09 - 2013-12-29 13:09 - 00000000 ____D C:\Program Files\Messenger

2013-12-29 13:07 - 2013-12-29 13:09 - 00000000 ____D C:\Program Files (x86)\Yahoo!

2013-12-29 13:07 - 2013-12-29 13:07 - 00444024 _____ (Yahoo! Inc.) C:\Users\Raubtier\Downloads\msgr11de.exe

2013-12-29 13:05 - 2013-12-30 05:35 - 00000000 ____D C:\ProgramData\Razer

2013-12-29 13:04 - 2013-12-29 13:05 - 13163200 _____ (Razer Inc.) C:\Users\Raubtier\Downloads\Razer_Synapse_Framework_V1.16.06.exe

2013-12-29 13:03 - 2013-12-29 13:03 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_RzSynapse_01007.Wdf

2013-12-29 13:02 - 2013-12-29 13:05 - 00000000 ____D C:\Program Files (x86)\Razer

2013-12-29 13:02 - 2013-12-29 13:03 - 00007312 _____ C:\Windows\DPINST.LOG

2013-12-29 13:02 - 2013-12-29 13:02 - 00000000 ____D C:\Program Files\Razer

2013-12-29 12:59 - 2013-12-29 13:00 - 40394840 _____ (Razer USA Ltd.                                               ) C:\Users\Raubtier\Downloads\Razer_NagaEpic_Driver_v3.03.exe

2013-12-29 12:57 - 2013-12-29 12:57 - 00000909 _____ C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk

2013-12-29 12:57 - 2013-12-29 12:57 - 00000000 ____D C:\Program Files\TeamSpeak 3 Client

2013-12-29 12:55 - 2013-12-29 12:56 - 32520760 _____ (TeamSpeak Systems GmbH) C:\Users\Raubtier\Downloads\TeamSpeak3-Client-win64-3.0.13.1.exe

2013-12-29 12:49 - 2014-01-14 21:21 - 00001114 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-12-29 12:49 - 2014-01-14 20:42 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-12-29 12:49 - 2013-12-29 13:16 - 00004110 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2013-12-29 12:49 - 2013-12-29 13:16 - 00003858 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2013-12-29 12:49 - 2013-12-29 12:51 - 00000000 ____D C:\Users\Raubtier\AppData\Local\Google

2013-12-29 12:49 - 2013-12-29 12:51 - 00000000 ____D C:\Program Files (x86)\Google

2013-12-29 12:49 - 2013-12-29 12:49 - 00000000 ____D C:\Users\Raubtier\AppData\Local\Deployment

2013-12-29 12:49 - 2013-12-29 12:49 - 00000000 ____D C:\Users\Raubtier\AppData\Local\Apps\2.0

2013-12-29 12:30 - 2013-12-29 12:30 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\ATI

2013-12-29 12:30 - 2013-12-29 12:30 - 00000000 ____D C:\Users\Raubtier\AppData\Local\ATI

2013-12-29 12:30 - 2013-12-29 12:30 - 00000000 ____D C:\Users\Raubtier\AppData\Local\AMD

2013-12-29 12:30 - 2013-12-29 12:30 - 00000000 ____D C:\ProgramData\ATI

2013-12-29 12:29 - 2013-12-29 12:29 - 00000000 _____ C:\Windows\ativpsrm.bin

2013-12-29 12:23 - 2013-02-04 22:46 - 02738264 _____ (Sysinternals - www.sysinternals.com) C:\Users\Raubtier\Desktop\Process Explorer.exe

2013-12-29 12:22 - 2013-12-29 21:06 - 00000000 ____D C:\Users\Raubtier\AppData\Local\Origin

2013-12-29 12:22 - 2013-12-29 12:36 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\Origin

2013-12-29 12:21 - 2014-01-12 17:03 - 00000000 ____D C:\ProgramData\Origin

2013-12-29 12:21 - 2014-01-10 22:00 - 00000000 ____D C:\Program Files\Steam

2013-12-29 12:21 - 2013-12-29 21:06 - 00000000 ____D C:\ProgramData\Electronic Arts

2013-12-29 12:20 - 2014-01-14 20:46 - 00000000 ____D C:\Program Files\Origin

2013-12-29 12:19 - 2013-12-30 05:43 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR

2013-12-29 12:18 - 2014-01-11 23:12 - 00000000 ____D C:\ProgrammeVirtualCloneDrive

2013-12-29 12:18 - 2013-12-29 12:18 - 00000000 ____D C:\Program Files\VLC

2013-12-29 12:17 - 2013-12-29 12:19 - 00000000 ____D C:\Program Files\WinRAR

2013-12-29 12:13 - 2014-01-13 17:27 - 00001912 _____ C:\Windows\epplauncher.mif

2013-12-29 12:13 - 2013-12-30 05:46 - 00059296 _____ C:\Users\Raubtier\AppData\Local\GDIPFONTCACHEV1.DAT

2013-12-29 12:13 - 2013-12-29 12:13 - 00000000 ____D C:\Program Files (x86)\AMD APP

2013-12-29 12:13 - 2012-03-30 15:49 - 00056448 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\usbfilter.sys

2013-12-29 12:08 - 2011-09-29 10:30 - 00646248 _____ (Realtek                                            ) C:\Windows\system32\Drivers\Rt64win7.sys

2013-12-29 12:08 - 2011-09-29 10:30 - 00107552 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RTNUninst64.dll

2013-12-29 12:08 - 2011-09-29 10:30 - 00074272 _____ C:\Windows\system32\RtNicProp64.dll

2013-12-29 12:07 - 2014-01-10 22:00 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information

2013-12-29 12:07 - 2013-12-29 12:08 - 00000000 ____D C:\Program Files (x86)\Realtek

2013-12-29 12:07 - 2013-12-29 12:07 - 00000000 ____D C:\Windows\SysWOW64\RTCOM

2013-12-29 12:07 - 2013-12-29 12:07 - 00000000 ____D C:\Program Files\Realtek

2013-12-29 12:07 - 2013-12-29 12:07 - 00000000 ____D C:\Program Files (x86)\AMD AVT

2013-12-29 12:07 - 2012-06-19 09:54 - 04065296 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RTKVHD64.sys

2013-12-29 12:07 - 2012-06-19 06:31 - 00293889 _____ C:\Windows\system32\Drivers\RTAIODAT.DAT

2013-12-29 12:07 - 2012-06-08 09:23 - 00083072 _____ (Creative Technology Ltd.) C:\Windows\system32\MBWrp64.dll

2013-12-29 12:07 - 2012-06-08 09:21 - 00897152 _____ (Creative Technology Ltd.) C:\Windows\system32\MBAPO64.dll

2013-12-29 12:07 - 2012-06-08 09:21 - 00753280 _____ (Creative Technology Ltd.) C:\Windows\SysWOW64\MBAPO32.dll

2013-12-29 12:07 - 2012-06-08 09:18 - 03615888 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkAPO64.dll

2013-12-29 12:07 - 2012-06-06 03:44 - 00869520 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkApi64.dll

2013-12-29 12:07 - 2012-06-05 06:45 - 00237968 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RtHDMIVX.sys

2013-12-29 12:07 - 2012-06-01 02:37 - 02674320 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtPgEx64.dll

2013-12-29 12:07 - 2012-05-31 11:08 - 00105616 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoInstII64.dll

2013-12-29 12:07 - 2012-05-25 11:06 - 01706640 _____ (Realtek Semiconductor Corp.) C:\Windows\RtlExUpd.dll

2013-12-29 12:07 - 2012-05-17 04:29 - 07163744 _____ (Dolby Laboratories) C:\Windows\system32\R4EEP64H.dll

2013-12-29 12:07 - 2012-05-17 04:29 - 00433504 _____ (Dolby Laboratories) C:\Windows\system32\R4EED64H.dll

2013-12-29 12:07 - 2012-05-17 04:29 - 00141152 _____ (Dolby Laboratories) C:\Windows\system32\R4EEL64H.dll

2013-12-29 12:07 - 2012-05-17 04:29 - 00123744 _____ (Dolby Laboratories) C:\Windows\system32\R4EEA64H.dll

2013-12-29 12:07 - 2012-05-17 04:29 - 00074592 _____ (Dolby Laboratories) C:\Windows\system32\R4EEG64H.dll

2013-12-29 12:07 - 2012-05-10 08:22 - 01262696 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTCOM64.dll

2013-12-29 12:07 - 2012-04-10 07:40 - 02533952 _____ (Fortemedia Corporation) C:\Windows\system32\FMAPO64.dll

2013-12-29 12:07 - 2012-04-03 11:42 - 01015640 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPOShell64.dll

2013-12-29 12:07 - 2012-03-08 04:47 - 00202336 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAC64.dll

2013-12-29 12:07 - 2012-03-08 04:47 - 00108640 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAR64.dll

2013-12-29 12:07 - 2012-02-21 12:45 - 02605400 _____ (Waves Audio Ltd.) C:\Windows\system32\WavesGUILib.dll

2013-12-29 12:07 - 2011-12-20 08:32 - 00331880 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtlCPAPI64.dll

2013-12-29 12:07 - 2011-12-18 10:58 - 02131288 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioEQ.dll

2013-12-29 12:07 - 2011-12-16 07:57 - 00065112 _____ (Creative Technology Ltd.) C:\Windows\system32\MBppld64.dll

2013-12-29 12:07 - 2011-12-13 09:58 - 01560168 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTSnMg64.cpl

2013-12-29 12:07 - 2011-12-02 07:20 - 03746408 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkHDM64.dll

2013-12-29 12:07 - 2011-11-22 09:28 - 00014952 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCoLDR64.dll

2013-12-29 12:07 - 2011-09-27 07:04 - 02526824 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RHDMEx64.dll

2013-12-29 12:07 - 2011-07-06 06:27 - 00092264 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RHCoInst64.dll

2013-12-29 12:07 - 2010-11-08 00:31 - 00375128 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEP64A.dll

2013-12-29 12:07 - 2010-11-08 00:31 - 00372056 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEP64H.dll

2013-12-29 12:07 - 2010-11-08 00:31 - 00310104 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DHT64.dll

2013-12-29 12:07 - 2010-11-08 00:31 - 00310104 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DAA64.dll

2013-12-29 12:07 - 2010-11-08 00:31 - 00310104 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RH3DHT64.dll

2013-12-29 12:07 - 2010-11-08 00:31 - 00310104 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RH3DAA64.dll

2013-12-29 12:07 - 2010-11-08 00:31 - 00204120 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEED64H.dll

2013-12-29 12:07 - 2010-11-08 00:31 - 00204120 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEED64A.dll

2013-12-29 12:07 - 2010-11-08 00:31 - 00101208 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEL64A.dll

2013-12-29 12:07 - 2010-11-08 00:31 - 00097624 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEL64H.dll

2013-12-29 12:07 - 2010-11-08 00:31 - 00078680 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEG64H.dll

2013-12-29 12:07 - 2010-11-08 00:31 - 00078680 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEG64A.dll

2013-12-29 12:07 - 2010-11-03 11:30 - 00149608 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCfg64.dll

2013-12-29 12:07 - 2010-09-27 02:34 - 00318808 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO20.dll

2013-12-29 12:07 - 2009-11-24 02:55 - 00518896 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSX64.dll

2013-12-29 12:07 - 2009-11-24 02:55 - 00211184 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSH64.dll

2013-12-29 12:07 - 2009-11-24 02:55 - 00198896 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSHP64.dll

2013-12-29 12:07 - 2009-11-24 02:55 - 00155888 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSWOW64.dll

2013-12-29 12:07 - 2009-11-18 00:13 - 00060504 _____ (Creative Technology Ltd.) C:\Windows\system32\MBPPCn64.dll

2013-12-29 12:06 - 2013-12-29 12:07 - 00000000 ____D C:\ProgramData\AMD

2013-12-29 12:06 - 2013-12-29 12:06 - 00060197 _____ C:\Windows\SysWOW64\CCCInstall_201312291206544121.log

2013-12-29 12:05 - 2013-12-29 12:05 - 00000000 ____D C:\Program Files\Common Files\ATI Technologies

2013-12-29 12:03 - 2013-12-29 16:04 - 00000000 ____D C:\ProgramData\Package Cache

2013-12-29 12:03 - 2013-12-29 12:03 - 00000000 ____D C:\Program Files\ATI

2013-12-29 12:02 - 2013-12-29 12:06 - 00000000 ____D C:\Program Files\AMD

2013-12-29 12:01 - 2013-12-29 12:01 - 00372091 __RSH C:\WOYBL

2013-12-29 11:58 - 2014-01-11 21:28 - 00000000 ____D C:\Users\Raubtier

2013-12-29 11:58 - 2014-01-11 21:27 - 00000000 ____D C:\Users\Raubtier\AppData\Local\VirtualStore

2013-12-29 11:58 - 2013-12-30 06:31 - 00001421 _____ C:\Users\Raubtier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2013-12-29 11:58 - 2013-12-30 05:43 - 00000000 ___RD C:\Users\Raubtier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

2013-12-29 11:58 - 2013-12-30 05:43 - 00000000 ___RD C:\Users\Raubtier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

2013-12-29 11:58 - 2013-12-29 11:59 - 00000000 ___RD C:\Users\Raubtier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2013-12-29 11:58 - 2013-12-29 11:59 - 00000000 ___RD C:\Users\Raubtier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

2013-12-29 11:58 - 2013-12-29 11:58 - 00000020 ___SH C:\Users\Raubtier\ntuser.ini

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\Vorlagen

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\Startmenü

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\Netzwerkumgebung

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\Lokale Einstellungen

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\Eigene Dateien

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\Druckumgebung

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\Documents\Eigene Musik

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\Documents\Eigene Bilder

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\AppData\Roaming\Microsoft\Windows\Start Menu\Programme

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\AppData\Local\Verlauf

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\AppData\Local\Anwendungsdaten

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\Anwendungsdaten

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Musik

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Bilder

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\Vorlagen

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\Startmenü

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\Netzwerkumgebung

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\Lokale Einstellungen

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\Eigene Dateien

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\Druckumgebung

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Musik

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Bilder

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\AppData\Local\Verlauf

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\AppData\Local\Anwendungsdaten

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\Anwendungsdaten

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Musik

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Bilder

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Verlauf

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Anwendungsdaten

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Programme

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\ProgramData\Vorlagen

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\ProgramData\Startmenü

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\ProgramData\Favoriten

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\ProgramData\Dokumente

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\ProgramData\Anwendungsdaten

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Program Files\Gemeinsame Dateien

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Dokumente und Einstellungen

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\Adobe

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 ____D C:\Recovery

2013-12-29 11:50 - 2013-12-30 06:21 - 01591896 _____ C:\Windows\SysWOW64\PerfStringBackup.INI

2013-12-29 11:44 - 2013-12-29 11:44 - 00001355 _____ C:\Windows\TSSysprep.log

2013-12-29 11:43 - 2014-01-14 20:58 - 01752098 _____ C:\Windows\WindowsUpdate.log

2013-12-29 11:39 - 2014-01-11 19:25 - 00000000 ____D C:\Windows\Panther

2013-12-29 11:39 - 2013-12-29 11:39 - 00008192 __RSH C:\BOOTSECT.BAK

2013-12-29 11:39 - 2010-11-21 04:23 - 00383786 __RSH C:\bootmgr

2013-12-29 11:17 - 2013-12-06 23:07 - 00078432 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atimpc64.dll

2013-12-29 11:17 - 2013-12-06 23:07 - 00078432 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\amdpcom64.dll

2013-12-29 11:17 - 2013-12-06 23:07 - 00071704 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atimpc32.dll

2013-12-29 11:17 - 2013-12-06 23:07 - 00071704 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\amdpcom32.dll

2013-12-29 11:17 - 2013-12-06 23:04 - 00143304 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiuxp64.dll

2013-12-29 11:17 - 2013-12-06 23:03 - 00126336 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiuxpag.dll

2013-12-29 11:17 - 2013-12-06 23:03 - 00115512 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiu9p64.dll

2013-12-29 11:17 - 2013-12-06 23:02 - 00098496 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiu9pag.dll

2013-12-29 11:17 - 2013-12-06 23:01 - 01318552 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\aticfx64.dll

2013-12-29 11:17 - 2013-12-06 23:01 - 01100216 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\aticfx32.dll

2013-12-29 11:17 - 2013-12-06 23:00 - 09753752 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atidxx64.dll

2013-12-29 11:17 - 2013-12-06 22:59 - 08406024 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atidxx32.dll

2013-12-29 11:17 - 2013-12-06 22:59 - 08287008 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiumdva.dll

2013-12-29 11:17 - 2013-12-06 22:58 - 06630232 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiumdag.dll

2013-12-29 11:17 - 2013-12-06 22:57 - 08927704 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiumd6a.dll

2013-12-29 11:17 - 2013-12-06 22:56 - 07751920 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiumd64.dll

2013-12-29 11:17 - 2013-12-06 22:52 - 13207552 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\Drivers\atikmdag.sys

2013-12-29 11:17 - 2013-12-06 22:38 - 01187342 _____ C:\Windows\system32\amdocl_as64.exe

2013-12-29 11:17 - 2013-12-06 22:38 - 01061902 _____ C:\Windows\system32\amdocl_ld64.exe

2013-12-29 11:17 - 2013-12-06 22:38 - 00995342 _____ C:\Windows\SysWOW64\amdocl_as32.exe

2013-12-29 11:17 - 2013-12-06 22:38 - 00798734 _____ C:\Windows\SysWOW64\amdocl_ld32.exe

2013-12-29 11:17 - 2013-12-06 22:38 - 00099840 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\OpenVideo64.dll

2013-12-29 11:17 - 2013-12-06 22:38 - 00086528 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\OVDecode64.dll

2013-12-29 11:17 - 2013-12-06 22:38 - 00083968 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\OpenVideo.dll

2013-12-29 11:17 - 2013-12-06 22:38 - 00073728 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\OVDecode.dll

2013-12-29 11:17 - 2013-12-06 22:37 - 29382144 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\amdocl64.dll

2013-12-29 11:17 - 2013-12-06 22:35 - 24860160 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\amdocl.dll

2013-12-29 11:17 - 2013-12-06 22:33 - 00063488 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll

2013-12-29 11:17 - 2013-12-06 22:33 - 00057344 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll

2013-12-29 11:17 - 2013-12-06 22:26 - 00129536 _____ (AMD) C:\Windows\system32\coinst_13.251.dll

2013-12-29 11:17 - 2013-12-06 22:16 - 26352128 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atio6axx.dll

2013-12-29 11:17 - 2013-12-06 22:13 - 00550456 _____ C:\Windows\SysWOW64\atiapfxx.blb

2013-12-29 11:17 - 2013-12-06 22:13 - 00550456 _____ C:\Windows\system32\atiapfxx.blb

2013-12-29 11:17 - 2013-12-06 22:13 - 00368640 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atiapfxx.exe

2013-12-29 11:17 - 2013-12-06 22:12 - 15716352 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\aticaldd64.dll

2013-12-29 11:17 - 2013-12-06 22:12 - 00062464 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\aticalrt64.dll

2013-12-29 11:17 - 2013-12-06 22:12 - 00055808 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\aticalcl64.dll

2013-12-29 11:17 - 2013-12-06 22:12 - 00052224 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\aticalrt.dll

2013-12-29 11:17 - 2013-12-06 22:12 - 00049152 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\aticalcl.dll

2013-12-29 11:17 - 2013-12-06 22:09 - 14302208 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\aticaldd.dll

2013-12-29 11:17 - 2013-12-06 21:58 - 22157824 _____ (Advanced Micro Devices, Inc.) C:\Windows\SysWOW64\atioglxx.dll

2013-12-29 11:17 - 2013-12-06 21:53 - 00588288 _____ (AMD) C:\Windows\system32\atieclxx.exe

2013-12-29 11:17 - 2013-12-06 21:53 - 00442368 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atidemgy.dll

2013-12-29 11:17 - 2013-12-06 21:53 - 00031232 _____ (AMD) C:\Windows\system32\atimuixx.dll

2013-12-29 11:17 - 2013-12-06 21:52 - 00239616 _____ (AMD) C:\Windows\system32\atiesrxx.exe

2013-12-29 11:17 - 2013-12-06 21:50 - 00190976 _____ (AMD) C:\Windows\system32\atitmm64.dll

2013-12-29 11:17 - 2013-12-06 21:42 - 03426688 _____ C:\Windows\system32\atiumd6a.cap

2013-12-29 11:17 - 2013-12-06 21:39 - 00204952 _____ C:\Windows\SysWOW64\ativvsvl.dat

2013-12-29 11:17 - 2013-12-06 21:39 - 00204952 _____ C:\Windows\system32\ativvsvl.dat

2013-12-29 11:17 - 2013-12-06 21:39 - 00157144 _____ C:\Windows\SysWOW64\ativvsva.dat

2013-12-29 11:17 - 2013-12-06 21:39 - 00157144 _____ C:\Windows\system32\ativvsva.dat

2013-12-29 11:17 - 2013-12-06 21:31 - 03461040 _____ C:\Windows\SysWOW64\atiumdva.cap

2013-12-29 11:17 - 2013-12-06 21:22 - 01144320 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atiadlxx.dll

2013-12-29 11:17 - 2013-12-06 21:22 - 00825344 _____ (Advanced Micro Devices, Inc.) C:\Windows\SysWOW64\atiadlxy.dll

2013-12-29 11:17 - 2013-12-06 21:22 - 00100352 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atig6txx.dll

2013-12-29 11:17 - 2013-12-06 21:22 - 00074752 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atig6pxx.dll

2013-12-29 11:17 - 2013-12-06 21:22 - 00069632 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiglpxx.dll

2013-12-29 11:17 - 2013-12-06 21:22 - 00069632 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiglpxx.dll

2013-12-29 11:17 - 2013-12-06 21:21 - 00626176 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\Drivers\atikmpag.sys

2013-12-29 11:17 - 2013-12-06 21:21 - 00096768 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atigktxx.dll

2013-12-29 11:17 - 2013-12-06 21:18 - 00043520 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\Drivers\ati2erec.dll

2013-12-29 11:17 - 2013-11-01 09:08 - 00721296 _____ C:\Windows\system32\atiicdxx.dat

2013-12-29 11:17 - 2013-09-30 21:48 - 00047887 _____ C:\Windows\atiogl.xml

2013-12-29 11:17 - 2013-09-26 22:14 - 00083552 _____ C:\Windows\system32\ativce02.dat

2013-12-29 11:17 - 2013-09-24 15:53 - 00094208 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\AtihdW76.sys

2013-12-29 11:17 - 2013-09-24 15:51 - 00110080 _____ (TODO: <Company name>) C:\Windows\system32\DelayAPO.dll

2013-12-29 11:17 - 2013-09-12 17:31 - 00233776 _____ C:\Windows\system32\ativvaxy_cik_nd.dat

2013-12-29 11:17 - 2013-09-12 17:30 - 00234036 _____ C:\Windows\system32\ativvaxy_cik.dat

2013-12-29 11:17 - 2013-04-10 16:34 - 00332800 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\ATIODE.exe

2013-12-29 11:17 - 2013-04-10 16:34 - 00118784 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atibtmon.exe

2013-12-29 11:17 - 2013-04-10 16:34 - 00051200 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\ATIODCLI.exe

2013-12-29 11:17 - 2011-09-12 23:06 - 00003917 _____ C:\Windows\SysWOW64\atipblag.dat

2013-12-29 11:17 - 2011-09-12 23:06 - 00003917 _____ C:\Windows\system32\atipblag.dat
 

==================== One Month Modified Files and Folders =======
 

2014-01-14 21:26 - 2014-01-11 13:24 - 00006989 _____ C:\Users\Raubtier\Desktop\FRST.txt

2014-01-14 21:21 - 2014-01-14 21:21 - 02076160 _____ (Farbar) C:\Users\Raubtier\Desktop\FRST64.exe

2014-01-14 21:21 - 2013-12-29 12:49 - 00001114 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-01-14 21:20 - 2011-04-12 08:43 - 00698688 _____ C:\Windows\system32\perfh007.dat

2014-01-14 21:20 - 2011-04-12 08:43 - 00148828 _____ C:\Windows\system32\perfc007.dat

2014-01-14 21:20 - 2009-07-14 06:13 - 01618320 _____ C:\Windows\system32\PerfStringBackup.INI

2014-01-14 21:19 - 2013-12-30 23:09 - 00007607 _____ C:\Users\Raubtier\AppData\Local\Resmon.ResmonCfg

2014-01-14 21:19 - 2013-12-30 20:47 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\TS3Client

2014-01-14 20:58 - 2013-12-29 11:43 - 01752098 _____ C:\Windows\WindowsUpdate.log

2014-01-14 20:58 - 2009-07-14 05:51 - 00030576 _____ C:\Windows\setupact.log

2014-01-14 20:52 - 2013-12-29 13:09 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-01-14 20:49 - 2009-07-14 05:45 - 00026352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-01-14 20:49 - 2009-07-14 05:45 - 00026352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-01-14 20:46 - 2013-12-29 12:20 - 00000000 ____D C:\Program Files\Origin

2014-01-14 20:42 - 2013-12-29 12:49 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-01-14 20:42 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2014-01-14 17:56 - 2014-01-13 17:38 - 00000000 ____D C:\Users\Raubtier\Desktop\Updates

2014-01-14 05:33 - 2014-01-14 05:33 - 00000624 _____ C:\Users\Raubtier\Desktop\JRT.txt

2014-01-14 05:28 - 2014-01-14 05:28 - 00000000 ____D C:\Windows\ERUNT

2014-01-14 05:27 - 2014-01-14 05:27 - 01037068 _____ (Thisisu) C:\Users\Raubtier\Desktop\JRT (1).exe

2014-01-14 05:22 - 2014-01-14 05:17 - 00000000 ____D C:\AdwCleaner

2014-01-14 05:15 - 2014-01-14 05:15 - 01037068 _____ (Thisisu) C:\Users\Raubtier\Desktop\JRT.exe

2014-01-14 05:14 - 2014-01-14 05:14 - 01236282 _____ C:\Users\Raubtier\Desktop\adwcleaner.exe

2014-01-14 00:36 - 2014-01-12 00:13 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update

2014-01-13 17:27 - 2013-12-29 12:13 - 00001912 _____ C:\Windows\epplauncher.mif

2014-01-12 20:25 - 2014-01-12 20:25 - 00000000 ____D C:\Patch2

2014-01-12 20:25 - 2014-01-12 20:25 - 00000000 ____D C:\patch1

2014-01-12 20:24 - 2014-01-12 20:24 - 04693832 _____ C:\Users\Raubtier\Desktop\441065_intl_x64_zip.exe

2014-01-12 20:24 - 2014-01-12 20:23 - 00316912 _____ C:\Users\Raubtier\Desktop\441280_intl_x64_zip.exe

2014-01-12 20:10 - 2010-11-21 04:47 - 00008452 _____ C:\Windows\PFRO.log

2014-01-12 17:04 - 2014-01-12 17:03 - 00000000 ____D C:\Users\Raubtier\Desktop\Prime95

2014-01-12 17:03 - 2014-01-12 17:03 - 04277073 _____ C:\Users\Raubtier\Desktop\p95v279.win32.zip

2014-01-12 17:03 - 2013-12-29 12:21 - 00000000 ____D C:\ProgramData\Origin

2014-01-12 14:31 - 2014-01-12 14:25 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2014-01-12 14:25 - 2014-01-12 14:25 - 00089304 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-01-12 14:25 - 2014-01-12 14:24 - 00000000 ____D C:\Users\Raubtier\Desktop\mbar

2014-01-12 14:24 - 2014-01-12 14:24 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Raubtier\Desktop\mbar-1.07.0.1008.exe

2014-01-12 14:17 - 2014-01-12 14:17 - 00000914 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-01-12 14:17 - 2014-01-12 14:17 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware

2014-01-12 14:16 - 2014-01-12 00:13 - 00079672 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys

2014-01-12 14:13 - 2014-01-12 14:13 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Raubtier\Desktop\mbam-setup-1.75.0.1300.exe

2014-01-12 13:43 - 2014-01-12 13:43 - 00021244 _____ C:\ComboFix.txt

2014-01-12 13:43 - 2014-01-12 13:35 - 00000000 ____D C:\Qoobox

2014-01-12 13:41 - 2014-01-12 13:34 - 00000000 ____D C:\Windows\erdnt

2014-01-12 13:40 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini

2014-01-12 13:32 - 2014-01-12 13:32 - 05162489 ____R (Swearware) C:\Users\Raubtier\Desktop\ComboFix.exe

2014-01-12 00:13 - 2014-01-12 00:13 - 01034464 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys

2014-01-12 00:13 - 2014-01-12 00:13 - 00422216 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys

2014-01-12 00:13 - 2014-01-12 00:13 - 00334136 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe

2014-01-12 00:13 - 2014-01-12 00:13 - 00207904 _____ C:\Windows\system32\Drivers\aswVmm.sys

2014-01-12 00:13 - 2014-01-12 00:13 - 00092544 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys

2014-01-12 00:13 - 2014-01-12 00:13 - 00078648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys

2014-01-12 00:13 - 2014-01-12 00:13 - 00065776 _____ C:\Windows\system32\Drivers\aswRvrt.sys

2014-01-12 00:13 - 2014-01-12 00:13 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr

2014-01-12 00:13 - 2014-01-12 00:13 - 00001966 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk

2014-01-11 23:12 - 2013-12-29 12:18 - 00000000 ____D C:\ProgrammeVirtualCloneDrive

2014-01-11 22:36 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF

2014-01-11 21:28 - 2014-01-11 21:28 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdFs_01_09_00.Wdf

2014-01-11 21:28 - 2013-12-29 11:58 - 00000000 ____D C:\Users\Raubtier

2014-01-11 21:27 - 2014-01-11 18:34 - 00000000 ____D C:\Users\Raubtier\Desktop\rootkit detektiv

2014-01-11 21:27 - 2013-12-30 22:20 - 00000000 ____D C:\Windows\pss

2014-01-11 21:27 - 2013-12-29 15:29 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\DAEMON Tools Lite

2014-01-11 21:27 - 2013-12-29 11:58 - 00000000 ____D C:\Users\Raubtier\AppData\Local\VirtualStore

2014-01-11 21:27 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\registration

2014-01-11 19:37 - 2014-01-11 01:28 - 00050568 _____ C:\Users\Raubtier\Desktop\Extras.Txt

2014-01-11 19:37 - 2014-01-11 01:27 - 00217022 _____ C:\Users\Raubtier\Desktop\OTL.Txt

2014-01-11 19:25 - 2014-01-11 14:00 - 00000000 ____D C:\Windows\Minidump

2014-01-11 19:25 - 2013-12-29 22:42 - 00000000 ___DC C:\Users\Raubtier\AppData\Local\MigWiz

2014-01-11 19:25 - 2013-12-29 11:39 - 00000000 ____D C:\Windows\Panther

2014-01-11 17:59 - 2014-01-11 17:59 - 00000000 ____D C:\Users\Raubtier\Desktop\RootkitRevealer171

2014-01-11 17:56 - 2014-01-11 18:34 - 01720705 _____ C:\Users\Raubtier\Desktop\McafeeRootkitDetective11.zip

2014-01-11 13:32 - 2014-01-11 13:32 - 00225630 _____ C:\Users\Raubtier\Desktop\Gmer.txt

2014-01-11 13:22 - 2014-01-11 13:22 - 00000000 ____D C:\FRST

2014-01-11 13:21 - 2014-01-11 13:21 - 00000148 _____ C:\Users\Raubtier\defogger_reenable

2014-01-11 12:47 - 2014-01-11 12:47 - 00000000 ____D C:\Program Files (x86)\Sophos

2014-01-11 02:08 - 2014-01-11 02:08 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\AVAST Software

2014-01-11 02:07 - 2014-01-11 02:07 - 00000000 ____D C:\ProgramData\AVAST Software

2014-01-11 02:07 - 2014-01-11 02:07 - 00000000 ____D C:\Program Files\AVAST Software

2014-01-11 02:06 - 2014-01-11 02:05 - 91412976 _____ (AVAST Software) C:\Users\Raubtier\Desktop\avast_free_antivirus_setup.exe

2014-01-11 01:41 - 2014-01-11 01:41 - 04745728 _____ (AVAST Software) C:\Users\Raubtier\Desktop\aswMBR.exe

2014-01-11 01:23 - 2014-01-11 01:23 - 00602112 _____ (OldTimer Tools) C:\Users\Raubtier\Desktop\OTL.exe

2014-01-11 00:53 - 2009-07-14 06:08 - 00015246 _____ C:\Windows\Tasks\SCHEDLGU.TXT

2014-01-10 22:04 - 2014-01-10 22:04 - 00791552 _____ (AMD) C:\Users\Raubtier\Desktop\amddriverdownloader.exe

2014-01-10 22:00 - 2014-01-10 21:40 - 00000000 ____D C:\Users\Raubtier\Desktop\cpu-z-168

2014-01-10 22:00 - 2014-01-07 12:55 - 00000000 ____D C:\Program Files (x86)\Windows Live

2014-01-10 22:00 - 2014-01-01 21:18 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\Skype

2014-01-10 22:00 - 2013-12-29 12:21 - 00000000 ____D C:\Program Files\Steam

2014-01-10 22:00 - 2013-12-29 12:07 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information

2014-01-10 22:00 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD

2014-01-10 22:00 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\AppCompat

2014-01-10 21:38 - 2014-01-10 21:38 - 01994222 _____ C:\Users\Raubtier\Desktop\cpu-z-168.zip

2014-01-10 21:16 - 2014-01-10 21:16 - 00000010 _____ C:\csb.log

2014-01-10 01:01 - 2014-01-07 00:57 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\Usenet.nl

2014-01-10 00:55 - 2014-01-07 00:57 - 00000000 ____D C:\Users\Raubtier\Documents\Usenet.nl

2014-01-08 20:14 - 2014-01-07 20:43 - 00000000 ____D C:\Users\Raubtier\Tracing

2014-01-08 00:21 - 2014-01-07 12:50 - 00000000 ____D C:\Users\Raubtier\AppData\Local\Windows Live

2014-01-07 12:56 - 2014-01-07 12:56 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server Compact Edition

2014-01-07 12:55 - 2014-01-07 12:55 - 00000000 ____D C:\Windows\PCHEALTH

2014-01-07 12:51 - 2014-01-07 12:51 - 00000000 ____D C:\ProgramData\Microsoft SkyDrive

2014-01-07 12:50 - 2014-01-07 12:50 - 01245168 _____ (Microsoft Corporation) C:\Users\Raubtier\Desktop\wlsetup-web.exe

2014-01-07 12:49 - 2013-12-30 19:28 - 00000000 ____D C:\Program Files\HDDGURU LLF Tool

2014-01-07 12:48 - 2013-12-30 11:02 - 00000000 ____D C:\Windows\System32\Tasks\Abelssoft

2014-01-07 12:48 - 2013-12-29 20:26 - 00000000 ____D C:\Program Files\CheckDrive

2014-01-07 01:48 - 2013-12-31 01:25 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\vlc

2014-01-07 00:57 - 2014-01-07 00:57 - 07457256 _____ (                                                            ) C:\Users\Raubtier\Desktop\UsenetNLSetup.exe

2014-01-07 00:57 - 2014-01-07 00:57 - 00001682 _____ C:\Users\Raubtier\Desktop\Usenet.nl.lnk

2014-01-07 00:57 - 2014-01-07 00:57 - 00000000 ____D C:\Program Files\Usenet.nl

2014-01-07 00:39 - 2014-01-02 00:30 - 00000000 ____D C:\Users\Raubtier\AppData\Local\Microsoft Games

2014-01-03 21:18 - 2014-01-03 21:18 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\Malwarebytes

2014-01-03 21:18 - 2014-01-03 21:18 - 00000000 ____D C:\ProgramData\Malwarebytes

2014-01-02 23:15 - 2014-01-02 23:15 - 00000000 ____D C:\Users\Raubtier\Documents\WB Games

2014-01-02 23:11 - 2014-01-02 23:11 - 00001520 _____ C:\Users\Raubtier\Desktop\TheBureau.lnk

2014-01-02 23:11 - 2014-01-02 23:11 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\2K Sports

2014-01-02 23:10 - 2014-01-02 23:10 - 00001045 _____ C:\Users\Raubtier\Desktop\nba2k14.lnk

2014-01-02 23:09 - 2014-01-02 23:09 - 00001669 _____ C:\Users\Raubtier\Desktop\BatmanOrigins.lnk

2014-01-02 23:02 - 2013-12-29 16:01 - 00074987 _____ C:\Windows\DirectX.log

2014-01-01 22:52 - 2014-01-01 20:53 - 00000000 ____D C:\Users\Raubtier\AppData\Local\ESN Sonar

2014-01-01 22:35 - 2014-01-01 22:35 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_xusb21_01009.Wdf

2014-01-01 22:35 - 2014-01-01 22:35 - 00000000 ____D C:\Program Files\Microsoft Xbox 360 Accessories

2014-01-01 22:17 - 2013-12-29 16:04 - 00214392 _____ C:\Windows\SysWOW64\PnkBstrB.exe

2014-01-01 22:02 - 2013-12-29 16:04 - 00214392 _____ C:\Windows\SysWOW64\PnkBstrB.ex0

2014-01-01 21:18 - 2014-01-01 21:17 - 00000000 ____D C:\ProgramData\Skype

2014-01-01 21:17 - 2014-01-01 21:17 - 00002699 _____ C:\Users\Public\Desktop\Skype.lnk

2014-01-01 21:17 - 2014-01-01 21:17 - 00000000 ___RD C:\Program Files (x86)\Skype

2014-01-01 12:27 - 2013-12-29 16:04 - 00000000 ____D C:\Program Files (x86)\Battlelog Web Plugins

2014-01-01 03:02 - 2014-01-01 03:02 - 00000857 _____ C:\Users\Raubtier\Desktop\Yahoo! Messenger.lnk

2013-12-31 01:07 - 2013-12-31 01:07 - 00000000 ____D C:\Windows\System32\Tasks\Games

2013-12-30 19:29 - 2013-12-30 19:29 - 00000001 _____ C:\Users\Raubtier\AppData\Local\llftool.4.30.agreement

2013-12-30 12:35 - 2013-12-30 12:34 - 00000000 ____D C:\Program Files\Data Lifeguard Diagnostic for Windows

2013-12-30 11:02 - 2013-12-29 20:26 - 00000000 ____D C:\Users\Raubtier\AppData\Local\Abelssoft

2013-12-30 07:15 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache

2013-12-30 06:40 - 2013-12-29 22:28 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2013-12-30 06:40 - 2013-12-29 22:28 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight

2013-12-30 06:31 - 2013-12-29 11:58 - 00001421 _____ C:\Users\Raubtier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2013-12-30 06:28 - 2013-12-30 06:28 - 00000000 ____D C:\Program Files (x86)\Etron Technology

2013-12-30 06:28 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\PolicyDefinitions

2013-12-30 06:21 - 2013-12-29 11:50 - 01591896 _____ C:\Windows\SysWOW64\PerfStringBackup.INI

2013-12-30 06:19 - 2013-12-30 05:57 - 00015952 _____ C:\Windows\IE11_main.log

2013-12-30 06:15 - 2013-12-30 06:15 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2013-12-30 06:15 - 2013-12-30 06:15 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat

2013-12-30 06:15 - 2013-12-30 06:15 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat

2013-12-30 06:15 - 2013-12-30 06:15 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec

2013-12-30 06:15 - 2013-12-30 06:15 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec

2013-12-30 06:15 - 2013-12-30 06:15 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe

2013-12-30 06:15 - 2013-12-30 06:15 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe

2013-12-30 06:15 - 2013-12-30 06:15 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe

2013-12-30 06:15 - 2013-12-30 06:15 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe

2013-12-30 06:15 - 2013-12-30 06:15 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2013-12-30 06:15 - 2013-12-30 06:15 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe

2013-12-30 06:15 - 2013-12-30 06:15 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

2013-12-30 06:15 - 2013-12-30 06:15 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx

2013-12-30 06:15 - 2013-12-30 06:15 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe

2013-12-30 06:15 - 2013-12-30 06:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe

2013-12-30 06:15 - 2013-12-30 06:15 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx

2013-12-30 06:15 - 2013-12-30 06:15 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll

2013-12-30 06:15 - 2013-12-30 06:15 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe

2013-12-30 06:15 - 2013-12-30 06:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe

2013-12-30 06:15 - 2013-12-30 06:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe

2013-12-30 06:15 - 2013-12-30 06:15 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe

2013-12-30 06:08 - 2009-07-14 05:45 - 00294344 _____ C:\Windows\system32\FNTCACHE.DAT

2013-12-30 05:56 - 2013-12-29 22:25 - 00000000 ____D C:\Windows\system32\MRT

2013-12-30 05:46 - 2013-12-29 12:13 - 00059296 _____ C:\Users\Raubtier\AppData\Local\GDIPFONTCACHEV1.DAT

2013-12-30 05:44 - 2009-07-14 04:20 - 00000000 __RSD C:\Windows\Media

2013-12-30 05:43 - 2013-12-29 12:19 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR

2013-12-30 05:43 - 2013-12-29 11:58 - 00000000 ___RD C:\Users\Raubtier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

2013-12-30 05:43 - 2013-12-29 11:58 - 00000000 ___RD C:\Users\Raubtier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

2013-12-30 05:43 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared

2013-12-30 05:35 - 2013-12-29 13:05 - 00000000 ____D C:\ProgramData\Razer

2013-12-29 23:37 - 2013-12-29 23:36 - 00000000 ____D C:\Windows\System32\Tasks\Aufgaben der Ereignisanzeige

2013-12-29 22:05 - 2013-12-29 22:05 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\WinRAR

2013-12-29 21:28 - 2013-12-29 21:28 - 00000000 ____D C:\Users\Raubtier\AppData\Local\PunkBuster

2013-12-29 21:06 - 2013-12-29 21:06 - 00000000 ____D C:\Users\Raubtier\Documents\Battlefield 4

2013-12-29 21:06 - 2013-12-29 12:22 - 00000000 ____D C:\Users\Raubtier\AppData\Local\Origin

2013-12-29 21:06 - 2013-12-29 12:21 - 00000000 ____D C:\ProgramData\Electronic Arts

2013-12-29 20:34 - 2013-12-29 20:34 - 00000000 ____D C:\Users\Raubtier\AppData\Local\Razer

2013-12-29 20:15 - 2013-12-29 20:15 - 00000000 ____D C:\Users\Raubtier\AppData\Local\ESN

2013-12-29 16:14 - 2013-12-29 16:14 - 00000000 ____D C:\ProgramData\Steam

2013-12-29 16:04 - 2013-12-29 16:04 - 00076888 _____ C:\Windows\SysWOW64\PnkBstrA.exe

2013-12-29 16:04 - 2013-12-29 12:03 - 00000000 ____D C:\ProgramData\Package Cache

2013-12-29 15:54 - 2013-12-29 15:28 - 00000000 ____D C:\ProgramData\DAEMON Tools Lite

2013-12-29 15:29 - 2013-12-29 15:29 - 00283064 _____ (Disc Soft Ltd) C:\Windows\system32\Drivers\dtsoftbus01.sys

2013-12-29 15:29 - 2013-12-29 15:29 - 00000000 ____D C:\Program Files\DAEMON Tools Lite

2013-12-29 13:16 - 2013-12-29 12:49 - 00004110 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2013-12-29 13:16 - 2013-12-29 12:49 - 00003858 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2013-12-29 13:11 - 2013-12-29 13:11 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\Yahoo!

2013-12-29 13:10 - 2013-12-29 13:10 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\Macromedia

2013-12-29 13:09 - 2013-12-29 13:09 - 00419488 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2013-12-29 13:09 - 2013-12-29 13:09 - 00070304 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-12-29 13:09 - 2013-12-29 13:09 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2013-12-29 13:09 - 2013-12-29 13:09 - 00000000 ____D C:\Windows\SysWOW64\Macromed

2013-12-29 13:09 - 2013-12-29 13:09 - 00000000 ____D C:\ProgramData\Yahoo!

2013-12-29 13:09 - 2013-12-29 13:09 - 00000000 ____D C:\Program Files\Messenger

2013-12-29 13:09 - 2013-12-29 13:07 - 00000000 ____D C:\Program Files (x86)\Yahoo!

2013-12-29 13:07 - 2013-12-29 13:07 - 00444024 _____ (Yahoo! Inc.) C:\Users\Raubtier\Downloads\msgr11de.exe

2013-12-29 13:05 - 2013-12-29 13:04 - 13163200 _____ (Razer Inc.) C:\Users\Raubtier\Downloads\Razer_Synapse_Framework_V1.16.06.exe

2013-12-29 13:05 - 2013-12-29 13:02 - 00000000 ____D C:\Program Files (x86)\Razer

2013-12-29 13:03 - 2013-12-29 13:03 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_RzSynapse_01007.Wdf

2013-12-29 13:03 - 2013-12-29 13:02 - 00007312 _____ C:\Windows\DPINST.LOG

2013-12-29 13:02 - 2013-12-29 13:02 - 00000000 ____D C:\Program Files\Razer

2013-12-29 13:00 - 2013-12-29 12:59 - 40394840 _____ (Razer USA Ltd.                                               ) C:\Users\Raubtier\Downloads\Razer_NagaEpic_Driver_v3.03.exe

2013-12-29 12:57 - 2013-12-29 12:57 - 00000909 _____ C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk

2013-12-29 12:57 - 2013-12-29 12:57 - 00000000 ____D C:\Program Files\TeamSpeak 3 Client

2013-12-29 12:56 - 2013-12-29 12:55 - 32520760 _____ (TeamSpeak Systems GmbH) C:\Users\Raubtier\Downloads\TeamSpeak3-Client-win64-3.0.13.1.exe

2013-12-29 12:51 - 2013-12-29 12:49 - 00000000 ____D C:\Users\Raubtier\AppData\Local\Google

2013-12-29 12:51 - 2013-12-29 12:49 - 00000000 ____D C:\Program Files (x86)\Google

2013-12-29 12:49 - 2013-12-29 12:49 - 00000000 ____D C:\Users\Raubtier\AppData\Local\Deployment

2013-12-29 12:49 - 2013-12-29 12:49 - 00000000 ____D C:\Users\Raubtier\AppData\Local\Apps\2.0

2013-12-29 12:36 - 2013-12-29 12:22 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\Origin

2013-12-29 12:30 - 2013-12-29 12:30 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\ATI

2013-12-29 12:30 - 2013-12-29 12:30 - 00000000 ____D C:\Users\Raubtier\AppData\Local\ATI

2013-12-29 12:30 - 2013-12-29 12:30 - 00000000 ____D C:\Users\Raubtier\AppData\Local\AMD

2013-12-29 12:30 - 2013-12-29 12:30 - 00000000 ____D C:\ProgramData\ATI

2013-12-29 12:29 - 2013-12-29 12:29 - 00000000 _____ C:\Windows\ativpsrm.bin

2013-12-29 12:19 - 2013-12-29 12:17 - 00000000 ____D C:\Program Files\WinRAR

2013-12-29 12:18 - 2013-12-29 12:18 - 00000000 ____D C:\Program Files\VLC

2013-12-29 12:13 - 2013-12-29 12:13 - 00000000 ____D C:\Program Files (x86)\AMD APP

2013-12-29 12:08 - 2013-12-29 12:07 - 00000000 ____D C:\Program Files (x86)\Realtek

2013-12-29 12:07 - 2013-12-29 12:07 - 00000000 ____D C:\Windows\SysWOW64\RTCOM

2013-12-29 12:07 - 2013-12-29 12:07 - 00000000 ____D C:\Program Files\Realtek

2013-12-29 12:07 - 2013-12-29 12:07 - 00000000 ____D C:\Program Files (x86)\AMD AVT

2013-12-29 12:07 - 2013-12-29 12:06 - 00000000 ____D C:\ProgramData\AMD

2013-12-29 12:06 - 2013-12-29 12:06 - 00060197 _____ C:\Windows\SysWOW64\CCCInstall_201312291206544121.log

2013-12-29 12:06 - 2013-12-29 12:02 - 00000000 ____D C:\Program Files\AMD

2013-12-29 12:05 - 2013-12-29 12:05 - 00000000 ____D C:\Program Files\Common Files\ATI Technologies

2013-12-29 12:03 - 2013-12-29 12:03 - 00000000 ____D C:\Program Files\ATI

2013-12-29 12:03 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\system32\restore

2013-12-29 12:01 - 2013-12-29 12:01 - 00372091 __RSH C:\WOYBL

2013-12-29 11:59 - 2013-12-29 11:58 - 00000000 ___RD C:\Users\Raubtier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2013-12-29 11:59 - 2013-12-29 11:58 - 00000000 ___RD C:\Users\Raubtier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

2013-12-29 11:58 - 2013-12-29 11:58 - 00000020 ___SH C:\Users\Raubtier\ntuser.ini

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\Vorlagen

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\Startmenü

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\Netzwerkumgebung

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\Lokale Einstellungen

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\Eigene Dateien

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\Druckumgebung

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\Documents\Eigene Musik

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\Documents\Eigene Bilder

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\AppData\Roaming\Microsoft\Windows\Start Menu\Programme

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\AppData\Local\Verlauf

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\AppData\Local\Anwendungsdaten

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\Anwendungsdaten

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Musik

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Bilder

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\Vorlagen

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\Startmenü

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\Netzwerkumgebung

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\Lokale Einstellungen

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\Eigene Dateien

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\Druckumgebung

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Musik

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Bilder

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\AppData\Local\Verlauf

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\AppData\Local\Anwendungsdaten

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\Anwendungsdaten

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Musik

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Bilder

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Verlauf

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Anwendungsdaten

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Programme

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\ProgramData\Vorlagen

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\ProgramData\Startmenü

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\ProgramData\Favoriten

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\ProgramData\Dokumente

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\ProgramData\Anwendungsdaten

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Program Files\Gemeinsame Dateien

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Dokumente und Einstellungen

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\Adobe

2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 ____D C:\Recovery

2013-12-29 11:58 - 2009-07-14 04:20 - 00000000 __RHD C:\Users\Default

2013-12-29 11:58 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\Recovery

2013-12-29 11:58 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Windows NT

2013-12-29 11:44 - 2013-12-29 11:44 - 00001355 _____ C:\Windows\TSSysprep.log

2013-12-29 11:44 - 2009-07-14 05:46 - 00002790 _____ C:\Windows\DtcInstall.log

2013-12-29 11:44 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\sysprep

2013-12-29 11:41 - 2011-04-12 08:54 - 00000000 ____D C:\Windows\CSC

2013-12-29 11:39 - 2013-12-29 11:39 - 00008192 __RSH C:\BOOTSECT.BAK

2013-12-29 11:39 - 2009-07-14 06:38 - 00025600 ___SH C:\Windows\system32\config\BCD-Template.LOG

2013-12-29 11:39 - 2009-07-14 06:32 - 00028672 _____ C:\Windows\system32\config\BCD-Template

2013-12-29 11:39 - 2009-07-14 05:45 - 00000000 ____D C:\Windows\Setup
 

Some content of TEMP:

====================

C:\Users\Raubtier\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2014-01-09 22:50
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 14-01-2014 02

Ran by Raubtier at 2014-01-14 21:26:30

Running from C:\Users\Raubtier\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
 

==================== Installed Programs ======================
 

Adobe Flash Player 11 ActiveX (x32 Version: 11.2.202.235 - Adobe Systems Incorporated)

AMD Accelerated Video Transcoding (Version: 13.20.100.31206 - Advanced Micro Devices, Inc.) Hidden

AMD APP SDK Runtime (Version: 10.0.938.2 - Advanced Micro Devices Inc.) Hidden

AMD Catalyst Control Center (x32 Version: 2013.1206.1603.28764 - Ihr Firmenname) Hidden

AMD Catalyst Install Manager (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)

AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden

AMD Fuel (Version: 2013.1206.1603.28764 - Ihr Firmenname) Hidden

AMD Media Foundation Decoders (Version: 1.0.81206.1620 - Advanced Micro Devices, Inc.) Hidden

AMD Wireless Display v3.0 (Version: 1.0.0.14 - Advanced Micro Devices, Inc.) Hidden

avast! Free Antivirus (x32 Version: 9.0.2011 - Avast Software)

Batman Arkham Origins (x32 Version: 1 - )

Battlefield 4™ (x32 Version: 1.0.0.1 - Electronic Arts)

Battlelog Web Plugins (x32 Version: 2.3.2 - EA Digital Illusions CE AB)

Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center Graphics Previews Common (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center InstallProxy (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center Localization All (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Chinese Standard (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Chinese Traditional (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Czech (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Danish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Dutch (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help English (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Finnish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help French (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help German (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Greek (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Hungarian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Italian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Japanese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Korean (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Norwegian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Polish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Portuguese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Russian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Spanish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Swedish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Thai (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

CCC Help Turkish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden

ccc-utility64 (Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden

DAEMON Tools Lite (x32 Version: 4.48.1.0347 - Disc Soft Ltd)

Data Lifeguard Diagnostic for Windows 1.24 (x32 Version:  - Western Digital Corporation)

ESN Sonar (x32 Version: 0.70.4 - ESN Social Software AB)

Etron USB3.0 Host Controller (x32 Version: 0.115 - Etron Technology)

Etron USB3.0 Host Controller (x32 Version: 0.115 - Etron Technology) Hidden

Google Chrome (x32 Version: 31.0.1650.63 - Google Inc.)

Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden

Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)

Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (Version: 10.0.30319 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (x32 Version: 11.0.60610.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (x32 Version: 11.0.60610.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden

Microsoft Xbox 360 Accessories 1.2 (Version: 1.20.146.0 - Microsoft)

NBA 2K14 (x32 Version: 1.0.0 - 2K Sports)

No More Room in Hell (x32 Version:  - No More Room in Hell Team)

Origin (x32 Version: 9.3.11.2762 - Electronic Arts, Inc.)

PunkBuster Services (x32 Version: 0.993 - Even Balance, Inc.)

Razer Naga (x32 Version: 3.03.01 - Razer USA Ltd.)

Razer Synapse 2.0 (x32 Version: 1.16.6 - Razer Inc.)

Realtek Ethernet Controller Driver (x32 Version: 7.49.927.2011 - Realtek)

Realtek HDMI Audio Driver for ATI (x32 Version: 6.0.1.6650 - Realtek Semiconductor Corp.)

Realtek High Definition Audio Driver (x32 Version: 6.0.1.6662 - Realtek Semiconductor Corp.)

Skype™ 6.11 (x32 Version: 6.11.102 - Skype Technologies S.A.)

Steam (x32 Version:  - Valve Corporation)

TeamSpeak 3 Client (Version: 3.0.13 - TeamSpeak Systems GmbH)

The Bureau: XCOM Declassified (x32 Version: 1 - )

Usenet.nl (x32 Version:  - )

VLC media player 2.1.2 (x32 Version: 2.1.2 - VideoLAN)

WinRAR 5.00 (64-Bit) (Version: 5.00.0 - win.rar GmbH)

Yahoo! Messenger (x32 Version:  - Yahoo! Inc.)
 

==================== Restore Points  =========================
 

10-01-2014 13:40:18 Windows Update

10-01-2014 20:56:45 Configured Etron USB3.0 Host Controller

10-01-2014 20:59:11 Wiederherstellungsvorgang

10-01-2014 21:13:05 Windows Update

11-01-2014 01:07:25 avast! antivirus system restore point

11-01-2014 23:12:49 avast! antivirus system restore point

12-01-2014 19:26:02 Windows Update

12-01-2014 19:27:31 Windows Update

12-01-2014 19:31:32 Windows Update
 

==================== Hosts content: ==========================
 

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {08D4B8B1-9185-4CA9-A9EC-2EE7CA338D17} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-01-12] (AVAST Software)

Task: {49271653-5C6F-4686-9810-335BAF8B9F80} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => C:\Program Files\Microsoft Security Client\MpCmdRun.exe

Task: {6E7B4529-29ED-4013-93A9-C50CDC123A42} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-29] (Adobe Systems Incorporated)

Task: {7B97527C-D3F3-414E-9B0D-7E3D8F2330E6} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-29] (Google Inc.)

Task: {968D6584-599F-4831-902B-E2F584557820} - System32\Tasks\Games\UpdateCheck_S-1-5-21-199586521-2663480010-3892174971-1000

Task: {F04774E6-327B-4C2A-AB20-43DF7D1744F1} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-29] (Google Inc.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 

==================== Loaded Modules (whitelisted) =============
 

2013-12-06 16:06 - 2013-12-06 16:06 - 00102400 _____ () C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Proxy.Native.dll

2014-01-14 17:03 - 2014-01-14 08:32 - 02153984 _____ () C:\Program Files\AVAST Software\Avast\defs\14011400\algo.dll

2014-01-14 20:43 - 2014-01-14 18:11 - 02153984 _____ () C:\Program Files\AVAST Software\Avast\defs\14011401\algo.dll

2014-01-12 00:13 - 2014-01-12 00:13 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
 

==================== Alternate Data Streams (whitelisted) =========
 
 

==================== Safe Mode (whitelisted) ===================
 
 

==================== Faulty Device Manager Devices =============
 

Name: DAEMON Tools Virtual Bus

Description: DAEMON Tools Virtual Bus

Class Guid: {4d36e97d-e325-11ce-bfc1-08002be10318}

Manufacturer: DT Soft Ltd

Service: dtsoftbus01

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
 

Name: Enumerator-Treiber für Microsoft Virtual Drive

Description: Enumerator-Treiber für Microsoft Virtual Drive

Class Guid: {4d36e97d-e325-11ce-bfc1-08002be10318}

Manufacturer: (Standardsystemgeräte)

Service: vdrvroot

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (01/14/2014 09:25:40 PM) (Source: Application Hang) (User: )

Description: Programm FRST64.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
 

Prozess-ID: f24
 

Startzeit: 01cf116650aecaa5
 

Endzeit: 32
 

Anwendungspfad: C:\Users\Raubtier\Desktop\FRST64.exe
 

Berichts-ID:
 

Error: (01/14/2014 08:44:13 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (01/14/2014 05:04:42 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 

System errors:

=============

Error: (01/14/2014 08:42:53 PM) (Source: Service Control Manager) (User: )

Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 

dtsoftbus01

vdrvroot
 

Error: (01/14/2014 08:42:41 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Net.Tcp Listener Adapter" ist vom Dienst "Net.Tcp Port Sharing Service" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1058
 

Error: (01/14/2014 08:42:41 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Net.Pipe Listener Adapter" ist von folgendem Dienst abhängig: was. Dieser Dienst ist eventuell nicht installiert.
 

Error: (01/14/2014 08:42:41 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Net.Msmq Listener Adapter" ist von folgendem Dienst abhängig: msmq. Dieser Dienst ist eventuell nicht installiert.
 

Error: (01/14/2014 05:03:36 PM) (Source: Service Control Manager) (User: )

Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 

dtsoftbus01

vdrvroot
 

Error: (01/14/2014 05:03:13 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Net.Tcp Listener Adapter" ist vom Dienst "Net.Tcp Port Sharing Service" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1058
 

Error: (01/14/2014 05:03:13 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Net.Pipe Listener Adapter" ist von folgendem Dienst abhängig: was. Dieser Dienst ist eventuell nicht installiert.
 

Error: (01/14/2014 05:03:13 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Net.Msmq Listener Adapter" ist von folgendem Dienst abhängig: msmq. Dieser Dienst ist eventuell nicht installiert.
 
 

Microsoft Office Sessions:

=========================

Error: (01/14/2014 09:25:40 PM) (Source: Application Hang)(User: )

Description: FRST64.exe0.0.0.0f2401cf116650aecaa532C:\Users\Raubtier\Desktop\FRST64.exe
 

Error: (01/14/2014 08:44:13 PM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (01/14/2014 05:04:42 PM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 

CodeIntegrity Errors:

===================================

  Date: 2014-01-11 18:24:07.182

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\535E.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-01-11 18:24:07.135

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\535E.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-01-11 18:24:07.088

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\535E.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-01-11 18:24:07.041

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\535E.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-01-11 18:24:06.901

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\535E.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-01-11 18:24:06.854

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\535E.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-01-11 18:19:01.125

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\535E.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-01-11 18:19:01.078

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\535E.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-01-11 18:17:02.642

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\535E.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-01-11 18:17:02.596

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\535E.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 17%

Total physical RAM: 8173.43 MB

Available physical RAM: 6723.8 MB

Total Pagefile: 16345.04 MB

Available Pagefile: 14776.59 MB

Total Virtual: 8192 MB

Available Virtual: 8191.81 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:146.48 GB) (Free:93.56 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

Drive d: (frei) (Fixed) (Total:488.28 GB) (Free:262.91 GB) NTFS

Drive e: (Daten_BACKUP) (Fixed) (Total:443.1 GB) (Free:290.16 GB) NTFS

Drive f: (INTENSO) (Removable) (Total:14.44 GB) (Free:14.44 GB) FAT32

Drive g: (Volume) (Fixed) (Total:341.8 GB) (Free:163.85 GB) NTFS

Drive h: (Musik) (Fixed) (Total:443.23 GB) (Free:42.78 GB) NTFS

Drive i: (W7AiO_Okt13) (CDROM) (Total:6.99 GB) (Free:0 GB) UDF
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: D51718CD)

Partition 1: (Active) - (Size=146 GB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=342 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=443 GB) - (Type=07 NTFS)
 

========================================================

Disk: 1 (MBR Code: Windows 7 or Vista) (Size: 932 GB) (Disk ID: 0891393C)
 

Partition: GPT Partition Type

========================================================

Disk: 2 (Size: 14 GB) (Disk ID: 01CE7825)

Partition 1: (Active) - (Size=14 GB) - (Type=0C)
 

==================== End Of Log ============================

Gruß,

B3AM3R

Deine Windows Version, inklusiver der vorab installierten Updates sind schon älter, du bekommst das Dateum der Erstellung angezeigt, nicht wann es installiert wurde :)

Was bestehen denn noch für Probleme?

Moin Schrauber,

entschuldige meine späte Antwort.

Also, ich fang denn mal an: Rechner läuft nur auf 2 Kernen, laut Process Explorer. Zeigt zwar 4 Kerne, jedoch 2 Kerne und 2 logische. Task Manager zeigt 4. Irgendwelche Prozesse und Hostprozesse die zu komischen Pfaden führen und Berechtigungen für irgendwelche Benutzer im Vollzugriff zulassen. Like this: Anhang 63861 Anhang 63862 Das immer viele "SVCHost"-Prozesse laufen war mir klar. Mir erscheint das nur sehr viel.
Auf meiner C: Platte sind mehrere Ordner mit Namen "boot" aufgetaucht, mit Anwendungen oder Anwendungserweiterungen. Mein Browser speichert keine Passwörter mehr und ich hab den Eindruck das mein Google Konto und mein Yahoo von jemand anderem benutzt wurden. Passwörter geändert. Mein browser leitet mich neuerdings gerne auf englische Seiten weiter. Auch bei Yahoo, wenn ich meine mails abfragen möchte.

Anhang 63863 Anhang 63864

Die Umgebungsvariablen, auch wenn ich davon nicht wirklich Ahnung habe, erscheinen mir die Pfade extrem lang und unnatürlich, genau wie das OS Win NT?

Ich danke Dir vielmals für Deine Mühe.

Lieben Gruß

B3AM3R