floorballref | 13.07.2015 22:02 | Werde TrojWare.JS.Agend.PD@300743807 nicht los Moin liebe Helferin oder Helfer,
ich muss sagen, dass ich neu auf diesem Gebiet bin. Ich habe euren Thread zu exakt der gleichen Meldung hier: http://www.trojaner-board.de/168296-...43807-los.html gelesen, aber es heißt ja, dass jedes Problem individuell zu beheben sei.
Bei mir findet Comodo den oben angesprochenen Virus immer wieder, obwohl ich ihn jedes Mal in die Quarantäne schiebe. Beim Rumprobieren habe ich festgestellt, dass der Virus IMMER auftaucht (und zwar SOFORT), wenn ich auf die 9gag.com gehe. Hierzu hatte ich jeweils eine Seite besucht, den Suchlauf gestartet und anschließend den Cache gelöscht. Meine Freundin hat exakt das gleiche Problem auch auf ihrem Rechner. Als ich an ihrem Rechner heute auf 9gag.com gegangen bin, ist auch bei Ihr der Fehler aufgetaucht. Bisher war das bei ihr nicht der Fall, da sie diese Seite sonst nicht besucht.
Zum ersten Mal ist dieser Virus aufgetaucht, nachdem ich einen USB-Stick an meinen PC angeschlossen hatte, den ich zuvor an einem PC (es war ein iMac von Apple) an der Fachhochschule angeschlossen hatte.
Anbei sende ich dir die geforderten Log-Files:
defogger: Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 22:10 on 13/07/2015 (******)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=- FRST:
FRST Logfile:
FRST Logfile: Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:13-07-2015
Ran by ****** (administrator) on ****** on 13-07-2015 22:13:01
Running from C:\Users\******\Desktop
Loaded Profiles: ****** (Available Profiles: ******)
Platform: Windows 8.1 Pro N (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe
(Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\micmute.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tphkload.exe
(BlackBerry Limited) C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\virtscrl.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cistray.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlkd.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\mkrmsg.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tposd.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\shtctky.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
() C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cis.exe
(SunplusIT, Inc.) C:\Program Files (x86)\Integrated Camera\Monitor.exe
(Dropbox, Inc.) C:\Users\******\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe
(BlackBerry Limited) C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cis.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [1004032 2014-02-13] (Conexant Systems, Inc.)
HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1830616 2014-04-10] (Conexant Systems, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2963184 2013-04-24] (Synaptics Incorporated)
HKLM\...\Run: [LenovoOptMouseUpdate] => C:\Program Files\Lenovo\HOTKEY\extapsup.exe [341448 2015-03-27] (Lenovo Group Limited)
HKLM\...\Run: [COMODO Internet Security] => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [1427648 2015-06-08] (COMODO)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766688 2014-07-04] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Integrated Camera_Monitor] => C:\Program Files (x86)\Integrated Camera\monitor.exe [1720696 2013-09-27] (SunplusIT, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-07-30] (Oracle Corporation)
HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [685048 2012-08-03] (Cisco Systems, Inc.)
HKLM-x32\...\Run: [RIMBBLaunchAgent.exe] => C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [443640 2015-04-15] (BlackBerry Limited)
HKU\S-1-5-21-648624-2589984946-3326904889-1001\...\Run: [Dropbox Update] => C:\Users\******\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-16] (Dropbox, Inc.)
HKU\S-1-5-21-648624-2589984946-3326904889-1001\...\MountPoints2: {37c4546d-0bd0-11e5-9c61-201a06c783c9} - "F:\LaunchU3.exe" -a
HKU\S-1-5-21-648624-2589984946-3326904889-1001\...\MountPoints2: {b35326ca-32e6-11e4-9c03-806e6f6e6963} - "D:\S3\Autorun.exe"
HKU\S-1-5-21-648624-2589984946-3326904889-1001\...\MountPoints2: {c7af92ee-08ff-11e5-9c60-201a06c783c9} - "F:\LaunchU3.exe" -a
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2014-09-02]
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\Users\******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2014-08-25]
ShortcutTarget: Dropbox.lnk -> C:\Users\******\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\******\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\******\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\******\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\******\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\******\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\******\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\******\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\******\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll [2015-06-26] (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-648624-2589984946-3326904889-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_20\bin\ssv.dll [2014-10-06] (Oracle Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-05-13] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_20\bin\jp2ssv.dll [2014-10-06] (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{062BDDCD-413C-4660-B390-0F14C718BF4C}: [DhcpNameServer] 31.209.184.234 31.209.184.235
Tcpip\..\Interfaces\{483A2030-A2AF-4B5D-AC22-4F0FCC49B5FB}: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{CD675550-FE91-4D4D-8E80-FAA4CBD5C2C9}: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\******\AppData\Roaming\Mozilla\Firefox\Profiles\rlt8y14f.default
FF Homepage: www.google.de
FF NetworkProxy: "socks_remote_dns", true
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_203.dll [2015-07-09] ()
FF Plugin: @java.com/DTPlugin,version=11.20.2 -> C:\Program Files\Java\jre1.8.0_20\bin\dtplugin\npDeployJava1.dll [2014-10-06] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.20.2 -> C:\Program Files\Java\jre1.8.0_20\bin\plugin2\npjp2.dll [2014-10-06] (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_203.dll [2015-07-09] ()
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin-x32: @RIM.com/WebSLLauncher,version=1.0 -> C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll [2014-11-28] ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL [2006-10-26] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Extension: Avira Browser Safety - C:\Users\******\AppData\Roaming\Mozilla\Firefox\Profiles\rlt8y14f.default\Extensions\abs@avira.com [2015-07-02]
FF Extension: FoxyProxy Standard - C:\Users\******\AppData\Roaming\Mozilla\Firefox\Profiles\rlt8y14f.default\Extensions\foxyproxy@eric.h.jung [2015-05-30]
FF Extension: Adblock Plus - C:\Users\******\AppData\Roaming\Mozilla\Firefox\Profiles\rlt8y14f.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-08-25]
Chrome:
=======
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2014-07-04] (Advanced Micro Devices, Inc.) [File not signed]
S2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2252504 2013-09-04] (Broadcom Corporation.)
R3 BlackBerry Device Manager; C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [588024 2015-04-15] (BlackBerry Limited)
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2015-03-11] (Microsoft Corporation)
R2 btwdins; C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe [959192 2013-02-26] (Broadcom Corporation.)
R2 CmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [5541960 2015-06-08] (COMODO)
R3 cmdvirth; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [2265792 2015-06-08] (COMODO)
R2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [115184 2014-07-08] (Lenovo Group Limited)
S3 SUService; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [49136 2015-06-25] ()
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-03-11] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-03-11] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59648 2013-09-20] (Advanced Micro Devices)
S3 athr; C:\Windows\system32\DRIVERS\athwnx.sys [3680256 2013-06-18] (Qualcomm Atheros Communications, Inc.)
R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [170712 2013-09-04] (Broadcom Corporation.)
R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [6835784 2014-09-02] (Broadcom Corporation)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
S3 BTWPANFL; C:\Windows\system32\drivers\btwpanfl.sys [44912 2013-01-20] (Broadcom Corporation.)
R1 cmderd; C:\Windows\System32\DRIVERS\cmderd.sys [20672 2015-06-05] (COMODO)
R1 cmdGuard; C:\Windows\System32\DRIVERS\cmdguard.sys [820928 2015-06-05] (COMODO)
R1 cmdhlp; C:\Windows\system32\DRIVERS\cmdhlp.sys [35056 2015-06-05] (COMODO)
R1 inspect; C:\Windows\system32\DRIVERS\inspect.sys [126696 2015-06-05] (COMODO)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [79872 2015-04-15] (BlackBerry Limited)
R3 RimVSerPort; C:\Windows\system32\DRIVERS\RimSerial_AMD64.sys [44544 2015-04-15] (Research in Motion Ltd)
R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [288480 2012-12-13] (Realtek Semiconductor Corp.)
R3 SmbDrv; C:\Windows\system32\DRIVERS\Smb_driver_AMDASF.sys [30448 2013-10-30] (Synaptics Incorporated)
R3 SPUVCbv; C:\Windows\System32\Drivers\SPUVCbv_x64.sys [1515256 2013-10-09] (Sunplus)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-03-11] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-07-13 22:13 - 2015-07-13 22:13 - 00014721 _____ C:\Users\******\Desktop\FRST.txt
2015-07-13 22:12 - 2015-07-13 22:13 - 00000000 ____D C:\FRST
2015-07-13 22:11 - 2015-07-13 22:11 - 02133504 _____ (Farbar) C:\Users\******\Desktop\FRST64.exe
2015-07-13 22:10 - 2015-07-13 22:10 - 00000000 _____ C:\Users\******\defogger_reenable
2015-07-10 19:35 - 2015-07-10 19:35 - 00000000 ____D C:\Users\******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-07-03 09:28 - 2015-07-05 16:52 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-06-28 21:05 - 2015-06-28 21:06 - 00001322 _____ C:\Users\******\Desktop\page_tsv.php
2015-06-25 19:05 - 2015-06-25 19:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo ThinkVantage Tools
2015-06-25 19:05 - 2015-06-25 19:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo
2015-06-16 06:57 - 2015-07-13 22:02 - 00001252 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-648624-2589984946-3326904889-1001UA.job
2015-06-16 06:57 - 2015-07-11 07:02 - 00001200 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-648624-2589984946-3326904889-1001Core.job
2015-06-16 06:57 - 2015-06-16 06:57 - 00004206 _____ C:\Windows\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-648624-2589984946-3326904889-1001UA
2015-06-16 06:57 - 2015-06-16 06:57 - 00003826 _____ C:\Windows\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-648624-2589984946-3326904889-1001Core
2015-06-16 06:57 - 2015-06-16 06:57 - 00000000 ____D C:\Users\******\AppData\Local\Dropbox
2015-06-16 06:57 - 2015-06-16 06:57 - 00000000 ____D C:\ProgramData\Dropbox
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-07-13 22:12 - 2014-12-15 07:13 - 00085176 _____ C:\Windows\system32\Drivers\fvstore.dat
2015-07-13 22:10 - 2014-08-24 20:31 - 00000000 ____D C:\Users\******
2015-07-13 22:08 - 2014-08-25 20:57 - 01474832 _____ C:\Windows\system32\Drivers\sfi.dat
2015-07-13 22:06 - 2014-08-24 20:31 - 01384655 _____ C:\Windows\WindowsUpdate.log
2015-07-13 22:00 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\system32\sru
2015-07-13 21:55 - 2014-08-25 16:59 - 00003934 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{70CD939C-1548-455F-A8FA-77F618468B8B}
2015-07-13 21:43 - 2014-08-24 20:33 - 02139696 _____ C:\Windows\system32\PerfStringBackup.INI
2015-07-13 21:43 - 2013-08-23 01:26 - 01034068 _____ C:\Windows\system32\perfh007.dat
2015-07-13 21:43 - 2013-08-23 01:26 - 00248980 _____ C:\Windows\system32\perfc007.dat
2015-07-13 21:26 - 2014-08-27 14:12 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-07-13 15:28 - 2015-04-25 14:29 - 00000566 _____ C:\Windows\Tasks\MATLAB R2013b Startup Accelerator.job
2015-07-13 15:26 - 2014-08-25 17:12 - 00000000 ____D C:\Users\******\AppData\Roaming\Dropbox
2015-07-12 21:33 - 2014-09-02 23:39 - 12504164 _____ C:\Users\Public\CAFADEBUG.log
2015-07-12 16:41 - 2015-03-20 12:00 - 00000000 ____D C:\Users\******\AppData\Local\CrashDumps
2015-07-12 15:23 - 2014-09-30 17:31 - 00000000 ____D C:\Users\******\AppData\Roaming\vlc
2015-07-11 23:16 - 2013-08-22 17:20 - 00000000 ____D C:\Windows\CbsTemp
2015-07-10 21:46 - 2014-08-24 20:36 - 00003592 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-648624-2589984946-3326904889-1001
2015-07-10 10:15 - 2013-08-22 16:45 - 00019033 _____ C:\Windows\setupact.log
2015-07-10 10:15 - 2013-08-22 16:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-07-10 09:31 - 2015-04-15 19:34 - 00000385 _____ C:\Users\******\AppData\Roaming\Rim.DesktopHelper.Exception.log
2015-07-10 09:31 - 2015-04-15 19:34 - 00000385 _____ C:\Users\******\AppData\Roaming\Rim.Desktop.Exception.log
2015-07-09 22:26 - 2014-08-27 14:12 - 00003772 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-07-09 08:28 - 2014-08-26 00:16 - 00792568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-07-09 08:28 - 2014-08-26 00:16 - 00178168 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-07-06 21:08 - 2015-04-30 13:26 - 00011995 _____ C:\Users\******\Desktop\Arbeitsstunden.xlsx
2015-07-05 16:52 - 2014-08-25 17:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-07-05 16:52 - 2014-08-24 20:27 - 00240634 _____ C:\Windows\PFRO.log
2015-07-05 15:06 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\AppReadiness
2015-06-30 16:33 - 2013-08-22 15:25 - 00262144 ___SH C:\Windows\system32\config\BBI
2015-06-28 21:15 - 2015-01-04 17:15 - 00000000 ____D C:\Users\******\AppData\Roaming\FileZilla
2015-06-28 14:59 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\system32\NDF
2015-06-25 23:30 - 2015-01-18 16:14 - 00002008 _____ C:\Users\Public\Desktop\FileZilla Client.lnk
2015-06-25 23:30 - 2015-01-18 16:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
2015-06-25 23:30 - 2015-01-18 16:13 - 00000000 ____D C:\Program Files (x86)\FileZilla FTP Client
2015-06-25 19:05 - 2014-11-16 18:36 - 00000000 ____D C:\Windows\System32\Tasks\TVT
2015-06-25 19:05 - 2014-11-16 18:35 - 00000000 ____D C:\ProgramData\Lenovo
2015-06-25 19:05 - 2014-09-02 23:37 - 00000000 ____D C:\Program Files (x86)\Lenovo
2015-06-24 11:39 - 2014-12-26 10:18 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-06-19 21:57 - 2014-08-25 17:15 - 00000000 ____D C:\Users\******\AppData\Local\Microsoft Help
2015-06-17 19:58 - 2014-09-16 06:28 - 00000000 ____D C:\Users\******\.gimp-2.8
2015-06-16 15:13 - 2015-06-03 16:11 - 00000094 _____ C:\Users\******\psv.ini
2015-06-16 09:22 - 2015-06-08 16:43 - 00037706 _____ C:\Users\******\Desktop\Start_GT_2.vsdx
2015-06-13 07:36 - 2014-08-27 20:29 - 00000000 ____D C:\Users\******\AppData\Local\Adobe
==================== Files in the root of some directories =======
2014-09-28 10:06 - 2015-01-19 11:37 - 0023384 _____ () C:\Users\******\AppData\Roaming\Kommagetrennte Werte (Windows).ADR
2015-04-15 19:34 - 2015-07-10 09:31 - 0000385 _____ () C:\Users\******\AppData\Roaming\Rim.Desktop.Exception.log
2015-04-15 19:33 - 2015-04-15 19:33 - 0001111 _____ () C:\Users\******\AppData\Roaming\Rim.Desktop.HttpServerSetup.log
2015-04-15 19:34 - 2015-07-10 09:31 - 0000385 _____ () C:\Users\******\AppData\Roaming\Rim.DesktopHelper.Exception.log
2015-03-17 15:16 - 2015-03-17 15:16 - 0004096 ____H () C:\Users\******\AppData\Local\keyfile3.drm
2015-06-08 11:03 - 2015-06-08 11:03 - 0007159 _____ () C:\Users\******\AppData\Local\recently-used.xbel
2014-09-02 23:38 - 2014-09-02 23:38 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
Some files in TEMP:
====================
C:\Users\******\AppData\Local\Temp\avgnt.exe
C:\Users\******\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmprbzugf.dll
C:\Users\******\AppData\Local\Temp\install_flashplayer14x32_ltr5x64d_awc_aih.exe
C:\Users\******\AppData\Local\Temp\install_flashplayer15x32au_ltr5x64d_awc_aih.exe
C:\Users\******\AppData\Local\Temp\install_reader11_de_mssa_aaa_aih.exe
C:\Users\******\AppData\Local\Temp\ose00000.exe
C:\Users\******\AppData\Local\Temp\ose00001.exe
C:\Users\******\AppData\Local\Temp\ose00002.exe
C:\Users\******\AppData\Local\Temp\PidGenX.dll
C:\Users\******\AppData\Local\Temp\SkypeSetup.exe
C:\Users\******\AppData\Local\Temp\tempdotnetinstall.exe
C:\Users\******\AppData\Local\Temp\xmlUpdater.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-07-12 14:41
==================== End of log ============================ --- --- ---
--- --- ---
Die Fortsetzung der Files findest du in den folgenden Antworten.
Ich würde mich sehr freuen, falls mir jemand helfen kann.
Vielen Dank und einen schönen Abend,
Floorballref
Fortsetzung 1:
Addition: Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version:13-07-2015
Ran by ****** at 2015-07-13 22:13:57
Running from C:\Users\******\Desktop
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-648624-2589984946-3326904889-500 - Administrator - Disabled)
****** (S-1-5-21-648624-2589984946-3326904889-1001 - Administrator - Enabled) => C:\Users\******
Gast (S-1-5-21-648624-2589984946-3326904889-501 - Limited - Disabled)
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: COMODO Antivirus (Enabled - Up to date) {F25D0092-CDBE-B303-ADB7-88DE8CDECCF5}
AS: Comodo Defense+ (Enabled - Up to date) {493CE176-EB84-BC8D-9707-B3ACF7598648}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: COMODO Firewall (Enabled) {CA6681B7-87D1-B25B-86E8-21EB720D8B8E}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 18 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 18.0.0.203 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.11) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{B20EB44C-5CF4-1ED1-EFB8-FE5E1F8AF49D}) (Version: 8.0.903.0 - Advanced Micro Devices, Inc.)
AMD VISION Engine Control Center (HKLM-x32\...\WUCCCApp) (Version: 1.00.0000 - AMD)
Anzeige am Bildschirm (HKLM\...\OnScreenDisplay) (Version: 8.51.01 - )
BlackBerry Desktop Software 7.1 (HKLM-x32\...\BlackBerry_Desktop) (Version: 7.1.0.41 - Research in Motion Ltd.)
BlackBerry Desktop Software 7.1 (x32 Version: 7.1.0.41 - Research in Motion Ltd.) Hidden
BlackBerry Device Software Updater (HKLM-x32\...\{E755A98B-F45F-4008-A1A5-FC4CB4D2177A}) (Version: 8.0.0.66 - Research In Motion Ltd)
Broadcom 802.11 Network Adapter (HKLM\...\Broadcom 802.11 Network Adapter) (Version: 6.30.59.91 - Broadcom Corporation)
Bulk Rename Utility 2.7.1.3 (HKLM\...\Bulk Rename Utility_is1) (Version: - TGRMN Software)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.5306 - CDBurnerXP)
Cisco AnyConnect Secure Mobility Client (HKLM-x32\...\Cisco AnyConnect Secure Mobility Client) (Version: 3.1.00495 - Cisco Systems, Inc.)
Cisco AnyConnect Secure Mobility Client (x32 Version: 3.1.00495 - Cisco Systems, Inc.) Hidden
COMODO Internet Security Premium (HKLM\...\{D32EF4F9-1506-434E-A813-3D4C0AA50300}) (Version: 7.0.53315.4132 - COMODO Security Solutions Inc.)
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.65.27.61 - Conexant)
Die Siedler III Gold Edition (HKLM-x32\...\S3) (Version: - )
Dolby Digital Plus Advanced Audio (HKLM\...\{B0BFC63F-EA07-419E-960B-3FB2ED5DD0B2}) (Version: 7.5.1.1 - Dolby Laboratories Inc)
Dropbox (HKU\S-1-5-21-648624-2589984946-3326904889-1001\...\Dropbox) (Version: 3.6.8 - Dropbox, Inc.)
FileZilla Client 3.11.0.2 (HKLM-x32\...\FileZilla Client) (Version: 3.11.0.2 - Tim Kosse)
FluidEXL_Graphics_Stud_Eng_64 (HKLM\...\{5687F741-7915-4352-9497-60DBE76C357E}) (Version: 1.0.0 - Zittau/Goerlitz University of Applied Sciences)
Free Video Converter V 3.1 (HKLM-x32\...\Free Video Converter_is1) (Version: 3.1.0.0 - Koyote Soft)
GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)
Integrated Camera (HKLM-x32\...\Sunplus SPUVCb) (Version: 3.4.7.28 - SunplusIT)
Java 8 Update 20 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418020F0}) (Version: 8.0.200 - Oracle Corporation)
Java SE Development Kit 8 Update 20 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0180200}) (Version: 8.0.200.26 - Oracle Corporation)
Lenovo Auto Scroll Utility (HKLM\...\LenovoAutoScrollUtility) (Version: 2.12 - )
Lenovo Bluetooth with Enhanced Data Rate Software (HKLM\...\{C6D9ED03-6FCF-4410-9CB7-45CA285F9E11}) (Version: 12.0.0.6000 - Broadcom Corporation)
Lenovo Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.67.04.05 - )
Lenovo System Update (HKLM-x32\...\{25C64847-B900-48AD-A164-1B4F9B774650}) (Version: 5.06.0037 - Lenovo)
LyX 2.1.3 (HKLM-x32\...\LyX213) (Version: 2.1.3 - LyX Team)
MATLAB R2013b (HKLM\...\Matlab R2013b) (Version: 8.2 - The MathWorks, Inc.)
Metric Collection SDK (x32 Version: 1.1.0005.00 - Lenovo Group Limited) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Project Professional 2013 (HKLM-x32\...\Office15.PRJPROR) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Visio Professional 2013 (HKLM-x32\...\Office15.VISPROR) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Mozilla Firefox 39.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 39.0 (x86 de)) (Version: 39.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 31.0 - Mozilla)
NetBeans IDE 8.0.1 (HKLM\...\nbi-nb-base-8.0.1.0.201408251540) (Version: 8.0.1 - NetBeans.org)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.7.3 - Notepad++ Team)
Outils de vérification linguistique 2013 de Microsoft Office - Français (x32 Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.10.1226.2012 - Realtek)
Realtek PCIE Card Reader (HKLM-x32\...\{0D61A55C-3ADC-409F-BF5B-A1766D1F5944}) (Version: 6.2.9200.29048 - Realtek Semiconductor Corp.)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 32-Bit Edition (HKLM-x32\...\{91150000-003B-0000-0000-0000000FF1CE}_Office15.PRJPROR_{115B7592-B71D-4C27-AB34-34268FB199CA}) (Version: - Microsoft)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 32-Bit Edition (HKLM-x32\...\{91150000-0051-0000-0000-0000000FF1CE}_Office15.VISPROR_{8D2E04ED-3350-4ECE-9D6E-3BC9A9A93A47}) (Version: - Microsoft)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
TeamSpeak 3 Client (HKLM-x32\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
TeX Live 2014 (HKU\S-1-5-21-648624-2589984946-3326904889-1001\...\TeXLive2014) (Version: 2014 - )
ThinkPad UltraNav Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.19.7 - )
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update for Skype for Business 2015 (KB3054791) 32-Bit Edition (HKLM-x32\...\{90150000-002A-0000-1000-0000000FF1CE}_Office15.PRJPROR_{04ADDEC1-208F-4295-AA61-16789EA56814}) (Version: - Microsoft)
Update for Skype for Business 2015 (KB3054791) 32-Bit Edition (HKLM-x32\...\{90150000-002A-0000-1000-0000000FF1CE}_Office15.VISPROR_{04ADDEC1-208F-4295-AA61-16789EA56814}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
WinRAR 5.00 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.00.0 - win.rar GmbH)
XAMPP (HKLM-x32\...\xampp) (Version: 5.6.3-0 - Bitnami)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-648624-2589984946-3326904889-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\******\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-648624-2589984946-3326904889-1001_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\******\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-648624-2589984946-3326904889-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\******\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-648624-2589984946-3326904889-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\******\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-648624-2589984946-3326904889-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\******\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-648624-2589984946-3326904889-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\******\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-648624-2589984946-3326904889-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\******\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-648624-2589984946-3326904889-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\******\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-648624-2589984946-3326904889-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\******\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-648624-2589984946-3326904889-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\******\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (Dropbox, Inc.)
==================== Restore Points =========================
24-06-2015 14:15:59 Windows Update
01-07-2015 17:49:26 Geplanter Prüfpunkt
09-07-2015 10:54:38 Windows Modules Installer
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {08C7EB04-0006-476E-A157-2118F5B4C635} - System32\Tasks\{31DDBD37-5DB7-4030-8064-10B0CAA806C3} => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [2015-06-08] (COMODO)
Task: {168E9986-FB94-40CE-9AE3-CBC838966D44} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 => C:\Program Files (x86)\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2014-02-13] (Lenovo)
Task: {1D2CE371-50BB-4B41-90AD-7AA3ED8EC721} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-06-24] (Adobe Systems Incorporated)
Task: {35C4E217-D355-4CF2-93F9-0F45E8DE6FBC} - System32\Tasks\COMODO\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2015-06-08] (COMODO)
Task: {4F26D67B-035E-45FC-A142-BDD815FB30EC} - System32\Tasks\{F825F7C1-2315-428F-B73A-E7DD3914823C} => pcalua.exe -a C:\BlueByte\Siedler3\s3.exe -d C:\BlueByte\Siedler3
Task: {5DB01EDF-9F41-40F2-94EC-661CDC75CBE0} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-07-09] (Adobe Systems Incorporated)
Task: {727F7D35-6C6A-4F98-A9F3-784F19263952} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-06-10] (Microsoft Corporation)
Task: {7BCC23C2-A91B-48D3-8B0B-B615436A1398} - System32\Tasks\COMODO\COMODO Autostart {D5EFF3B3-E126-4AF6-BCE9-852A72129E10} => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [2015-06-08] (COMODO)
Task: {91B6A07E-79D3-463A-8BC2-8132EBF3AC78} - System32\Tasks\COMODO\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2015-06-08] (COMODO)
Task: {96FF9D9F-7D92-4112-B0E3-C98740D978D4} - System32\Tasks\MATLAB R2013b Startup Accelerator => C:\Program Files\MATLAB\R2013b\bin\win64\MATLABStartupAccelerator.exe [2015-04-25] ()
Task: {98030246-0E25-4A6D-B076-FAF5CD0DA204} - System32\Tasks\{BD9C797F-4495-4B91-8D2A-642BD59A0BD5} => Firefox.exe hxxp://ui.skype.com/ui/0/6.20.0.104/de/abandoninstall?source=lightinstaller&page=tsMain
Task: {9BBE35FB-041A-48B7-AA1A-28E3BE474872} - System32\Tasks\TVT\TVSUUpdateTask => C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe [2015-06-25] ()
Task: {A4152096-8EF4-42ED-BE55-D235BEA9A023} - System32\Tasks\COMODO\COMODO Cache Builder {0FB77674-7905-4F34-A362-C5A9A26F8CF9} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2015-06-08] (COMODO)
Task: {A9585A23-63BB-4D1C-80DB-EAA92CF6CFE8} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-648624-2589984946-3326904889-1001Core => C:\Users\******\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-16] (Dropbox, Inc.)
Task: {BA60F30B-75B7-4792-8BB6-AF00FE8A698F} - System32\Tasks\COMODO\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2015-06-08] (COMODO)
Task: {C45EC623-4EA1-4836-A1CA-D7478C3653A9} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe
Task: {C7C0FCC1-9F16-4701-AE1B-0C56336F7025} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2015-01-18] (Microsoft Corporation)
Task: {EDEC8EDA-D2A2-4782-94E9-BB5DEFDBE988} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2015-01-18] (Microsoft Corporation)
Task: {F1484E24-EB26-4690-BF33-E4146BDD2D1D} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-648624-2589984946-3326904889-1001UA => C:\Users\******\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-16] (Dropbox, Inc.)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-648624-2589984946-3326904889-1001Core.job => C:\Users\******\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-648624-2589984946-3326904889-1001UA.job => C:\Users\******\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\MATLAB R2013b Startup Accelerator.job => C:\Program Files\MATLAB\R2013b\bin\win64\MATLABStartupAccelerator.exe
==================== Loaded Modules (Whitelisted) ==============
2014-07-04 21:33 - 2014-07-04 21:33 - 00127488 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2013-02-26 18:46 - 2013-02-26 18:46 - 00049368 _____ () C:\Program Files\Lenovo\Bluetooth Software\btwleapi.dll
2014-05-12 11:49 - 2014-05-12 11:49 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll
2014-09-02 23:39 - 2010-10-26 12:40 - 00049056 _____ () C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
2013-04-15 18:39 - 2015-01-09 00:02 - 00067808 _____ () C:\Program Files\COMODO\COMODO Internet Security\scanners\smart.cav
2012-08-03 21:53 - 2012-08-03 21:53 - 00062968 _____ () C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\zlib1.dll
2015-07-13 15:26 - 2015-07-13 15:26 - 00043008 _____ () c:\Users\******\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmprbzugf.dll
2015-06-16 06:57 - 2015-03-19 09:15 - 00750080 _____ () C:\Users\******\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2015-06-16 06:57 - 2015-03-19 09:15 - 00047616 _____ () C:\Users\******\AppData\Roaming\Dropbox\bin\libEGL.dll
2015-06-16 06:57 - 2015-03-19 09:15 - 00865280 _____ () C:\Users\******\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
2015-06-16 06:57 - 2015-03-19 09:15 - 00200704 _____ () C:\Users\******\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
2015-06-16 06:57 - 2015-03-19 09:15 - 00010240 _____ () C:\Users\******\AppData\Roaming\Dropbox\bin\QtQuick.2\qtquick2plugin.dll
2015-06-16 06:57 - 2015-03-19 09:15 - 00726016 _____ () C:\Users\******\AppData\Roaming\Dropbox\bin\QtQuick\Controls\qtquickcontrolsplugin.dll
2015-06-16 06:57 - 2015-03-19 09:15 - 00010240 _____ () C:\Users\******\AppData\Roaming\Dropbox\bin\QtQuick\Window.2\windowplugin.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\Windows\explorer.exe:$CmdTcID
AlternateDataStreams: C:\Windows\HelpPane.exe:$CmdTcID
AlternateDataStreams: C:\Windows\hh.exe:$CmdTcID
AlternateDataStreams: C:\Windows\IsUn0407.exe:$CmdTcID
AlternateDataStreams: C:\Windows\notepad.exe:$CmdTcID
AlternateDataStreams: C:\Windows\regedit.exe:$CmdTcID
AlternateDataStreams: C:\Windows\splwow64.exe:$CmdTcID
AlternateDataStreams: C:\Windows\twain_32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\winhlp32.exe:$CmdTcID
AlternateDataStreams: C:\Windows\write.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\accessibilitycpl.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\acledit.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\aclui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\acmigration.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\acppage.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\acproxy.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ActionCenter.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ActionCenterCPL.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ActionQueue.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\activeds.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\actxprxy.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\adhapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\adhsvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AdmTmpl.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\adprovider.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\adrclient.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\adsldp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\adsldpc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\adsmsext.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\adsnt.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\adtschema.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\advapi32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\advpack.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\aecache.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\aeinv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\aelupsvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\aepdu.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\aepic.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AepRoam.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\aitagent.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\aitstatic.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\alg.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AltTab.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\amstream.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\apds.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\apphelp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Apphlpdm.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\appidapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\appidcertstorecheck.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\appidpolicyconverter.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AppIdPolicyEngineApi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\appidsvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\appinfo.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\appmgmts.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\appmgr.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\appraiser.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AppReadiness.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\apprepapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\apprepsync.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\appsruprov.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\appwiz.cpl:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AppxAllUserStore.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AppxApplicabilityEngine.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AppXDeploymentClient.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AppXDeploymentExtensions.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AppXDeploymentServer.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AppxPackaging.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AppxSip.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AppxStreamingDataSourcePS.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AppxSysprep.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ARP.EXE:$CmdTcID
AlternateDataStreams: C:\Windows\system32\aspnet_counters.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\asycfilt.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\at.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AtBroker.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\atl.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\atlthunk.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\atmfd.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\atmlib.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\attrib.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\audiodg.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AudioEndpointBuilder.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AudioEng.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AUDIOKSE.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AudioSes.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\audiosrv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\auditcse.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AuditNativeSnapIn.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\auditpol.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AuditPolicyGPInterop.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AuthBroker.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AuthExt.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\authfwcfg.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AuthFWGP.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AuthFWSnapin.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AuthFWWizFwk.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AuthHost.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AuthHostProxy.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\authui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\authz.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\autoconv.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\autoplay.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AutoWorkplaceN.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\avicap32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\avifil32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\avrt.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AxInstSv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AxInstUI.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\azroles.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\azroleui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AzSqlExt.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\baaupdate.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\backgroundTaskHost.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BackgroundTransferHost.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\basecsp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\basesrv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\batmeter.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bcd.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bcdboot.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bcdedit.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bcdprov.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bcdsrv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BCP47Langs.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bcrypt.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bcryptprimitives.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bdaplgin.ax:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bdechangepin.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BdeHdCfg.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BdeHdCfgLib.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bderepair.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bdesvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BdeSysprep.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bdeui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BdeUISrv.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bdeunlock.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BFE.DLL:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bidispl.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BioCredProv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bisrv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BitLockerDeviceEncryption.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BitLockerWizard.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BitLockerWizardElev.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bitsadmin.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bitsigd.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bitsperf.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bitsprx2.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bitsprx3.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bitsprx4.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bitsprx5.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bitsprx6.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bitsprx7.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\biwinrt.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\blb_ps.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BluetoothApis.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bootcfg.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bootim.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BootMenuUX.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bootsect.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bootux.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\brdgcfg.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bridgeunattend.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BrokerLib.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\browcli.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\browser.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\browseui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bthci.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BthHFSrv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BthMtpContextHandler.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bthpanapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BthpanContextHandler.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bthprops.cpl:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BthRadioMedia.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bthserv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BthSQM.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\bthudtask.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\btpanui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Bubbles.scr:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BulkOperationHost.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\BWContextHandler.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ByteCodeGenerator.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cabinet.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cabview.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cacls.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\calc.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CallButtons.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CallButtons.ProxyStub.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\capiprovider.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\capisp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\catsrv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\catsrvps.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\catsrvut.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cca.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cdd.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cdosys.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\certca.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\certcli.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\certCredProvider.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\certenc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CertEnroll.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CertEnrollCtrl.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CertEnrollUI.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\certmgr.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CertPolEng.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\certprop.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\certreq.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\certutil.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cfgbkend.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cfgmgr32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cfmifs.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cfmifsproxy.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\change.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\charmap.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\chartv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\chcp.com:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CheckNetIsolation.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\chglogon.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\chgport.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\chgusr.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\chkdsk.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\chkntfs.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\chkwudrv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\choice.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CHxReadingStringIME.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ci.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cic.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cipher.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CIRCoInst.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\clb.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\clbcatq.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cleanmgr.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\clfsw32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cliconfg.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cliconfg.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\clip.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CloudNotifications.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CloudStorageWizard.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\clusapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cmcfg32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cmd.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cmdext.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cmdial32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cmdkey.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cmdl32.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cmifw.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cmlua.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cmmon32.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cmpbk32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cmstp.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cmstplua.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cmutil.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cngcredui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cngprovider.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cnvfat.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cofire.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cofiredm.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\colbact.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\colorcpl.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\colorui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\combase.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\comcat.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\comctl32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\comdlg32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\comp.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\compact.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CompMgmtLauncher.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CompPkgSup.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\compstui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ComputerDefaults.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\comrepl.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\comsnap.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\comsvcs.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\comuid.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ConfigureExpandedStorage.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\conhost.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\connect.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ConnectedAccountState.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\consent.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ConsentUX.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\console.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\control.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\convert.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\correngine.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CPFilters.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CredentialMigrationHandler.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CredentialUIBroker.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\credssp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\credui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\credwiz.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cryptbase.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cryptcatsvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cryptdlg.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cryptdll.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cryptext.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cryptnet.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CryptoWinRT.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cryptsp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cryptsvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\crypttpmeksvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cryptui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cryptuiwizard.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cryptxml.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cscapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cscdll.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CscMig.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cscobj.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cscript.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cscsvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cscui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CSystemEventsBrokerClient.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ctfmon.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cttune.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cttunesvr.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\C_G18030.DLL:$CmdTcID
AlternateDataStreams: C:\Windows\system32\C_IS2022.DLL:$CmdTcID
AlternateDataStreams: C:\Windows\system32\C_ISCII.DLL:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d2d1.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3d10.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3d10core.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3d10level9.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3d10warp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3d10_1.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3d10_1core.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3d11.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3d8thk.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3d9.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\D3DCompiler_47.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dab.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dabapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DAConn.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dafBth.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DafPrintProvider.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dafupnp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dafWCN.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dafWfdProvider.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DAFWSD.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DAMM.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DaOtpCredentialProvider.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\das.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dasHost.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dataclen.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\datusage.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\davclnt.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\davhlpr.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dbgeng.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dbghelp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dbnetlib.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dbnmpntw.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dccw.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dciman32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dcomcnfg.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dcomp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DDACLSys.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ddodiag.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DDOIProxy.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DDORes.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ddpchunk.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ddptrace.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ddputils.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ddp_ps.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ddraw.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ddrawex.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DefaultDeviceManager.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DefaultPrinterProvider.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Defrag.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\defragproxy.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\defragsvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\delegatorprovider.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\desk.cpl:$CmdTcID
AlternateDataStreams: C:\Windows\system32\deskadp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\deskmon.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DevDispItemProvider.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\devenum.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\deviceaccess.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\deviceassociation.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DeviceCenter.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DeviceDisplayStatusManager.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DeviceDriverRetrievalClient.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DeviceEject.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DeviceElementSource.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DeviceMetadataRetrievalClient.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DevicePairing.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DevicePairingFolder.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DevicePairingProxy.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DevicePairingWizard.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DeviceProperties.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\deviceregistration.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DeviceSetupManager.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DeviceSetupManagerAPI.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DeviceUxRes.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\devinv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\devmgr.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\devobj.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DevPropMgr.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\devrtl.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dfdts.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DFDWiz.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dfp.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DfpCommon.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dfrgui.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dfscli.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DfsShlEx.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dhcpcmonitor.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dhcpcore.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dhcpcore6.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dhcpcsvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dhcpcsvc6.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DHCPQEC.DLL:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dhcpsapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DiagCpl.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\diagperf.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dialer.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\difxapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dimsjob.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dimsroam.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dinput.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dinput8.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\discan.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\diskcomp.com:$CmdTcID
AlternateDataStreams: C:\Windows\system32\diskcopy.com:$CmdTcID
AlternateDataStreams: C:\Windows\system32\diskcopy.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\diskpart.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\diskperf.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\diskraid.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dispci.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dispdiag.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dispex.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Display.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DisplaySwitch.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\djoin.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dllhost.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dllhst3g.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dmdlgs.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dmdskmgr.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dmintf.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dmloader.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dmocx.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dmsynth.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dmusic.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dmutil.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dmvdsitf.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dmview.ocx:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dnsapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dnscacheugc.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dnsext.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dnshc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dnsrslvr.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\docprop.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\doskey.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dot3api.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dot3cfg.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Dot3Conn.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dot3dlg.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dot3gpclnt.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dot3gpui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dot3hc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dot3mm.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dot3msm.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dot3svc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dot3ui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dpapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dpapimig.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dpapiprovider.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dpapisrv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DpiScaling.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dps.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\driverquery.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\drprov.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\drt.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\drtprov.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\drttransport.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\drvcfg.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\drvinst.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\drvstore.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dsauth.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DscCore.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DscCoreConfProv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dsdmo.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dskquota.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dskquoui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DsmUserTask.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dsound.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dsparse.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dsprop.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dsquery.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dsrole.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dssec.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dssenh.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Dsui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dsuiext.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dswave.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dtsh.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dui70.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\duser.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dvdplay.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dvdupgrd.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dwm.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dwmapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dwmcore.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dwmredir.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DWrite.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DWWIN.EXE:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dxdiag.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dxdiagn.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dxgi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dxgwdi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DXP.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dxpps.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Dxpserver.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DxpTaskSync.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dxtmsft.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dxtrans.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dxva2.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Eap3Host.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\eapp3hst.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\eappcfg.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\eappgnui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\eapphost.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\eappprxy.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\eapprovp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\EAPQEC.DLL:$CmdTcID
AlternateDataStreams: C:\Windows\system32\eapsvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\easconsent.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\EaseOfAccessDialog.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\easinvoker.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\easinvoker.proxystub.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\easwrt.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\efsadu.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\efscore.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\efslsaext.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\efssvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\efsui.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\efsutil.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\efswrt.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\EhStorAPI.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\EhStorAuthn.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\EhStorPwdMgr.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\EhStorShell.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\els.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ELSCore.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\elshyph.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\elslad.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\elsTrans.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\embeddedapplauncher.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\EmbeddedAppLauncherConfig.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\encapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\EncDec.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\EncDump.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\energy.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\energyprov.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\energytask.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\eqossnap.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\es.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\esent.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\esentprf.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\esentutl.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\eudcedit.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\EventAggregation.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\eventcls.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\eventcreate.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\eventvwr.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\expand.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ExplorerFrame.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\extrac32.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Faultrep.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fc.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fdBth.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fdBthProxy.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\FdDevQuery.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fde.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fdeploy.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fdPHost.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fdPnp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fdprint.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fdProxy.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\FDResPub.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fdSSDP.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fdWCN.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fdWNet.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fdWSD.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\feclient.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fhautoplay.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fhcat.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fhcfg.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fhcleanup.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fhcpl.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fhengine.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fhevents.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fhlisten.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fhmanagew.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fhshl.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fhsrchapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fhsrchph.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fhsvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fhsvcctl.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fhtask.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\FileAppxStreamingDataSource.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\filemgmt.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\find.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\findnetprinters.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\findstr.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\finger.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Firewall.cpl:$CmdTcID
AlternateDataStreams: C:\Windows\system32\FirewallAPI.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\FirewallControlPanel.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fixmapi.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fltLib.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fltMC.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fmapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fmifs.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fms.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\FntCache.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Fondue.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fontext.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fontsub.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fontview.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\forfiles.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\format.com:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fphc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\framedyn.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\framedynos.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\frprov.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fsavailux.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fsquirt.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fsutil.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fsutilext.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fthsvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ftp.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fundisc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fveapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fveapibase.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fvecerts.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fvecpl.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fvenotify.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fveprompt.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fveskybackup.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fveui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fvewiz.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fwcfg.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\FWPUCLNT.DLL:$CmdTcID
AlternateDataStreams: C:\Windows\system32\FwRemoteSvr.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\FXSAPI.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\FXSCOM.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\FXSCOMEX.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\FXSCOMPOSE.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\FXSCOVER.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\FXSMON.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\FXSROUTE.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\FXSST.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\FXSSVC.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\FXST30.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\FXSTIFF.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\FXSUNATD.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\FXSUTILITY.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\g711codc.ax:$CmdTcID
AlternateDataStreams: C:\Windows\system32\gacinstall.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\gameux.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\gcdef.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\gdi32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\GdiPlus.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\generaltel.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\GeofenceMonitorService.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\getmac.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\getuname.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\glcndFilter.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\glmf32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\GlobCollationHost.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\globinputhost.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\glu32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\gpapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\gpedit.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\gpprefcl.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\gpprnext.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\gpresult.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\gpscript.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\gpscript.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\gpsvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\gptext.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\gpupdate.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Groupinghc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\grpconv.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\hbaapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\hcproviders.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\hdwwiz.cpl:$CmdTcID
AlternateDataStreams: C:\Windows\system32\hdwwiz.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\help.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\HelpPaneProxy.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\hgcpl.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\hgprint.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\hhctrl.ocx:$CmdTcID
AlternateDataStreams: C:\Windows\system32\hhsetup.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\hid.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\hidphone.tsp:$CmdTcID
AlternateDataStreams: C:\Windows\system32\hidserv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\hnetcfg.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\hnetmon.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\HOSTNAME.EXE:$CmdTcID
AlternateDataStreams: C:\Windows\system32\hotplug.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\hotspotauth.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\httpapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\httpprxm.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\httpprxp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\htui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\hwrcomp.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\hwrreg.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ias.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\iasacct.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\iasads.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\iasdatastore.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\iashlpr.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\IasMigPlugin.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\iasnap.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\iaspolcy.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\iasrad.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\iasrecst.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\iassam.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\iassdo.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\iassvcs.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\icacls.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\icfupgd.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\icm32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\icmui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\IconCodecService.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\icsigd.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\icsunattend.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\icsvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\IdCtrls.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\IdListen.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\idndl.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\IDStore.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ie4uinit.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ieapfltr.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\iedkcs32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ieframe.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\iepeers.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\iertutil.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ieui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ifmon.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ifsutil.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ifsutilx.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igdDiag.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\IKEEXT.DLL:$CmdTcID
AlternateDataStreams: C:\Windows\system32\imaadp32.acm:$CmdTcID
AlternateDataStreams: C:\Windows\system32\imagehlp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\imapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\imapi2.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\imapi2fs.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\imm32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\immersivetpmvscmgrsvr.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\inetcomm.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\inetcpl.cpl:$CmdTcID
AlternateDataStreams: C:\Windows\system32\inetmib1.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\inetpp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\inetppui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\InfDefaultInstall.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\InkEd.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\input.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\InputSwitch.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\inseng.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\intl.cpl:$CmdTcID
AlternateDataStreams: C:\Windows\system32\invagent.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ipconfig.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\IPHLPAPI.DLL:$CmdTcID
AlternateDataStreams: C:\Windows\system32\iphlpsvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ipnathlp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\iprtprio.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\iprtrmgr.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ipsecsnp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\IPSECSVC.DLL:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ipsmsnap.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\irclass.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\irftp.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\irmon.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\irprops.cpl:$CmdTcID
AlternateDataStreams: C:\Windows\system32\iscsicli.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\iscsicpl.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\iscsicpl.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\iscsidsc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\iscsied.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\iscsiexe.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\iscsium.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\iscsiwmi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\iscsiwmiv2.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\isoburn.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\itircl.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\itss.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\iuilp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\iyuv_32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\jnwmon.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\joy.cpl:$CmdTcID
AlternateDataStreams: C:\Windows\system32\jscript.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\jscript9.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\jscript9diag.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\KdsCli.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\kdusb.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\kd_02_8086.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\keepaliveprovider.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\kernel.appcore.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\kernel32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\KernelBase.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\kernelceip.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\KeyboardFilterCore.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\KeyboardFilterSvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\keyiso.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\keymgr.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\klist.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\kmddsp.tsp:$CmdTcID
AlternateDataStreams: C:\Windows\system32\KMSVC.DLL:$CmdTcID
AlternateDataStreams: C:\Windows\system32\korwbrkr.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ksetup.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ksproxy.ax:$CmdTcID
AlternateDataStreams: C:\Windows\system32\kstvtune.ax:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ksuser.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Kswdmcap.ax:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ksxbar.ax:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ktmutil.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ktmw32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\l2gpstore.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\l2nacp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\L2SecHC.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\label.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\LangCleanupSysprepAction.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\LaunchTM.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\linkinfo.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ListSvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\livessp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\LldpNotify.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\lltdapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\lltdsvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\lmhsvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\loadperf.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\localsec.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\localspl.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\localui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\LocationApi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\LocationNotifications.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Locator.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\LockScreenContent.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\LockScreenContentHost.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\LockScreenContentServer.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\lodctr.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\loghours.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\logman.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\logoff.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\logoncli.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\LogonUI.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\lpk.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\lpkinstall.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\lpksetup.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\lpksetupproxyserv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\lpremove.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\lsasrv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\lsass.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\lsm.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\lsmproxy.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\luainstall.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Magnification.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Magnify.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\main.cpl:$CmdTcID
AlternateDataStreams: C:\Windows\system32\MaintenanceUI.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\makecab.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\manage-bde.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mapi32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mapistub.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\MbaeApi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\MbaeApiPublic.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\MbaeParserTask.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\MbaeXmlParser.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mblctr.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mbsmsapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mbussdapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mcbuilder.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mciavi32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mcicda.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mciqtz32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mciseq.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mciwave.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mcupdate_GenuineIntel.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\McxDriv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\MDMAgent.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mdminst.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mdmregistration.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\MdRes.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\MdSched.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\MemoryDiagnostic.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mf3216.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mfc42.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mfc42u.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mfcsubs.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mgmtapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mibincodec.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Microsoft.Management.Infrastructure.Native.Unmanaged.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\MicrosoftAccountTokenProvider.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\midimap.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\migflt.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\miguiresource.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mimefilt.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mimofcodec.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\MirrorDrvCompat.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mispace.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\miutils.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mlang.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mmc.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mmcbase.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mmci.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mmcico.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mmcndmgr.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mmcshext.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mmcss.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\MMDevAPI.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mmsys.cpl:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mobsync.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mode.com:$CmdTcID
AlternateDataStreams: C:\Windows\system32\modemui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\montr_ci.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\more.com:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mountvol.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Mpeg2Data.ax:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mpg2splt.ax:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mpnotify.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mpr.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mprapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mprddm.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mprdim.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mprext.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mprmsg.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\MPSSVC.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\MRINFO.EXE:$CmdTcID
AlternateDataStreams: C:\Windows\system32\MrmCoreR.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\MrmIndexer.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msaatext.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msacm32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msacm32.drv:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msadp32.acm:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msasn1.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msaudite.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msauserext.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mscandui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mscat32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msched.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\MSchedExe.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mscms.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msconfig.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msctf.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msctfime.ime:$CmdTcID
AlternateDataStreams: C:\Windows\system32\MsCtfMonitor.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msctfp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msctfui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msctfuimanager.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msdadiag.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msdart.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msdelta.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msdmo.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msdri.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msdrm.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msdt.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msdtc.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msdtckrm.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msdtclog.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msdtcprx.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msdtctm.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msdtcuiu.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\MSDvbNP.ax:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msfeeds.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msftedit.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msg.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msg711.acm:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msgsm32.acm:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mshtml.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\MshtmlDac.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mshtmled.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\MsiCofire.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msidcrl40.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msident.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msidle.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msieftp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msiexec.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msihnd.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msiltcfg.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msimg32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msimtf.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msinfo32.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msisip.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msiwer.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mskeyprotcli.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mskeyprotect.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msls31.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\MSNP.ax:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msoeacct.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msoert2.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mspaint.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mspatcha.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mspatchc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msports.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msra.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msrahc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msrdc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\MsRdpWebAccess.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msrle32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msscntrs.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mssha.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msshooks.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mssign32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mssip32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mssitlb.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\MsSpellCheckingFacility.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\MsSpellCheckingHost.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mssph.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mssphtb.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mssprxy.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mssrch.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mssvp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mstask.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msTextPrediction.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mstsc.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mstscax.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msutb.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msv1_0.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msvcirt.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msvcp60.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msvcrt.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msvfw32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msvidc32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\MSVidCtl.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\MSWB7.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\MSWB70011.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\MSWB7001E.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\MSWB70404.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\MSWB70804.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mswsock.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msxml3.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msxml6.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msyuv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mtstocom.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mtxclu.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mtxdm.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mtxex.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mtxoci.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\muifontsetup.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\MUILanguageCleanup.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\MuiUnattend.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\MultiDigiMon.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mycomput.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mydocs.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Mystify.scr:$CmdTcID
AlternateDataStreams: C:\Windows\system32\napdsnap.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\NapiNSP.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\napipsec.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\NAPMONTR.DLL:$CmdTcID
AlternateDataStreams: C:\Windows\system32\NAPSTAT.EXE:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Narrator.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\NaturalLanguage6.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\nbtstat.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\NcaApi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\NcaSvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ncbservice.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\NcdAutoSetup.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\NcdProp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\nci.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ncobjapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ncpa.cpl:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ncrypt.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ncryptprov.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ncryptsslp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ncsi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ncuprov.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ndadmin.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\nddeapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ndfapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ndfetw.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ndfhcdiscovery.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ndiscapCfg.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ndishc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\NdisImPlatform.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ndproxystub.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\nduprov.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\negoexts.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\net.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\net1.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\netapi32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\netbios.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\netbtugc.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\netcenter.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\netcfg.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\netcfgx.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\netcorehc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\netdiagfx.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\NetEvtFwdr.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\netid.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\netiohlp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\netiougc.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\netjoin.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\netlogon.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\netman.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\netplwiz.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Netplwiz.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\netprofm.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\netprofmsvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\netprovisionsp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\NetSetupApi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\netsh.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\netshell.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\NETSTAT.EXE:$CmdTcID
AlternateDataStreams: C:\Windows\system32\nettrace.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\netutils.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\NetVscCoinstall.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\networkexplorer.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\networkitemfactory.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\NetworkStatus.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\newdev.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\newdev.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ninput.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\NL7Data0011.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\NL7Data001E.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\NL7Data0404.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\NL7Data0804.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\nlaapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\nlahc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\nlasvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\nlhtml.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\nlmgp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\nlmproxy.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\nlmsprep.dll:$CmdTcID |