Hallo,
ich habe gerade mehrere Dateien bei mir im Ordner C: entdeckt (Siehe Bild, alle Dateien und .exe unter halb des Ordners Windows). Das komische ist das diese Dateien fast alle im Jahr 2007 erstellt wurden mein Laptop vor ein paar Monaten neu aufgesetzt wurde. Ich habe schon einwenig gegooglet und die meisten Dateien scheinen von Visual C++ zustammen, jedoch weis ich nicht woher die Dateien und .exe stammen.

Mein Rechner:

Lenovo U410
Windows 7
64 Bit
Kaspersky Internet Security

defogger_disable.log

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 12:53 on 17/08/2014 (User)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

FRST.txt

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-08-2014 04
Ran by User (administrator) on USER-PC on 17-08-2014 12:55:51
Running from C:\Users\User\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Windows\SysWOW64\irstrtsv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Lenovo Smart Update\LenovoSmartConnectService.exe
(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(Synaptics) C:\Program Files\Synaptics\SynTP\SynLenovoGestureMgr.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(hxxp://tortoisesvn.net) C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
(Vimicro) C:\Program Files (x86)\USB Camera2\VM332_STI.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe
() C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe
(Lenovo) C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe
(LENOVO) C:\Program Files (x86)\Lenovo\Lenovo CAPOSD\CAPOSD.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe
(Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
() C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
(Microsoft Corporation) C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
(Dropbox, Inc.) C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe
(CyberLink) C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
() C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [AtherosBtStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [792224 2011-12-13] (Atheros Communications)
HKLM\...\Run: [AthBtTray] => C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [657568 2011-12-13] (Atheros Commnucations)
HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [378968 2012-01-05] (Alcor Micro Corp.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2847016 2011-11-10] (Synaptics Incorporated)
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [883840 2012-03-29] (Conexant Systems, Inc.)
HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()
HKLM\...\Run: [SynLenovoGestureMgr] => C:\Program Files\Synaptics\SynTP\SynLenovoGestureMgr.exe [408872 2011-11-10] (Synaptics)
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [8079408 2014-04-29] (Lenovo (Beijing) Limited)
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [6200368 2014-04-29] (Lenovo(beijing) Limited)
HKLM-x32\...\Run: [332BigDog] => C:\Program Files (x86)\USB Camera2\VM332_STI.EXE [548864 2011-12-09] (Vimicro)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-27] (Intel Corporation)
HKLM-x32\...\Run: [Dolby Home Theater v4] => C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe [506712 2011-06-01] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [Smart Update] => C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe [3244080 2012-04-06] (Lenovo)
HKLM-x32\...\Run: [Intelligent Touchpad] => C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe [291272 2011-12-08] ()
HKLM-x32\...\Run: [VeriFaceManager] => C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe [329056 2014-04-29] (Lenovo)
HKLM-x32\...\Run: [CAPOSD] => C:\Program Files (x86)\Lenovo\Lenovo CAPOSD\CAPOSD.exe [1876992 2012-02-17] (LENOVO)
HKLM-x32\...\Run: [KeePass 2 PreLoad] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [2117632 2014-07-06] (Dominik Reichl)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
Winlogon\Notify\igfxcui: igfxdev.dll [X]
HKU\S-1-5-21-3577023336-649988219-1192559642-1001\...\Run: [SkyDrive] => C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe [251040 2014-08-08] (Microsoft Corporation)
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [184048 2013-12-26] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [156256 2013-12-26] (NVIDIA Corporation)
Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Kaspersky Internet Security.lnk
ShortcutTarget: Kaspersky Internet Security.lnk -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe (Kaspersky Lab ZAO)
ShellIconOverlayIdentifiers: 1TortoiseNormal -> {C5994560-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers: 2TortoiseModified -> {C5994561-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers: 3TortoiseConflict -> {C5994562-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers: 4TortoiseLocked -> {C5994563-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers: 5TortoiseReadOnly -> {C5994564-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers: 6TortoiseDeleted -> {C5994565-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers: 7TortoiseAdded -> {C5994566-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers: 8TortoiseIgnored -> {C5994567-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers: 9TortoiseUnversioned -> {C5994568-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: VeriFace Enc -> {771C7324-DA80-49D3-8017-753B0AF60951} => C:\Windows\system32\IcnOvrly.dll ()
ShellIconOverlayIdentifiers-x32: 1TortoiseNormal -> {C5994560-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers-x32: 2TortoiseModified -> {C5994561-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers-x32: 3TortoiseConflict -> {C5994562-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers-x32: 4TortoiseLocked -> {C5994563-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers-x32: 5TortoiseReadOnly -> {C5994564-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers-x32: 6TortoiseDeleted -> {C5994565-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers-x32: 7TortoiseAdded -> {C5994566-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers-x32: 8TortoiseIgnored -> {C5994567-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers-x32: 9TortoiseUnversioned -> {C5994568-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (hxxp://tortoisesvn.net)
ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=LENN&bmod=LENN
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
URLSearchHook: HKCU - (No Name) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - No File
SearchScopes: HKLM - DefaultScope {16B26D30-2FA7-49A8-9AAD-93A94B928D29} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKLM - {16B26D30-2FA7-49A8-9AAD-93A94B928D29} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKCU - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7LENN
SearchScopes: HKCU - {16B26D30-2FA7-49A8-9AAD-93A94B928D29} URL = 
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7LENN
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: No Name -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} ->  No File
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: No Name -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} ->  No File
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} -  No File
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} -  No File
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} -  No File
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} -  No File
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} -  No File
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} -  No File
Tcpip\Parameters: [DhcpNameServer] 10.0.1.1

FireFox:
========
FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\umu2ci6e.default
FF SearchEngineOrder.1: SuchMaschine
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_125.dll ()
FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL No File
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_125.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/MSC,version=10 -> c:\progra~2\mcafee\msc\npmcsn~1.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\umu2ci6e.default\searchplugins\search_engine.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Ghostery - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\umu2ci6e.default\Extensions\firefox@ghostery.com.xpi [2014-06-12]
FF Extension: NoScript - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\umu2ci6e.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-06-12]
FF Extension: Adblock Plus - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\umu2ci6e.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-07-13]
FF HKLM-x32\...\Firefox\Extensions:  - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: 卡巴斯基網址顧問 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com [2014-06-11]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: 虛擬鍵盤 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-06-11]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: 惡意網站攔截器 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com [2014-06-11]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Chặn quảng cáo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com [2014-06-11]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com [2014-06-11]

Chrome: 
=======
CHR HomePage: hxxp://www.google.com/ig/redirectdomain?brand=LENN&bmod=LENN
CHR StartupUrls: "hxxp://www.google.com/"
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.143\gcswf32.dll No File
CHR Plugin: (Chrome NaCl) - C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.143\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.143\pdf.dll ()
CHR Plugin: (McAfee SiteAdvisor) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.31.137.7_0\McChPlg.dll No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.57\npGoogleUpdate3.dll No File
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
CHR Plugin: (McAfee SecurityCenter) - c:\progra~2\mcafee\msc\npmcsn~1.dll No File
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Extension: (Adblock Plus) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-06-15]
CHR Extension: (Modul zur Link-Untersuchung) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj [2014-06-11]
CHR Extension: (HTTPS Everywhere) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\gcbommkclmclpchllfjekcdonpmejbdp [2014-06-12]
CHR Extension: (Sicherer Zahlungsverkehr) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh [2014-06-11]
CHR Extension: (Modul zum Sperren von gefährlichen Webseiten) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\hghkgaeecgjhjkannahfamoehjmkjail [2014-06-11]
CHR Extension: (Virtual Keyboard) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh [2014-06-11]
CHR Extension: (Ghostery) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlomiejdfkolichcflejclcbmpeaniij [2014-06-12]
CHR Extension: (Google Wallet) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-06-11]
CHR Extension: (Anti-Banner) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman [2014-06-11]
CHR HKLM-x32\...\Chrome\Extension: [blbkdnmdcafmfhinpmnlhhddbepgkeaa] - https://chrome.google.com/webstore/detail/blbkdnmdcafmfhinpmnlhhddbepgkeaa [2014-06-11]
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\urladvisor.crx [2014-05-28]
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2014-05-28]
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\online_banking_chrome.crx [2014-05-28]
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\content_blocker_chrome.crx [2014-05-28]
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx [2014-05-28]
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\ab.crx [2014-05-28]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [106144 2011-12-13] (Atheros Commnucations) [File not signed]
R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2014-05-28] (Kaspersky Lab ZAO)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [314696 2014-05-21] (Intel Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [127320 2012-04-16] ()
R2 irstrtsv; C:\Windows\SysWOW64\irstrtsv.exe [193536 2012-02-06] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [164184 2012-04-16] (Intel Corporation)
R2 LenovoSmartConnectService; C:\Program Files (x86)\Lenovo\Lenovo Smart Update\LenovoSmartConnectService.exe [66608 2012-02-20] (Lenovo)
S2 NSDSvc; C:\Windows\System32\NSDSvc.exe [120160 2011-12-23] (Lenovo)
R2 ZAtheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [158880 2011-12-13] (Atheros) [File not signed]
S3 McAWFwk; c:\PROGRA~1\mcafee\msc\mcawfwk.exe [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 irstrtdv; C:\Windows\System32\DRIVERS\irstrtdv.sys [26504 2012-02-07] (Intel Corporation)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2014-05-28] (Kaspersky Lab ZAO)
S4 klflt; C:\Windows\System32\DRIVERS\klflt.sys [115296 2014-05-28] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [625248 2014-05-28] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2014-05-28] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2014-05-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2014-05-28] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2013-05-14] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178272 2014-05-28] (Kaspersky Lab ZAO)
R3 LAD; C:\Windows\System32\DRIVERS\LAD.sys [8192 2012-01-13] (TODO: <Company name>)
R0 NSD; C:\Windows\System32\drivers\nsd.sys [24160 2011-12-23] (Lenovo Corporation")
R1 Nsdfltr; C:\Windows\System32\drivers\Nsdfltr.sys [59488 2011-12-21] (Lenovo Corporation)
U3 BcmSqlStartupSvc; 
U2 CLKMSVC10_3A60B698; 
U2 CLKMSVC10_C3B3B687; 
U2 DriverService; 
U2 iATAgentService; 
U2 idealife Update Service; 
U3 IGRS; 
U2 IviRegMgr; 
U2 Oasis2Service; 
U2 PCCarerService; 
U2 ReadyComm.DirectRouter; 
U2 RichVideo; 
U2 RtLedService; 
U2 SeaPort; 
U2 SoftwareService; 
U3 SQLWriter; 
U2 wlidsvc; 

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-17 12:55 - 2014-08-17 12:56 - 00029979 _____ () C:\Users\User\Desktop\FRST.txt
2014-08-17 12:55 - 2014-08-17 12:55 - 00000000 ____D () C:\FRST
2014-08-17 12:53 - 2014-08-17 12:53 - 00000470 _____ () C:\Users\User\Desktop\defogger_disable.log
2014-08-17 12:53 - 2014-08-17 12:53 - 00000000 _____ () C:\Users\User\defogger_reenable
2014-08-17 12:51 - 2014-08-17 12:51 - 02101760 _____ (Farbar) C:\Users\User\Desktop\FRST64.exe
2014-08-17 12:51 - 2014-08-17 12:51 - 00380416 _____ () C:\Users\User\Desktop\Gmer-19357.exe
2014-08-17 12:50 - 2014-08-17 12:51 - 00050477 _____ () C:\Users\User\Desktop\Defogger.exe
2014-08-17 03:46 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-17 03:46 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-17 03:46 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-17 03:46 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-17 03:46 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-17 03:46 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-17 03:46 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-17 03:46 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-08-16 18:20 - 2014-08-01 01:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-16 18:20 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-16 18:20 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-16 18:20 - 2014-07-25 16:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-16 18:20 - 2014-07-25 16:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-08-16 18:20 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-16 18:20 - 2014-07-25 15:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-16 18:20 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-16 18:20 - 2014-07-25 15:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-08-16 18:20 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-16 18:20 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-08-16 18:20 - 2014-07-25 15:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-16 18:20 - 2014-07-25 15:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-16 18:20 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-16 18:20 - 2014-07-25 15:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-16 18:20 - 2014-07-25 15:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-16 18:20 - 2014-07-25 15:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-08-16 18:20 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-08-16 18:20 - 2014-07-25 14:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-08-16 18:20 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-16 18:20 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-08-16 18:20 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-16 18:20 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-08-16 18:20 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-08-16 18:20 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-16 18:20 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-08-16 18:20 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-16 18:20 - 2014-07-25 14:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-16 18:20 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-16 18:20 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-16 18:20 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-16 18:20 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-16 18:20 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-16 18:20 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-08-16 18:20 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-08-16 18:20 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-16 18:20 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-16 18:20 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-16 18:20 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-08-16 18:20 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-16 18:20 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-16 18:20 - 2014-07-25 13:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-08-16 18:20 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-16 18:20 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-16 18:20 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-16 18:20 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-16 18:20 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-16 18:20 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-16 18:20 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-08-16 18:20 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-16 18:20 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-16 18:20 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-16 18:20 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-08-16 18:20 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-08-16 18:20 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-16 18:20 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-16 18:20 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-16 18:20 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-08-16 18:20 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-08-16 18:20 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-08-16 18:20 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-16 18:20 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-16 18:20 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-16 18:20 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-16 18:20 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-16 18:20 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-16 18:20 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-16 18:20 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-16 18:18 - 2014-08-07 04:06 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-16 18:18 - 2014-08-07 04:01 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-16 18:18 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-16 18:18 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-08-09 21:30 - 2014-08-09 21:30 - 00031936 _____ () C:\Users\User\Documents\Notenübersicht_M.Schrader_MSc.xls_0.ods
2014-08-09 10:21 - 2014-08-09 10:21 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-08-09 10:21 - 2014-08-09 10:21 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-08-09 10:21 - 2014-08-09 10:21 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-08-09 10:21 - 2014-08-09 10:21 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-08-09 10:21 - 2014-08-09 10:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-08-09 10:21 - 2014-08-09 10:21 - 00000000 ____D () C:\Program Files (x86)\Java
2014-08-08 17:26 - 2014-08-08 17:26 - 00000000 ____D () C:\Users\User\AppData\Local\Downloaded Installations
2014-08-08 17:25 - 2014-08-08 17:25 - 00000000 ____D () C:\Users\User\Documents\TomTom
2014-08-08 17:25 - 2014-08-08 17:25 - 00000000 ____D () C:\Users\User\AppData\Roaming\TomTom
2014-08-08 17:25 - 2014-08-08 17:25 - 00000000 ____D () C:\Users\User\AppData\Local\TomTom
2014-08-08 17:25 - 2014-08-08 17:25 - 00000000 ____D () C:\ProgramData\TomTom
2014-08-08 17:24 - 2014-08-08 17:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TomTom
2014-08-08 17:24 - 2014-08-08 17:27 - 00000000 ____D () C:\Program Files (x86)\TomTom HOME 2
2014-08-08 17:24 - 2014-08-08 17:24 - 00000000 ____D () C:\Program Files (x86)\TomTom International B.V
2014-08-08 17:24 - 2014-08-08 17:24 - 00000000 ____D () C:\Program Files (x86)\TomTom DesktopSuite
2014-08-02 22:32 - 2014-08-02 22:32 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-27 20:45 - 2014-07-31 17:43 - 00000000 ____D () C:\Users\User\AppData\Roaming\TortoiseSVN
2014-07-23 09:08 - 2014-08-17 10:14 - 00000000 ____D () C:\Users\User\AppData\Local\TSVNCache
2014-07-22 14:45 - 2014-07-22 14:45 - 00000000 ____D () C:\Users\User\AppData\Local\TortoiseSVN
2014-07-22 14:44 - 2014-07-22 14:44 - 00000000 ____D () C:\Users\User\AppData\Roaming\Subversion
2014-07-22 14:44 - 2014-07-22 14:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TortoiseSVN
2014-07-22 14:44 - 2014-07-22 14:44 - 00000000 ____D () C:\Program Files\TortoiseSVN
2014-07-22 14:44 - 2014-07-22 14:44 - 00000000 ____D () C:\Program Files\Common Files\TortoiseOverlays

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-17 12:56 - 2014-08-17 12:55 - 00029979 _____ () C:\Users\User\Desktop\FRST.txt
2014-08-17 12:55 - 2014-08-17 12:55 - 00000000 ____D () C:\FRST
2014-08-17 12:53 - 2014-08-17 12:53 - 00000470 _____ () C:\Users\User\Desktop\defogger_disable.log
2014-08-17 12:53 - 2014-08-17 12:53 - 00000000 _____ () C:\Users\User\defogger_reenable
2014-08-17 12:52 - 2014-06-11 20:02 - 00000000 ____D () C:\Users\User\AppData\Roaming\KeePass
2014-08-17 12:51 - 2014-08-17 12:51 - 02101760 _____ (Farbar) C:\Users\User\Desktop\FRST64.exe
2014-08-17 12:51 - 2014-08-17 12:51 - 00380416 _____ () C:\Users\User\Desktop\Gmer-19357.exe
2014-08-17 12:51 - 2014-08-17 12:50 - 00050477 _____ () C:\Users\User\Desktop\Defogger.exe
2014-08-17 12:40 - 2014-04-29 12:44 - 01990211 _____ () C:\Windows\WindowsUpdate.log
2014-08-17 12:30 - 2014-06-11 19:23 - 00000000 ___RD () C:\Users\User\Dropbox
2014-08-17 12:30 - 2014-06-11 19:20 - 00000000 ____D () C:\Users\User\AppData\Roaming\Dropbox
2014-08-17 12:22 - 2009-07-14 06:45 - 00031248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-17 12:22 - 2009-07-14 06:45 - 00031248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-17 12:19 - 2014-06-11 18:56 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-08-17 12:17 - 2014-06-11 19:17 - 00000000 ___RD () C:\Users\User\OneDrive
2014-08-17 12:13 - 2014-07-10 10:08 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-17 10:19 - 2014-04-29 22:37 - 00699666 _____ () C:\Windows\system32\perfh007.dat
2014-08-17 10:19 - 2014-04-29 22:37 - 00149774 _____ () C:\Windows\system32\perfc007.dat
2014-08-17 10:19 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-17 10:17 - 2014-06-11 20:21 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-08-17 10:14 - 2014-07-23 09:08 - 00000000 ____D () C:\Users\User\AppData\Local\TSVNCache
2014-08-17 10:14 - 2014-07-10 10:08 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-08-17 10:14 - 2014-06-06 09:36 - 00015858 _____ () C:\Users\Public\CAFADEBUG.log
2014-08-17 10:14 - 2014-06-06 07:23 - 00450178 _____ () C:\FaceProv.log
2014-08-17 10:14 - 2014-04-29 13:12 - 00000000 ____D () C:\ProgramData\VeriFace
2014-08-17 10:13 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-17 10:13 - 2009-07-14 06:51 - 00067891 _____ () C:\Windows\setupact.log
2014-08-17 10:12 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-08-17 03:50 - 2014-06-11 22:37 - 00000000 ____D () C:\Windows\system32\MRT
2014-08-17 03:49 - 2014-06-11 22:37 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-08-17 03:46 - 2014-06-11 22:42 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-08-17 03:34 - 2009-07-14 07:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2014-08-17 03:33 - 2014-06-11 19:50 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-08-17 01:03 - 2014-06-18 14:24 - 00000000 ____D () C:\Users\User\AppData\Roaming\Skype
2014-08-16 18:14 - 2014-06-11 19:22 - 00000000 ____D () C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-08-09 21:30 - 2014-08-09 21:30 - 00031936 _____ () C:\Users\User\Documents\Notenübersicht_M.Schrader_MSc.xls_0.ods
2014-08-09 10:21 - 2014-08-09 10:21 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-08-09 10:21 - 2014-08-09 10:21 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-08-09 10:21 - 2014-08-09 10:21 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-08-09 10:21 - 2014-08-09 10:21 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-08-09 10:21 - 2014-08-09 10:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-08-09 10:21 - 2014-08-09 10:21 - 00000000 ____D () C:\Program Files (x86)\Java
2014-08-09 10:21 - 2014-06-24 16:01 - 00000000 ____D () C:\ProgramData\Oracle
2014-08-08 17:27 - 2014-08-08 17:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TomTom
2014-08-08 17:27 - 2014-08-08 17:24 - 00000000 ____D () C:\Program Files (x86)\TomTom HOME 2
2014-08-08 17:26 - 2014-08-08 17:26 - 00000000 ____D () C:\Users\User\AppData\Local\Downloaded Installations
2014-08-08 17:25 - 2014-08-08 17:25 - 00000000 ____D () C:\Users\User\Documents\TomTom
2014-08-08 17:25 - 2014-08-08 17:25 - 00000000 ____D () C:\Users\User\AppData\Roaming\TomTom
2014-08-08 17:25 - 2014-08-08 17:25 - 00000000 ____D () C:\Users\User\AppData\Local\TomTom
2014-08-08 17:25 - 2014-08-08 17:25 - 00000000 ____D () C:\ProgramData\TomTom
2014-08-08 17:24 - 2014-08-08 17:24 - 00000000 ____D () C:\Program Files (x86)\TomTom International B.V
2014-08-08 17:24 - 2014-08-08 17:24 - 00000000 ____D () C:\Program Files (x86)\TomTom DesktopSuite
2014-08-08 17:22 - 2014-06-11 19:17 - 00002202 _____ () C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2014-08-07 04:06 - 2014-08-16 18:18 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-07 04:01 - 2014-08-16 18:18 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-05 16:27 - 2014-06-12 10:23 - 00000000 ____D () C:\Users\User\Documents\bloodbowlchaos
2014-08-04 21:18 - 2014-05-05 17:59 - 00000000 ____D () C:\Users\User\Desktop\Software
2014-08-02 22:32 - 2014-08-02 22:32 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-08-02 19:45 - 2014-06-06 07:24 - 00000000 ____D () C:\Users\User\Documents\Bluetooth Folder
2014-08-01 01:41 - 2014-08-16 18:20 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-01 01:16 - 2014-08-16 18:20 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-31 17:43 - 2014-07-27 20:45 - 00000000 ____D () C:\Users\User\AppData\Roaming\TortoiseSVN
2014-07-31 15:18 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-07-25 19:06 - 2010-11-21 05:47 - 00129296 _____ () C:\Windows\PFRO.log
2014-07-25 19:06 - 2009-07-14 07:08 - 00006426 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-07-25 16:52 - 2014-08-16 18:20 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-25 16:02 - 2014-08-16 18:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-25 16:01 - 2014-08-16 18:20 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-25 15:51 - 2014-08-16 18:20 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-25 15:30 - 2014-08-16 18:20 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-25 15:28 - 2014-08-16 18:20 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-25 15:28 - 2014-08-16 18:20 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-25 15:25 - 2014-08-16 18:20 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-25 15:25 - 2014-08-16 18:20 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-25 15:11 - 2014-08-16 18:20 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-25 15:10 - 2014-08-16 18:20 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-25 15:04 - 2014-08-16 18:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-25 15:03 - 2014-08-16 18:20 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-25 15:00 - 2014-08-16 18:20 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-25 15:00 - 2014-08-16 18:20 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-25 14:59 - 2014-08-16 18:20 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-25 14:47 - 2014-08-16 18:20 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-25 14:40 - 2014-08-16 18:20 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-25 14:34 - 2014-08-16 18:20 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-25 14:34 - 2014-08-16 18:20 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-25 14:33 - 2014-08-16 18:20 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-25 14:30 - 2014-08-16 18:20 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-25 14:28 - 2014-08-16 18:20 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-25 14:28 - 2014-08-16 18:20 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-25 14:21 - 2014-08-16 18:20 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-25 14:19 - 2014-08-16 18:20 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-25 14:18 - 2014-08-16 18:20 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-25 14:17 - 2014-08-16 18:20 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-25 14:17 - 2014-08-16 18:20 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-25 14:12 - 2014-08-16 18:20 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-25 14:10 - 2014-08-16 18:20 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-25 14:10 - 2014-08-16 18:20 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-25 14:08 - 2014-08-16 18:20 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-25 14:06 - 2014-08-16 18:20 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-25 13:52 - 2014-08-16 18:20 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-25 13:47 - 2014-08-16 18:20 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-25 13:43 - 2014-08-16 18:20 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-25 13:42 - 2014-08-16 18:20 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-25 13:39 - 2014-08-16 18:20 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-25 13:39 - 2014-08-16 18:20 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-25 13:36 - 2014-08-16 18:20 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-25 13:34 - 2014-08-16 18:20 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-25 13:29 - 2014-08-16 18:20 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-25 13:23 - 2014-08-16 18:20 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-25 13:13 - 2014-08-16 18:20 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-25 13:07 - 2014-08-16 18:20 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-25 13:07 - 2014-08-16 18:20 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-25 13:03 - 2014-08-16 18:20 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-25 12:52 - 2014-08-16 18:20 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-25 12:26 - 2014-08-16 18:20 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-25 12:17 - 2014-08-16 18:20 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-25 12:09 - 2014-08-16 18:20 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-25 12:05 - 2014-08-16 18:20 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-25 12:00 - 2014-08-16 18:20 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-24 09:14 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Public\Libraries
2014-07-22 14:45 - 2014-07-22 14:45 - 00000000 ____D () C:\Users\User\AppData\Local\TortoiseSVN
2014-07-22 14:44 - 2014-07-22 14:44 - 00000000 ____D () C:\Users\User\AppData\Roaming\Subversion
2014-07-22 14:44 - 2014-07-22 14:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TortoiseSVN
2014-07-22 14:44 - 2014-07-22 14:44 - 00000000 ____D () C:\Program Files\TortoiseSVN
2014-07-22 14:44 - 2014-07-22 14:44 - 00000000 ____D () C:\Program Files\Common Files\TortoiseOverlays

Some content of TEMP:
====================
C:\Users\User\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpaqf5dx.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-07 20:50

==================== End Of Log ============================
         

--- --- ---


Die weiteren Logs habe ich angehängt, weil der Beitrag sonst zu lange geworden wäre.
Ich hoffe ich habe soweit alles richtig gemacht mit den Scans.

Und schonmal im Vorraus für die Hilfe.

Beste Grüße,
Max

Die sind ganz normal.



Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.
Ich kann auf Arbeit keine Anhänge öffnen, danke.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

• Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
• Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
• Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
• Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Hi Schruber,

danke für die schnelle Antwort.
Ich werde die weiteren logs in den nächsten Antworten posten.

Addition.txt
FRST Additions Logfile:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 16-08-2014 04
Ran by User at 2014-08-17 12:56:18
Running from C:\Users\User\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.125 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.07) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
Alcor Micro USB Card Reader (HKLM-x32\...\AmUStor) (Version: 3.1.3042.60281 - Alcor Micro Corp.)
Alcor Micro USB Card Reader (x32 Version: 3.1.3042.60281 - Alcor Micro Corp.) Hidden
Atheros WLAN Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 9.0 - Atheros)
Blood Bowl: Chaos Edition (HKLM-x32\...\Steam App 216890) (Version:  - Cyanide Studios)
Bluetooth Win7 Suite (64) (HKLM\...\{230D1595-57DA-4933-8C4E-375797EBB7E1}) (Version: 7.3.0.145 - Atheros Communications)
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.54.28.50 - Conexant)
Dolby Home Theater v4 (HKLM-x32\...\{B26438B4-BF51-49C3-9567-7F14A5E40CB9}) (Version: 7.2.7000.7 - Dolby Laboratories Inc)
Dropbox (HKCU\...\Dropbox) (Version: 2.10.28 - Dropbox, Inc.)
Energy Management (HKLM-x32\...\InstallShield_{D0956C11-0F60-43FE-99AD-524E833471BB}) (Version: 7.0.3.9 - Lenovo)
Energy Management (x32 Version: 7.0.3.9 - Lenovo) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 36.0.1985.143 - Google Inc.)
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.10.1464 - Intel Corporation)
Intel(R) OpenCL CPU Runtime (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version:  - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3621 - Intel Corporation)
Intel(R) Rapid Start Technology (HKLM-x32\...\3D073343-CEEB-4ce7-85AC-A69A7631B5D6) (Version: 1.0.0.1021 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.1.0.1006 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.4.220 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.23.943.1 - Intel Corporation) Hidden
Intelligent Touchpad (HKLM-x32\...\{FDB0A81A-1173-4B15-BEA4-89FEA0474F17}) (Version: 1.00.0108 - Lenovo)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)
Java Auto Updater (x32 Version: 2.1.67.1 - Oracle, Inc.) Hidden
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{6F6873E3-5C92-4049-B511-231A138DD090}) (Version: 14.0.0.4651 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 14.0.0.4651 - Kaspersky Lab) Hidden
KeePass Password Safe 2.27 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: 2.27 - Dominik Reichl)
Lenovo CAPOSD (HKLM-x32\...\InstallShield_{48F851E7-DD0C-4A35-AD7A-57878023E987}) (Version: 1.0.0.7 - Lenovo)
Lenovo CAPOSD (x32 Version: 1.0.0.7 - Lenovo) Hidden
Lenovo EasyCamera (HKLM-x32\...\{ADE16A9D-FBDC-4ECC-B6BD-9C31E51D0333}) (Version: 1.11.1214.1 - Lenovo EasyCamera)
Lenovo Smart Update (HKLM-x32\...\{29B7C0EB-A1E6-4BC3-8344-70EDE4F189F1}) (Version: 1.0.29 - Lenovo Corporation)
Lenovo YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.1.3728 - CyberLink Corp.)
Lenovo YouCam (x32 Version: 3.1.3728 - CyberLink Corp.) Hidden
LenovoDrv_x64 (HKLM\...\{83E68458-AF28-4CA4-8AFC-595A10307290}) (Version: 1.0.00 - Lenovo)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Games for Windows - LIVE (HKLM-x32\...\{F112F66E-25CA-42DD-983C-6118EB38F606}) (Version: 3.0.89.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{2E660A2A-A55F-43CD-9F73-CAD7382EEB78}) (Version: 3.0.19.0 - Microsoft Corporation)
Microsoft OneDrive (HKCU\...\OneDriveSetup.exe) (Version: 17.3.1171.0714 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 31.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 31.0 (x86 de)) (Version: 31.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 30.0 - Mozilla)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.6.7 - Notepad++ Team)
Nsd (HKLM-x32\...\{4677B88C-CE16-4CBB-A2CB-B76E9D456C7F}) (Version: 1.0.1.5 - Lenovo)
NVIDIA Grafiktreiber 327.62 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 327.62 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.141.953 - NVIDIA Corporation) Hidden
NVIDIA Optimus 1.14.17 (Version: 1.14.17 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.11.1111 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.11.1111 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.11.1111 - NVIDIA Corporation)
NVIDIA Systemsteuerung 327.62 (Version: 327.62 - NVIDIA Corporation) Hidden
NVIDIA Update 1.14.17 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.14.17 - NVIDIA Corporation)
NVIDIA Update Components (Version: 1.14.17 - NVIDIA Corporation) Hidden
OpenOffice 4.1.0 (HKLM-x32\...\{E19483E2-6C18-494D-A307-D4498BCFD2C7}) (Version: 4.10.9764 - Apache Software Foundation)
R for Windows 3.1.0 (HKLM\...\R for Windows 3.1.0_is1) (Version: 3.1.0 - R Core Team)
Realtek Ethernet Controller All-In-One Windows Driver (HKLM-x32\...\{F7E7F0CB-AA41-4D5A-B6F2-8E6738EB063F}) (Version: 7.48.823.2011 - Realtek)
RStudio (HKLM-x32\...\RStudio) (Version: 0.98.953 - RStudio)
Skype™ 6.16 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.16.105 - Skype Technologies S.A.)
Steam (HKLM-x32\...\Steam) (Version:  - Valve Corporation)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.3.33.0 - Synaptics Incorporated)
TomTom HOME (HKLM-x32\...\{7A2BB1C8-903D-4585-9F3B-CADD67D07D37}) (Version: 2.9.8 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
TortoiseSVN 1.8.7.25475 (64 bit) (HKLM\...\{A8573F59-C080-4495-A9A8-EC32D8A4ECFF}) (Version: 1.8.25475 - TortoiseSVN)
VeriFace (HKLM-x32\...\VeriFace) (Version: 4.0.1.1230 - Lenovo)
VLC media player 2.1.3 (HKLM\...\VLC media player) (Version: 2.1.3 - VideoLAN)
Warhammer® 40,000™: Dawn of War® II - Chaos Rising™ (HKLM-x32\...\Steam App 20570) (Version:  - Relic Entertainment)
Warhammer® 40,000™: Dawn of War® II – Retribution™ (HKLM-x32\...\Steam App 56400) (Version:  - Relic Entertainment)
Warhammer® 40,000™: Dawn of War® II (HKLM-x32\...\Steam App 15620) (Version:  - Relic Entertainment)
Windows Driver Package - Lenovo Corporation (LAD) System  (01/13/2012 1.0.0.2) (HKLM\...\5E61CDC4058A17FE9BE3046B1846F3118CD618B1) (Version: 01/13/2012 1.0.0.2 - Lenovo Corporation)
Windows-Treiberpaket - Lenovo (ACPIVPC) System  (12/15/2011 7.1.0.1) (HKLM\...\99841829BE839365AA67B2AD0E50D371F59F8A1E) (Version: 12/15/2011 7.1.0.1 - Lenovo)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3577023336-649988219-1192559642-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3577023336-649988219-1192559642-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)
CustomCLSID: HKU\S-1-5-21-3577023336-649988219-1192559642-1001_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\User\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3577023336-649988219-1192559642-1001_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\User\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3577023336-649988219-1192559642-1001_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\User\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3577023336-649988219-1192559642-1001_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\User\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3577023336-649988219-1192559642-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\User\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\FileSyncApi64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3577023336-649988219-1192559642-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3577023336-649988219-1192559642-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3577023336-649988219-1192559642-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3577023336-649988219-1192559642-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3577023336-649988219-1192559642-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3577023336-649988219-1192559642-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3577023336-649988219-1192559642-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3577023336-649988219-1192559642-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

==================== Restore Points  =========================

22-07-2014 12:44:05 Installed TortoiseSVN 1.8.7.25475 (64 bit)
24-07-2014 17:44:12 Windows-Sicherung
24-07-2014 17:59:32 Windows-Sicherung
07-08-2014 18:57:17 Geplanter Prüfpunkt
08-08-2014 15:26:36 Installed TomTom HOME.
09-08-2014 08:20:50 Installed Java 7 Update 67
09-08-2014 19:26:04 Windows-Sicherung
09-08-2014 19:39:48 Windows-Sicherung
17-08-2014 01:46:28 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {2CCDE57D-0068-445E-A3AD-77DC754AFBA0} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {91763521-82B2-4864-A835-C9BEAA2EED4D} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-07-10] (Google Inc.)
Task: {B97EB4A2-9292-43C4-8587-A3B6BD7CEC5D} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-07-10] (Google Inc.)
Task: {D4C2DBC6-23FE-4880-9A67-CC38D0C5C64C} - System32\Tasks\Intel® Rapid Start Technology Manager => C:\Program Files (x86)\Intel\irstrt\RapidStartConfig.exe [2012-02-06] (Intel)
Task: {E8B8A20A-AE88-474A-B927-0E0752653FF4} - System32\Tasks\MirageAgent => C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [2011-01-28] (CyberLink)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2014-04-29 12:52 - 2013-10-29 01:38 - 00097568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2013-12-26 19:42 - 2013-12-26 19:42 - 00013088 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll
2014-05-06 20:37 - 2014-05-06 20:37 - 00076032 _____ () C:\Program Files\TortoiseSVN\bin\TortoiseStub.dll
2014-05-06 20:37 - 2014-05-06 20:37 - 00088832 _____ () C:\Program Files\TortoiseSVN\bin\libsasl.dll
2014-04-29 13:12 - 2014-04-29 13:12 - 00628064 _____ () C:\Windows\system32\SimpleExt.dll
2014-05-12 11:49 - 2014-05-12 11:49 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll
2008-12-20 03:20 - 2014-04-29 13:19 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\HookLib.dll
2012-03-28 14:34 - 2014-04-29 13:19 - 01509936 _____ () C:\Program Files (x86)\Lenovo\Energy Management\EMWpfUI.dll
2012-03-10 16:31 - 2014-04-29 13:19 - 00012336 _____ () C:\Program Files (x86)\Lenovo\Energy Management\de-DE\EMWpfUI.resources.dll
2008-12-20 03:20 - 2014-04-29 13:19 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\kbdhook.dll
2014-04-29 13:10 - 2011-12-08 11:12 - 00291272 _____ () C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe
2014-04-29 13:02 - 2010-10-26 06:40 - 00049056 _____ () C:\Program Files\Conexant\ForteConfig\fmapp.exe
2014-04-29 13:01 - 2012-04-16 09:17 - 00127320 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
2013-06-17 12:35 - 2013-06-17 12:35 - 00478400 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\dblite.dll
2013-05-08 14:52 - 2013-05-08 14:52 - 01270464 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\kpcengine.2.3.dll
2014-05-05 22:21 - 2014-05-05 22:21 - 00065792 _____ () C:\Program Files\TortoiseSVN\bin\TortoiseStub32.dll
2014-05-05 22:20 - 2014-05-05 22:20 - 00071936 _____ () C:\Program Files\TortoiseSVN\bin\libsasl32.dll
2014-04-29 13:09 - 2012-02-20 16:08 - 00021040 _____ () C:\Program Files (x86)\Lenovo\Lenovo Smart Update\HookDll.dll
2014-04-29 13:09 - 2012-02-20 16:08 - 00089136 _____ () C:\Program Files (x86)\Lenovo\Lenovo Smart Update\CommonTools.dll
2014-04-29 13:12 - 2014-04-29 13:12 - 00013664 _____ () C:\Program Files (x86)\Lenovo\VeriFace\ChooseLang.dll
2011-06-28 08:28 - 2011-06-28 08:28 - 00042496 _____ () C:\Program Files (x86)\Lenovo\Lenovo CAPOSD\QTKB.dll
2014-08-17 10:14 - 2014-08-17 10:14 - 00043008 _____ () c:\users\user\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpaqf5dx.dll
2013-08-23 21:01 - 2013-08-23 21:01 - 25100288 _____ () C:\Users\User\AppData\Roaming\Dropbox\bin\libcef.dll
2014-04-29 12:47 - 2012-02-01 16:25 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2014-04-29 13:01 - 2012-03-28 16:18 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2014-06-11 20:22 - 2014-07-12 02:53 - 01116672 _____ () C:\Program Files (x86)\Steam\libavcodec-55.dll
2014-06-11 20:22 - 2014-07-12 02:53 - 00438784 _____ () C:\Program Files (x86)\Steam\libavutil-53.dll
2014-06-11 20:22 - 2014-07-12 02:53 - 00399360 _____ () C:\Program Files (x86)\Steam\libavformat-55.dll
2014-06-11 20:22 - 2014-07-12 02:53 - 00331264 _____ () C:\Program Files (x86)\Steam\libavresample-1.dll
2014-06-11 20:22 - 2014-06-27 00:40 - 00764416 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2014-06-11 20:22 - 2014-07-16 04:28 - 02139328 _____ () C:\Program Files (x86)\Steam\video.dll
2014-06-11 20:22 - 2014-04-29 02:37 - 00519168 _____ () C:\Program Files (x86)\Steam\libswscale-2.dll
2014-06-11 20:22 - 2014-07-16 04:28 - 01116864 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2014-06-11 20:22 - 2014-05-02 01:35 - 20628160 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll
2014-08-16 18:24 - 2014-08-07 05:20 - 00718152 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.143\libglesv2.dll
2014-08-16 18:24 - 2014-08-07 05:20 - 00126280 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.143\libegl.dll
2014-08-16 18:24 - 2014-08-07 05:20 - 08537928 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.143\pdf.dll
2014-08-16 18:24 - 2014-08-07 05:20 - 00353096 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.143\ppGoogleNaClPluginChrome.dll
2014-08-16 18:24 - 2014-08-07 05:20 - 01732936 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.143\ffmpegsumo.dll
2014-08-02 22:32 - 2014-08-02 22:32 - 03800688 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: KeePass 2 PreLoad => "C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe" --preload
MSCONFIG\startupreg: YouCam Mirage => "C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe"
MSCONFIG\startupreg: YouCam Tray => "C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe" /s

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (08/17/2014 10:15:23 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/17/2014 10:13:49 AM) (Source: NSDSvc) (EventID: 256) (User: )
Description: An error has occurred (---query POLICYVT key success failed with 0, The Code is:0x424.).

Error: (08/17/2014 10:13:49 AM) (Source: NSDSvc) (EventID: 256) (User: )
Description: An error has occurred (---Get Poicy Open key suc failed with 0, The Code is:0x422.).

Error: (08/17/2014 10:13:49 AM) (Source: NSDSvc) (EventID: 256) (User: )
Description: An error has occurred (---query POLICYVT key success failed with 0, The Code is:0x424.).

Error: (08/17/2014 10:13:49 AM) (Source: NSDSvc) (EventID: 256) (User: )
Description: An error has occurred (---Get Poicy Open key suc failed with 0, The Code is:0x422.).

Error: (08/17/2014 10:13:49 AM) (Source: NSDSvc) (EventID: 256) (User: )
Description: An error has occurred (---query POLICYVT key success failed with 0, The Code is:0x424.).

Error: (08/17/2014 10:13:49 AM) (Source: NSDSvc) (EventID: 256) (User: )
Description: An error has occurred (---Get Poicy Open key suc failed with 0, The Code is:0x422.).

Error: (08/17/2014 10:13:49 AM) (Source: NSDSvc) (EventID: 256) (User: )
Description: An error has occurred (---query POLICYVT key success failed with 0, The Code is:0x424.).

Error: (08/17/2014 10:13:49 AM) (Source: NSDSvc) (EventID: 256) (User: )
Description: An error has occurred (---Get Poicy Open key suc failed with 0, The Code is:0x422.).

Error: (08/17/2014 10:13:49 AM) (Source: NSDSvc) (EventID: 256) (User: )
Description: An error has occurred (---query POLICYVT key success failed with 0, The Code is:0x424.).


System errors:
=============
Error: (08/17/2014 10:13:49 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "Start" aufgrund folgenden Fehlers fehlgeschlagen: 
%%5

Error: (08/17/2014 03:34:15 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "Start" aufgrund folgenden Fehlers fehlgeschlagen: 
%%5

Error: (08/16/2014 06:10:46 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "Start" aufgrund folgenden Fehlers fehlgeschlagen: 
%%5

Error: (08/12/2014 02:06:51 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "Start" aufgrund folgenden Fehlers fehlgeschlagen: 
%%5

Error: (08/12/2014 09:34:36 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "Start" aufgrund folgenden Fehlers fehlgeschlagen: 
%%5

Error: (08/11/2014 09:21:13 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "Start" aufgrund folgenden Fehlers fehlgeschlagen: 
%%5

Error: (08/10/2014 05:23:00 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "Start" aufgrund folgenden Fehlers fehlgeschlagen: 
%%5

Error: (08/09/2014 09:24:37 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "Start" aufgrund folgenden Fehlers fehlgeschlagen: 
%%5

Error: (08/09/2014 05:51:06 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "Start" aufgrund folgenden Fehlers fehlgeschlagen: 
%%5

Error: (08/09/2014 09:20:24 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "Start" aufgrund folgenden Fehlers fehlgeschlagen: 
%%5


Microsoft Office Sessions:
=========================
Error: (08/17/2014 10:15:23 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/17/2014 10:13:49 AM) (Source: NSDSvc) (EventID: 256) (User: )
Description: NSDSvc---query POLICYVT key success failed with 0, The Code is:0x424.

Error: (08/17/2014 10:13:49 AM) (Source: NSDSvc) (EventID: 256) (User: )
Description: NSDSvc---Get Poicy Open key suc failed with 0, The Code is:0x422.

Error: (08/17/2014 10:13:49 AM) (Source: NSDSvc) (EventID: 256) (User: )
Description: NSDSvc---query POLICYVT key success failed with 0, The Code is:0x424.

Error: (08/17/2014 10:13:49 AM) (Source: NSDSvc) (EventID: 256) (User: )
Description: NSDSvc---Get Poicy Open key suc failed with 0, The Code is:0x422.

Error: (08/17/2014 10:13:49 AM) (Source: NSDSvc) (EventID: 256) (User: )
Description: NSDSvc---query POLICYVT key success failed with 0, The Code is:0x424.

Error: (08/17/2014 10:13:49 AM) (Source: NSDSvc) (EventID: 256) (User: )
Description: NSDSvc---Get Poicy Open key suc failed with 0, The Code is:0x422.

Error: (08/17/2014 10:13:49 AM) (Source: NSDSvc) (EventID: 256) (User: )
Description: NSDSvc---query POLICYVT key success failed with 0, The Code is:0x424.

Error: (08/17/2014 10:13:49 AM) (Source: NSDSvc) (EventID: 256) (User: )
Description: NSDSvc---Get Poicy Open key suc failed with 0, The Code is:0x422.

Error: (08/17/2014 10:13:49 AM) (Source: NSDSvc) (EventID: 256) (User: )
Description: NSDSvc---query POLICYVT key success failed with 0, The Code is:0x424.


CodeIntegrity Errors:
===================================
  Date: 2014-08-17 12:17:22.662
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-17 12:17:22.661
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-17 12:17:22.656
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-17 12:17:22.655
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-17 12:16:42.297
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-17 12:16:42.289
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-10 20:17:32.985
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-10 20:17:32.984
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-10 20:17:32.983
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-10 20:17:32.975
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-3317U CPU @ 1.70GHz
Percentage of memory in use: 45%
Total physical RAM: 8052.9 MB
Available physical RAM: 4348.76 MB
Total Pagefile: 16103.98 MB
Available Pagefile: 11717.38 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: (Windows7_OS) (Fixed) (Total:420.56 GB) (Free:299.75 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (LENOVO) (Fixed) (Total:25.47 GB) (Free:21.56 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 8 GB) (Disk ID: 3BD4BA94)
Partition 1: (Not Active) - (Size=8 GB) - (Type=84)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 3BD4BA98)
Partition 1: (Active) - (Size=200 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=420.6 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=25.5 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=19.3 GB) - (Type=12)

==================== End Of Log ============================
         

--- --- ---

Gemer.txt (1/3)

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-08-17 13:15:10
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk1\DR1 -> \Device\Ide\IAAStorageDevice-1 Intel___ rev.1.0. 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\User\AppData\Local\Temp\kxldapoc.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528                                                                                                                                                 fffff800031a4000 49 bytes [4D, 08, 8D, 45, DC, 50, 8D, ...]
INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 578                                                                                                                                                 fffff800031a4032 63 bytes {OR EAX, 0xc4d8d00; CALL 0xfffffffffffb7f5d}

---- User code sections - GMER 2.1 ----

.text     C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe[1736] C:\Windows\SysWOW64\ntdll.dll!NtQueryValueKey                                                                                000000007755faa8 5 bytes JMP 00000001743818dd
.text     C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe[1736] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                                         0000000077560038 5 bytes JMP 0000000174381ed6
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                                                                                     00000000773611f5 8 bytes {JMP 0xd}
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                                                                                   0000000077361390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                                          000000007736143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                                                                          000000007736158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                                                  000000007736191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                                                                                  0000000077361b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                                                                                 0000000077361bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                                                    0000000077361d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                                                                                    0000000077361eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                                                        0000000077361edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                                                                       0000000077361f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                                                                      0000000077361fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                                                                              0000000077361fd7 8 bytes {JMP 0xb}
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                                                                          0000000077362272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                                                                          0000000077362301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                                                                               0000000077362792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                                                      00000000773627b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                                                    00000000773627d2 8 bytes {JMP 0x10}
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                                                     000000007736282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176                                                                    0000000077362890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                * 2
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                                            0000000077362d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                                                                            0000000077362d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                * 3
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                                                                                    0000000077363023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                                                        000000007736323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                                                                        00000000773633c0 16 bytes {JMP 0x4e}
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                                                       0000000077363a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                                                       0000000077363ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                                                           0000000077363b85 8 bytes [10, 6A, F8, FF, 00, 00, 00, ...]
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                                                                           0000000077363d23 8 bytes [00, 6A, F8, FF, 00, 00, 00, ...]
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                                                    0000000077364190 8 bytes [A0, 69, F8, FF, 00, 00, 00, ...]
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                                              00000000773b1380 8 bytes JMP 3f3f3f3f
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                                            00000000773b1500 8 bytes JMP 3f3f3f3f
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                  00000000773b1530 8 bytes JMP 3f3f3f3f
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                                00000000773b1650 8 bytes JMP 3f3f3f3f
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                                    00000000773b1700 8 bytes JMP 3f3f3f3f
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                                    00000000773b1d30 8 bytes JMP 3f3f3f3f
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                                  00000000773b1f80 8 bytes JMP 3f3f3f3f
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                  00000000773b27e0 8 bytes JMP 3f3f3f3f
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                                                00000000743a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                                                00000000743a146b 8 bytes {JMP 0xffffffffffffffb0}
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                                             00000000743a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                                                               00000000743a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                                          00000000743a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                                          00000000743a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                                                                    00000000743a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                                                                      00000000743a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                                                    00000000743a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe[2920] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                                                                         00000000743a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                                                                       00000000773611f5 8 bytes {JMP 0xd}
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                                                                     0000000077361390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                            000000007736143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                                                            000000007736158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                                    000000007736191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                                                                    0000000077361b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                                                                   0000000077361bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                                      0000000077361d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                                                                      0000000077361eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                                          0000000077361edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                                                         0000000077361f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                                                        0000000077361fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                                                                0000000077361fd7 8 bytes {JMP 0xb}
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                                                            0000000077362272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                                                            0000000077362301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                                                                 0000000077362792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                                        00000000773627b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                                      00000000773627d2 8 bytes {JMP 0x10}
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                                       000000007736282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176                                                      0000000077362890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                * 2
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                              0000000077362d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                                                              0000000077362d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                * 3
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                                                                      0000000077363023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                                          000000007736323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                                                          00000000773633c0 16 bytes {JMP 0x4e}
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                                         0000000077363a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                                         0000000077363ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                                             0000000077363b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                                                             0000000077363d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                                      0000000077364190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                                00000000773b1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                              00000000773b1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                    00000000773b1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                  00000000773b1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                      00000000773b1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                      00000000773b1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                    00000000773b1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                    00000000773b27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                                  00000000743a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                                  00000000743a146b 8 bytes {JMP 0xffffffffffffffb0}
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                               00000000743a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                                                 00000000743a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                            00000000743a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                            00000000743a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                                                      00000000743a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                                                        00000000743a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                                      00000000743a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3164] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                                                           00000000743a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                                                                                   00000000773611f5 8 bytes {JMP 0xd}
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                                                                                 0000000077361390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                                        000000007736143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                                                                        000000007736158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                                                000000007736191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                                                                                0000000077361b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                                                                               0000000077361bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                                                  0000000077361d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                                                                                  0000000077361eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                                                      0000000077361edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                                                                     0000000077361f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                                                                    0000000077361fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                                                                            0000000077361fd7 8 bytes {JMP 0xb}
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                                                                        0000000077362272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                                                                        0000000077362301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                                                                             0000000077362792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                                                    00000000773627b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                                                  00000000773627d2 8 bytes {JMP 0x10}
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                                                   000000007736282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176                                                                  0000000077362890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                * 2
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                                          0000000077362d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                                                                          0000000077362d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                * 3
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                                                                                  0000000077363023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                                                      000000007736323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                                                                      00000000773633c0 16 bytes {JMP 0x4e}
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                                                     0000000077363a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                                                     0000000077363ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                                                         0000000077363b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                                                                         0000000077363d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                                                  0000000077364190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                                            00000000773b1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                                          00000000773b1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                00000000773b1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                              00000000773b1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                                  00000000773b1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                                  00000000773b1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                                00000000773b1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                00000000773b27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                                              00000000743a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                                              00000000743a146b 8 bytes {JMP 0xffffffffffffffb0}
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                                           00000000743a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                                                             00000000743a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                                        00000000743a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                                        00000000743a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                                                                  00000000743a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                                                                    00000000743a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                                                  00000000743a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[3356] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                                                                       00000000743a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                                                                                     00000000773611f5 8 bytes {JMP 0xd}
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                                                                                   0000000077361390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                                          000000007736143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                                                                          000000007736158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                                                  000000007736191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                                                                                  0000000077361b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                                                                                 0000000077361bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                                                    0000000077361d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                                                                                    0000000077361eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                                                        0000000077361edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                                                                       0000000077361f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                                                                      0000000077361fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                                                                              0000000077361fd7 8 bytes {JMP 0xb}
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                                                                          0000000077362272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                                                                          0000000077362301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                                                                               0000000077362792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                                                      00000000773627b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                                                    00000000773627d2 8 bytes {JMP 0x10}
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                                                     000000007736282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176                                                                    0000000077362890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                * 2
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                                            0000000077362d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                                                                            0000000077362d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                * 3
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                                                                                    0000000077363023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                                                        000000007736323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                                                                        00000000773633c0 16 bytes {JMP 0x4e}
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                                                       0000000077363a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                                                       0000000077363ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                                                           0000000077363b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                                                                           0000000077363d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                                                    0000000077364190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                                              00000000773b1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                                            00000000773b1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                  00000000773b1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                                00000000773b1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                                    00000000773b1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                                    00000000773b1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                                  00000000773b1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                  00000000773b27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                                                00000000743a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                                                00000000743a146b 8 bytes {JMP 0xffffffffffffffb0}
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                                             00000000743a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                                                               00000000743a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                                          00000000743a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                                          00000000743a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                                                                    00000000743a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                                                                      00000000743a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                                                    00000000743a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[3468] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                                                                         00000000743a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\kernel32.dll!RegSetValueExW                                                                                                                                  000000007724a400 7 bytes JMP 000000016fff0260
.text     C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\kernel32.dll!RegQueryValueExW                                                                                                                                0000000077253f20 5 bytes JMP 000000016fff01b8
.text     C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\kernel32.dll!RegDeleteValueW                                                                                                                                 000000007726ffb0 5 bytes JMP 000000016fff01f0
.text     C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                                                                                                           000000007727f2e0 5 bytes JMP 000000016fff0148
.text     C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                                                                                                         00000000772a9a30 7 bytes JMP 000000016fff00d8
.text     C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                                                                                                         00000000772b94c0 5 bytes JMP 000000016fff0180
.text     C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                                                                                                         00000000772b9630 5 bytes JMP 000000016fff0110
.text     C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                                                                                                  00000000772d87e0 7 bytes JMP 000000016fff0228
.text     C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                                                                                   000007fefd312db0 5 bytes JMP 000007fffd300180
.text     C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                                                                              000007fefd3137d0 7 bytes JMP 000007fffd3000d8
.text     C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                                                000007fefd318ef0 6 bytes JMP 000007fffd300148
.text     C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                                                                            000007fefd32af60 5 bytes JMP 000007fffd300110
.text     C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                                                             000007feff3389e0 8 bytes JMP 000007fffd3001f0
.text     C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                                                                           000007feff33be40 8 bytes JMP 000007fffd3001b8
.text     C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\USER32.dll!EnumDisplayDevicesW                                                                                                                               0000000077146c80 5 bytes JMP 000000016fff0308
.text     C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\USER32.dll!EnumDisplayDevicesA                                                                                                                               000000007714a5b4 5 bytes JMP 000000016fff02d0
.text     C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\USER32.dll!CreateWindowExW                                                                                                                                   0000000077150810 7 bytes JMP 000000016fff0340
.text     C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\USER32.dll!DisplayConfigGetDeviceInfo                                                                                                                        000000007715ccec 9 bytes JMP 000000016fff0298
.text     C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\ole32.dll!CoCreateInstance                                                                                                                                   000007fefe697490 11 bytes JMP 000007fffd300228
.text     C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                                                                                                                  000007fefe6abf00 7 bytes JMP 000007fffd300260
.text     C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\dxgi.dll!CreateDXGIFactory                                                                                                                                   000007fef7c9dc88 5 bytes JMP 000007fff7c700d8
.text     C:\Windows\system32\Dwm.exe[3188] C:\Windows\system32\dxgi.dll!CreateDXGIFactory1                                                                                                                                  000007fef7c9de10 5 bytes JMP 000007fff7c70110
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                                                                                               00000000773611f5 8 bytes {JMP 0xd}
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                                                                                             0000000077361390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                                                    000000007736143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                                                                                    000000007736158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                                                            000000007736191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                                                                                            0000000077361b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                                                                                           0000000077361bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                                                              0000000077361d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                                                                                              0000000077361eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                                                                  0000000077361edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                                                                                 0000000077361f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                                                                                0000000077361fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                                                                                        0000000077361fd7 8 bytes {JMP 0xb}
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                                                                                    0000000077362272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                                                                                    0000000077362301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                                                                                         0000000077362792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                                                                00000000773627b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                                                              00000000773627d2 8 bytes {JMP 0x10}
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                                                               000000007736282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176                                                                              0000000077362890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                * 2
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                                                      0000000077362d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                                                                                      0000000077362d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                * 3
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                                                                                              0000000077363023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                                                                  000000007736323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                                                                                  00000000773633c0 16 bytes {JMP 0x4e}
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                                                                 0000000077363a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                                                                 0000000077363ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                                                                     0000000077363b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                                                                                     0000000077363d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                                                              0000000077364190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                                                        00000000773b1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                                                      00000000773b1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                            00000000773b1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                                          00000000773b1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                                              00000000773b1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                                              00000000773b1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                                            00000000773b1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                            00000000773b27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                                                          00000000743a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                                                          00000000743a146b 8 bytes {JMP 0xffffffffffffffb0}
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                                                       00000000743a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                                                                         00000000743a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                                                    00000000743a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                                                    00000000743a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                                                                              00000000743a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                                                                                00000000743a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                                                              00000000743a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\USB Camera2\VM332_STI.EXE[4528] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                                                                                   00000000743a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                                       00000000773611f5 8 bytes {JMP 0xd}
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                                     0000000077361390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                            000000007736143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                            000000007736158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                    000000007736191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                                    0000000077361b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                                   0000000077361bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                      0000000077361d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                                      0000000077361eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                          0000000077361edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                         0000000077361f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                        0000000077361fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                                0000000077361fd7 8 bytes {JMP 0xb}
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                            0000000077362272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                            0000000077362301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                                 0000000077362792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                        00000000773627b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                      00000000773627d2 8 bytes {JMP 0x10}
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                       000000007736282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176                      0000000077362890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                * 2
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                              0000000077362d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                              0000000077362d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                * 3
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                                      0000000077363023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                          000000007736323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                          00000000773633c0 16 bytes {JMP 0x4e}
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                         0000000077363a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                         0000000077363ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                             0000000077363b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                             0000000077363d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                      0000000077364190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                00000000773b1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                              00000000773b1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                    00000000773b1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                  00000000773b1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                      00000000773b1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                      00000000773b1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                    00000000773b1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                    00000000773b27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                  00000000743a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                  00000000743a146b 8 bytes {JMP 0xffffffffffffffb0}
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                               00000000743a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                 00000000743a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                            00000000743a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                            00000000743a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                      00000000743a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                        00000000743a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                      00000000743a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4628] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                           00000000743a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                                                                              00000000773611f5 8 bytes {JMP 0xd}
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                                                                            0000000077361390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                                   000000007736143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                                                                   000000007736158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                                           000000007736191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                                                                           0000000077361b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                                                                          0000000077361bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                                             0000000077361d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                                                                             0000000077361eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                                                 0000000077361edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                                                                0000000077361f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                                                               0000000077361fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                                                                       0000000077361fd7 8 bytes {JMP 0xb}
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                                                                   0000000077362272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                                                                   0000000077362301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                                                                        0000000077362792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                                               00000000773627b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                                             00000000773627d2 8 bytes {JMP 0x10}
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                                              000000007736282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176                                                             0000000077362890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                * 2
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                                     0000000077362d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                                                                     0000000077362d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                * 3
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                                                                             0000000077363023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                                                 000000007736323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                                                                 00000000773633c0 16 bytes {JMP 0x4e}
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                                                0000000077363a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                                                0000000077363ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                                                    0000000077363b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                                                                    0000000077363d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                                             0000000077364190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                                       00000000773b1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                                     00000000773b1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                           00000000773b1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                         00000000773b1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                             00000000773b1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                             00000000773b1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                           00000000773b1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                           00000000773b27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                                         00000000743a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                                         00000000743a146b 8 bytes {JMP 0xffffffffffffffb0}
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                                      00000000743a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                                                        00000000743a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                                   00000000743a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                                   00000000743a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                                                             00000000743a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                                                               00000000743a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                                             00000000743a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\Lenovo Smart Update\SmartUpdate.exe[4868] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                                                                  00000000743a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                                                                                     00000000773611f5 8 bytes {JMP 0xd}
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                                                                                   0000000077361390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                                          000000007736143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                                                                          000000007736158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                                                  000000007736191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                                                                                  0000000077361b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                                                                                 0000000077361bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                                                    0000000077361d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                                                                                    0000000077361eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                                                        0000000077361edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                                                                       0000000077361f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                                                                      0000000077361fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                                                                              0000000077361fd7 8 bytes {JMP 0xb}
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                                                                          0000000077362272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                                                                          0000000077362301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                                                                               0000000077362792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                                                      00000000773627b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                                                    00000000773627d2 8 bytes {JMP 0x10}
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                                                     000000007736282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176                                                                    0000000077362890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                * 2
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                                            0000000077362d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                                                                            0000000077362d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                * 3
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                                                                                    0000000077363023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                                                        000000007736323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                                                                        00000000773633c0 16 bytes {JMP 0x4e}
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                                                       0000000077363a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                                                       0000000077363ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                                                           0000000077363b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                                                                           0000000077363d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                                                    0000000077364190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                                              00000000773b1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                                            00000000773b1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                  00000000773b1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                                00000000773b1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                                    00000000773b1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                                    00000000773b1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                                  00000000773b1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                  00000000773b27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                                                00000000743a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                                                00000000743a146b 8 bytes {JMP 0xffffffffffffffb0}
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                                             00000000743a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                                                               00000000743a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                                          00000000743a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                                          00000000743a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                                                                    00000000743a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                                                                      00000000743a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                                                    00000000743a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                                                                         00000000743a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                           0000000077511465 2 bytes [51, 77]
.text     C:\Program Files\Lenovo\Intelligent Touchpad\TouchZone.exe[4916] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                          00000000775114bb 2 bytes [51, 77]
.text     ...                                                                                                                                                                                                                * 2
         

Gemer.txt (2/3)

.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                                                                                             00000000773611f5 8 bytes {JMP 0xd}
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                                                                                           0000000077361390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                                                  000000007736143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                                                                                  000000007736158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                                                          000000007736191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                                                                                          0000000077361b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                                                                                         0000000077361bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                                                            0000000077361d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                                                                                            0000000077361eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                                                                0000000077361edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                                                                               0000000077361f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                                                                              0000000077361fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                                                                                      0000000077361fd7 8 bytes {JMP 0xb}
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                                                                                  0000000077362272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                                                                                  0000000077362301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                                                                                       0000000077362792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                                                              00000000773627b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                                                            00000000773627d2 8 bytes {JMP 0x10}
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                                                             000000007736282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176                                                                            0000000077362890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                * 2
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                                                    0000000077362d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                                                                                    0000000077362d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                * 3
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                                                                                            0000000077363023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                                                                000000007736323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                                                                                00000000773633c0 16 bytes {JMP 0x4e}
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                                                               0000000077363a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                                                               0000000077363ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                                                                   0000000077363b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                                                                                   0000000077363d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                                                            0000000077364190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                                                      00000000773b1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                                                    00000000773b1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                          00000000773b1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                                        00000000773b1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                                            00000000773b1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                                            00000000773b1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                                          00000000773b1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                          00000000773b27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                                                        00000000743a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                                                        00000000743a146b 8 bytes {JMP 0xffffffffffffffb0}
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                                                     00000000743a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                                                                       00000000743a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                                                  00000000743a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                                                  00000000743a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                                                                            00000000743a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                                                                              00000000743a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                                                            00000000743a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                                                                                 00000000743a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                   0000000077511465 2 bytes [51, 77]
.text     C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[4976] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                  00000000775114bb 2 bytes [51, 77]
.text     ...                                                                                                                                                                                                                * 2
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                                                                                                         00000000773611f5 8 bytes {JMP 0xd}
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                                                                                                       0000000077361390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                                                              000000007736143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                                                                                              000000007736158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                                                                      000000007736191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                                                                                                      0000000077361b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                                                                                                     0000000077361bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                                                                        0000000077361d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                                                                                                        0000000077361eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                                                                            0000000077361edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                                                                                           0000000077361f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                                                                                          0000000077361fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                                                                                                  0000000077361fd7 8 bytes {JMP 0xb}
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                                                                                              0000000077362272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                                                                                              0000000077362301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                                                                                                   0000000077362792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                                                                          00000000773627b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                                                                        00000000773627d2 8 bytes {JMP 0x10}
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                                                                         000000007736282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176                                                                                        0000000077362890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                * 2
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                                                                0000000077362d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                                                                                                0000000077362d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                * 3
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                                                                                                        0000000077363023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                                                                            000000007736323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                                                                                            00000000773633c0 16 bytes {JMP 0x4e}
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                                                                           0000000077363a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                                                                           0000000077363ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                                                                               0000000077363b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                                                                                               0000000077363d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                                                                        0000000077364190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                                                                  00000000773b1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                                                                00000000773b1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                                      00000000773b1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                                                    00000000773b1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                                                        00000000773b1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                                                        00000000773b1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                                                      00000000773b1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                                      00000000773b27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                                                                    00000000743a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                                                                    00000000743a146b 8 bytes {JMP 0xffffffffffffffb0}
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                                                                 00000000743a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                                                                                   00000000743a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                                                              00000000743a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                                                              00000000743a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                                                                                        00000000743a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                                                                                          00000000743a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                                                                        00000000743a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\PROGRA~2\Lenovo\LENOVO~2\CAPOSD.exe[5008] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                                                                                             00000000743a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                                                                               00000000773611f5 8 bytes {JMP 0xd}
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                                                                             0000000077361390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                                    000000007736143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                                                                    000000007736158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                                            000000007736191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                                                                            0000000077361b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                                                                           0000000077361bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                                              0000000077361d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                                                                              0000000077361eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                                                  0000000077361edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                                                                 0000000077361f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                                                                0000000077361fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                                                                        0000000077361fd7 8 bytes {JMP 0xb}
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                                                                    0000000077362272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                                                                    0000000077362301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                                                                         0000000077362792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                                                00000000773627b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                                              00000000773627d2 8 bytes {JMP 0x10}
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                                               000000007736282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176                                                              0000000077362890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                * 2
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                                      0000000077362d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                                                                      0000000077362d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                * 3
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                                                                              0000000077363023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                                                  000000007736323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                                                                  00000000773633c0 16 bytes {JMP 0x4e}
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                                                 0000000077363a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                                                 0000000077363ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                                                     0000000077363b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                                                                     0000000077363d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                                              0000000077364190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                                        00000000773b1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                                      00000000773b1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                            00000000773b1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                          00000000773b1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                              00000000773b1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                              00000000773b1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                            00000000773b1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                            00000000773b27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                                          00000000743a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                                          00000000743a146b 8 bytes {JMP 0xffffffffffffffb0}
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                                       00000000743a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                                                         00000000743a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                                    00000000743a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                                    00000000743a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                                                              00000000743a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                                                                00000000743a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                                              00000000743a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5052] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                                                                   00000000743a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                                                                                    00000000773611f5 8 bytes {JMP 0xd}
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                                                                                  0000000077361390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                                         000000007736143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                                                                         000000007736158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                                                 000000007736191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                                                                                 0000000077361b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                                                                                0000000077361bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                                                   0000000077361d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                                                                                   0000000077361eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                                                       0000000077361edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                                                                      0000000077361f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                                                                     0000000077361fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                                                                             0000000077361fd7 8 bytes {JMP 0xb}
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                                                                         0000000077362272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                                                                         0000000077362301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                                                                              0000000077362792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                                                     00000000773627b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                                                   00000000773627d2 8 bytes {JMP 0x10}
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                                                    000000007736282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176                                                                   0000000077362890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                * 2
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                                           0000000077362d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                                                                           0000000077362d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                * 3
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                                                                                   0000000077363023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                                                       000000007736323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                                                                       00000000773633c0 16 bytes {JMP 0x4e}
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                                                      0000000077363a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                                                      0000000077363ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                                                          0000000077363b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                                                                          0000000077363d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                                                   0000000077364190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                                             00000000773b1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                                           00000000773b1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                 00000000773b1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                               00000000773b1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                                   00000000773b1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                                   00000000773b1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                                 00000000773b1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                 00000000773b27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                                               00000000743a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                                               00000000743a146b 8 bytes {JMP 0xffffffffffffffb0}
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                                            00000000743a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                                                              00000000743a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                                         00000000743a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                                         00000000743a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                                                                   00000000743a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                                                                     00000000743a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                                                   00000000743a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                                                                        00000000743a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                          0000000077511465 2 bytes [51, 77]
.text     C:\Users\User\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[3940] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                         00000000775114bb 2 bytes [51, 77]
.text     ...                                                                                                                                                                                                                * 2
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                                                                                          00000000773611f5 8 bytes {JMP 0xd}
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                                                                                        0000000077361390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                                               000000007736143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                                                                               000000007736158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                                                       000000007736191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                                                                                       0000000077361b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                                                                                      0000000077361bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                                                         0000000077361d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                                                                                         0000000077361eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                                                             0000000077361edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                                                                            0000000077361f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                                                                           0000000077361fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                                                                                   0000000077361fd7 8 bytes {JMP 0xb}
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                                                                               0000000077362272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                                                                               0000000077362301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                                                                                    0000000077362792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                                                           00000000773627b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                                                         00000000773627d2 8 bytes {JMP 0x10}
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                                                          000000007736282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176                                                                         0000000077362890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                * 2
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                                                 0000000077362d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                                                                                 0000000077362d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                * 3
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                                                                                         0000000077363023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                                                             000000007736323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                                                                             00000000773633c0 16 bytes {JMP 0x4e}
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                                                            0000000077363a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                                                            0000000077363ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                                                                0000000077363b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                                                                                0000000077363d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                                                         0000000077364190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                                                   00000000773b1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                                                 00000000773b1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                       00000000773b1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                                     00000000773b1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                                         00000000773b1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                                         00000000773b1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                                       00000000773b1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                       00000000773b27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                                                     00000000743a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                                                     00000000743a146b 8 bytes {JMP 0xffffffffffffffb0}
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                                                  00000000743a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                                                                    00000000743a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                                               00000000743a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                                               00000000743a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                                                                         00000000743a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                                                                           00000000743a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                                                         00000000743a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                                                                              00000000743a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 69                                                                                                0000000077511465 2 bytes [51, 77]
.text     C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2872] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 155                                                                                               00000000775114bb 2 bytes [51, 77]
.text     ...                                                                                                                                                                                                                * 2
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                                                            00000000773611f5 8 bytes {JMP 0xd}
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                                                          0000000077361390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                 000000007736143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                                                 000000007736158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                         000000007736191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                                                         0000000077361b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                                                        0000000077361bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                           0000000077361d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                                                           0000000077361eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                               0000000077361edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                                              0000000077361f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                                             0000000077361fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                                                     0000000077361fd7 8 bytes {JMP 0xb}
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                                                 0000000077362272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                                                 0000000077362301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                                                      0000000077362792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                             00000000773627b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                           00000000773627d2 8 bytes {JMP 0x10}
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                            000000007736282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176                                           0000000077362890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                * 2
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                   0000000077362d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                                                   0000000077362d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                * 3
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                                                           0000000077363023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                               000000007736323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                                               00000000773633c0 16 bytes {JMP 0x4e}
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                              0000000077363a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                              0000000077363ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                                  0000000077363b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                                                  0000000077363d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                           0000000077364190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                     00000000773b1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                   00000000773b1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                         00000000773b1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                       00000000773b1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                           00000000773b1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                           00000000773b1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                         00000000773b1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                         00000000773b27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                       00000000743a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                       00000000743a146b 8 bytes {JMP 0xffffffffffffffb0}
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                    00000000743a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                                      00000000743a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                 00000000743a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                 00000000743a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                                           00000000743a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                                             00000000743a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                           00000000743a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5568] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                                                00000000743a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                                              00000000773611f5 8 bytes {JMP 0xd}
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                                            0000000077361390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                   000000007736143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                                   000000007736158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                           000000007736191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                                           0000000077361b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                                          0000000077361bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                             0000000077361d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                                             0000000077361eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                 0000000077361edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                                0000000077361f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                               0000000077361fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                                       0000000077361fd7 8 bytes {JMP 0xb}
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                                   0000000077362272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                                   0000000077362301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                                        0000000077362792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                               00000000773627b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                             00000000773627d2 8 bytes {JMP 0x10}
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                              000000007736282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176                             0000000077362890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                * 2
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                     0000000077362d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                                     0000000077362d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                * 3
         

Gemer.txt (3/3)

.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                                             0000000077363023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                 000000007736323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                                 00000000773633c0 16 bytes {JMP 0x4e}
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                0000000077363a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                0000000077363ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                    0000000077363b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                                    0000000077363d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                             0000000077364190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                       00000000773b1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                     00000000773b1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                           00000000773b1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                         00000000773b1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                             00000000773b1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                             00000000773b1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                           00000000773b1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                           00000000773b27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                         00000000743a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                         00000000743a146b 8 bytes {JMP 0xffffffffffffffb0}
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                      00000000743a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                        00000000743a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                   00000000743a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                   00000000743a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                             00000000743a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                               00000000743a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                             00000000743a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe[5648] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                                  00000000743a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                                                                 00000000773611f5 8 bytes {JMP 0xd}
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                                                               0000000077361390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                      000000007736143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                                                      000000007736158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                              000000007736191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                                                              0000000077361b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                                                             0000000077361bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                                0000000077361d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                                                                0000000077361eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                                    0000000077361edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                                                   0000000077361f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                                                  0000000077361fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                                                          0000000077361fd7 8 bytes {JMP 0xb}
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                                                      0000000077362272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                                                      0000000077362301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                                                           0000000077362792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                                  00000000773627b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                                00000000773627d2 8 bytes {JMP 0x10}
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                                 000000007736282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176                                                0000000077362890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                * 2
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                        0000000077362d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                                                        0000000077362d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                * 3
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                                                                0000000077363023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                                    000000007736323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                                                    00000000773633c0 16 bytes {JMP 0x4e}
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                                   0000000077363a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                                   0000000077363ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                                       0000000077363b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                                                       0000000077363d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                                0000000077364190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                          00000000773b1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                        00000000773b1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                              00000000773b1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                            00000000773b1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                00000000773b1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                00000000773b1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                              00000000773b1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                              00000000773b27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                            00000000743a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                            00000000743a146b 8 bytes {JMP 0xffffffffffffffb0}
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                         00000000743a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                                           00000000743a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                      00000000743a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                      00000000743a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                                                00000000743a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                                                  00000000743a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                                00000000743a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[5660] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                                                     00000000743a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                                                                 00000000773611f5 8 bytes {JMP 0xd}
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                                                               0000000077361390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                      000000007736143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                                                      000000007736158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                              000000007736191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                                                              0000000077361b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                                                             0000000077361bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                                0000000077361d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                                                                0000000077361eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                                    0000000077361edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                                                   0000000077361f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                                                  0000000077361fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                                                          0000000077361fd7 8 bytes {JMP 0xb}
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                                                      0000000077362272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                                                      0000000077362301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                                                           0000000077362792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                                  00000000773627b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                                00000000773627d2 8 bytes {JMP 0x10}
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                                 000000007736282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176                                                0000000077362890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                * 2
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                        0000000077362d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                                                        0000000077362d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                * 3
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                                                                0000000077363023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                                    000000007736323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                                                    00000000773633c0 16 bytes {JMP 0x4e}
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                                   0000000077363a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                                   0000000077363ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                                       0000000077363b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                                                       0000000077363d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                                0000000077364190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                          00000000773b1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                        00000000773b1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                              00000000773b1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                            00000000773b1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                00000000773b1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                00000000773b1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                              00000000773b1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                              00000000773b27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                            00000000743a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                            00000000743a146b 8 bytes {JMP 0xffffffffffffffb0}
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                         00000000743a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                                           00000000743a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                      00000000743a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                      00000000743a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                                                00000000743a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                                                  00000000743a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                                00000000743a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4100] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                                                     00000000743a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Steam\Steam.exe[5872] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                                                                    00000000743a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Steam\Steam.exe[5872] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                                                                    00000000743a146b 8 bytes {JMP 0xffffffffffffffb0}
.text     C:\Program Files (x86)\Steam\Steam.exe[5872] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                                                                 00000000743a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Steam\Steam.exe[5872] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                                                                                   00000000743a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Steam\Steam.exe[5872] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                                                              00000000743a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Steam\Steam.exe[5872] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                                                              00000000743a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Steam\Steam.exe[5872] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                                                                                        00000000743a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Steam\Steam.exe[5872] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                                                                                          00000000743a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Steam\Steam.exe[5872] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                                                                        00000000743a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Steam\Steam.exe[5872] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                                                                                             00000000743a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Steam\Steam.exe[5872] C:\Windows\syswow64\KERNELBASE.dll!HeapCreate                                                                                                                         0000000076b954a9 5 bytes JMP 00000001000a0800
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                                                                                     00000000773611f5 8 bytes {JMP 0xd}
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                                                                                   0000000077361390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                                          000000007736143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                                                                          000000007736158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                                                  000000007736191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                                                                                  0000000077361b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                                                                                 0000000077361bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                                                    0000000077361d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                                                                                    0000000077361eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                                                        0000000077361edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                                                                       0000000077361f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                                                                      0000000077361fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                                                                              0000000077361fd7 8 bytes {JMP 0xb}
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                                                                          0000000077362272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                                                                          0000000077362301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                                                                               0000000077362792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                                                      00000000773627b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                                                    00000000773627d2 8 bytes {JMP 0x10}
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                                                     000000007736282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176                                                                    0000000077362890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                * 2
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                                            0000000077362d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                                                                            0000000077362d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                * 3
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                                                                                    0000000077363023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                                                        000000007736323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                                                                        00000000773633c0 16 bytes {JMP 0x4e}
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                                                       0000000077363a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                                                       0000000077363ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                                                           0000000077363b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                                                                           0000000077363d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                                                    0000000077364190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                                              00000000773b1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                                            00000000773b1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                  00000000773b1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                                00000000773b1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                                    00000000773b1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                                    00000000773b1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                                  00000000773b1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                  00000000773b27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                                                00000000743a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                                                00000000743a146b 8 bytes {JMP 0xffffffffffffffb0}
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                                             00000000743a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                                                               00000000743a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                                          00000000743a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                                          00000000743a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                                                                    00000000743a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                                                                      00000000743a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                                                    00000000743a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                                                                         00000000743a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\syswow64\KERNELBASE.dll!HeapCreate                                                                                                     0000000076b954a9 5 bytes JMP 0000000100330800
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                                                                                           0000000077511465 2 bytes [51, 77]
.text     C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3804] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                                                                                          00000000775114bb 2 bytes [51, 77]
.text     ...                                                                                                                                                                                                                * 2
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                                                                                                           00000000773611f5 8 bytes {JMP 0xd}
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                                                                                                         0000000077361390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                                                                000000007736143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                                                                                                000000007736158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                                                                        000000007736191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                                                                                                        0000000077361b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                                                                                                       0000000077361bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                                                                          0000000077361d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                                                                                                          0000000077361eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                                                                              0000000077361edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                                                                                             0000000077361f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                                                                                            0000000077361fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                                                                                                    0000000077361fd7 8 bytes {JMP 0xb}
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                                                                                                0000000077362272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                                                                                                0000000077362301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                                                                                                     0000000077362792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                                                                            00000000773627b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                                                                          00000000773627d2 8 bytes {JMP 0x10}
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                                                                           000000007736282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176                                                                                          0000000077362890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                * 2
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                                                                  0000000077362d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                                                                                                  0000000077362d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     ...                                                                                                                                                                                                                * 3
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                                                                                                          0000000077363023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                                                                              000000007736323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                                                                                              00000000773633c0 16 bytes {JMP 0x4e}
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                                                                             0000000077363a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                                                                             0000000077363ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                                                                                 0000000077363b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                                                                                                 0000000077363d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                                                                          0000000077364190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                                                                    00000000773b1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                                                                  00000000773b1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                                        00000000773b1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                                                      00000000773b1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                                                          00000000773b1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                                                          00000000773b1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                                                        00000000773b1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                                        00000000773b27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                                                                      00000000743a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                                                                      00000000743a146b 8 bytes {JMP 0xffffffffffffffb0}
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                                                                   00000000743a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                                                                                     00000000743a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                                                                00000000743a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                                                                00000000743a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                                                                                          00000000743a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                                                                                            00000000743a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                                                                          00000000743a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text     C:\Users\User\Desktop\Gmer-19357.exe[6840] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                                                                                               00000000743a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

---- Threads - GMER 2.1 ----

Thread    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2920:2936]                                                                                                                                             00000000765e7587
Thread    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2920:2948]                                                                                                                                             000000006faf7712
Thread    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2920:2964]                                                                                                                                             0000000077592e65
Thread    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2920:3636]                                                                                                                                             0000000074ffd864
Thread    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2920:5624]                                                                                                                                             0000000077593e85
Thread    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2920:7128]                                                                                                                                             0000000077593e85
Thread    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2920:6072]                                                                                                                                             0000000077593e85
---- Processes - GMER 2.1 ----

Library   C:\Users\User\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll (*** suspicious ***) @ C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe [2872](2014-08-15 18:46:08)                                                0000000003d40000
Library   c:\users\user\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpaqf5dx.dll (*** suspicious ***) @ C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe [2872](2014-08-17 08:14:48)  00000000043f0000
Library   C:\Users\User\AppData\Roaming\Dropbox\bin\libcef.dll (*** suspicious ***) @ C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe [2872](2013-08-23 19:01:44)                                                      000000005c120000
Library   C:\Users\User\AppData\Roaming\Dropbox\bin\icudt.dll (*** suspicious ***) @ C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe [2872] (ICU Data DLL/The ICU Project)(2013-08-23 19:01:42)                        000000005b780000

---- Registry - GMER 2.1 ----

Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\446d57a390f2                                                                                                                                        
Reg       HKLM\SYSTEM\CurrentControlSet\services\KLIF\Parameters@LastProcessedRevision                                                                                                                                       114123641
Reg       HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\446d57a390f2 (not active ControlSet)                                                                                                                    

---- EOF - GMER 2.1 ----
         

So das müssten jetzt alle Log-Dateien gewesen sein.
Wenn die Dateien normal sind, kannst du mir dann sagen wie die Dateien dahin kommen?

Beste Grüße,
Max

von der Windows Installation

Achso, die sind mir nur noch nie aufgefallen und es hat mich stutzig gemacht, dass ein Datum angezeigt wird, das garnicht sein kann, weil mein Laptop erst vor drei Monaten neu aufgesetzt wurde. :P

Beste Grüße und Danke für deine Antworten,
Max

Windows 7 wurde halt en stück eher gebaut und entwickelt

Danke für die Info! ;-)
Jetzt bin ich beruhigt. :-P

ok