activitate hdd suspecta

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 27.01.2018
Ran by work (administrator) on WORK-PC (04-02-2018 17:06:35)
Running from C:\Users\work\Downloads
Loaded Profiles: work (Available Profiles: work)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 8 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleCrashHandler.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleCrashHandler64.exe
(CrypKey (Canada) Ltd.) C:\Windows\System32\Crypserv.exe
(Transaction Software, D 81829 Munich) D:\ewa\database\TransBase EWA\tbmux32.exe
(Transaction Software, D 81829 Munich) D:\ewa\database\TransBase EPC\tbmux32.exe
(Transaction Software, D 81829 Munich) D:\ewa\database\TransBase WIS\tbmux32.exe
(Apache Software Foundation) D:\ewa\server\bin\tomcat7.exe
() D:\ewa\apps\jre\private_jre\bin\java.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(CMedia) C:\Program Files\UNi Xonar Audio\Customapp\AsusAudioCenter.exe
(DEVGURU Co., LTD.) C:\Program Files\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe
() C:\Program Files (x86)\ATRis_Technik\sed.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\ATRis_Technik\pgsql\bin\pg_ctl.exe
(Wondershare) C:\Program Files (x86)\Wondershare\WAF\2.4.3.225\WsAppService.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\ATRis_Technik\pgsql\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\ATRis_Technik\pgsql\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\ATRis_Technik\pgsql\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\ATRis_Technik\pgsql\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\ATRis_Technik\pgsql\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\ATRis_Technik\pgsql\bin\postgres.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Transaction Software, D 81829 Munich) D:\ewa\database\TransBase EWA\tbkern32.exe
(Transaction Software, D 81829 Munich) D:\ewa\database\TransBase EWA\tbkern32.exe
(Transaction Software, D 81829 Munich) D:\ewa\database\TransBase EWA\tbkern32.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
(Transaction Software, D 81829 Munich) D:\ewa\database\TransBase EPC\tbkern32.exe
(Transaction Software, D 81829 Munich) D:\ewa\database\TransBase EPC\tbkern32.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\ATRis_Technik\pgsql\bin\postgres.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
() C:\Program Files (x86)\WinMend\Auto Shutdown\BugFixer.exe
(BitTorrent Inc.) C:\Users\work\AppData\Roaming\uTorrent\uTorrent.exe
(BitTorrent Inc.) C:\Users\work\AppData\Roaming\uTorrent\updates\3.5.1_44332\utorrentie.exe
(BitTorrent Inc.) C:\Users\work\AppData\Roaming\uTorrent\updates\3.5.1_44332\utorrentie.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Cmaudio8788] => C:\Windows\syswow64\RunDll32.exe C:\Windows\Syswow64\cmicnfgp.dll,CMICtrlWnd
HKLM\...\Run: [Cmaudio8788GX] => C:\Windows\syswow64\HsMgr.exe [200704 2008-07-11] ()
HKLM\...\Run: [Cmaudio8788GX64] => C:\Windows\system\HsMgr64.exe [282112 2008-07-11] ()
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [303928 2017-07-14] (Apple Inc.)
HKLM-x32\...\Run: [SedServer] => C:\Program Files (x86)\ATRis_Technik\Sed.exe [120587776 2012-11-23] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [335232 2015-02-10] (Oracle Corporation)
HKU\S-1-5-21-1435933851-4050489574-2603001200-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3111712 2017-12-15] (Valve Corporation)
HKU\S-1-5-21-1435933851-4050489574-2603001200-1000\...\Run: [OscarEditor] => "C:\Program Files (x86)\OSCAR Editor X7\OscarEditor.exe" Minimum
HKU\S-1-5-21-1435933851-4050489574-2603001200-1000\...\MountPoints2: F - F:\AUTORUN.EXE
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SteelSeries Engine 3.lnk [2018-01-04]
ShortcutTarget: SteelSeries Engine 3.lnk -> C:\Program Files\SteelSeries\SteelSeries Engine 3\SteelSeriesEngine3.exe (SteelSeries ApS)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Hosts: 127.0.0.1    example.net
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{6F012EDC-1A0D-4D05-8C27-479BF309DE48}: [DhcpNameServer] 192.168.1.1
Internet Explorer:
==================
HKU\S-1-5-21-1435933851-4050489574-2603001200-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/?ocid=iehp
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\root\Office16\URLREDIR.DLL [2018-01-20] (Microsoft Corporation)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll [2018-01-20] (Microsoft Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\ssv.dll [2017-07-16] (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\URLREDIR.DLL [2018-01-20] (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\jp2ssv.dll [2017-07-16] (Oracle Corporation)
Handler: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2018-01-20] (Microsoft Corporation)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2018-01-20] (Microsoft Corporation)
Handler: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2018-01-20] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2018-01-20] (Microsoft Corporation)
Handler: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2018-01-20] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2018-01-20] (Microsoft Corporation)
Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2018-01-20] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2018-01-20] (Microsoft Corporation)
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-21] (Microsoft Corporation)
Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-21] (Microsoft Corporation)
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-21] (Microsoft Corporation)
Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-21] (Microsoft Corporation)
FireFox:
========
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL [2018-01-20] (Microsoft Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2017-07-16] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2017-07-16] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\NPSPWRAP.DLL [2017-12-18] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-15] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-15] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.5.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2017-04-07] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-11-04] (Adobe Systems Inc.)
Chrome:
=======
CHR Profile: C:\Users\work\AppData\Local\Google\Chrome\User Data\Default [2018-02-04]
CHR Extension: (Slides) - C:\Users\work\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-10-14]
CHR Extension: (Docs) - C:\Users\work\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-14]
CHR Extension: (Google Drive) - C:\Users\work\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-05-19]
CHR Extension: (YouTube) - C:\Users\work\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-05-19]
CHR Extension: (Sheets) - C:\Users\work\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-10-14]
CHR Extension: (Google Docs Offline) - C:\Users\work\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-05-19]
CHR Extension: (IE Tab) - C:\Users\work\AppData\Local\Google\Chrome\User Data\Default\Extensions\hehijbfgiekmjfkfjpbkbammjbdenadd [2018-02-04]
CHR Extension: (Chrome Web Store Payments) - C:\Users\work\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-08-23]
CHR Extension: (Gmail) - C:\Users\work\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-05-19]
CHR Extension: (Chrome Media Router) - C:\Users\work\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-01-26]
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2017-04-03] (Apple Inc.)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [7968432 2018-01-30] (Microsoft Corporation)
R2 CrypKey License; C:\Windows\system32\crypserv.exe [126976 2010-03-18] (CrypKey (Canada) Ltd.) [File not signed]
R2 EWA net DB Core; D:\EWA\database\TransBase EWA\tbmux32.exe [306304 2014-07-11] (Transaction Software, D 81829 Munich) [File not signed]
R2 EWA net DB EPC; D:\EWA\database\TransBase EPC\tbmux32.exe [417792 2007-11-27] (Transaction Software, D 81829 Munich) [File not signed]
R2 EWA net DB WIS; D:\EWA\database\TransBase WIS\tbmux32.exe [306304 2014-07-11] (Transaction Software, D 81829 Munich) [File not signed]
R2 EWA net Server; D:\EWA\server\bin\tomcat7.exe [86656 2014-11-03] (Apache Software Foundation)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6234056 2017-11-01] (Malwarebytes)
R2 ss_conn_service; C:\Program Files\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe [752224 2017-01-16] (DEVGURU Co., LTD.)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [10803440 2017-08-29] (TeamViewer GmbH)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)
R2 WsAppService; C:\Program Files (x86)\Wondershare\WAF\2.4.3.225\WsAppService.exe [473824 2017-05-05] (Wondershare)
R2 WorkshopDbService; "C:\Program Files (x86)\ATRis_Technik\pgsql\bin\pg_ctl.exe" runservice  -N WorkshopDbService -D "C:\ProgramData\WorkshopData\data2" -w
S2 WsDrvInst; C:\Program Files (x86)\Wondershare\dr.fone toolkit for iOS\Library\DriverInstaller\DriverInstall.exe [X]
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 ampa; C:\Windows\system32\ampa.sys [38320 2016-12-25] ()
S3 ampa; C:\Windows\SysWOW64\ampa.sys [38320 2016-12-25] ()
R3 cmudaxp; C:\Windows\System32\drivers\cmudaxp.sys [2735616 2015-06-02] (C-Media Inc)
S3 dg_ssudbus; C:\Windows\System32\DRIVERS\ssudbus.sys [131712 2017-01-16] (Samsung Electronics Co., Ltd.)
R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [77432 2017-11-29] ()
R2 MBAMChameleon; C:\Windows\System32\Drivers\MbamChameleon.sys [193968 2018-02-01] (Malwarebytes)
R3 MBAMFarflt; C:\Windows\System32\DRIVERS\farflt.sys [110016 2018-02-04] (Malwarebytes)
R3 MBAMProtection; C:\Windows\System32\DRIVERS\mbam.sys [46008 2018-02-04] (Malwarebytes)
R0 MBAMSwissArmy; C:\Windows\System32\Drivers\mbamswissarmy.sys [253880 2018-02-01] (Malwarebytes)
R3 MBAMWebProtection; C:\Windows\System32\DRIVERS\mwac.sys [84256 2018-02-04] (Malwarebytes)
R1 NetworkX; C:\Windows\System32\ckldrv.sys [30272 2010-03-19] ()
R3 ssdevfactory; C:\Windows\System32\DRIVERS\ssdevfactory.sys [46408 2017-12-15] (SteelSeries ApS)
R3 sshid; C:\Windows\System32\DRIVERS\sshid.sys [45896 2017-12-15] (SteelSeries ApS)
S3 ssudmdm; C:\Windows\System32\DRIVERS\ssudmdm.sys [165504 2017-01-16] (Samsung Electronics Co., Ltd.)
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2018-02-04 17:06 - 2018-02-04 17:07 - 000016434 _____ C:\Users\work\Downloads\FRST.txt
2018-02-04 17:06 - 2018-02-04 17:06 - 002393088 _____ (Farbar) C:\Users\work\Downloads\FRST64.exe
2018-02-04 17:06 - 2018-02-04 17:06 - 000000000 ____D C:\FRST
2018-02-04 15:24 - 2018-02-04 15:24 - 000000000 ____D C:\Users\work\Downloads\Source.Code.2011.720p.BluRay.DD5.1.x264.RoSubbed-playHD
2018-02-04 15:23 - 2018-02-04 15:23 - 000031386 _____ C:\Users\work\Downloads\Source.Code.2011.720p.BluRay.DD5.1.x264.RoSubbed-playHD.torrent
2018-02-04 15:23 - 2018-02-04 15:23 - 000000000 ____D C:\Users\work\AppData\LocalLow\uTorrent
2018-02-04 12:00 - 2018-02-04 12:00 - 000110016 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys
2018-02-02 01:52 - 2018-02-04 11:59 - 000000464 _____ C:\Windows\Tasks\WinMendAutoShutdownwork.job
2018-02-02 01:52 - 2018-02-04 03:36 - 000003000 _____ C:\Windows\System32\Tasks\WinMendAutoShutdownwork
2018-02-02 00:57 - 2018-02-02 01:07 - 000000000 ____D C:\Users\work\Downloads\The.Prestige.2006.720p.BluRay.x264-SKALiWAGZ
2018-02-02 00:56 - 2018-02-02 00:57 - 000034530 _____ C:\Users\work\Downloads\The.Prestige.2006.720p.BluRay.x264.RoSubbed-SKALiWAGZ.torrent
2018-02-01 23:55 - 2018-02-04 16:46 - 000084256 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
2018-02-01 23:55 - 2018-02-04 12:00 - 000046008 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2018-02-01 23:55 - 2018-02-01 23:55 - 000193968 _____ (Malwarebytes) C:\Windows\system32\Drivers\MbamChameleon.sys
2018-02-01 23:54 - 2018-02-01 23:54 - 000001867 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2018-02-01 23:54 - 2018-02-01 23:54 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2018-02-01 23:54 - 2018-02-01 23:54 - 000000000 ____D C:\ProgramData\MB2Migration
2018-02-01 23:54 - 2018-02-01 23:54 - 000000000 ____D C:\Program Files\Malwarebytes
2018-02-01 23:54 - 2017-11-29 09:11 - 000077432 _____ C:\Windows\system32\Drivers\mbae64.sys
2018-02-01 23:53 - 2018-02-01 23:54 - 000253880 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamswissarmy.sys
2018-02-01 23:51 - 2018-02-01 23:54 - 000000000 ____D C:\ProgramData\Malwarebytes
2018-02-01 23:51 - 2018-02-01 23:54 - 000000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2018-02-01 23:50 - 2018-02-01 23:50 - 000003118 _____ C:\Users\work\Downloads\license.conf
2018-02-01 23:49 - 2018-02-01 23:49 - 000007762 _____ C:\Users\work\Downloads\Malwarebytes.Anti-Malware.Premium.v2.2.1.1043.Incl.License-warez_spam.torrent
2018-02-01 23:49 - 2018-02-01 23:49 - 000000483 _____ C:\Users\work\Downloads\HostsMod.bat
2018-02-01 23:49 - 2018-02-01 23:49 - 000000000 ____D C:\Users\work\Downloads\Malwarebytes.Anti-Malware.Premium.v2.2.1.1043.Incl.License-warez_spam
2018-02-01 22:49 - 2018-02-01 23:10 - 000000000 ____D C:\ESD
2018-02-01 22:43 - 2018-02-01 22:43 - 018617536 _____ (Microsoft Corporation) C:\Users\work\Downloads\MediaCreationTool (1).exe
2018-02-01 22:43 - 2018-02-01 22:43 - 000005962 _____ C:\Users\work\Downloads\KMS.Tools.Portable-01.11.2016-Ratiborus.torrent
2018-02-01 22:43 - 2018-02-01 22:43 - 000000000 ___HD C:\$Windows.~WS
2018-02-01 22:43 - 2018-02-01 22:43 - 000000000 ____D C:\Users\work\Downloads\KMS.Tools.Portable-01.11.2016-Ratiborus
2018-02-01 22:43 - 2018-02-01 22:43 - 000000000 ____D C:\$WINDOWS.~BT
2018-02-01 22:40 - 2018-02-01 22:40 - 018617536 _____ (Microsoft Corporation) C:\Users\work\Downloads\MediaCreationTool.exe
2018-02-01 22:29 - 2018-02-01 22:29 - 000000000 ____D C:\Program Files\Common Files\DESIGNER
2018-01-29 23:48 - 2018-01-29 23:54 - 000000000 ____D C:\Users\work\Downloads\The Bone Collector 1999 Blu-ray 720p x264-playHD
2018-01-29 23:48 - 2018-01-29 23:48 - 000027332 _____ C:\Users\work\Downloads\The Bone Collector 1999 Blu-ray 720p x264-playHD.torrent
2018-01-29 23:38 - 2018-01-29 23:38 - 000034399 _____ C:\Users\work\Downloads\The Bone Collector 1999 720p BluRay DTS x264 ROSubbed-RuDE.torrent
2018-01-29 23:28 - 2018-01-29 23:28 - 000034482 _____ C:\Users\work\Downloads\Gia.Unrated.1998.BluRay.720p.X264-MySiLU.torrent
2018-01-28 01:46 - 2018-01-28 01:51 - 000000000 ____D C:\Users\work\Downloads\24.Hours.to.Live.2017.BluRay.720p.DTS.x264-MTeam
2018-01-28 01:45 - 2018-01-28 01:45 - 000043763 _____ C:\Users\work\Downloads\24.Hours.to.Live.2017.BluRay.1080p.DTS.x264-MTeam.torrent
2018-01-28 01:45 - 2018-01-28 01:45 - 000024199 _____ C:\Users\work\Downloads\24.Hours.to.Live.2017.BluRay.720p.DTS.x264-MTeam.torrent
2018-01-24 01:39 - 2018-01-24 01:39 - 000000000 ____D C:\ProgramData\AomeiBR
2018-01-24 01:38 - 2018-01-24 02:04 - 000001024 ____H C:\AMTAG.BIN
2018-01-24 01:38 - 2018-01-24 01:38 - 000001289 _____ C:\Users\Public\Desktop\AOMEI Partition Assistant Standard Edition 6.6.lnk
2018-01-24 01:38 - 2018-01-24 01:38 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AOMEI Partition Assistant Standard Edition 6.6
2018-01-24 01:37 - 2018-01-24 01:42 - 000000000 ____D C:\Program Files (x86)\AOMEI Partition Assistant Standard Edition 6.6
2018-01-24 01:37 - 2018-01-24 01:37 - 010673256 _____ (AOMEI Technology Co., Ltd. ) C:\Users\work\Downloads\PAssist_Std.exe
2018-01-24 01:37 - 2017-11-20 15:45 - 001987432 _____ C:\Windows\ampa.exe
2018-01-24 01:37 - 2016-12-25 23:26 - 000038320 _____ C:\Windows\SysWOW64\ampa.sys
2018-01-24 01:37 - 2016-12-25 23:26 - 000038320 _____ C:\Windows\system32\ampa.sys
2018-01-22 19:43 - 2018-01-22 19:47 - 000000000 ____D C:\Users\work\Downloads\Hatred.2016.720p.BluRay.x264.DTS-WiKi
2018-01-22 19:42 - 2018-01-22 19:42 - 000028551 _____ C:\Users\work\Downloads\Hatred.2016.720p.BluRay.x264.DTS-WiKi.torrent
2018-01-19 01:46 - 2018-01-19 01:51 - 000000000 ____D C:\Users\work\Downloads\The.Accountant.2016.REPACK.720p.BluRay.DD5.1.x264-IDE
2018-01-19 01:45 - 2018-01-19 01:45 - 000045136 _____ C:\Users\work\Downloads\The.Accountant.2016.REPACK.720p.BluRay.DD5.1.x264.RoSubbed-IDE.torrent
2018-01-18 01:07 - 2018-01-18 01:07 - 000000000 ____D C:\Users\work\Downloads\Ultimate bass music Vol.5 @ TyG3r & wWw.FisierulMeu.Org
2018-01-18 00:54 - 2018-01-18 00:54 - 130439011 _____ C:\Users\work\Downloads\fileshare_Nicu Ficiu - E verde iarba si deasa [ @ NvpMuzic & wWw.####.Net ].rar
2018-01-18 00:54 - 2013-07-05 02:13 - 000000000 ____D C:\Users\work\Downloads\Nicu Ficiu - E verde iarba si deasa [ @ NvpMuzic & wWw.####.Net ]
2018-01-18 00:52 - 2018-01-18 00:57 - 417447518 _____ C:\Users\work\Downloads\Ultimate bass music Vol.5 @ TyG3r & wWw.FisierulMeu.Org.rar
2018-01-17 00:25 - 2018-02-02 00:15 - 000000000 ____D C:\Users\work\AppData\Roaming\fex
2018-01-09 20:38 - 2018-01-22 19:42 - 000000000 ____D C:\Users\work\Downloads\Windows.Loader.v2.1.7-Daz
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2018-02-04 17:05 - 2017-05-19 23:46 - 000000000 ____D C:\Users\work\AppData\Roaming\uTorrent
2018-02-04 17:03 - 2017-05-21 23:03 - 000000000 ____D C:\Users\work\AppData\Roaming\vlc
2018-02-04 16:58 - 2017-12-09 23:10 - 000000876 _____ C:\Windows\Tasks\WinmendUpdateTask_work.job
2018-02-04 16:58 - 2017-05-20 01:07 - 000003946 _____ C:\Windows\System32\Tasks\WinmendUpdateTask_work
2018-02-04 12:07 - 2009-07-14 06:45 - 000026352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2018-02-04 12:07 - 2009-07-14 06:45 - 000026352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2018-02-04 12:01 - 2017-05-23 22:16 - 000000000 ____D C:\Program Files (x86)\Steam
2018-02-04 12:01 - 2009-07-14 04:34 - 000000584 _____ C:\Windows\win.ini
2018-02-04 11:59 - 2009-07-14 07:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2018-02-04 02:53 - 2017-07-25 22:12 - 000000000 ____D C:\Users\work\AppData\Roaming\Imminent
2018-02-04 02:34 - 2017-06-03 20:43 - 000000000 ____D C:\Users\work\AppData\Local\IE Tab
2018-02-02 19:35 - 2017-05-19 23:41 - 000002224 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2018-02-02 19:35 - 2017-05-19 23:41 - 000002183 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2018-02-02 01:38 - 2017-07-16 01:48 - 000000000 ____D C:\Users\work\XFER
2018-02-02 01:38 - 2009-08-29 03:58 - 000000000 ____D C:\Users\work
2018-02-02 01:15 - 2017-07-16 01:47 - 000000102 _____ C:\Users\work\.ewanapi_cookie
2018-02-02 00:11 - 2017-07-25 22:12 - 000000000 ____D C:\Windows\System32\Tasks\Update
2018-02-02 00:09 - 2017-11-25 22:22 - 000000000 ___HD C:\Users\work\AppData\Roaming\41YWCQVb09nHUAXW
2018-02-02 00:06 - 2017-11-25 22:22 - 000000000 ____D C:\Users\work\AppData\Local\LeRsVteVWh
2018-02-02 00:06 - 2017-11-16 23:26 - 000000000 ____D C:\Program Files\EVC
2018-02-02 00:00 - 2009-07-14 07:13 - 000801094 _____ C:\Windows\system32\PerfStringBackup.INI
2018-02-02 00:00 - 2009-07-14 05:20 - 000000000 ____D C:\Windows\inf
2018-02-01 23:10 - 2009-08-29 03:55 - 000000000 ____D C:\Windows\Panther
2018-02-01 22:30 - 2017-05-27 18:24 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2018-02-01 22:29 - 2009-07-14 05:20 - 000000000 ____D C:\Program Files\Common Files\Microsoft Shared
2018-02-01 22:28 - 2017-05-27 18:21 - 000000000 ____D C:\Program Files\Microsoft Office
2018-01-27 13:44 - 2017-05-27 18:32 - 000000000 ____D C:\ProgramData\KMSAutoS
2018-01-25 23:45 - 2018-01-04 20:00 - 000000000 ____D C:\Users\work\AppData\Roaming\steelseries-engine-3-client
2018-01-13 21:28 - 2017-08-23 18:58 - 000000000 ____D C:\Users\work\Downloads\odin3_v3.12.7
2018-01-13 21:28 - 2017-05-27 18:30 - 000000000 ____D C:\Users\work\Documents\Outlook Files
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2018-01-28 14:13
==================== End of FRSTtxt ============================



Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27.01.2018
Ran by work (04-02-2018 17:07:25)
Running from C:\Users\work\Downloads
Windows 7 Ultimate Service Pack 1 (X64) (2009-08-29 01:58:19)
Boot Mode: Normal
==========================================================

==================== Accounts: =============================
Administrator (S-1-5-21-1435933851-4050489574-2603001200-500 - Administrator - Disabled)
Guest (S-1-5-21-1435933851-4050489574-2603001200-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1435933851-4050489574-2603001200-1002 - Limited - Enabled)
work (S-1-5-21-1435933851-4050489574-2603001200-1000 - Administrator - Enabled) => C:\Users\work
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B}
AS: Malwarebytes (Enabled - Up to date) {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
µTorrent (HKU\S-1-5-21-1435933851-4050489574-2603001200-1000\...\uTorrent) (Version: 3.5.1.44332 - BitTorrent Inc.)
7-Zip 17.00 beta (x64) (HKLM\...\7-Zip) (Version: 17.00 beta - Igor Pavlov)
Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 18.009.20050 - Adobe Systems Incorporated)
Adobe Flash Player 10 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 10.3.183.7 - Adobe Systems Incorporated)
AOMEI Partition Assistant Standard Edition 6.6 (HKLM-x32\...\{02F850ED-FD0E-4ED1-BE0B-54981f5BD3D4}_is1) (Version:  - AOMEI Technology Co., Ltd.)
Apple Application Support (32-bit) (HKLM-x32\...\{D2FE6376-E549-4F63-A2C5-CA24DA035DE4}) (Version: 5.6 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{BB109E24-EE90-485B-A28B-ADDEFB40540B}) (Version: 5.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{0A596141-97D5-45FA-9281-98DFAF48D579}) (Version: 10.3.2.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{52D87F32-70E4-4348-8148-C0B9F35B1314}) (Version: 2.3.0.177 - Apple Inc.)
ATRis STAHLGRUBER DVD Setup (01/2013) (HKLM-x32\...\{4E95F911-B344-48FB-8E5E-1CED78E0FBDE}) (Version:  - )
ATRis_Technik (HKLM-x32\...\ATRis_Technik) (Version: 12.0.0.1 - Vivid Automotive Data & Media bv)
Audacity 2.1.0 (HKLM-x32\...\Audacity_is1) (Version: 2.1.0 - Audacity Team)
AutoHotkey 1.1.26.01 (HKLM\...\AutoHotkey) (Version: 1.1.26.01 - Lexikos)
Bigasoft Audio Converter 5.1.3.6446 (HKLM-x32\...\{E6333CE4-9DC0-455C-9D43-E011CE33F550}_is1) (Version:  - Bigasoft Corporation)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.8.6795 - CDBurnerXP)
ChrisTV Online! FREE Edition 11.00 (HKLM-x32\...\{CA2D0537-7041-4027-A0E7-1A09968D8112}_is1) (Version: 11.0.0.0 - Chris P.C. srl)
CPUID CPU-Z 1.81.1 (HKLM\...\CPUID CPU-Z_is1) (Version: 1.81.1 - )
Document_Installer (HKLM-x32\...\{D78A1468-84FD-4226-BB33-713A7EBE3028}) (Version: 1.00.0000 - DaimlerChrysler AG) Hidden
Elcomsoft Phone Breaker (HKLM-x32\...\{D9762DC3-2E37-4F6D-B095-CFB8E7F9AA6C}) (Version: 6.45.18347.3529 - Elcomsoft Co. Ltd.)
EWA (HKLM-x32\...\EWA net) (Version:  - )
EWA_net_Admin (HKLM-x32\...\{F49AFE1E-A8F1-4764-9138-C82C8E617E2B}) (Version: 1.00.0000 - DaimlerChrysler AG) Hidden
EWA_net_Client_Applications (HKLM-x32\...\{278DB2A0-512A-4555-8BA0-C5D65E9DDC79}) (Version: 1.00.0000 - DaimlerChrysler AG) Hidden
EWA_net_Core (HKLM-x32\...\{F41852C7-939E-49A3-A5A7-5E3A81C32A8B}) (Version: 1.00.0000 - DaimlerChrysler AG) Hidden
EWA_net_EPC (HKLM-x32\...\{7A997C02-81D4-4FEC-9C1C-F916611F8360}) (Version: 1.00.0000 - Daimler) Hidden
EWA_net_EPC (HKLM-x32\...\InstallShield_{7A997C02-81D4-4FEC-9C1C-F916611F8360}) (Version:  - )
EWA_net_Server (HKLM-x32\...\{E68C5783-A1E6-4D4C-83D4-99DD470F3D94}) (Version: 1.00.0000 - DaimlerChrysler AG) Hidden
EWA_net_WIS (HKLM-x32\...\{C0F1D697-0C8F-4563-A406-830AE52BCE65}) (Version: 1.00.0000 - DaimlerChrysler AG) Hidden
EWA_net_WIS_CaseOnline_Importer (HKLM-x32\...\{00989200-325C-4910-8D7C-708529685D64}) (Version: 1.00.0000 - DaimlerChrysler AG) Hidden
GOM Player (HKLM-x32\...\GOM Player) (Version: 2.3.17.5274 - GOM & Company)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 64.0.3282.140 - Google Inc.)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.7 - Google Inc.) Hidden
iTunes (HKLM\...\{02F95875-9527-49CC-B32F-970ADAEBD1EF}) (Version: 12.6.2.20 - Apple Inc.)
Java 7 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.450 - Oracle)
Java 8 Update 40 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218040F0}) (Version: 8.0.400 - Oracle Corporation)
LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version:  - )
Malwarebytes version 3.3.1.2183 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.3.1.2183 - Malwarebytes)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Office Professional Plus 2016 - en-us (HKLM\...\ProplusRetail - en-us) (Version: 16.0.9001.2138 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1435933851-4050489574-2603001200-1000\...\OneDriveSetup.exe) (Version: 17.3.4604.0120 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24212 (HKLM-x32\...\{462f63a8-6347-4894-a1b3-dbfe3a4c981d}) (Version: 14.0.24212.0 - Microsoft Corporation)
NVIDIA 3D Vision Controller Driver 334.89 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 334.89 - NVIDIA Corporation)
NVIDIA Graphics Driver 334.89 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 334.89 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
Office 16 Click-to-Run Extensibility Component (HKLM\...\{90160000-008C-0000-1000-0000000FF1CE}) (Version: 16.0.9001.2138 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (HKLM\...\{90160000-007E-0000-1000-0000000FF1CE}) (Version: 16.0.9001.2138 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (HKLM\...\{90160000-008C-0409-1000-0000000FF1CE}) (Version: 16.0.9001.2138 - Microsoft Corporation) Hidden
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
PowerISO (HKLM-x32\...\PowerISO) (Version: 6.8 - Power Software Ltd)
Realtek Ethernet Controller Driver For Windows Vista and Later (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0009 - Realtek)
Samsung USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.63.0 - Samsung Electronics Co., Ltd.)
SopCast 4.2.0 (HKLM-x32\...\SopCast) (Version: 4.2.0 - www.sopcast.com)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
SteelSeries Engine 3.11.8 (HKLM\...\SteelSeries Engine 3) (Version: 3.11.8 - SteelSeries ApS)
TeamViewer 12 (HKLM-x32\...\TeamViewer) (Version: 12.0.83369 - TeamViewer)
Total Commander 64-bit (Remove or Repair) (HKLM\...\Totalcmd64) (Version: 9.0a - Ghisler Software GmbH)
UNi Xonar Audio Driver (HKLM\...\C-Media Oxygen HD Audio Driver) (Version:  - )
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.5.1 - VideoLAN)
Windows Driver Package - Microsoft (xusb21) XnaComposite  (08/13/2009 2.1.0.1349) (HKLM\...\0AEBEF6F936CFE16E003F7E141631FAB754D9816) (Version: 08/13/2009 2.1.0.1349 - Microsoft)
WinMend Auto Shutdown 1.4.0 (HKLM-x32\...\WinMend Auto Shutdown_is1) (Version:  - WinMend.com)
Winols 2.24 (HKLM-x32\...\Winols 2.24) (Version: 2.24 - OLS)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
ContextMenuHandlers1: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2017-04-29] (Igor Pavlov)
ContextMenuHandlers1: [PowerISO] -> {967B2D40-8B7D-4127-9049-61EA0C2C6DCE} => C:\Program Files\PowerISO\PWRISOSH.DLL [2017-02-02] (Power Software Ltd)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-11-01] (Malwarebytes)
ContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2017-04-29] (Igor Pavlov)
ContextMenuHandlers4: [PowerISO] -> {967B2D40-8B7D-4127-9049-61EA0C2C6DCE} => C:\Program Files\PowerISO\PWRISOSH.DLL [2017-02-02] (Power Software Ltd)
ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\Windows\system32\nvshext.dll [2014-02-08] (NVIDIA Corporation)
ContextMenuHandlers6: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2017-04-29] (Igor Pavlov)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2017-11-01] (Malwarebytes)
ContextMenuHandlers6: [PowerISO] -> {967B2D40-8B7D-4127-9049-61EA0C2C6DCE} => C:\Program Files\PowerISO\PWRISOSH.DLL [2017-02-02] (Power Software Ltd)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {22629A48-5920-41A1-AD48-6B65D4BD8617} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerLogon => C:\Program Files\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe [2018-02-01] (Microsoft Corporation)
Task: {34A62A09-6BC3-44B5-8A47-7AB0A28E6DA0} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerRegistration => C:\Program Files\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe [2018-02-01] (Microsoft Corporation)
Task: {5C28238F-DBA0-4B9C-B834-6BC88DAAEF5F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-05-19] (Google Inc.)
Task: {642960DB-2C10-4D40-BD8D-A2B818FF8CD7} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2018-01-30] (Microsoft Corporation)
Task: {69553361-1516-407A-A208-D0AE0C13019D} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2017-02-14] (Apple Inc.)
Task: {6B0419C0-1766-4EC1-A7C8-D6B3D8F4AF9E} - System32\Tasks\WinMendAutoShutdownwork => C:\Program Files (x86)\WinMend\Auto Shutdown\AutoShutdown.exe [2015-10-26] (WinMend.com)
Task: {8216C297-DC6A-4E2C-BB8C-B04292582FB0} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2017-09-27] (Adobe Systems Incorporated)
Task: {8AC47832-3120-4FEC-AAB6-3325A20C245D} - System32\Tasks\WinmendUpdateTask_work => C:\Program Files (x86)\WinMend\Auto Shutdown\LiveUpdate.exe [2017-05-20] ()
Task: {8C1A9B0E-E96A-4E2F-BBF2-8D0172B2B729} - System32\Tasks\Microsoft\Office\Office Automatic Updates 2.0 => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2018-01-30] (Microsoft Corporation)
Task: {8CD85D52-3EA0-44E7-86EA-CACB0B8CF812} - System32\Tasks\KMSAutoNet => C:\ProgramData\KMSAutoS\KMSAuto Net.exe [2017-05-27] (MSFree Inc.)
Task: {9251FEBB-A22E-4759-8742-DEFC240F5E5B} - System32\Tasks\Update\Updatewer => cmd /c type "C:\Users\work\AppData\Local\Temp\Updatewer.txt" | cmd <==== ATTENTION
Task: {AE5550D6-E606-45A9-B6DA-FD9A35C0F090} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-05-19] (Google Inc.)
Task: {B01D9054-3303-4387-A874-E89637D31413} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files\Microsoft Office\root\Office16\msoia.exe [2018-02-01] (Microsoft Corporation)
Task: {C41E9539-E231-4C60-8F60-0D11E95A114E} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files\Microsoft Office\root\Office16\msoia.exe [2018-02-01] (Microsoft Corporation)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\WinMendAutoShutdownwork.job => C:\Program Files (x86)\WinMend\Auto Shutdown\AutoShutdown.exe
Task: C:\Windows\Tasks\WinmendUpdateTask_work.job => C:\Program Files (x86)\WinMend\Auto Shutdown\LiveUpdate.exe
==================== Shortcuts & WMI ========================
(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============
2017-05-19 23:54 - 2014-02-08 19:42 - 000117024 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2017-07-13 19:50 - 2017-07-13 19:50 - 001354040 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2017-07-13 19:50 - 2017-07-13 19:50 - 000092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2017-06-07 00:21 - 2015-06-22 14:06 - 000045056 _____ () D:\EWA\apps\jre\private_jre\bin\java.exe
2017-07-14 09:26 - 2017-07-14 09:26 - 001354040 _____ () C:\Program Files\iTunes\libxml2.dll
2017-07-14 09:27 - 2017-07-14 09:27 - 000092472 _____ () C:\Program Files\iTunes\zlib1.dll
2017-06-05 15:13 - 2012-11-23 18:14 - 120587776 _____ () C:\Program Files (x86)\ATRis_Technik\sed.exe
2018-02-01 23:54 - 2017-11-29 09:11 - 002301384 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SelfProtectionSdk.dll
2018-02-01 23:54 - 2017-11-29 09:11 - 002358728 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MwacLib.dll
2017-10-12 19:19 - 2017-10-12 19:19 - 000332320 _____ () C:\Program Files (x86)\WinMend\Auto Shutdown\BugFixer.exe
2018-02-02 19:35 - 2018-02-01 08:13 - 004433752 _____ () C:\Program Files (x86)\Google\Chrome\Application\64.0.3282.140\libglesv2.dll
2018-02-02 19:35 - 2018-02-01 08:13 - 000099672 _____ () C:\Program Files (x86)\Google\Chrome\Application\64.0.3282.140\libegl.dll
2017-06-07 00:21 - 2015-06-22 14:06 - 000180224 _____ () D:\EWA\apps\jre\private_jre\bin\server\jvm.dll
2017-05-23 22:18 - 2017-11-29 07:09 - 000781088 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2017-05-23 22:18 - 2016-09-01 03:02 - 004969248 _____ () C:\Program Files (x86)\Steam\v8.dll
2017-05-23 22:18 - 2016-09-01 03:02 - 001563936 _____ () C:\Program Files (x86)\Steam\icui18n.dll
2017-05-23 22:18 - 2016-09-01 03:02 - 001195296 _____ () C:\Program Files (x86)\Steam\icuuc.dll
2017-05-23 22:18 - 2017-12-15 21:59 - 002558752 _____ () C:\Program Files (x86)\Steam\video.dll
2017-12-15 21:14 - 2017-11-04 03:54 - 005137696 _____ () C:\Program Files (x86)\Steam\libavcodec-57.dll
2017-12-15 21:14 - 2017-11-04 03:54 - 000847136 _____ () C:\Program Files (x86)\Steam\libavutil-55.dll
2017-12-15 21:14 - 2017-11-04 03:54 - 000695584 _____ () C:\Program Files (x86)\Steam\libavformat-57.dll
2017-12-15 21:14 - 2017-11-04 03:54 - 000351520 _____ () C:\Program Files (x86)\Steam\libavresample-3.dll
2017-12-15 21:14 - 2017-11-04 03:54 - 000783648 _____ () C:\Program Files (x86)\Steam\libswscale-4.dll
2017-05-23 22:18 - 2017-12-15 21:59 - 000904992 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2017-05-23 22:18 - 2016-07-05 00:17 - 000266560 _____ () C:\Program Files (x86)\Steam\openvr_api.dll
2017-05-23 22:39 - 2012-06-06 09:56 - 000143360 ____N () C:\Program Files\UNi Xonar Audio\Customapp\VmixP8.dll
2017-06-05 15:13 - 2012-06-28 15:04 - 012947968 _____ () C:\Program Files (x86)\ATRis_Technik\rt\jetrt\XKRN76033.dll
2017-06-05 15:13 - 2012-06-28 15:04 - 000771584 _____ () C:\Program Files (x86)\ATRis_Technik\rt\jetrt\XSCR76033.dll
2017-06-05 15:13 - 2012-06-28 15:04 - 002003456 _____ () C:\Program Files (x86)\ATRis_Technik\rt\jetrt\XMNG76033.dll
2017-06-05 15:13 - 2012-06-28 15:04 - 001238528 _____ () C:\Program Files (x86)\ATRis_Technik\rt\jetrt\XSND76033.dll
2017-06-05 15:13 - 2012-06-28 15:04 - 000494080 _____ () C:\Program Files (x86)\ATRis_Technik\rt\jetrt\XJCE76033.dll
2017-06-05 15:13 - 2012-06-28 15:04 - 003162112 _____ () C:\Program Files (x86)\ATRis_Technik\rt\jetrt\XMIS76033.dll
2017-06-05 15:13 - 2012-06-28 15:04 - 008420352 _____ () C:\Program Files (x86)\ATRis_Technik\rt\jetrt\XXML76033.dll
2017-06-05 15:13 - 2012-06-28 15:04 - 004968960 _____ () C:\Program Files (x86)\ATRis_Technik\rt\jetrt\XXXL76033.dll
2017-06-05 15:13 - 2012-06-28 15:04 - 000610816 _____ () C:\Program Files (x86)\ATRis_Technik\rt\jetrt\XSSE76033.dll
2017-06-05 15:13 - 2012-06-28 15:04 - 001563136 _____ () C:\Program Files (x86)\ATRis_Technik\rt\jetrt\XSEC76033.dll
2017-06-05 15:13 - 2012-06-28 15:04 - 000544256 _____ () C:\Program Files (x86)\ATRis_Technik\rt\jetrt\XPKC76033.dll
2017-06-05 15:13 - 2012-06-28 15:04 - 000655360 _____ () C:\Program Files (x86)\ATRis_Technik\rt\jetrt\XSQL76033.dll
2017-06-05 15:13 - 2012-06-28 15:04 - 002305024 _____ () C:\Program Files (x86)\ATRis_Technik\rt\jetrt\XSWN76033.dll
2017-06-05 15:13 - 2012-06-28 15:04 - 012645888 _____ () C:\Program Files (x86)\ATRis_Technik\rt\jetrt\XAWT76033.dll
2017-06-05 15:13 - 2012-06-28 15:04 - 000256512 _____ () C:\Program Files (x86)\ATRis_Technik\rt\jetrt\XRMI76033.dll
2017-06-05 15:13 - 2012-06-28 15:04 - 005638144 _____ () C:\Program Files (x86)\ATRis_Technik\rt\jetrt\XCRB76033.dll
2017-06-05 15:13 - 2011-09-16 02:27 - 000020480 _____ () C:\Program Files (x86)\ATRis_Technik\rt\bin\jetvm\jvm.dll
2017-06-05 15:13 - 2011-09-16 02:27 - 000069632 _____ () C:\Program Files (x86)\ATRis_Technik\rt\bin\java.dll
2017-06-05 15:13 - 2012-06-16 02:00 - 000126976 _____ () C:\Program Files (x86)\ATRis_Technik\rt\bin\zip.dll
2017-06-05 15:13 - 2011-09-16 02:26 - 000176128 _____ () C:\Program Files (x86)\ATRis_Technik\rt\jetrt\baseline760.dll
2017-06-05 15:13 - 2012-06-28 15:04 - 003672064 _____ () C:\Program Files (x86)\ATRis_Technik\rt\jetrt\xjitb_j76033.dll
2017-06-05 15:12 - 2012-06-01 03:59 - 000168448 _____ () C:\Program Files (x86)\ATRis_Technik\pgsql\bin\LIBPQ.dll
2017-06-05 15:12 - 2012-06-01 03:59 - 000987136 _____ () C:\Program Files (x86)\ATRis_Technik\pgsql\bin\libxml2.dll
2017-06-05 15:12 - 2012-06-01 03:59 - 000066560 _____ () C:\Program Files (x86)\ATRis_Technik\pgsql\bin\zlib1.dll
2017-06-07 00:24 - 2014-07-10 15:19 - 000036864 ____N () D:\EWA\database\TransBase EWA\polycsr.dll
2017-06-07 00:24 - 2014-07-10 15:19 - 000166912 ____N () D:\EWA\database\TransBase EWA\libmcrypt.dll
2017-06-09 19:27 - 2017-09-07 04:04 - 000678400 _____ () C:\Program Files (x86)\Steam\bin\cef\cef.win7\SDL2.dll
2017-05-23 22:19 - 2017-10-31 06:44 - 071471904 _____ () C:\Program Files (x86)\Steam\bin\cef\cef.win7\libcef.dll
2017-05-23 22:18 - 2015-09-25 01:52 - 000119208 _____ () C:\Program Files (x86)\Steam\winh264.dll
2017-06-07 00:27 - 2005-03-21 15:54 - 000036864 ____N () D:\EWA\database\TransBase EPC\polycsr.dll
2017-06-07 00:27 - 2007-11-26 16:26 - 000166912 ____N () D:\EWA\database\TransBase EPC\libmcrypt.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\ProgramData\TEMP:E8956AB5 [251]
AlternateDataStreams: C:\ProgramData\TEMP:EFB09287 [111]
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2018-02-02 00:04 - 000000867 _____ C:\Windows\system32\Drivers\etc\hosts
127.0.0.1    example.net
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1435933851-4050489574-2603001200-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\work\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==

==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [{91F19D90-9D2B-4F4D-8519-2D60E9A7C98E}] => (Allow) C:\Users\work\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{912743A3-06E1-4253-AED7-11E1AEC83D4A}] => (Allow) C:\Users\work\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{DF4B3323-0E28-43D8-AE9E-693A6C05E8B1}] => (Allow) C:\Users\work\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{CCCFEFC5-A1E6-41B4-A685-BCBBC19E856F}] => (Allow) C:\Users\work\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{D8A80FA6-5CA6-42D8-874D-68BF9F301F6A}] => (Allow) C:\Users\work\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{91D38CAE-C0E2-453A-8BB1-298452C15C26}] => (Allow) C:\Users\work\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{6B6B6A2B-1D75-4BD1-9983-8DF898A28575}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{703F9451-1B6E-46DB-8E3A-BE53A572E944}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{178C01E7-A29E-4F48-A9B2-D4CF1916113C}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{91EDA267-F26A-4618-9D9D-55492E08B88A}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{8206E40B-87D6-4AEE-9A2F-3A3EBE7CC6F0}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{BB2F7EEB-496A-4BC0-BD57-31FFCDE46702}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{F014F91C-14E1-4AF1-B9FF-186147658494}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2cfg.exe
FirewallRules: [{C30803DB-6D38-4E25-955D-8F9D8F2D722B}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2cfg.exe
FirewallRules: [{A8138996-64D0-47C3-B95B-E25E78C4A3D0}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{B7013717-D71A-48E1-8CB5-FB5187B3AA92}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{7B9FA976-2323-4F62-AB2D-8D1132E9CA90}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{06A51E08-9F9E-46DF-A670-8E16C03DA8C7}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{E661F65E-F39D-4894-A0F8-61F8255922D8}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{D865D26F-BC5F-4ADA-89DF-E7044B6782BA}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{7798DEC7-5779-4B04-AC53-EB7C6EDB4245}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{48EE0577-DFEA-445D-94E1-B8CBC917A002}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{97F58CFD-60B1-4425-AE9B-FB429855FA36}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{D8FAE45A-210C-4F34-BC4F-C56C110F1CDF}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{FE98985E-BE6F-44C6-999B-B23FAEC52EDB}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{89FF513D-3E00-4895-8336-A7C75E8D1F0C}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{990CB28E-418C-4C8E-A323-571144B490B7}] => (Allow) C:\Users\work\AppData\Local\Microsoft\OneDrive\OneDrive.exe
FirewallRules: [TCP Query User{57AF6AC6-4646-4029-AEF2-E664203769E8}C:\program files (x86)\atris_technik\sed.exe] => (Allow) C:\program files (x86)\atris_technik\sed.exe
FirewallRules: [UDP Query User{AC43051C-D07F-455A-8710-E54ED6B0F1F5}C:\program files (x86)\atris_technik\sed.exe] => (Allow) C:\program files (x86)\atris_technik\sed.exe
FirewallRules: [TCP Query User{7029574B-8143-43EB-8A5E-96BF6A20CC58}C:\program files (x86)\atris_technik\sed.exe] => (Allow) C:\program files (x86)\atris_technik\sed.exe
FirewallRules: [UDP Query User{8C32D2F5-CC06-4028-8F38-EAEDCBA8C914}C:\program files (x86)\atris_technik\sed.exe] => (Allow) C:\program files (x86)\atris_technik\sed.exe
FirewallRules: [{FBC04349-1E96-455B-B901-1D2E495BBE98}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{1466C3F1-B09D-4BD6-9414-6FDA8B78F226}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{91490715-40C2-4BFA-8F50-6D4E575EEBFC}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{CF3201E0-3373-47C4-943D-2A4D2C4D001B}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{D971095A-B6F3-453D-A501-B228B097F015}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{0782CEA4-D983-4C79-8432-623BC8E18525}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{78C78A75-02A3-4FEE-9469-8899DCE0447C}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{9FD5F13A-0B6E-47E2-9C04-8BCA02BC84DD}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{61FB2108-8F1E-49E3-8A4A-9B411B559774}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{9E05D60C-CC8B-45D0-B36C-09EB8FC9C686}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{9A4D8F2F-0C84-4A37-A473-B2196315024C}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{7E2E6E79-65EB-4F51-8EA9-F008EF671B4B}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{1142A387-F35C-454E-840B-BE708E8FFCA7}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{24E9D73A-4A20-43D6-9C7E-F0CD727B05D9}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{F079F946-1D5E-49AF-99AA-246B97BF2EFB}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{0FA1B78D-457C-49C9-92B1-645C472C8CBC}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{718AFC50-3F0A-41F2-85DB-2140EA6462B0}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{BEA4AEC5-CA0A-4ADB-A52C-66722ACF6A96}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{0F00A01F-5B14-4E2D-94B0-4D7D966F2678}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{0E0583F9-AD95-4892-888B-86D24861D253}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{51F84B40-D48C-4618-9C93-1821145A2A67}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{440270BF-3CC3-4CAB-8B80-0C1DA8C436BE}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{E0A05211-53A3-44F9-A481-A8146BEF9E92}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{221AA529-F159-4A0B-A6B6-A80041191099}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{D472A7EE-16C6-453B-9C48-C016BBF5D031}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{4FD52D28-C4AD-493D-A6B8-61BCE163AD0A}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{D76A5B3A-6538-47C4-A2A2-E9FC68FBCC3A}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{BDB9AE95-3EE9-48C2-BBCA-E5D8043ED775}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{979E494B-8149-40A3-A924-C18776CC4D7D}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{7CFB2427-61F0-41FC-8A3F-B439003346F8}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{3EDFF707-CC71-4A56-BB4D-262D42572AFF}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{7D20A74C-B4F3-4E5D-B5DA-7190C88E5987}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{57447E41-A3CA-492D-B3D6-86551827A382}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{A15AE5FC-23FB-4509-9F26-32C7B059B33B}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{21EDE2C8-C5BC-4F46-B51A-F1630CFFCFBC}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{FA3C54C5-3822-4D47-9CBE-AB98C1886B4F}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{B92B9CDB-397B-44BE-A09C-83CA8179F057}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{56C21CBF-0B21-4A3B-AD40-640F8AF0BD69}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{AA336AF7-C906-4CC3-9307-28CD7AD3E07A}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{A1DA7333-C356-4C77-861F-112334989339}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [TCP Query User{F983EF84-C8DE-4E9B-B2BA-093BBFD863BE}C:\program files (x86)\sopcast\sopcast.exe] => (Allow) C:\program files (x86)\sopcast\sopcast.exe
FirewallRules: [UDP Query User{2CAF09BC-1D33-43BF-B290-598A76A2B805}C:\program files (x86)\sopcast\sopcast.exe] => (Allow) C:\program files (x86)\sopcast\sopcast.exe
FirewallRules: [{A7BF4E05-794B-46AD-AD02-89BFF1B22F31}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{7D72AC73-43B3-46D4-820F-3DC01D518A8A}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{A811B393-869F-4072-86FD-CD7831F567B8}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{0F189F9B-9138-4DDB-9B39-416AF1A144D8}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{F627D0D8-ADE8-4EA5-A0CC-3BB516B15324}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{A39AF93E-927E-4450-880D-E3ECB5D2A0F5}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{152A41C4-7AA0-4B2A-BA92-0D1EB0E71BF6}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{958BB0CB-DBA4-4EA6-976E-61A366987F99}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{B1C0F544-6AFB-4F04-8F48-8E73848F7DC1}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{15A19E62-6FCB-4C5C-A29E-3AAE12FE79DA}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{909A7BFB-F3D7-4EE1-946F-4C3330E883C9}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{84476473-12DD-4549-B32B-6D84E6B36609}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{5D131611-164A-45D6-85C4-51DC411DB2F7}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{070DD02C-37AF-4B19-A4AC-2A98CE4605CB}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{C1BC768A-D663-4F6E-9E68-B41BDE682078}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{5B174676-9FEE-45F9-911D-824C34EC037A}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{76B7FE1B-853B-4F8D-9DAD-3E643AF66C65}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{37718929-FB60-4B12-A6BF-22F0DD8C8AC3}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{8DCE092F-9AF4-4E8B-9C73-3061E7FDE9F1}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{4D52501F-93CD-4267-BBEA-E63B46BBE5E8}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{4395F473-A148-43D1-A96F-4754BD7DC180}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{58F86F36-3B9B-49DC-B0F7-BA181D7E5060}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{21C9A5C6-46E5-4C15-8494-8CD9111C12B4}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{B8F16182-555F-44D7-8BF4-FB3BFEECB89F}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{162DB37C-5D7E-4C08-9250-2202BFE5189C}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{6DB647A0-6A96-48BC-85C0-79A730B4BEDB}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{A0E9DE16-6327-474E-94CD-2CF07D20EAD6}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{03C976CB-C9A0-4F59-B8AE-53B1D27A6609}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{462DB657-0D2D-43B2-BCEE-F3D21BFEDC68}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{8FAE07E1-AC00-46C6-BDDB-41382BA7E6EF}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{1E1A713A-D6A8-4D80-B2A2-643F44C7C314}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{9AEEDDB6-813E-4FF3-89E7-098B14AA90E2}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{33092A9F-FE8C-4775-A61D-925DA931E940}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{2DDB233E-174C-4342-BFA8-BF0616D262C3}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{A05E97EF-B8D3-4697-9976-F0B6717284BA}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{5CF56629-57AF-4974-99DB-4DE3CADE2734}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{249CE986-833A-4931-8934-D95829D4BD93}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{B277CCD1-84C4-4308-8AEB-9D2C9C13672C}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{02BC985A-31FD-4831-8923-9D6FC46FA5DB}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{4B181EDF-9D29-4092-9D70-3FCC06AD4719}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{F069C2A2-D689-4302-ACA4-D2A1D9388D0C}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{B803C3DF-37D6-48F3-A246-82D0A15F680B}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{1DB8EF1A-DF8E-4A26-801F-BD99E8B57FBC}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{46DF989A-B747-47A6-A140-D5B7240BA536}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{D97B156E-502F-4C57-81FC-0156F4C000B3}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{8E047696-0164-4D1C-8062-D6866929A37A}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{DFDEC000-3F2B-48E8-BA65-C3AAF812F756}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{160BCA29-B4A3-4370-8749-4B026B81883F}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{622F7103-0876-4D8A-BC59-9D6812B6AA70}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{532EDB28-5355-4C16-BECD-2618F143A3F8}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{3D66C764-2241-49DB-921E-0DEF796A6681}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{F41211B6-8465-40B5-863A-51E4F35E6090}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{684C26E4-D3B0-4A75-B6BD-46C68D71D3B0}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{41CE81AC-CDF0-4FAA-A130-C7BC53407BA3}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{6A5832D8-D865-4145-B400-95FA7A37FA8B}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{29BDA03E-D838-4383-9DD9-B75B795261E5}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{07ED7295-E722-4A13-9287-EEF6E6AD3D4B}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{C7C986FB-133A-487A-8C41-648E9022C6C7}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{0B72392E-64A0-47B9-A7F1-D05A39214D86}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{A263E04A-45C6-4D62-906F-BD71FD97561A}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{FFBF79A9-8D76-4750-89D8-948845A4D0AB}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{6772A380-4FFD-42EB-993C-4DBA2BD93C40}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{E5798709-6315-4B4F-9D95-BC102D7D0144}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{6C517710-91B9-4E12-B32E-A9DFA3EFD7DD}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{C7A08E3B-82CF-428E-AA45-324B670D7C64}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{DB2B936F-844B-4622-A5C1-98097B1AA1CD}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{ACD4A193-40B7-4AC0-8E17-A89B01C01E83}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{769D904C-785D-455E-A536-95B25BC95B55}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{3A698654-90FE-44C8-B595-9C9DAD681582}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{2049B401-2D63-4A79-88AC-2BA757A78AB6}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{4CA03447-8620-437D-A8FE-FEC721EACA99}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{729A7F4B-7E0D-4103-962C-65ED36ECDBE2}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{0AD84768-49A1-437F-B16F-D8DCE72AB416}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{2865F116-C49F-43FF-B039-AB2F8EA11748}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{E6C8CE24-AD9F-42E6-9A06-2CA93DC2A09F}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{FFDB5797-F6B5-41E7-9854-11794DA0832D}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{17D52C67-BA7A-4C37-BF36-2E5AE0D2FCE6}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{A6E3D59A-3227-4AB8-BA5C-3E72610B1691}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{083A9345-E8CA-418B-ABA1-3A1079AB63A9}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [TCP Query User{07FAE579-744C-4294-AA9C-78884D6E7D4B}C:\users\work\appdata\local\ie tab\10.7.31.1\ietabhelper.exe] => (Allow) C:\users\work\appdata\local\ie tab\10.7.31.1\ietabhelper.exe
FirewallRules: [UDP Query User{6308BDF5-14AC-4993-93DB-7605EFB63A1F}C:\users\work\appdata\local\ie tab\10.7.31.1\ietabhelper.exe] => (Allow) C:\users\work\appdata\local\ie tab\10.7.31.1\ietabhelper.exe
FirewallRules: [{05337BA4-8CA9-41D5-BBC6-2467C763CEE1}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{66C05925-172D-4FB5-8E08-822C14A1DD6E}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{65226C53-AD27-40E3-B6A7-CB2F84F4851F}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{14349170-563F-47F2-B4C5-676924A8FC84}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{9807FD47-910C-42A4-B50D-FF1D6BF373BC}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{5072DD33-0631-475B-92FE-EC767ECEC2AB}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{C6BA51FC-53CF-4BE5-87CA-9D9E28BF705C}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{867BA08A-5E0C-4208-9C9D-C0D3C547DC44}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{4BE2FC5F-144E-438E-BCE4-EAEC2097E799}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{3D981331-11C0-4C24-98D5-913066895F05}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{FF1EAC6E-E285-47C8-B868-94BA97D828C0}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{917E09A0-A412-40F6-A9AA-6501DA069D8B}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{82A31595-C1B7-4B8D-9A56-BB1617DA0787}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{86E2526D-9840-4DD1-A619-5E22F306D260}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{ED6E084E-D029-4CF5-83CB-F4F581443E20}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{9106E2A6-E99E-49DC-9CEC-3BFCD824CAC3}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{2EA9D884-6591-4AE0-A042-FCFFFB13CA1D}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{57B71F56-4CB8-47B6-8E89-DD348EB50522}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{D69CC2AD-AEFC-471D-9D12-90361F3040BC}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{2386284F-422C-44DC-8C9C-C0D959228C3D}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{75F877FE-F3FC-4833-A6D2-B001B3672F90}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{8AE7BF46-8C40-40C9-8824-6EF2145AB96B}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{2D95DB41-77E0-4B3D-950B-4AAF3121332A}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{DDE79C07-4720-4140-9A4B-9005F99B3ED1}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{B05A9792-C6E9-42C3-9A02-1334CF762D8D}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{CB54091D-8671-4EF3-977A-09B8A41DAB0A}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{654A8A0E-F12C-4E5C-BFBB-FA296417B296}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{5CE29840-17AF-4B26-8011-49215D56C5B6}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [TCP Query User{8C64951F-0F69-4536-B41A-AD280568C8E0}C:\users\work\appdata\local\ie tab\10.9.8.1\ietabhelper.exe] => (Allow) C:\users\work\appdata\local\ie tab\10.9.8.1\ietabhelper.exe
FirewallRules: [UDP Query User{9891016B-7EB0-4988-9F18-46AC5043EB86}C:\users\work\appdata\local\ie tab\10.9.8.1\ietabhelper.exe] => (Allow) C:\users\work\appdata\local\ie tab\10.9.8.1\ietabhelper.exe
FirewallRules: [{EAD0FDE9-18A4-422F-A471-B6DF8B39C2D5}] => (Allow) C:\Windows\system32\rundll32.exe
FirewallRules: [{5D066318-4EF4-4964-9F91-5ED2C0BF11DD}] => (Allow) C:\Windows\system32\rundll32.exe
FirewallRules: [TCP Query User{28A9F31F-81FC-4B30-9AE0-FB84DE6C2F6D}C:\windows\syswow64\rundll32.exe] => (Allow) C:\windows\syswow64\rundll32.exe
FirewallRules: [UDP Query User{FB21F122-23B9-4E48-B40E-7C84A5953CD2}C:\windows\syswow64\rundll32.exe] => (Allow) C:\windows\syswow64\rundll32.exe
FirewallRules: [{CC2D6263-5B84-4C39-BDC0-9754AEF78989}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{A9730BA2-4A4B-4DC2-908C-93E4C4F60CB8}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{1B934CCF-EACD-4201-A7F1-BAFFD118AA5C}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{9BBD31F5-B686-46E3-BF75-1E940A1079A2}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{C956CB81-B152-4904-BDD6-6C41A45EBE75}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{C0551322-6BB9-48D7-BC5A-24889A9DC6FA}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{47B373E7-95A9-40D9-9871-6406FAA3A1D0}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{98091723-C502-4D27-9987-19777002D646}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{AFC1D66E-25AC-406A-A6DA-97BAED2E20B2}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{876362A8-7E8E-4A8E-AA90-70748EE1854C}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{C38DD3D7-5AB8-47E1-91FE-A46943F7ACAE}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{5BD2E162-06F6-4F32-982D-621D97028988}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{8B8095B4-E365-49A7-800E-373B693A00F3}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{66DD4972-1968-4900-A71B-EB9FAA5E1127}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{577D57A7-E11A-4FA7-9719-D9B38B4773A1}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{1DF4408B-ED06-430D-B83E-E833C04FBC13}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{918B2ED3-B606-4BDF-B572-102DB27AE252}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{F11193B7-0E3E-4D1D-93E4-45FEC5A98CC2}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{00CC1472-5C71-459A-86CC-659994182017}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{8601E830-4F5E-4050-8673-9D121A917862}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{79F03944-6333-466D-8FD6-F917AA5A64B7}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{C4525459-1D01-4C67-A900-475EB1579262}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{CE35FD8A-EAE8-4BFB-9EFE-4FDF00F1F1BC}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{95B3BD2D-A1D5-43B9-8E51-299CEE3BCAEB}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{DD0E50E0-91AA-4CF8-ABAB-9DC244DC9EF9}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{123D6EFD-F550-424E-BA74-1393329815FC}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{E2FCAF14-8F79-4A7E-AE81-59EB724E9962}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{E6875168-4A2E-41DC-8E86-C0F8A29F5FAB}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{1D1C4AD9-ACC4-45D5-AC25-83BE3D520F66}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{6895B6BE-30F2-4300-95CB-821497160FB5}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{5A3D2655-DC83-44B4-8967-E03722662A53}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{5CCDDF6E-EFF3-4BD7-9C00-27316A4B8CFC}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{614B8F6E-119A-41DB-A5F3-6FCE17BB8AD9}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{1642CFE8-6D16-4481-BBA4-7B642F72087B}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{3E4A1188-F76A-48F9-AD11-6783876E5D14}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{A042CF38-1345-40F0-8546-65FE9F61B858}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{2FAADDFC-ECD0-4884-926A-FC21F7C453C7}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{F669019B-4C18-4427-ABDF-F5A293813CC8}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{DEE71F55-732F-4E2C-AABE-6C33DA71F4D9}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{3B3C76AE-D602-40B4-8B83-9D6C066379BC}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{0B3D17D9-2C72-4F21-8B98-78789C975B30}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{0851E072-413F-4045-B2D9-1134D1A09641}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{A6B9838B-1C2B-47BE-8F99-4E84B8A1DE40}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{E3ADC3B9-EA50-48C1-BFF5-7C9025D9F5A4}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{37E9C1A7-3BDD-4F3F-89BC-D529F3449D6E}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{A53917C6-D956-4343-B9D3-939D5E66BBAB}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{4EB192B6-28B4-4981-8420-C5C101948994}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{62AFB08E-8D73-4C4F-956F-85C761D785DC}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [TCP Query User{EED6AA52-6BCC-4CEF-8426-E200E77145A9}C:\windows\syswow64\rundll32.exe] => (Block) C:\windows\syswow64\rundll32.exe
FirewallRules: [UDP Query User{0498A303-C253-4ACD-95D9-0AC9E5230A7D}C:\windows\syswow64\rundll32.exe] => (Block) C:\windows\syswow64\rundll32.exe
FirewallRules: [{7A501DC7-04A3-414C-A738-8C90668AE59A}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{EAEDB414-CC05-419A-87AB-03E55AB78873}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{F663BC76-C57B-4464-9BD2-8919193EEB31}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{CBAE3EC8-FE81-4C49-B479-6D60CC26C318}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{40E7DE28-D16A-4C2D-994F-FD2DF755074C}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{0BD6F40C-53C7-4EA2-A2D6-9B29FB45E1AA}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{4E7128C1-F98B-4946-971D-27C022316242}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{84BC2299-E667-46C6-8D5A-134AF8D66B71}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{874BDABA-EB9C-4D97-80DB-EADE4246E536}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{9F4280EB-A923-4364-A10C-4ACD3E406DB6}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{0F5A22ED-DE30-4DA1-A226-F0B7C48022C8}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{E4A448F0-FE28-4A37-8CF1-0F0C38CFB734}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{D6835230-1C8B-475A-8E8E-4B60FD0505FC}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{53DDFE47-B54F-4F6D-A2FD-1A97E5B0F631}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{A7946113-55B0-46FF-84FA-BC416F28B1E8}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{4AEDA565-58EE-46C8-BB35-46935B62CDB6}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{3BC30C0E-DB6F-4F10-B890-5C1639E045D0}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{41ECC419-78AF-4A02-9967-497C484D4683}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{E74886E1-1E58-4358-BB99-5A6332FBA08D}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{4E4071D3-693C-4FB6-BAF4-82C07A17C180}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{FC77A2F1-9A9A-406B-99FF-D28523C04AB1}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{A346E48A-6B99-4413-9218-F65FCE2D75C0}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{06E97690-AB62-4C42-87BA-0CC6EF57BE4F}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{402D000D-2493-42F0-AA66-9D3D5F1E898A}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{0B4D831F-9D29-4369-8ABB-425F497B8FDA}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{B66EC29A-9BC5-4A90-ACAD-AD1D6D62E5AB}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{2993990A-A710-43FC-8C70-5E9A63E3C98E}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{079ABA17-4307-4D20-B79C-3CAF67A4113F}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{B643A312-2151-4C2B-A5DD-F6EFAFC9FDAF}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{9F0E4049-7A48-4538-B592-13739CDEC22E}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{1A523D99-1ECA-45F1-9BA9-F16B5BC155DC}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{9E930B22-AF14-488B-9898-BC11DBECAD7C}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{013FBB5A-0483-4F6C-BC75-60B4DCA7C45E}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{D79FF4B4-810B-4A39-911B-661CFDECF899}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{5612467E-4403-4951-B157-6AE86161F4C8}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{F137B9B9-16FF-4744-B753-B3CFA84F2293}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{C38053AD-3A20-4F7B-81E1-D8CC58CD45FD}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{C43375E6-FABB-424E-8C92-8E1C839423CA}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{7DA18545-B2AF-405D-9FF5-014797512B55}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{9FD37FD8-90E6-477B-88D0-1ED2D50EAB32}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{894D0AD2-6862-47B3-B394-F2FD21F80BF9}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{6F87C494-F9B7-409C-A584-DC44C92B24C9}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{B9808ACC-F435-4472-BD52-E571FB5EC79B}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{59CE865E-7123-47AB-B5EF-22AD779C1042}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{1CD09FD3-A6F8-4FCF-A625-0A1D0C6588F8}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{EB4E80EB-BC12-4509-95F9-CB51EC5D17E2}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{1DE644C1-7A29-4240-9988-26FCF349989A}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{AAD1E46A-F67C-4516-9311-B1C78573DD88}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{8B9F3375-836C-4EC0-9FBC-44F4445ED1C4}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{BB041D24-BD9D-422A-86F7-D2BA39B8795C}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{6BD9823F-6A5C-4133-9B6C-AA6E099E58D0}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{481D93E2-FC38-4020-902A-ABEC55C39770}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{339ECD77-09C2-4082-A147-B16AE8CCD9FE}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{1ED98576-71A6-4620-89E4-5CFCE07C0FE5}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{20A3A59E-474F-4868-B007-C35475AEC4E1}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{782F14FA-FF01-42AC-BA1F-E2D61018DD1E}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{B6257C22-8AC4-42E8-92DA-2E6895118E26}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{A2814F01-9570-48DC-9663-5189E81488DA}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{44EFE340-CC04-41E1-B7E5-22408295FB2A}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{843CAD65-8EC2-495E-96AA-5E8A05FD9ACE}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{90991ECD-6070-414A-83BB-D218E7499611}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{C2A80D92-62E0-4F6D-853D-8830E1F9099D}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{61ABEA83-8892-4704-99E9-131CDA5616CC}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{A960EE9E-054F-4EE1-A184-D1FA47E8D614}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{F35DBC34-43B0-4A06-9B0E-01AA550316E5}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{A81F5555-AB23-4CEB-8B6D-B50DC8218BBB}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{B4C44063-C7A7-4BA9-883C-3D9C99C7CA04}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{97770211-A75D-4712-990F-C8A9BBDDA11B}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{FD38D008-0F75-4787-809A-3D9F11518CA9}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{29B0CF5A-8A30-4A42-9BE4-063130FE03F9}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{4284867F-64EB-408B-B00F-52F7839CA03E}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{2E9F58FD-D195-4251-A1B4-404EE05DBF69}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{22228A46-7031-4549-99AB-B1D92DEBBA05}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{778989C3-915B-46C0-BDF2-F48D1420A9EA}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{4FC8CB71-2E65-44E1-B763-AD45060EED16}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{EC57D8A3-1608-4C42-9B2D-3D5AD861C96B}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{B61C5FE6-21DB-4659-99F9-ADEE16D4D1E8}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{430B947B-83DB-4280-A862-5930107A9E5E}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{ADB0FE81-8913-460D-9AB1-E29BC1BAC349}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{FCEC9310-C347-48AB-B378-990F47E0E88A}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{DEE0C42D-5DD4-4AB4-BE27-D22B396D07BA}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{165783C2-CBB2-4F4E-B9DC-0CD2597448F4}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{3CE9B239-66F0-410F-A8B4-1320ED144994}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{EC85ED4C-86D6-49EF-BB83-1E9F4C14BB9A}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{00FAC695-2E34-4692-9EAE-464BEC11021B}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\outlook.exe
FirewallRules: [{00156511-9ED9-47D0-9AD8-CA658A5AC6C9}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{D91C5912-7985-4F62-9846-27EBD670E5AD}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{08DAC82A-308F-4DE5-B2D7-65625401D45E}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{EE773D08-225F-4000-AC2B-5B84C72D07FE}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{9A907339-79CE-41CC-8B63-0EB19938FE85}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{6761755A-A0DF-4516-A25D-29FB53A754F3}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{46E47E94-6737-4946-AC2B-A52353DFF8AB}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{590B650D-5F8F-467A-ACD4-243C15637528}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{23FEF9C1-5131-4D80-968F-08D702DBD080}] => (Allow) D:\dota\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
StandardProfile\AuthorizedApplications: [C:\Windows\system32\rundll32.exe] => Enabled:rundll32
==================== Restore Points =========================

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================
Application errors:
==================
Error: (02/04/2018 12:01:36 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Error: (02/03/2018 06:49:14 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Error: (02/02/2018 07:55:22 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "c:\program files (x86)\atris_technik\Updater\RunAsAdmin3.exe".
Dependent Assembly Microsoft.VC90.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8" could not be found.
Please use sxstrace.exe for detailed diagnosis.
Error: (02/02/2018 07:24:55 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Error: (02/02/2018 12:23:43 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Error: (02/02/2018 12:23:13 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: mbamservice.exe, version: 3.1.0.595, time stamp: 0x59f745cb
Faulting module name: mbamservice.exe, version: 3.1.0.595, time stamp: 0x59f745cb
Exception code: 0xc0000005
Fault offset: 0x00000000001c6e66
Faulting process id: 0xcd0
Faulting application start time: 0x01d39bab3ae21cf8
Faulting application path: C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
Faulting module path: C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
Report Id: 7d1fcdf7-079e-11e8-9bbb-001966e78996
Error: (02/02/2018 12:11:23 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Error: (02/02/2018 12:04:07 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: Explorer.EXE, version: 6.1.7601.17514, time stamp: 0x4ce7a144
Faulting module name: mbshlext.dll_unloaded, version: 0.0.0.0, time stamp: 0x58891aa6
Exception code: 0xc0000005
Fault offset: 0x000007fee91ef86e
Faulting process id: 0x624
Faulting application start time: 0x01d39b99854122d6
Faulting application path: C:\Windows\Explorer.EXE
Faulting module path: mbshlext.dll
Report Id: d20f9270-079b-11e8-8444-001966e78996
Error: (02/01/2018 10:30:31 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Error: (02/01/2018 10:17:56 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

System errors:
=============
Error: (02/04/2018 03:34:08 PM) (Source: volsnap) (EventID: 36) (User: )
Description: The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.
Error: (02/04/2018 12:00:33 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Wondershare Driver Install Service service failed to start due to the following error:
The system cannot find the file specified.
Error: (02/04/2018 11:59:43 AM) (Source: Microsoft-Windows-Kernel-Processor-Power) (EventID: 6) (User: NT AUTHORITY)
Description: Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware.
Error: (02/04/2018 02:32:30 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (60000 milliseconds) was reached while waiting for a transaction response from the lmhosts service.
Error: (02/03/2018 06:48:25 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Wondershare Driver Install Service service failed to start due to the following error:
The system cannot find the file specified.
Error: (02/03/2018 06:47:21 PM) (Source: Microsoft-Windows-Kernel-Processor-Power) (EventID: 6) (User: NT AUTHORITY)
Description: Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware.
Error: (02/02/2018 07:24:18 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Wondershare Driver Install Service service failed to start due to the following error:
The system cannot find the file specified.
Error: (02/02/2018 07:23:01 PM) (Source: Microsoft-Windows-Kernel-Processor-Power) (EventID: 6) (User: NT AUTHORITY)
Description: Some processor performance power management features have been disabled due to a known firmware problem. Check with the computer manufacturer for updated firmware.
Error: (02/02/2018 01:07:06 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The EWA net Server service terminated unexpectedly.  It has done this 1 time(s).
Error: (02/02/2018 12:23:42 AM) (Source: WMPNetworkSvc) (EventID: 14332) (User: )
Description: Service 'WMPNetworkSvc' did not start correctly because CoCreateInstance(CLSID_UPnPDeviceFinder) encountered error '0x80070420'. Verify that the UPnPHost service is running and that the UPnPHost component of Windows is installed properly.

==================== Memory info ===========================
Processor: Intel® Core™2 Duo CPU E8400 @ 3.00GHz
Percentage of memory in use: 74%
Total physical RAM: 4095.27 MB
Available physical RAM: 1059.36 MB
Total Virtual: 8188.75 MB
Available Virtual: 4749.5 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:149.32 GB) (Free:12.51 GB) NTFS
Drive d: () (Fixed) (Total:782.1 GB) (Free:495.32 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: A0548A5D)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=149.3 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=782.1 GB) - (Type=07 NTFS)
==================== End of Addition.txt ============================

Malwarebytes
www.malwarebytes.com
-Log Details-
Scan Date: 2/4/18
Scan Time: 2:48 AM
Log File: 11cd476b-0945-11e8-910f-001966e78996.json
Administrator: Yes
-Software Information-
Version: 3.3.1.2183
Components Version: 1.0.262
Update Package Version: 1.0.3861
License: Trial
-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: System
-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 240482
Threats Detected: 8
Threats Quarantined: 8
Time Elapsed: 4 min, 28 sec
-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect
-Scan Details-
Process: 0
(No malicious items detected)
Module: 0
(No malicious items detected)
Registry Key: 2
PUP.Optional.WinMendRegistryCleaner, HKU\S-1-5-21-1435933851-4050489574-2603001200-1000\SOFTWARE\SunnyDigits, Quarantined, [1578], [483624],1.0.3861
PUP.Optional.WinMendRegistryCleaner, HKLM\SOFTWARE\WOW6432NODE\SunnyDigits, Quarantined, [1578], [483620],1.0.3861
Registry Value: 4
PUP.Optional.WinMendRegistryCleaner, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\COMPATIBILITYADAPTER\SIGNATURES|WINMENDUPDATETASK_WORK.JOB, Quarantined, [1578], [484526],1.0.3861
PUP.Optional.WinMendRegistryCleaner, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\COMPATIBILITYADAPTER\SIGNATURES|WINMENDUPDATETASK_WORK.JOB.FP, Quarantined, [1578], [484526],1.0.3861
PUP.Optional.WinMendRegistryCleaner, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\COMPATIBILITYADAPTER\SIGNATURES|WINMENDAUTOSHUTDOWNWORK.JOB, Quarantined, [1578], [484526],1.0.3861
PUP.Optional.WinMendRegistryCleaner, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\COMPATIBILITYADAPTER\SIGNATURES|WINMENDAUTOSHUTDOWNWORK.JOB.FP, Quarantined, [1578], [484526],1.0.3861
Registry Data: 0
(No malicious items detected)
Data Stream: 0
(No malicious items detected)
Folder: 1
Trojan.StolenData, C:\USERS\WORK\APPDATA\ROAMING\IMMINENT\LOGS, Quarantined, [1023], [250104],1.0.3861
File: 1
Trojan.StolenData, C:\USERS\WORK\APPDATA\ROAMING\IMMINENT\LOGS\02-02-2018, Quarantined, [1023], [250104],1.0.3861
Physical Sector: 0
(No malicious items detected)

(end)