| |
| |||||||
Log-Analyse und Auswertung: Windows 7: Auf den meisten Webseiten kommt Werbung von DNSUnlocker!Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
14.10.2015, 15:39
| #1 |
| |  Windows 7: Auf den meisten Webseiten kommt Werbung von DNSUnlocker! Hallo Zusammen! Seit einigen Tagen bekomme ich bei den meisten Webseiten Werbung von DNSUnlocker eingeblendet! Ich bekomme diese Malware aber einfach nicht mehr runter!!! Ich bin schon allen Schritten aus diesem Beitrag gefolgt, --> http://www.trojaner-board.de/169694-...icht_entfernen jedoch bekomme ich meine Computer nicht rein. BITTE helft mir! Die Logfiles sind auch im Anhang weil sie für diesen Beitrag zu groß sind --> Addition.txt, Gmer.txt DANKE und lg Wolfgang defogger_disable.log Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 16:02 on 14/10/2015 (Wuff)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
FRST.txt Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:12-10-2015
durchgeführt von Wuff (Administrator) auf DOSE (14-10-2015 16:03:30)
Gestartet von C:\Users\Wuff\Desktop
Geladene Profile: Wuff (Verfügbare Profile: Wuff)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: IE)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AgileBits) C:\Program Files (x86)\1Password\Agile1pService.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
() C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsusFanControlService\1.01.02\AsusFanControlService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avp.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(DTS, Inc) C:\Program Files\Realtek\Audio\HDA\DTSU2PAuSrv64.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Shared\DTSRVC.exe
(Sanford, L.P.) C:\Program Files (x86)\DYMO\DYMO Label Software\DymoPnpService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Aladdin Knowledge Systems Ltd.) C:\Windows\System32\hasplms.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(Nalpeiron Ltd.) C:\Windows\SysWOW64\nlssrv32.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe
() C:\Windows\System32\PnkBstrA.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avpui.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.28.15\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.28.15\GoogleCrashHandler64.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\LGDevAgt.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
() C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe
() C:\Program Files\SteelSeries\SteelSeries Engine 3\SteelSeriesEngine3.exe
(Dropbox, Inc.) C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(AgileBits) C:\Program Files (x86)\1Password\Agile1pAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Disc Soft Ltd) C:\Program Files (x86)\DAEMON Tools Lite\DiscSoftBusService.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\concentr.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\redirector.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(GoPro) C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\Receiver\Receiver.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Portrait Displays, Inc) C:\Program Files (x86)\BenQ\Display Pilot\dthtml.exe
(Portrait Displays Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Shared\HookManager.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\Applets\LCDClock.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdiSDKHelper.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe
() C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpCtrl.exe
() C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\Floater.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\WMPSideShowGadget.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_19_0_0_207_ActiveX.exe
() C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\DP\DPHelper.exe
() C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\DP\DPHelper64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
==================== Registry (Nicht auf der Ausnahmeliste) ===========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6463592 2012-02-10] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_DTS] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1158248 2012-02-08] (Realtek Semiconductor)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [500208 2010-03-06] (Adobe Systems Incorporated)
HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [Launch LgDeviceAgent] => C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe [415816 2010-08-03] (Logitech Inc.)
HKLM\...\Run: [Launch LCDMon] => C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe [2412616 2010-08-03] (Logitech Inc.)
HKLM\...\Run: [Launch LGDCore] => C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe [4725320 2010-08-03] (Logitech Inc.)
HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2634872 2015-08-27] (NVIDIA Corporation)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170256 2015-09-23] (Apple Inc.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60688 2015-09-23] (Apple Inc.)
HKLM-x32\...\Run: [Agile1pAgent] => C:\Program Files (x86)\1Password\Agile1pAgent.exe [2248976 2014-09-17] (AgileBits)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-01] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-03-27] (Intel Corporation)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS5ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [402432 2010-07-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ConnectionCenter] => C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [395656 2013-10-01] (Citrix Systems, Inc.)
HKLM-x32\...\Run: [Redirector] => C:\Program Files (x86)\Citrix\ICA Client\redirector.exe [153992 2013-10-01] (Citrix Systems, Inc.)
HKLM-x32\...\Run: [DLSService] => "C:\Program Files (x86)\DYMO\DYMO Label Software\DLSService.exe"
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [GoPro Studio Importer] => C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe [3217672 2015-07-02] (GoPro)
HKLM-x32\...\Run: [PivotSoftware] => C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\Pivot_startup.exe [112424 2013-06-18] ()
HKLM-x32\...\Run: [DT BEN] => C:\Program Files (x86)\Common Files\Portrait Displays\Shared\DT_startup.exe [122336 2014-08-12] (Portrait Displays, Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2015-08-06] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [597552 2015-08-04] (Oracle Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-1612083073-1725845651-2389301402-1000\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22568208 2015-09-11] (Google)
HKU\S-1-5-21-1612083073-1725845651-2389301402-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2015-04-26] (Apple Inc.)
HKU\S-1-5-21-1612083073-1725845651-2389301402-1000\...\Run: [AppleIEDAV] => C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe [1079592 2015-04-26] (Apple Inc.)
HKU\S-1-5-21-1612083073-1725845651-2389301402-1000\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [43816 2015-04-26] (Apple Inc.)
HKU\S-1-5-21-1612083073-1725845651-2389301402-1000\...\Run: [Amazon Music] => C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe [6277952 2014-12-08] ()
HKU\S-1-5-21-1612083073-1725845651-2389301402-1000\...\Run: [Dropbox Update] => C:\Users\Wuff\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-21] (Dropbox, Inc.)
HKU\S-1-5-21-1612083073-1725845651-2389301402-1000\...\Run: [DAEMON Tools Lite Automount] => C:\Program Files (x86)\DAEMON Tools Lite\DTAgent.exe [4468056 2015-06-18] (Disc Soft Ltd)
HKU\S-1-5-21-1612083073-1725845651-2389301402-1000\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
HKU\S-1-5-21-1612083073-1725845651-2389301402-1000\...\MountPoints2: {0514ac27-fd4e-11e3-8fe9-c86000dd858a} - F:\Startme.exe
ShellIconOverlayIdentifiers: [ GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-09-11] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-09-11] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-09-11] (Google)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Wuff\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-10-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Wuff\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-10-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Wuff\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-10-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Wuff\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll [2015-10-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => Keine Datei
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Wuff\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-10-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Wuff\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-10-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Wuff\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-10-02] (Dropbox, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SteelSeries Engine 3.lnk [2014-12-30]
ShortcutTarget: SteelSeries Engine 3.lnk -> C:\Program Files\SteelSeries\SteelSeries Engine 3\SteelSeriesEngine3.exe ()
Startup: C:\Users\Wuff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2012-10-05]
ShortcutTarget: Dropbox.lnk -> C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
Hosts: Es ist mehr als ein Eintrag in der Hosts Datei zu finden. Siehe Hosts-Bereich in Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1
Tcpip\..\Interfaces\{663DF090-D1D6-46D7-8925-DF534D0F207A}: [DhcpNameServer] 192.168.1.1 192.168.1.1
Tcpip\..\Interfaces\{CD4AD847-8156-4535-AE13-6398FCD54D8C}: [DhcpNameServer] 192.168.1.1 192.168.1.1
Tcpip\..\Interfaces\{E39ADF19-EB4C-4C40-9FB1-441FB92D3B0F}: [DhcpNameServer] 192.168.1.1 192.168.1.1
Internet Explorer:
==================
HKU\S-1-5-21-1612083073-1725845651-2389301402-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.at/
HKU\S-1-5-21-1612083073-1725845651-2389301402-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://at.msn.com/?ocid=iehp
HKU\S-1-5-21-1612083073-1725845651-2389301402-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://at.msn.com/?ocid=OIE9HP
SearchScopes: HKU\S-1-5-21-1612083073-1725845651-2389301402-1000 -> DefaultScope {A13B781B-2C74-4498-AAC6-ED23A187E5C7} URL = hxxp://www.google.at/search?q={searchTerms}&rlz=
SearchScopes: HKU\S-1-5-21-1612083073-1725845651-2389301402-1000 -> {A13B781B-2C74-4498-AAC6-ED23A187E5C7} URL = hxxp://www.google.at/search?q={searchTerms}&rlz=
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-09-25] (Google Inc.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: Kaspersky Protection plugin -> {C66D064F-82FE-4E1A-B06A-B2490BA48B18} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\x64\IEExt\ie_plugin.dll [2015-07-08] (AO Kaspersky Lab)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_60\bin\ssv.dll [2015-09-12] (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-25] (Google Inc.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Kaspersky Protection plugin -> {C66D064F-82FE-4E1A-B06A-B2490BA48B18} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\IEExt\ie_plugin.dll [2015-07-08] (AO Kaspersky Lab)
BHO-x32: 1Password -> {CB1A24DA-7416-4921-A0CF-5AA1160AAE2A} -> C:\Program Files (x86)\1Password\Agile1pIE.dll [2014-09-17] (AgileBits)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_60\bin\jp2ssv.dll [2015-09-12] (Oracle Corporation)
Toolbar: HKLM - Kaspersky Protection toolbar - {3507FA00-ADA2-4A02-99B9-51AD26CA9120} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\x64\IEExt\ie_plugin.dll [2015-07-08] (AO Kaspersky Lab)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-09-25] (Google Inc.)
Toolbar: HKLM-x32 - Kaspersky Protection toolbar - {3507FA00-ADA2-4A02-99B9-51AD26CA9120} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\IEExt\ie_plugin.dll [2015-07-08] (AO Kaspersky Lab)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-25] (Google Inc.)
DPF: HKLM-x32 {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: HKLM-x32 {1ABA5FAC-1417-422B-BA82-45C35E2C908B} hxxp://kitchenplanner.ikea.com/AT/Core/Player/2020PlayerAX_IKEA_Win32.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2013-10-01] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2013-10-01] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2013-10-01] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2013-10-01] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2013-10-01] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2013-10-01] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2013-10-01] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2013-10-01] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2013-10-01] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2013-10-01] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2013-10-01] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2013-10-01] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2013-10-01] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2013-10-01] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2013-10-01] (Citrix Systems, Inc.)
Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2013-10-01] (Citrix Systems, Inc.)
FireFox:
========
FF ProfilePath: C:\Users\Wuff\AppData\Roaming\Mozilla\Firefox\Profiles\msgj34mr.default
FF Homepage: hxxp://www.google.at/
FF Keyword.URL: hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_19_0_0_207.dll [2015-10-14] ()
FF Plugin: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelogx64.dll [2014-12-03] (EA Digital Illusions CE AB)
FF Plugin: @esn/npbattlelog,version=2.7.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.7.1\npbattlelogx64.dll [2015-04-30] (EA Digital Illusions CE AB)
FF Plugin: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-30] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-30] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-30] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_207.dll [2015-10-14] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @Citrix.com/npican -> C:\Program Files (x86)\Citrix\ICA Client\npicaN.dll [2013-10-01] (Citrix Systems, Inc.)
FF Plugin-x32: @dymo.com/DymoLabelFramework -> C:\Program Files (x86)\DYMO\DYMO Label Software\Framework\npDYMOLabelFramework.dll [2014-03-20] ( Sanford L.P.)
FF Plugin-x32: @esn/esnlaunch,version=1.140.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.140.0\npesnlaunch.dll [Keine Datei]
FF Plugin-x32: @esn/esnlaunch,version=2.1.3 -> C:\Program Files (x86)\Battlelog Web Plugins\2.1.3\npesnlaunch.dll [Keine Datei]
FF Plugin-x32: @esn/npbattlelog,version=2.4.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.4.0\npbattlelog.dll [Keine Datei]
FF Plugin-x32: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelog.dll [2014-12-03] (EA Digital Illusions CE AB)
FF Plugin-x32: @esn/npbattlelog,version=2.7.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.7.1\npbattlelog.dll [2015-04-30] (EA Digital Illusions CE AB)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-21] (Google)
FF Plugin-x32: @google.com/sewebplugin -> C:\Windows\system32\npsewebplugin.dll [Keine Datei]
FF Plugin-x32: @java.com/DTPlugin,version=11.60.2 -> C:\Program Files (x86)\Java\jre1.8.0_60\bin\dtplugin\npDeployJava1.dll [2015-09-12] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.60.2 -> C:\Program Files (x86)\Java\jre1.8.0_60\bin\plugin2\npjp2.dll [2015-09-12] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Keine Datei]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-08-25] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-08-25] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-20] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-20] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-09-27] (Adobe Systems Inc.)
FF Extension: DownThemAll! - C:\Users\Wuff\AppData\Roaming\Mozilla\Firefox\Profiles\msgj34mr.default\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2015-08-31]
FF HKLM-x32\...\Firefox\Extensions: [light_plugin_D772DC8D6FAF43A29B25C4EBAA5AD1DE@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\FFExt\light_plugin_firefox
FF Extension: Kaspersky Protection - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\FFExt\light_plugin_firefox [2015-09-12]
FF Extension: Kein Name - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [nicht gefunden]
FF Extension: Kein Name - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [nicht gefunden]
FF Extension: Kein Name - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com [nicht gefunden]
FF Extension: Kein Name - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [nicht gefunden]
FF Extension: Kein Name - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com [nicht gefunden]
FF Extension: Kein Name - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com [nicht gefunden]
Chrome:
=======
CHR Profile: C:\Users\Wuff\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Wuff\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-13]
CHR Extension: (Google Drive) - C:\Users\Wuff\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-13]
CHR Extension: (YouTube) - C:\Users\Wuff\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-13]
CHR Extension: (Google Search) - C:\Users\Wuff\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-13]
CHR Extension: (Kaspersky URL Advisor) - C:\Users\Wuff\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj [2014-04-13]
CHR Extension: (Safe Money) - C:\Users\Wuff\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh [2014-04-13]
CHR Extension: (Content Blocker) - C:\Users\Wuff\AppData\Local\Google\Chrome\User Data\Default\Extensions\hghkgaeecgjhjkannahfamoehjmkjail [2014-04-13]
CHR Extension: (Virtual Keyboard) - C:\Users\Wuff\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh [2014-04-13]
CHR Extension: (Google Wallet) - C:\Users\Wuff\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-13]
CHR Extension: (Gmail) - C:\Users\Wuff\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-13]
CHR Extension: (Anti-Banner) - C:\Users\Wuff\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman [2014-04-13]
CHR HKLM\...\Chrome\Extension: [eahebamiopdhefndnmappcihfajigkka] - hxxps://chrome.google.com/webstore/detail/eahebamiopdhefndnmappcihfajigkka
CHR HKU\S-1-5-21-1612083073-1725845651-2389301402-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [eahebamiopdhefndnmappcihfajigkka] - hxxps://chrome.google.com/webstore/detail/eahebamiopdhefndnmappcihfajigkka
==================== Dienste (Nicht auf der Ausnahmeliste) ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 Agile1Password; C:\Program Files (x86)\1Password\Agile1pService.exe [768784 2014-09-17] (AgileBits)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-09-02] (Apple Inc.)
R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe [920736 2012-06-01] ()
R2 asHmComSvc; C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe [951936 2012-02-02] (ASUSTeK Computer Inc.)
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe [149120 2012-02-17] (ASUSTeK Computer Inc.)
R2 AsusFanControlService; C:\Program Files (x86)\ASUS\AsusFanControlService\1.01.02\AsusFanControlService.exe [1470592 2012-03-21] (ASUSTeK Computer Inc.)
R2 AVP16.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avp.exe [194000 2015-09-12] (Kaspersky Lab ZAO)
R3 Disc Soft Lite Bus Service; C:\Program Files (x86)\DAEMON Tools Lite\DiscSoftBusService.exe [1268568 2015-06-18] (Disc Soft Ltd)
R2 DTSAudioSvc; C:\Program Files\Realtek\Audio\HDA\DTSU2PAuSrv64.exe [233328 2012-01-23] (DTS, Inc)
R2 DTSRVC; C:\Program Files (x86)\Common Files\Portrait Displays\Shared\dtsrvc.exe [138720 2014-08-12] (Portrait Displays, Inc.)
R2 DymoPnpService; C:\Program Files (x86)\DYMO\DYMO Label Software\DymoPnpService.exe [33072 2014-03-20] (Sanford, L.P.)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1155192 2015-08-27] (NVIDIA Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
R2 nlsX86cc; C:\Windows\SysWOW64\nlssrv32.exe [66560 2011-12-19] (Nalpeiron Ltd.) [Datei ist nicht signiert]
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1872504 2015-08-27] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [5544568 2015-08-27] (NVIDIA Corporation)
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2078216 2015-10-04] (Electronic Arts)
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76152 2014-07-12] ()
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2012-12-02] ()
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [Datei ist nicht signiert]
S3 vssbrigde64; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\x64\vssbridge64.exe [144640 2015-07-09] (AO Kaspersky Lab)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 MSSQL$KNXETS4; "C:\Program Files (x86)\Microsoft SQL Server\MSSQL10_50.KNXETS4\MSSQL\Binn\sqlservr.exe" -sKNXETS4 [X]
S4 SQLAgent$KNXETS4; "C:\Program Files (x86)\Microsoft SQL Server\MSSQL10_50.KNXETS4\MSSQL\Binn\SQLAGENT.EXE" -i KNXETS4 [X]
===================== Treiber (Nicht auf der Ausnahmeliste) ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-24] ()
S3 ATSZIO; C:\Program Files (x86)\ASUS\ASUS PC Diagnostics\ATSZIO64.sys [19584 2012-04-12] ()
R0 cm_km; C:\Windows\System32\DRIVERS\cm_km.sys [389816 2015-07-06] (Kaspersky Lab ZAO)
R3 dtlitescsibus; C:\Windows\System32\DRIVERS\dtlitescsibus.sys [30264 2015-08-09] (Disc Soft Ltd)
S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
S3 ggsomc; C:\Windows\System32\DRIVERS\ggsomc.sys [30424 2014-09-11] (Sony Mobile Communications)
R0 hotcore3; C:\Windows\System32\DRIVERS\hotcore3.sys [37392 2010-05-20] (Paragon Software Group)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [478392 2015-06-22] (Kaspersky Lab ZAO)
R0 klbackupdisk; C:\Windows\System32\DRIVERS\klbackupdisk.sys [53432 2015-06-06] (Kaspersky Lab ZAO)
R1 klbackupflt; C:\Windows\System32\DRIVERS\klbackupflt.sys [70000 2015-06-27] (Kaspersky Lab ZAO)
R2 kldisk; C:\Windows\System32\DRIVERS\kldisk.sys [68280 2015-06-06] (Kaspersky Lab ZAO)
R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [171192 2015-06-30] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [227000 2015-07-04] (AO Kaspersky Lab)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [931000 2015-06-30] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [39096 2015-06-11] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [41144 2015-06-06] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [41648 2015-06-07] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [41352 2015-09-28] (AO Kaspersky Lab)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [65208 2015-06-11] (Kaspersky Lab ZAO)
R1 Klwtp; C:\Windows\System32\DRIVERS\klwtp.sys [103096 2015-06-16] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [187056 2015-06-23] (Kaspersky Lab ZAO)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-10-05] (Malwarebytes Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19576 2015-08-27] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [50472 2015-08-11] (NVIDIA Corporation)
S3 PCAMp50a64; C:\Windows\System32\Drivers\PCAMp50a64.sys [43328 2006-11-28] (Printing Communications Assoc., Inc. (PCAUSA))
S3 PCASp50a64; C:\Windows\System32\Drivers\PCASp50a64.sys [41280 2006-11-28] (Printing Communications Assoc., Inc. (PCAUSA))
S4 RsFx0153; C:\Windows\System32\DRIVERS\RsFx0153.sys [321992 2012-06-29] (Microsoft Corporation)
R3 sshid; C:\Windows\System32\DRIVERS\sshid.sys [38912 2014-10-30] (SteelSeries ApS)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2014-08-15] (Apple, Inc.) [Datei ist nicht signiert]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S3 WPN111; system32\DRIVERS\WPN111vx.sys [X]
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2015-10-14 16:03 - 2015-10-14 16:03 - 00038528 _____ C:\Users\Wuff\Desktop\FRST.txt
2015-10-14 16:03 - 2015-10-14 16:03 - 00000000 ____D C:\FRST
2015-10-14 16:02 - 2015-10-14 16:02 - 00000470 _____ C:\Users\Wuff\Desktop\defogger_disable.log
2015-10-14 16:02 - 2015-10-14 16:02 - 00000000 _____ C:\Users\Wuff\defogger_reenable
2015-10-14 16:01 - 2015-10-14 16:01 - 00380416 _____ C:\Users\Wuff\Desktop\Gmer-19357.exe
2015-10-14 15:59 - 2015-10-14 15:59 - 02196480 _____ (Farbar) C:\Users\Wuff\Desktop\FRST64.exe
2015-10-14 15:57 - 2015-10-14 15:57 - 00050477 _____ C:\Users\Wuff\Desktop\Defogger.exe
2015-10-14 15:11 - 2015-10-14 15:15 - 00000000 ____D C:\ProgramData\HitmanPro
2015-10-14 15:11 - 2015-10-14 15:11 - 00000000 ____D C:\Program Files\HitmanPro
2015-10-14 14:25 - 2015-10-14 14:25 - 00000000 ____D C:\Program Files (x86)\ESET
2015-10-14 13:32 - 2015-10-14 15:39 - 00000000 ____D C:\AdwCleaner
2015-10-14 12:53 - 2015-10-14 12:53 - 00003126 _____ C:\Windows\System32\Tasks\{9DD43648-5A2B-4EC1-878D-8843EAA21C60}
2015-10-14 11:34 - 2015-10-14 15:31 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-10-14 11:34 - 2015-10-14 11:34 - 00001112 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-10-14 11:34 - 2015-10-14 11:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-10-14 11:34 - 2015-10-14 11:34 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-10-14 11:34 - 2015-10-14 11:34 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-10-14 11:34 - 2015-10-05 09:50 - 00109272 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-10-14 11:34 - 2015-10-05 09:50 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-10-14 11:34 - 2015-10-05 09:50 - 00025816 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2015-10-04 10:48 - 2015-07-30 15:13 - 00124624 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-10-04 10:48 - 2015-07-30 15:13 - 00103120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-10-04 10:46 - 2015-08-05 20:02 - 00157016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-10-04 10:46 - 2015-08-05 20:02 - 00097112 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-10-04 10:46 - 2015-08-05 19:56 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-10-04 10:46 - 2015-08-05 19:56 - 01216512 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-10-04 10:46 - 2015-08-05 19:56 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-10-04 10:46 - 2015-08-05 19:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-10-04 10:46 - 2015-08-05 19:56 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-10-04 10:46 - 2015-08-05 19:56 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-10-04 10:46 - 2015-08-05 19:56 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-10-04 10:46 - 2015-08-05 19:56 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-10-04 10:46 - 2015-08-05 19:56 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-10-04 10:46 - 2015-08-05 19:56 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2015-10-04 10:46 - 2015-08-05 19:56 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-10-04 10:46 - 2015-08-05 19:56 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-10-04 10:46 - 2015-08-05 19:56 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\icaapi.dll
2015-10-04 10:46 - 2015-08-05 19:56 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-10-04 10:46 - 2015-08-05 19:55 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-10-04 10:46 - 2015-08-05 19:55 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-10-04 10:46 - 2015-08-05 19:50 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-10-04 10:46 - 2015-08-05 19:50 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-10-04 10:46 - 2015-08-05 19:46 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-10-04 10:46 - 2015-08-05 19:41 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-10-04 10:46 - 2015-08-05 19:41 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-10-04 10:46 - 2015-08-05 19:41 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-10-04 10:46 - 2015-08-05 19:41 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-10-04 10:46 - 2015-08-05 19:40 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-10-04 10:46 - 2015-08-05 19:40 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-10-04 10:46 - 2015-08-05 19:40 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-10-04 10:46 - 2015-08-05 19:40 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2015-10-04 10:46 - 2015-08-05 19:40 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-10-04 10:46 - 2015-08-05 19:39 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-10-04 10:46 - 2015-08-05 19:39 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-10-04 10:46 - 2015-08-05 19:39 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-10-04 10:46 - 2015-08-05 19:34 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-10-04 10:46 - 2015-08-05 19:34 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-10-04 10:46 - 2015-08-05 19:30 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-10-04 10:46 - 2015-08-05 19:06 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2015-10-04 10:46 - 2015-08-05 18:38 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-10-04 10:46 - 2015-08-05 18:37 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-10-04 10:46 - 2015-08-05 18:37 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-10-04 10:46 - 2015-07-18 15:08 - 00984448 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00901264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ucrtbase.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00066400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-private-l1-1-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00063840 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00022368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-math-l1-1-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00020832 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00019808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00019808 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00017760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-string-l1-1-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00017760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00016224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00016224 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00015712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00015712 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00014176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-time-l1-1-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00014176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00013664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00013664 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-process-l1-1-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-eventing-provider-l1-1-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l2-1-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-eventing-provider-l1-1-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll
2015-10-04 10:46 - 2015-07-18 15:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll
2015-10-04 10:22 - 2015-10-04 10:22 - 00000000 ____D C:\Users\Wuff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-09-28 18:30 - 2015-09-28 18:30 - 00001759 _____ C:\Users\Public\Desktop\iTunes.lnk
2015-09-28 18:30 - 2015-09-28 18:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-09-28 18:30 - 2015-09-28 18:30 - 00000000 ____D C:\Program Files\iTunes
2015-09-28 18:30 - 2015-09-28 18:30 - 00000000 ____D C:\Program Files\iPod
2015-09-28 18:30 - 2015-09-28 18:30 - 00000000 ____D C:\Program Files (x86)\iTunes
2015-09-28 18:29 - 2015-09-28 18:29 - 00000000 ____D C:\Windows\System32\Tasks\Apple
2015-09-28 18:29 - 2015-09-28 18:29 - 00000000 ____D C:\Program Files\Bonjour
2015-09-28 18:29 - 2015-09-28 18:29 - 00000000 ____D C:\Program Files (x86)\Bonjour
2015-09-28 18:29 - 2015-09-28 18:29 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2015-10-14 16:02 - 2012-10-05 16:30 - 00000000 ____D C:\Users\Wuff
2015-10-14 15:56 - 2009-07-14 06:45 - 00015152 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-10-14 15:56 - 2009-07-14 06:45 - 00015152 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-10-14 15:54 - 2009-07-14 19:58 - 00831760 _____ C:\Windows\system32\perfh007.dat
2015-10-14 15:54 - 2009-07-14 19:58 - 00199600 _____ C:\Windows\system32\perfc007.dat
2015-10-14 15:54 - 2009-07-14 07:13 - 01992674 _____ C:\Windows\system32\PerfStringBackup.INI
2015-10-14 15:52 - 2013-07-01 21:05 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-10-14 15:51 - 2012-10-05 16:30 - 01112608 _____ C:\Windows\WindowsUpdate.log
2015-10-14 15:49 - 2012-10-05 20:01 - 00000000 ____D C:\Users\Wuff\AppData\Roaming\Dropbox
2015-10-14 15:48 - 2014-09-11 22:38 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2015-10-14 15:48 - 2014-01-14 14:53 - 00209823 _____ C:\Windows\setupact.log
2015-10-14 15:48 - 2013-03-17 14:07 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-10-14 15:48 - 2012-10-05 19:45 - 00000198 _____ C:\Windows\Tasks\AutoKMS.job
2015-10-14 15:48 - 2012-10-05 17:12 - 00000000 ____D C:\ProgramData\NVIDIA
2015-10-14 15:48 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-10-14 15:30 - 2015-06-21 08:20 - 00001220 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1612083073-1725845651-2389301402-1000UA.job
2015-10-14 15:10 - 2015-06-22 13:33 - 00000000 ____D C:\Program Files (x86)\Rs
2015-10-14 15:10 - 2014-09-13 21:06 - 00000000 ____D C:\Users\Wuff\AppData\Roaming\uTorrent
2015-10-14 14:52 - 2013-07-01 21:05 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-10-14 14:52 - 2012-10-05 22:52 - 00780488 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-10-14 14:52 - 2012-10-05 22:52 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-10-14 14:27 - 2014-01-15 19:50 - 00053944 _____ C:\Windows\PFRO.log
2015-10-14 13:43 - 2009-07-14 20:18 - 00000000 ____D C:\Windows\RemotePackages
2015-10-14 13:43 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\Cursors
2015-10-14 13:40 - 2013-10-22 21:12 - 00003910 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{EC3F5380-0119-4CEB-97D7-BABCAC381129}
2015-10-14 12:57 - 2014-01-12 12:24 - 00000000 ____D C:\ProgramData\Sony Mobile
2015-10-14 12:57 - 2014-01-12 12:24 - 00000000 ____D C:\Program Files (x86)\Sony Mobile
2015-10-14 12:57 - 2012-10-05 18:01 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2015-10-14 11:30 - 2015-06-21 08:20 - 00001168 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1612083073-1725845651-2389301402-1000Core.job
2015-10-14 11:27 - 2014-01-14 14:53 - 00328759 _____ C:\Windows\AutoKMS.log
2015-10-14 10:24 - 2014-10-18 10:11 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-10-14 10:23 - 2014-12-25 10:18 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-10-14 10:10 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-10-11 18:23 - 2012-12-25 17:15 - 00000000 ____D C:\Program Files (x86)\Lidl_Fotos
2015-10-04 10:56 - 2015-01-06 11:19 - 00226168 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2015-10-04 10:56 - 2012-10-05 20:28 - 00214392 _____ C:\Windows\SysWOW64\PnkBstrB.ex0
2015-10-04 10:50 - 2013-07-05 08:41 - 00000000 ____D C:\ProgramData\Package Cache
2015-10-04 10:50 - 2012-10-05 18:51 - 00000000 ____D C:\ProgramData\Origin
2015-10-04 10:50 - 2012-10-05 18:51 - 00000000 ____D C:\Program Files (x86)\Origin
2015-10-04 10:21 - 2013-03-17 14:10 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2015-09-28 18:30 - 2012-10-05 19:59 - 00000000 ____D C:\Program Files\Common Files\Apple
2015-09-28 18:29 - 2012-10-05 19:59 - 00002519 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2015-09-28 18:01 - 2015-06-08 19:43 - 00041352 _____ (AO Kaspersky Lab) C:\Windows\system32\Drivers\klpd.sys
2015-09-20 20:02 - 2013-03-17 14:07 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-09-20 20:02 - 2013-03-17 14:07 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-09-20 20:02 - 2013-03-17 14:07 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2014-09-18 20:06 - 2014-09-18 20:07 - 0044086 __RSH () C:\Program Files (x86)\DLS8Uninstall.log
2013-07-26 16:23 - 2013-07-26 16:23 - 0007833 _____ () C:\Users\Wuff\AppData\Roaming\ezplay.cat
2013-07-26 16:23 - 2013-07-26 16:23 - 0001126 _____ () C:\Users\Wuff\AppData\Roaming\ezplay.inf
2013-07-26 16:23 - 2013-07-26 16:23 - 0000125 _____ () C:\Users\Wuff\AppData\Roaming\ezplay.ini
2013-07-26 16:23 - 2013-07-26 16:23 - 0000074 _____ () C:\Users\Wuff\AppData\Roaming\ezplay.log
2013-07-26 16:23 - 2013-07-26 16:23 - 0118400 _____ (VSO Software) C:\Users\Wuff\AppData\Roaming\ezplay.sys
2013-07-26 16:23 - 2013-07-26 16:23 - 0099384 _____ () C:\Users\Wuff\AppData\Roaming\inst.exe
2014-04-13 22:09 - 2014-04-13 22:09 - 0000600 _____ () C:\Users\Wuff\AppData\Roaming\winscp.rnd
2014-01-06 23:15 - 2015-05-31 11:53 - 0000702 _____ () C:\Users\Wuff\AppData\Local\CastleLinkProps.dat
2014-04-13 22:08 - 2014-04-13 22:09 - 0000600 _____ () C:\Users\Wuff\AppData\Local\PUTTY.RND
2014-01-14 21:41 - 2014-01-14 21:41 - 0007601 _____ () C:\Users\Wuff\AppData\Local\Resmon.ResmonCfg
2008-02-05 13:28 - 2008-02-05 13:28 - 0000051 _____ () C:\Users\Wuff\AppData\Local\setup.txt
2012-10-05 19:06 - 2012-10-05 19:06 - 0017408 _____ () C:\Users\Wuff\AppData\Local\WebpageIcons.db
Einige Dateien in TEMP:
====================
C:\Users\Wuff\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpsnivpg.dll
C:\Users\Wuff\AppData\Local\Temp\Uninstall.exe
==================== Bamital & volsnap =================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2015-10-14 14:46
==================== Ende von FRST.txt ============================
Geändert von halflife1409 (14.10.2015 um 16:02 Uhr) |
|
14.10.2015, 16:24
| #2 |
| /// the machine /// TB-Ausbilder    | Windows 7: Auf den meisten Webseiten kommt Werbung von DNSUnlocker! Hi,
__________________Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen. Ich kann auf Arbeit keine Anhänge öffnen, danke.  So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
14.10.2015, 16:43
| #3 |
| | Gmer.txt - Teil 1Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-10-14 16:27:29
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 SAMSUNG_ rev.CXM0 238,47GB
Running: Gmer-19357.exe; Driver: C:\Users\Wuff\AppData\Local\Temp\pgddapow.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\1Password\Agile1pService.exe[2020] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075521401 2 bytes JMP 7572b20b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\1Password\Agile1pService.exe[2020] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075521419 2 bytes JMP 7572b336 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\1Password\Agile1pService.exe[2020] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075521431 2 bytes JMP 757a8f39 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\1Password\Agile1pService.exe[2020] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007552144a 2 bytes CALL 75704885 C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\1Password\Agile1pService.exe[2020] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000755214dd 2 bytes JMP 757a8832 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\1Password\Agile1pService.exe[2020] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000755214f5 2 bytes JMP 757a8a08 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\1Password\Agile1pService.exe[2020] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007552150d 2 bytes JMP 757a8728 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\1Password\Agile1pService.exe[2020] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075521525 2 bytes JMP 757a8af2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\1Password\Agile1pService.exe[2020] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007552153d 2 bytes JMP 7571fc98 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\1Password\Agile1pService.exe[2020] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075521555 2 bytes JMP 757268df C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\1Password\Agile1pService.exe[2020] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007552156d 2 bytes JMP 757a8ff1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\1Password\Agile1pService.exe[2020] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075521585 2 bytes JMP 757a8b52 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\1Password\Agile1pService.exe[2020] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007552159d 2 bytes JMP 757a86ec C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\1Password\Agile1pService.exe[2020] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000755215b5 2 bytes JMP 7571fd31 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\1Password\Agile1pService.exe[2020] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000755215cd 2 bytes JMP 7572b2cc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\1Password\Agile1pService.exe[2020] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000755216b2 2 bytes JMP 757a8eb4 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\1Password\Agile1pService.exe[2020] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000755216bd 2 bytes JMP 757a8681 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avp.exe[2160] C:\Windows\SysWOW64\ntdll.dll!NtQueryValueKey 0000000077a1fae8 5 bytes JMP 00000001708a28d0
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avp.exe[2160] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077a20078 5 bytes JMP 00000001708a2890
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avp.exe[2160] C:\Windows\syswow64\USER32.dll!UserClientDllInitialize + 779 00000000772ab9f8 4 bytes [B0, 3C, 8A, 70]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avp.exe[2160] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075521401 2 bytes JMP 7572b20b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avp.exe[2160] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075521419 2 bytes JMP 7572b336 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avp.exe[2160] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075521431 2 bytes JMP 757a8f39 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avp.exe[2160] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007552144a 2 bytes CALL 75704885 C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avp.exe[2160] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000755214dd 2 bytes JMP 757a8832 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avp.exe[2160] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000755214f5 2 bytes JMP 757a8a08 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avp.exe[2160] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007552150d 2 bytes JMP 757a8728 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avp.exe[2160] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075521525 2 bytes JMP 757a8af2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avp.exe[2160] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007552153d 2 bytes JMP 7571fc98 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avp.exe[2160] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075521555 2 bytes JMP 757268df C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avp.exe[2160] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007552156d 2 bytes JMP 757a8ff1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avp.exe[2160] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075521585 2 bytes JMP 757a8b52 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avp.exe[2160] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007552159d 2 bytes JMP 757a86ec C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avp.exe[2160] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000755215b5 2 bytes JMP 7571fd31 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avp.exe[2160] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000755215cd 2 bytes JMP 7572b2cc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avp.exe[2160] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000755216b2 2 bytes JMP 757a8eb4 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avp.exe[2160] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000755216bd 2 bytes JMP 757a8681 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\system32\hasplms.exe[2512] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075521401 2 bytes JMP 7572b20b C:\Windows\syswow64\kernel32.dll
.text C:\Windows\system32\hasplms.exe[2512] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075521419 2 bytes JMP 7572b336 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\system32\hasplms.exe[2512] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075521431 2 bytes JMP 757a8f39 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\system32\hasplms.exe[2512] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007552144a 2 bytes CALL 75704885 C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Windows\system32\hasplms.exe[2512] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000755214dd 2 bytes JMP 757a8832 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\system32\hasplms.exe[2512] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000755214f5 2 bytes JMP 757a8a08 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\system32\hasplms.exe[2512] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007552150d 2 bytes JMP 757a8728 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\system32\hasplms.exe[2512] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075521525 2 bytes JMP 757a8af2 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\system32\hasplms.exe[2512] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007552153d 2 bytes JMP 7571fc98 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\system32\hasplms.exe[2512] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075521555 2 bytes JMP 757268df C:\Windows\syswow64\kernel32.dll
.text C:\Windows\system32\hasplms.exe[2512] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007552156d 2 bytes JMP 757a8ff1 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\system32\hasplms.exe[2512] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075521585 2 bytes JMP 757a8b52 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\system32\hasplms.exe[2512] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007552159d 2 bytes JMP 757a86ec C:\Windows\syswow64\kernel32.dll
.text C:\Windows\system32\hasplms.exe[2512] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000755215b5 2 bytes JMP 7571fd31 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\system32\hasplms.exe[2512] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000755215cd 2 bytes JMP 7572b2cc C:\Windows\syswow64\kernel32.dll
.text C:\Windows\system32\hasplms.exe[2512] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000755216b2 2 bytes JMP 757a8eb4 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\system32\hasplms.exe[2512] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000755216bd 2 bytes JMP 757a8681 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\system32\PnkBstrA.exe[2824] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075521401 2 bytes JMP 7572b20b C:\Windows\syswow64\kernel32.dll
.text C:\Windows\system32\PnkBstrA.exe[2824] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075521419 2 bytes JMP 7572b336 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\system32\PnkBstrA.exe[2824] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075521431 2 bytes JMP 757a8f39 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\system32\PnkBstrA.exe[2824] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007552144a 2 bytes CALL 75704885 C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Windows\system32\PnkBstrA.exe[2824] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000755214dd 2 bytes JMP 757a8832 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\system32\PnkBstrA.exe[2824] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000755214f5 2 bytes JMP 757a8a08 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\system32\PnkBstrA.exe[2824] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007552150d 2 bytes JMP 757a8728 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\system32\PnkBstrA.exe[2824] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075521525 2 bytes JMP 757a8af2 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\system32\PnkBstrA.exe[2824] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007552153d 2 bytes JMP 7571fc98 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\system32\PnkBstrA.exe[2824] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075521555 2 bytes JMP 757268df C:\Windows\syswow64\kernel32.dll
.text C:\Windows\system32\PnkBstrA.exe[2824] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007552156d 2 bytes JMP 757a8ff1 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\system32\PnkBstrA.exe[2824] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075521585 2 bytes JMP 757a8b52 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\system32\PnkBstrA.exe[2824] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007552159d 2 bytes JMP 757a86ec C:\Windows\syswow64\kernel32.dll
.text C:\Windows\system32\PnkBstrA.exe[2824] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000755215b5 2 bytes JMP 7571fd31 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\system32\PnkBstrA.exe[2824] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000755215cd 2 bytes JMP 7572b2cc C:\Windows\syswow64\kernel32.dll
.text C:\Windows\system32\PnkBstrA.exe[2824] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000755216b2 2 bytes JMP 757a8eb4 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\system32\PnkBstrA.exe[2824] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000755216bd 2 bytes JMP 757a8681 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2848] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 0000000075521401 2 bytes JMP 7572b20b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2848] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17 0000000075521419 2 bytes JMP 7572b336 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2848] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17 0000000075521431 2 bytes JMP 757a8f39 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2848] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42 000000007552144a 2 bytes CALL 75704885 C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2848] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 00000000755214dd 2 bytes JMP 757a8832 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2848] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 00000000755214f5 2 bytes JMP 757a8a08 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2848] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 000000007552150d 2 bytes JMP 757a8728 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2848] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 0000000075521525 2 bytes JMP 757a8af2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2848] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 000000007552153d 2 bytes JMP 7571fc98 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2848] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17 0000000075521555 2 bytes JMP 757268df C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2848] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 000000007552156d 2 bytes JMP 757a8ff1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2848] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17 0000000075521585 2 bytes JMP 757a8b52 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2848] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17 000000007552159d 2 bytes JMP 757a86ec C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2848] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 00000000755215b5 2 bytes JMP 7571fd31 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2848] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 00000000755215cd 2 bytes JMP 7572b2cc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2848] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 00000000755216b2 2 bytes JMP 757a8eb4 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2848] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 00000000755216bd 2 bytes JMP 757a8681 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe[5092] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000778213ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe[5092] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077821544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe[5092] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000778218ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe[5092] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077821ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe[5092] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077821d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe[5092] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077821e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe[5092] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077821f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe[5092] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077822238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe[5092] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778226e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe[5092] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007786da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe[5092] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007786dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe[5092] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007786dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe[5092] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007786dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe[5092] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007786de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe[5092] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007786e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe[5092] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007786e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe[5092] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007786eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe[5092] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe[5092] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe[5092] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe[5092] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe[5092] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe[5092] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000778213ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077821544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000778218ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077821ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077821d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077821e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077821f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077822238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778226e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007786da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007786dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007786dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007786dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007786de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007786e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007786e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007786eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000076ce2ab1 5 bytes JMP 000000010011f4f2
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075521401 2 bytes JMP 7572b20b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075521419 2 bytes JMP 7572b336 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075521431 2 bytes JMP 757a8f39 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007552144a 2 bytes CALL 75704885 C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000755214dd 2 bytes JMP 757a8832 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000755214f5 2 bytes JMP 757a8a08 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007552150d 2 bytes JMP 757a8728 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075521525 2 bytes JMP 757a8af2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007552153d 2 bytes JMP 7571fc98 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075521555 2 bytes JMP 757268df C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007552156d 2 bytes JMP 757a8ff1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075521585 2 bytes JMP 757a8b52 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007552159d 2 bytes JMP 757a86ec C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000755215b5 2 bytes JMP 7571fd31 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000755215cd 2 bytes JMP 7572b2cc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000755216b2 2 bytes JMP 757a8eb4 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5676] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000755216bd 2 bytes JMP 757a8681 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[5756] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000778213ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[5756] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077821544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[5756] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000778218ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[5756] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077821ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[5756] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077821d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[5756] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077821e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[5756] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077821f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[5756] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077822238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[5756] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778226e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[5756] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007786da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[5756] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007786dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[5756] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007786dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[5756] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007786dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[5756] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007786de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[5756] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007786e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[5756] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007786e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[5756] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007786eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[5756] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[5756] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[5756] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[5756] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[5756] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[5756] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000778213ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077821544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000778218ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077821ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077821d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077821e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077821f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077822238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778226e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007786da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007786dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007786dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007786dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007786de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007786e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007786e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007786eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[5812] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[5812] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[5812] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[5812] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[5812] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[5812] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000778213ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077821544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000778218ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077821ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077821d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077821e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077821f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077822238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778226e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007786da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007786dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007786dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007786dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007786de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007786e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007786e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007786eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[5836] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[5836] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[5836] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[5836] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[5836] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[5836] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000778213ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077821544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000778218ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077821ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077821d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077821e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077821f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077822238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778226e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007786da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007786dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007786dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007786dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007786de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007786e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007786e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007786eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe[5856] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe[5856] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe[5856] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe[5856] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe[5856] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe[5856] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe[5856] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075521401 2 bytes JMP 7572b20b C:\Windows\syswow64\kernel32.dll
.text C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe[5856] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075521419 2 bytes JMP 7572b336 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe[5856] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075521431 2 bytes JMP 757a8f39 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe[5856] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007552144a 2 bytes CALL 75704885 C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe[5856] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000755214dd 2 bytes JMP 757a8832 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe[5856] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000755214f5 2 bytes JMP 757a8a08 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe[5856] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007552150d 2 bytes JMP 757a8728 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe[5856] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075521525 2 bytes JMP 757a8af2 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe[5856] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007552153d 2 bytes JMP 7571fc98 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe[5856] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075521555 2 bytes JMP 757268df C:\Windows\syswow64\kernel32.dll
.text C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe[5856] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007552156d 2 bytes JMP 757a8ff1 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe[5856] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075521585 2 bytes JMP 757a8b52 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe[5856] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007552159d 2 bytes JMP 757a86ec C:\Windows\syswow64\kernel32.dll
.text C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe[5856] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000755215b5 2 bytes JMP 7571fd31 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe[5856] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000755215cd 2 bytes JMP 7572b2cc C:\Windows\syswow64\kernel32.dll
.text C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe[5856] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000755216b2 2 bytes JMP 757a8eb4 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe[5856] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000755216bd 2 bytes JMP 757a8681 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000778213ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077821544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000778218ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077821ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077821d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077821e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077821f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077822238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778226e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007786da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007786dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007786dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007786dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007786de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007786e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007786e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007786eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[6112] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[6112] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[6112] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[6112] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[6112] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[6112] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[6112] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075521401 2 bytes JMP 7572b20b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[6112] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075521419 2 bytes JMP 7572b336 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[6112] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075521431 2 bytes JMP 757a8f39 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[6112] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007552144a 2 bytes CALL 75704885 C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[6112] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000755214dd 2 bytes JMP 757a8832 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[6112] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000755214f5 2 bytes JMP 757a8a08 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[6112] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007552150d 2 bytes JMP 757a8728 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[6112] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075521525 2 bytes JMP 757a8af2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[6112] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007552153d 2 bytes JMP 7571fc98 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[6112] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075521555 2 bytes JMP 757268df C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[6112] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007552156d 2 bytes JMP 757a8ff1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[6112] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075521585 2 bytes JMP 757a8b52 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[6112] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007552159d 2 bytes JMP 757a86ec C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[6112] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000755215b5 2 bytes JMP 7571fd31 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[6112] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000755215cd 2 bytes JMP 7572b2cc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[6112] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000755216b2 2 bytes JMP 757a8eb4 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[6112] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000755216bd 2 bytes JMP 757a8681 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Wuff\AppData\Local\NVIDIA\NvBackend\ApplicationOntology\NvOAWrapperCache.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000778213ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Wuff\AppData\Local\NVIDIA\NvBackend\ApplicationOntology\NvOAWrapperCache.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077821544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Wuff\AppData\Local\NVIDIA\NvBackend\ApplicationOntology\NvOAWrapperCache.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000778218ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Wuff\AppData\Local\NVIDIA\NvBackend\ApplicationOntology\NvOAWrapperCache.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077821ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Wuff\AppData\Local\NVIDIA\NvBackend\ApplicationOntology\NvOAWrapperCache.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077821d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Wuff\AppData\Local\NVIDIA\NvBackend\ApplicationOntology\NvOAWrapperCache.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077821e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Wuff\AppData\Local\NVIDIA\NvBackend\ApplicationOntology\NvOAWrapperCache.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077821f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Wuff\AppData\Local\NVIDIA\NvBackend\ApplicationOntology\NvOAWrapperCache.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077822238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Wuff\AppData\Local\NVIDIA\NvBackend\ApplicationOntology\NvOAWrapperCache.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778226e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Wuff\AppData\Local\NVIDIA\NvBackend\ApplicationOntology\NvOAWrapperCache.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007786da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text C:\Users\Wuff\AppData\Local\NVIDIA\NvBackend\ApplicationOntology\NvOAWrapperCache.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007786dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text C:\Users\Wuff\AppData\Local\NVIDIA\NvBackend\ApplicationOntology\NvOAWrapperCache.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007786dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text C:\Users\Wuff\AppData\Local\NVIDIA\NvBackend\ApplicationOntology\NvOAWrapperCache.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007786dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text C:\Users\Wuff\AppData\Local\NVIDIA\NvBackend\ApplicationOntology\NvOAWrapperCache.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007786de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text C:\Users\Wuff\AppData\Local\NVIDIA\NvBackend\ApplicationOntology\NvOAWrapperCache.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007786e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text C:\Users\Wuff\AppData\Local\NVIDIA\NvBackend\ApplicationOntology\NvOAWrapperCache.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007786e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text C:\Users\Wuff\AppData\Local\NVIDIA\NvBackend\ApplicationOntology\NvOAWrapperCache.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007786eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text C:\Users\Wuff\AppData\Local\NVIDIA\NvBackend\ApplicationOntology\NvOAWrapperCache.exe[5600] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Wuff\AppData\Local\NVIDIA\NvBackend\ApplicationOntology\NvOAWrapperCache.exe[5600] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Users\Wuff\AppData\Local\NVIDIA\NvBackend\ApplicationOntology\NvOAWrapperCache.exe[5600] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Wuff\AppData\Local\NVIDIA\NvBackend\ApplicationOntology\NvOAWrapperCache.exe[5600] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Wuff\AppData\Local\NVIDIA\NvBackend\ApplicationOntology\NvOAWrapperCache.exe[5600] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Wuff\AppData\Local\NVIDIA\NvBackend\ApplicationOntology\NvOAWrapperCache.exe[5600] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe[6284] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000778213ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe[6284] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077821544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe[6284] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000778218ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe[6284] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077821ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe[6284] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077821d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe[6284] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077821e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe[6284] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077821f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe[6284] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077822238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe[6284] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778226e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe[6284] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007786da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe[6284] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007786dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe[6284] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007786dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe[6284] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007786dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe[6284] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007786de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe[6284] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007786e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe[6284] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007786e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe[6284] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007786eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe[6284] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe[6284] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe[6284] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe[6284] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe[6284] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe[6284] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe[6284] C:\Windows\syswow64\Psapi.dll!GetModuleFileNameExW + 17 0000000075521401 2 bytes JMP 7572b20b C:\Windows\syswow64\kernel32.dll
.text C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe[6284] C:\Windows\syswow64\Psapi.dll!EnumProcessModules + 17 0000000075521419 2 bytes JMP 7572b336 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe[6284] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 17 0000000075521431 2 bytes JMP 757a8f39 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe[6284] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 42 000000007552144a 2 bytes CALL 75704885 C:\Windows\syswow64\kernel32.dll
.text ...
|
|
14.10.2015, 16:46
| #4 |
| | Gmer.txt - Teil 2Code:
ATTFilter .text C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe[6284] C:\Windows\syswow64\Psapi.dll!EnumDeviceDrivers + 17 00000000755214dd 2 bytes JMP 757a8832 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe[6284] C:\Windows\syswow64\Psapi.dll!GetDeviceDriverBaseNameA + 17 00000000755214f5 2 bytes JMP 757a8a08 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe[6284] C:\Windows\syswow64\Psapi.dll!QueryWorkingSetEx + 17 000000007552150d 2 bytes JMP 757a8728 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe[6284] C:\Windows\syswow64\Psapi.dll!GetDeviceDriverBaseNameW + 17 0000000075521525 2 bytes JMP 757a8af2 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe[6284] C:\Windows\syswow64\Psapi.dll!GetModuleBaseNameW + 17 000000007552153d 2 bytes JMP 7571fc98 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe[6284] C:\Windows\syswow64\Psapi.dll!EnumProcesses + 17 0000000075521555 2 bytes JMP 757268df C:\Windows\syswow64\kernel32.dll
.text C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe[6284] C:\Windows\syswow64\Psapi.dll!GetProcessMemoryInfo + 17 000000007552156d 2 bytes JMP 757a8ff1 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe[6284] C:\Windows\syswow64\Psapi.dll!GetPerformanceInfo + 17 0000000075521585 2 bytes JMP 757a8b52 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe[6284] C:\Windows\syswow64\Psapi.dll!QueryWorkingSet + 17 000000007552159d 2 bytes JMP 757a86ec C:\Windows\syswow64\kernel32.dll
.text C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe[6284] C:\Windows\syswow64\Psapi.dll!GetModuleBaseNameA + 17 00000000755215b5 2 bytes JMP 7571fd31 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe[6284] C:\Windows\syswow64\Psapi.dll!GetModuleFileNameExA + 17 00000000755215cd 2 bytes JMP 7572b2cc C:\Windows\syswow64\kernel32.dll
.text C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe[6284] C:\Windows\syswow64\Psapi.dll!GetProcessImageFileNameW + 20 00000000755216b2 2 bytes JMP 757a8eb4 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe[6284] C:\Windows\syswow64\Psapi.dll!GetProcessImageFileNameW + 31 00000000755216bd 2 bytes JMP 757a8681 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\1Password\Agile1pAgent.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000778213ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\1Password\Agile1pAgent.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077821544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\1Password\Agile1pAgent.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000778218ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\1Password\Agile1pAgent.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077821ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\1Password\Agile1pAgent.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077821d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\1Password\Agile1pAgent.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077821e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\1Password\Agile1pAgent.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077821f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\1Password\Agile1pAgent.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077822238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\1Password\Agile1pAgent.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778226e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\1Password\Agile1pAgent.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007786da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text C:\Program Files (x86)\1Password\Agile1pAgent.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007786dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text C:\Program Files (x86)\1Password\Agile1pAgent.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007786dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text C:\Program Files (x86)\1Password\Agile1pAgent.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007786dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text C:\Program Files (x86)\1Password\Agile1pAgent.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007786de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text C:\Program Files (x86)\1Password\Agile1pAgent.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007786e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text C:\Program Files (x86)\1Password\Agile1pAgent.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007786e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text C:\Program Files (x86)\1Password\Agile1pAgent.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007786eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text C:\Program Files (x86)\1Password\Agile1pAgent.exe[6444] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\1Password\Agile1pAgent.exe[6444] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\1Password\Agile1pAgent.exe[6444] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\1Password\Agile1pAgent.exe[6444] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\1Password\Agile1pAgent.exe[6444] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\1Password\Agile1pAgent.exe[6444] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[6476] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000778213ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[6476] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077821544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[6476] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000778218ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[6476] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077821ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[6476] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077821d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[6476] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077821e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[6476] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077821f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[6476] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077822238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[6476] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778226e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[6476] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007786da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[6476] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007786dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[6476] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007786dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[6476] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007786dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[6476] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007786de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[6476] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007786e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[6476] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007786e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[6476] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007786eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[6476] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[6476] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[6476] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[6476] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[6476] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[6476] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[6636] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000778213ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[6636] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077821544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[6636] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000778218ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[6636] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077821ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[6636] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077821d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[6636] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077821e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[6636] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077821f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[6636] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077822238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[6636] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778226e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[6636] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007786da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[6636] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007786dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[6636] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007786dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[6636] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007786dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[6636] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007786de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[6636] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007786e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[6636] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007786e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[6636] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007786eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[6636] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[6636] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[6636] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[6636] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[6636] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[6636] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[6636] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075521401 2 bytes JMP 7572b20b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[6636] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075521419 2 bytes JMP 7572b336 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[6636] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075521431 2 bytes JMP 757a8f39 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[6636] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007552144a 2 bytes CALL 75704885 C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[6636] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000755214dd 2 bytes JMP 757a8832 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[6636] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000755214f5 2 bytes JMP 757a8a08 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[6636] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007552150d 2 bytes JMP 757a8728 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[6636] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075521525 2 bytes JMP 757a8af2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[6636] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007552153d 2 bytes JMP 7571fc98 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[6636] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075521555 2 bytes JMP 757268df C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[6636] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007552156d 2 bytes JMP 757a8ff1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[6636] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075521585 2 bytes JMP 757a8b52 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[6636] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007552159d 2 bytes JMP 757a86ec C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[6636] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000755215b5 2 bytes JMP 7571fd31 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[6636] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000755215cd 2 bytes JMP 7572b2cc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[6636] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000755216b2 2 bytes JMP 757a8eb4 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\concentr.exe[6636] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000755216bd 2 bytes JMP 757a8681 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[6648] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000778213ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[6648] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077821544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[6648] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000778218ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[6648] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077821ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[6648] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077821d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[6648] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077821e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[6648] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077821f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[6648] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077822238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[6648] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778226e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[6648] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007786da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[6648] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007786dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[6648] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007786dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[6648] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007786dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[6648] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007786de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[6648] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007786e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[6648] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007786e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[6648] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007786eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[6648] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[6648] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[6648] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[6648] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[6648] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[6648] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[6648] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075521401 2 bytes JMP 7572b20b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[6648] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075521419 2 bytes JMP 7572b336 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[6648] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075521431 2 bytes JMP 757a8f39 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[6648] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007552144a 2 bytes CALL 75704885 C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[6648] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000755214dd 2 bytes JMP 757a8832 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[6648] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000755214f5 2 bytes JMP 757a8a08 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[6648] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007552150d 2 bytes JMP 757a8728 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[6648] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075521525 2 bytes JMP 757a8af2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[6648] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007552153d 2 bytes JMP 7571fc98 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[6648] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075521555 2 bytes JMP 757268df C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[6648] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007552156d 2 bytes JMP 757a8ff1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[6648] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075521585 2 bytes JMP 757a8b52 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[6648] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007552159d 2 bytes JMP 757a86ec C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[6648] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000755215b5 2 bytes JMP 7571fd31 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[6648] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000755215cd 2 bytes JMP 7572b2cc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[6648] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000755216b2 2 bytes JMP 757a8eb4 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\redirector.exe[6648] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000755216bd 2 bytes JMP 757a8681 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6656] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000778213ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6656] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077821544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6656] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000778218ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6656] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077821ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6656] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077821d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6656] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077821e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6656] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077821f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6656] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077822238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6656] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778226e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6656] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007786da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6656] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007786dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6656] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007786dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6656] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007786dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6656] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007786de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6656] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007786e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6656] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007786e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6656] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007786eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6656] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6656] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6656] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6656] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6656] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6656] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6656] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 0000000075521401 2 bytes JMP 7572b20b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6656] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17 0000000075521419 2 bytes JMP 7572b336 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6656] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17 0000000075521431 2 bytes JMP 757a8f39 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6656] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42 000000007552144a 2 bytes CALL 75704885 C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6656] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 00000000755214dd 2 bytes JMP 757a8832 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6656] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 00000000755214f5 2 bytes JMP 757a8a08 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6656] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 000000007552150d 2 bytes JMP 757a8728 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6656] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 0000000075521525 2 bytes JMP 757a8af2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6656] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 000000007552153d 2 bytes JMP 7571fc98 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6656] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17 0000000075521555 2 bytes JMP 757268df C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6656] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 000000007552156d 2 bytes JMP 757a8ff1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6656] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17 0000000075521585 2 bytes JMP 757a8b52 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6656] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17 000000007552159d 2 bytes JMP 757a86ec C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6656] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 00000000755215b5 2 bytes JMP 7571fd31 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6656] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 00000000755215cd 2 bytes JMP 7572b2cc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6656] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 00000000755216b2 2 bytes JMP 757a8eb4 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[6656] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 00000000755216bd 2 bytes JMP 757a8681 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe[6724] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000778213ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe[6724] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077821544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe[6724] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000778218ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe[6724] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077821ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe[6724] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077821d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe[6724] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077821e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe[6724] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077821f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe[6724] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077822238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe[6724] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778226e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe[6724] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007786da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe[6724] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007786dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe[6724] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007786dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe[6724] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007786dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe[6724] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007786de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe[6724] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007786e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe[6724] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007786e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe[6724] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007786eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe[6724] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe[6724] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe[6724] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe[6724] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe[6724] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe[6724] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe[6724] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075521401 2 bytes JMP 7572b20b C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe[6724] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075521419 2 bytes JMP 7572b336 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe[6724] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075521431 2 bytes JMP 757a8f39 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe[6724] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007552144a 2 bytes CALL 75704885 C:\Windows\syswow64\KERNEL32.dll
.text ... * 9
.text C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe[6724] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000755214dd 2 bytes JMP 757a8832 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe[6724] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000755214f5 2 bytes JMP 757a8a08 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe[6724] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007552150d 2 bytes JMP 757a8728 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe[6724] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075521525 2 bytes JMP 757a8af2 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe[6724] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007552153d 2 bytes JMP 7571fc98 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe[6724] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075521555 2 bytes JMP 757268df C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe[6724] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007552156d 2 bytes JMP 757a8ff1 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe[6724] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075521585 2 bytes JMP 757a8b52 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe[6724] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007552159d 2 bytes JMP 757a86ec C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe[6724] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000755215b5 2 bytes JMP 7571fd31 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe[6724] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000755215cd 2 bytes JMP 7572b2cc C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe[6724] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000755216b2 2 bytes JMP 757a8eb4 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe[6724] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000755216bd 2 bytes JMP 757a8681 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[6752] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000778213ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[6752] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077821544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[6752] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000778218ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[6752] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077821ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[6752] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077821d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[6752] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077821e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[6752] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077821f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[6752] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077822238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[6752] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778226e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[6752] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007786da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[6752] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007786dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[6752] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007786dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[6752] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007786dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[6752] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007786de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[6752] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007786e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[6752] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007786e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[6752] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007786eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[6752] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[6752] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[6752] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[6752] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[6752] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[6752] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[6752] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075521401 2 bytes JMP 7572b20b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[6752] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075521419 2 bytes JMP 7572b336 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[6752] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075521431 2 bytes JMP 757a8f39 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[6752] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007552144a 2 bytes CALL 75704885 C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[6752] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000755214dd 2 bytes JMP 757a8832 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[6752] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000755214f5 2 bytes JMP 757a8a08 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[6752] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007552150d 2 bytes JMP 757a8728 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[6752] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075521525 2 bytes JMP 757a8af2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[6752] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007552153d 2 bytes JMP 7571fc98 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[6752] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075521555 2 bytes JMP 757268df C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[6752] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007552156d 2 bytes JMP 757a8ff1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[6752] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075521585 2 bytes JMP 757a8b52 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[6752] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007552159d 2 bytes JMP 757a86ec C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[6752] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000755215b5 2 bytes JMP 7571fd31 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[6752] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000755215cd 2 bytes JMP 7572b2cc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[6752] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000755216b2 2 bytes JMP 757a8eb4 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\Receiver\Receiver.exe[6752] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000755216bd 2 bytes JMP 757a8681 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\BenQ\Display Pilot\DTHtml.exe[6788] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000778213ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\BenQ\Display Pilot\DTHtml.exe[6788] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077821544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\BenQ\Display Pilot\DTHtml.exe[6788] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000778218ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\BenQ\Display Pilot\DTHtml.exe[6788] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077821ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\BenQ\Display Pilot\DTHtml.exe[6788] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077821d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\BenQ\Display Pilot\DTHtml.exe[6788] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077821e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\BenQ\Display Pilot\DTHtml.exe[6788] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077821f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\BenQ\Display Pilot\DTHtml.exe[6788] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077822238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\BenQ\Display Pilot\DTHtml.exe[6788] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778226e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\BenQ\Display Pilot\DTHtml.exe[6788] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007786da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text C:\Program Files (x86)\BenQ\Display Pilot\DTHtml.exe[6788] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007786dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text C:\Program Files (x86)\BenQ\Display Pilot\DTHtml.exe[6788] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007786dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text C:\Program Files (x86)\BenQ\Display Pilot\DTHtml.exe[6788] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007786dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text C:\Program Files (x86)\BenQ\Display Pilot\DTHtml.exe[6788] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007786de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text C:\Program Files (x86)\BenQ\Display Pilot\DTHtml.exe[6788] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007786e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text C:\Program Files (x86)\BenQ\Display Pilot\DTHtml.exe[6788] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007786e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text C:\Program Files (x86)\BenQ\Display Pilot\DTHtml.exe[6788] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007786eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text C:\Program Files (x86)\BenQ\Display Pilot\DTHtml.exe[6788] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\BenQ\Display Pilot\DTHtml.exe[6788] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\BenQ\Display Pilot\DTHtml.exe[6788] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\BenQ\Display Pilot\DTHtml.exe[6788] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\BenQ\Display Pilot\DTHtml.exe[6788] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\BenQ\Display Pilot\DTHtml.exe[6788] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[6804] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000778213ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[6804] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077821544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[6804] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000778218ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[6804] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077821ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[6804] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077821d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[6804] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077821e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[6804] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077821f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[6804] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077822238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[6804] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778226e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[6804] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007786da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[6804] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007786dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[6804] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007786dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[6804] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007786dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[6804] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007786de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[6804] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007786e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[6804] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007786e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[6804] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007786eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[6804] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[6804] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[6804] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[6804] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[6804] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[6804] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[7200] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000778213ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[7200] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077821544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[7200] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000778218ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[7200] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077821ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[7200] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077821d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[7200] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077821e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[7200] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077821f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[7200] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077822238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[7200] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778226e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[7200] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007786da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[7200] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007786dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[7200] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007786dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[7200] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007786dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[7200] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007786de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[7200] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007786e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[7200] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007786e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[7200] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007786eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[7200] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[7200] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[7200] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[7200] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[7200] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[7200] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[7200] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 0000000075521401 2 bytes JMP 7572b20b C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[7200] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17 0000000075521419 2 bytes JMP 7572b336 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[7200] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17 0000000075521431 2 bytes JMP 757a8f39 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[7200] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42 000000007552144a 2 bytes CALL 75704885 C:\Windows\syswow64\KERNEL32.dll
.text ... * 9
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[7200] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 00000000755214dd 2 bytes JMP 757a8832 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[7200] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 00000000755214f5 2 bytes JMP 757a8a08 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[7200] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 000000007552150d 2 bytes JMP 757a8728 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[7200] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 0000000075521525 2 bytes JMP 757a8af2 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[7200] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 000000007552153d 2 bytes JMP 7571fc98 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[7200] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17 0000000075521555 2 bytes JMP 757268df C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[7200] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 000000007552156d 2 bytes JMP 757a8ff1 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[7200] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17 0000000075521585 2 bytes JMP 757a8b52 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[7200] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17 000000007552159d 2 bytes JMP 757a86ec C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[7200] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 00000000755215b5 2 bytes JMP 7571fd31 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[7200] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 00000000755215cd 2 bytes JMP 7572b2cc C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[7200] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 00000000755216b2 2 bytes JMP 757a8eb4 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe[7200] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31
|
|
14.10.2015, 16:47
| #5 |
| | Gmer.txt - Teil 3Code:
ATTFilter .text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000778213ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077821544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000778218ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077821ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077821d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077821e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077821f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077822238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778226e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007786da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007786dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007786dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007786dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007786de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007786e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007786e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007786eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[7280] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[7280] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[7280] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[7280] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[7280] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[7280] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[7280] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075521401 2 bytes JMP 7572b20b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[7280] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075521419 2 bytes JMP 7572b336 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[7280] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075521431 2 bytes JMP 757a8f39 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[7280] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007552144a 2 bytes CALL 75704885 C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[7280] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000755214dd 2 bytes JMP 757a8832 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[7280] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000755214f5 2 bytes JMP 757a8a08 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[7280] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007552150d 2 bytes JMP 757a8728 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[7280] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075521525 2 bytes JMP 757a8af2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[7280] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007552153d 2 bytes JMP 7571fc98 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[7280] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075521555 2 bytes JMP 757268df C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[7280] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007552156d 2 bytes JMP 757a8ff1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[7280] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075521585 2 bytes JMP 757a8b52 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[7280] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007552159d 2 bytes JMP 757a86ec C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[7280] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000755215b5 2 bytes JMP 7571fd31 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[7280] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000755215cd 2 bytes JMP 7572b2cc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[7280] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000755216b2 2 bytes JMP 757a8eb4 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe[7280] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000755216bd 2 bytes JMP 757a8681 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe[7784] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000778213ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe[7784] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077821544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe[7784] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000778218ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe[7784] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077821ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe[7784] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077821d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe[7784] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077821e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe[7784] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077821f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe[7784] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077822238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe[7784] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778226e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe[7784] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007786da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe[7784] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007786dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe[7784] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007786dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe[7784] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007786dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe[7784] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007786de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe[7784] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007786e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe[7784] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007786e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe[7784] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007786eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe[7784] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe[7784] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe[7784] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe[7784] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe[7784] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe[7784] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdiSdkHelper.exe[7816] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000778213ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdiSdkHelper.exe[7816] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077821544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdiSdkHelper.exe[7816] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000778218ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdiSdkHelper.exe[7816] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077821ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdiSdkHelper.exe[7816] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077821d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdiSdkHelper.exe[7816] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077821e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdiSdkHelper.exe[7816] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077821f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdiSdkHelper.exe[7816] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077822238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdiSdkHelper.exe[7816] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778226e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdiSdkHelper.exe[7816] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007786da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdiSdkHelper.exe[7816] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007786dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdiSdkHelper.exe[7816] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007786dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdiSdkHelper.exe[7816] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007786dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdiSdkHelper.exe[7816] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007786de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdiSdkHelper.exe[7816] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007786e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdiSdkHelper.exe[7816] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007786e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdiSdkHelper.exe[7816] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007786eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdiSdkHelper.exe[7816] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdiSdkHelper.exe[7816] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdiSdkHelper.exe[7816] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdiSdkHelper.exe[7816] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdiSdkHelper.exe[7816] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdiSdkHelper.exe[7816] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpctrl.exe[6292] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000778213ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpctrl.exe[6292] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077821544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpctrl.exe[6292] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000778218ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpctrl.exe[6292] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077821ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpctrl.exe[6292] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077821d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpctrl.exe[6292] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077821e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpctrl.exe[6292] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077821f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpctrl.exe[6292] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077822238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpctrl.exe[6292] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778226e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpctrl.exe[6292] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007786da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpctrl.exe[6292] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007786dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpctrl.exe[6292] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007786dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpctrl.exe[6292] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007786dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpctrl.exe[6292] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007786de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpctrl.exe[6292] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007786e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpctrl.exe[6292] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007786e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpctrl.exe[6292] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007786eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpctrl.exe[6292] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpctrl.exe[6292] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpctrl.exe[6292] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpctrl.exe[6292] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpctrl.exe[6292] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpctrl.exe[6292] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\floater.exe[8012] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000778213ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\floater.exe[8012] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077821544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\floater.exe[8012] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000778218ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\floater.exe[8012] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077821ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\floater.exe[8012] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077821d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\floater.exe[8012] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077821e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\floater.exe[8012] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077821f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\floater.exe[8012] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077822238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\floater.exe[8012] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778226e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\floater.exe[8012] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007786da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\floater.exe[8012] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007786dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\floater.exe[8012] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007786dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\floater.exe[8012] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007786dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\floater.exe[8012] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007786de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\floater.exe[8012] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007786e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\floater.exe[8012] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007786e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\floater.exe[8012] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007786eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\floater.exe[8012] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\floater.exe[8012] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\floater.exe[8012] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\floater.exe[8012] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\floater.exe[8012] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\floater.exe[8012] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Windows Media Player\wmplayer.exe[8076] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000778213ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Windows Media Player\wmplayer.exe[8076] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077821544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Windows Media Player\wmplayer.exe[8076] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000778218ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Windows Media Player\wmplayer.exe[8076] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077821ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Windows Media Player\wmplayer.exe[8076] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077821d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Windows Media Player\wmplayer.exe[8076] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077821e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Windows Media Player\wmplayer.exe[8076] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077821f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Windows Media Player\wmplayer.exe[8076] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077822238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Windows Media Player\wmplayer.exe[8076] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778226e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Windows Media Player\wmplayer.exe[8076] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007786da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text C:\Program Files (x86)\Windows Media Player\wmplayer.exe[8076] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007786dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text C:\Program Files (x86)\Windows Media Player\wmplayer.exe[8076] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007786dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text C:\Program Files (x86)\Windows Media Player\wmplayer.exe[8076] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007786dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text C:\Program Files (x86)\Windows Media Player\wmplayer.exe[8076] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007786de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text C:\Program Files (x86)\Windows Media Player\wmplayer.exe[8076] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007786e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text C:\Program Files (x86)\Windows Media Player\wmplayer.exe[8076] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007786e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text C:\Program Files (x86)\Windows Media Player\wmplayer.exe[8076] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007786eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text C:\Program Files (x86)\Windows Media Player\wmplayer.exe[8076] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Windows Media Player\wmplayer.exe[8076] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Windows Media Player\wmplayer.exe[8076] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Windows Media Player\wmplayer.exe[8076] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Windows Media Player\wmplayer.exe[8076] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Windows Media Player\wmplayer.exe[8076] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe[8348] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000778213ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe[8348] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077821544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe[8348] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000778218ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe[8348] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077821ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe[8348] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077821d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe[8348] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077821e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe[8348] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077821f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe[8348] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077822238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe[8348] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778226e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe[8348] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007786da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe[8348] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007786dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe[8348] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007786dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe[8348] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007786dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe[8348] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007786de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe[8348] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007786e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe[8348] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007786e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe[8348] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007786eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe[8348] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe[8348] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe[8348] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe[8348] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe[8348] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe[8348] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe[8348] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075521401 2 bytes JMP 7572b20b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe[8348] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075521419 2 bytes JMP 7572b336 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe[8348] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075521431 2 bytes JMP 757a8f39 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe[8348] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007552144a 2 bytes CALL 75704885 C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe[8348] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000755214dd 2 bytes JMP 757a8832 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe[8348] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000755214f5 2 bytes JMP 757a8a08 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe[8348] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007552150d 2 bytes JMP 757a8728 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe[8348] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075521525 2 bytes JMP 757a8af2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe[8348] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007552153d 2 bytes JMP 7571fc98 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe[8348] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075521555 2 bytes JMP 757268df C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe[8348] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007552156d 2 bytes JMP 757a8ff1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe[8348] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075521585 2 bytes JMP 757a8b52 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe[8348] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007552159d 2 bytes JMP 757a86ec C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe[8348] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000755215b5 2 bytes JMP 7571fd31 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe[8348] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000755215cd 2 bytes JMP 7572b2cc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe[8348] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000755216b2 2 bytes JMP 757a8eb4 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetiCtrlTray.exe[8348] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000755216bd 2 bytes JMP 757a8681 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe[8520] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000778213ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe[8520] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077821544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe[8520] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000778218ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe[8520] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077821ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe[8520] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077821d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe[8520] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077821e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe[8520] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077821f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe[8520] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077822238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe[8520] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778226e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe[8520] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007786da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe[8520] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007786dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe[8520] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007786dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe[8520] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007786dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe[8520] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007786de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe[8520] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007786e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe[8520] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007786e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe[8520] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007786eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe[8520] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe[8520] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe[8520] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe[8520] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe[8520] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe[8520] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe[8520] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075521401 2 bytes JMP 7572b20b C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe[8520] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075521419 2 bytes JMP 7572b336 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe[8520] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075521431 2 bytes JMP 757a8f39 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe[8520] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007552144a 2 bytes CALL 75704885 C:\Windows\syswow64\KERNEL32.dll
.text ... * 9
.text C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe[8520] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000755214dd 2 bytes JMP 757a8832 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe[8520] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000755214f5 2 bytes JMP 757a8a08 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe[8520] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007552150d 2 bytes JMP 757a8728 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe[8520] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075521525 2 bytes JMP 757a8af2 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe[8520] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007552153d 2 bytes JMP 7571fc98 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe[8520] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075521555 2 bytes JMP 757268df C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe[8520] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007552156d 2 bytes JMP 757a8ff1 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe[8520] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075521585 2 bytes JMP 757a8b52 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe[8520] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007552159d 2 bytes JMP 757a86ec C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe[8520] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000755215b5 2 bytes JMP 7571fd31 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe[8520] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000755215cd 2 bytes JMP 7572b2cc C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe[8520] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000755216b2 2 bytes JMP 757a8eb4 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\ET\EtHost.exe[8520] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000755216bd 2 bytes JMP 757a8681 C:\Windows\syswow64\KERNEL32.dll
.text C:\Users\Wuff\Desktop\Gmer-19357.exe[8660] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000778213ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Wuff\Desktop\Gmer-19357.exe[8660] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077821544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Wuff\Desktop\Gmer-19357.exe[8660] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000778218ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Wuff\Desktop\Gmer-19357.exe[8660] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077821ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Wuff\Desktop\Gmer-19357.exe[8660] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077821d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Wuff\Desktop\Gmer-19357.exe[8660] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077821e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Wuff\Desktop\Gmer-19357.exe[8660] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077821f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Wuff\Desktop\Gmer-19357.exe[8660] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077822238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Wuff\Desktop\Gmer-19357.exe[8660] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778226e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Wuff\Desktop\Gmer-19357.exe[8660] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007786da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text C:\Users\Wuff\Desktop\Gmer-19357.exe[8660] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007786dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text C:\Users\Wuff\Desktop\Gmer-19357.exe[8660] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007786dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text C:\Users\Wuff\Desktop\Gmer-19357.exe[8660] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007786dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text C:\Users\Wuff\Desktop\Gmer-19357.exe[8660] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007786de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text C:\Users\Wuff\Desktop\Gmer-19357.exe[8660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007786e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text C:\Users\Wuff\Desktop\Gmer-19357.exe[8660] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007786e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text C:\Users\Wuff\Desktop\Gmer-19357.exe[8660] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007786eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text C:\Users\Wuff\Desktop\Gmer-19357.exe[8660] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Wuff\Desktop\Gmer-19357.exe[8660] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Users\Wuff\Desktop\Gmer-19357.exe[8660] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Wuff\Desktop\Gmer-19357.exe[8660] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Wuff\Desktop\Gmer-19357.exe[8660] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Wuff\Desktop\Gmer-19357.exe[8660] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
---- Processes - GMER 2.1 ----
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\python27.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112] (Python Core/Python Software Foundation)(2015-10-14 14:19:53) 000000001e000000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\win32api.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112](2015-10-14 14:19:53) 000000001e8c0000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\pywintypes27.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112](2015-10-14 14:19:53) 000000001e7a0000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\pythoncom27.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112](2015-10-14 14:19:53) 0000000000300000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\_socket.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112](2015-10-14 14:19:53) 00000000002e0000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\_ssl.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112](2015-10-14 14:19:53) 0000000010000000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\win32com.shell.shell.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112](2015-10-14 14:19:53) 000000001e800000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\_hashlib.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112](2015-10-14 14:19:53) 0000000002c90000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\wx._core_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112](2015-10-14 14:19:53) 0000000002d60000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\wxbase30u_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112] (wxWidgets base library/wxWidgets development team)(2015-10-14 14:19:53) 0000000002e90000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\wxbase30u_net_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112] (wxWidgets network library/wxWidgets development team)(2015-10-14 14:19:53) 0000000000390000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\wxmsw30u_core_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112] (wxWidgets core library/wxWidgets development team)(2015-10-14 14:19:53) 0000000003090000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\wxmsw30u_adv_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112] (wxWidgets advanced library/wxWidgets development team)(2015-10-14 14:19:53) 0000000003560000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\wx._gdi_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112](2015-10-14 14:19:53) 00000000037a0000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\wx._windows_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112](2015-10-14 14:19:53) 0000000004240000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\wxmsw30u_html_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112] (wxWidgets html library/wxWidgets development team)(2015-10-14 14:19:53) 0000000002100000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\wx._controls_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112](2015-10-14 14:19:53) 0000000004310000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\wx._misc_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112](2015-10-14 14:19:53) 0000000004420000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\pysqlite2._sqlite.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112](2015-10-14 14:19:53) 00000000044e0000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\_ctypes.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112](2015-10-14 14:19:53) 000000001d1a0000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\win32file.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112](2015-10-14 14:19:53) 000000001ea10000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\win32security.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112](2015-10-14 14:19:53) 000000001ec80000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\hashobjs_ext.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112](2015-10-14 14:19:53) 0000000000690000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\usb_ext.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112](2015-10-14 14:19:53) 00000000008c0000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\win32gui.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112](2015-10-14 14:19:53) 000000001ea40000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\win32event.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112](2015-10-14 14:19:53) 000000001e9b0000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\_elementtree.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112](2015-10-14 14:19:53) 000000001d100000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\pyexpat.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112](2015-10-14 14:19:53) 00000000008e0000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\common.time34.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112](2015-10-14 14:19:53) 00000000006a0000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\_psutil_windows.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112](2015-10-14 14:19:53) 0000000000910000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\win32inet.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112](2015-10-14 14:19:53) 000000001eaa0000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\win32crypt.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112](2015-10-14 14:19:53) 000000001e980000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\wx._html2.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112](2015-10-14 14:19:53) 0000000005660000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\wxmsw30u_webview_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112] (wxWidgets webview library/wxWidgets development team)(2015-10-14 14:19:53) 00000000056a0000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\_multiprocessing.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112](2015-10-14 14:19:53) 00000000021a0000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\_yappi.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112](2015-10-14 14:19:53) 0000000003870000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\win32process.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112](2015-10-14 14:19:53) 000000001ebf0000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\unicodedata.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112](2015-10-14 14:19:53) 0000000005810000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\wx._wizard.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112](2015-10-14 14:19:53) 00000000056c0000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\win32pipe.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112](2015-10-14 14:19:53) 000000001eb90000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\select.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112](2015-10-14 14:19:53) 0000000005680000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\win32pdh.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112](2015-10-14 14:19:53) 000000001eb60000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\win32profile.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112](2015-10-14 14:19:53) 000000001ec20000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\win32ts.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112](2015-10-14 14:19:53) 000000001ed40000
Library C:\Users\Wuff\AppData\Local\Temp\_MEI57562\wx._animate.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [6112](2015-10-14 14:19:53) 00000000056f0000
Library C:\Users\Wuff\AppData\Roaming\Dropbox\bin\PYTHON27.DLL (*** suspicious ***) @ C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe [6284] (Python Core/Python Software Foundation)(2015-10-04 08:22:08) 000000001e000000
Library c:\users\wuff\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpgvjksq.dll (*** suspicious ***) @ C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe [6284](2015-10-14 14:19:58) 0000000060e50000
Library C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Qt5Core.dll (*** suspicious ***) @ C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe [6284] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:24) 000000005f2d0000
Library C:\Users\Wuff\AppData\Roaming\Dropbox\bin\icuin55.dll (*** suspicious ***) @ C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe [6284] (ICU I18N DLL/The ICU Project)(2015-08-03 14:51:46) 000000004a900000
Library C:\Users\Wuff\AppData\Roaming\Dropbox\bin\icuuc55.dll (*** suspicious ***) @ C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe [6284] (ICU Common DLL/The ICU Project)(2015-08-03 14:51:46) 0000000005af0000
Library C:\Users\Wuff\AppData\Roaming\Dropbox\bin\icudt55.dll (*** suspicious ***) @ C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe [6284] (ICU Data DLL/The ICU Project)(2015-08-03 14:51:46) 000000005da10000
Library C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Qt5Widgets.dll (*** suspicious ***) @ C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe [6284] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:28) 000000005d550000
Library C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Qt5Gui.dll (*** suspicious ***) @ C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe [6284] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 000000005d110000
Library C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Qt5Network.dll (*** suspicious ***) @ C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe [6284] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 000000005cd30000
Library C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Qt5WebKit.dll (*** suspicious ***) @ C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe [6284] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 000000005bc90000
Library C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Qt5Quick.dll (*** suspicious ***) @ C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe [6284] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 000000005b900000
Library C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Qt5Qml.dll (*** suspicious ***) @ C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe [6284] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 000000005b690000
Library C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Qt5WebChannel.dll (*** suspicious ***) @ C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe [6284] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-08-03 14:51:46) 000000005b670000
Library C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Qt5Sql.dll (*** suspicious ***) @ C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe [6284] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 000000005b640000
Library C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Qt5WebKitWidgets.dll (*** suspicious ***) @ C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe [6284] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:28) 000000005b320000
Library C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Qt5PrintSupport.dll (*** suspicious ***) @ C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe [6284] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 000000005b2d0000
Library C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Qt5OpenGL.dll (*** suspicious ***) @ C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe [6284] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 000000005b280000
Library C:\Users\Wuff\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll (*** suspicious ***) @ C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe [6284] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:30) 0000000059d40000
Library C:\Users\Wuff\AppData\Roaming\Dropbox\bin\plugins\imageformats\qgif.dll (*** suspicious ***) @ C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe [6284] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-10-04 08:22:08) 000000005ab70000
Library C:\Users\Wuff\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll (*** suspicious ***) @ C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe [6284] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:30) 0000000059b70000
---- EOF - GMER 2.1 ----
|
|
14.10.2015, 16:49
| #6 |
| | Addition.txt - Teil 1Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:12-10-2015
durchgeführt von Wuff (2015-10-14 16:03:47)
Gestartet von C:\Users\Wuff\Desktop
Windows 7 Ultimate Service Pack 1 (X64) (2012-10-05 14:30:12)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Admin (S-1-5-21-1612083073-1725845651-2389301402-1009 - Administrator - Enabled)
Administrator (S-1-5-21-1612083073-1725845651-2389301402-500 - Administrator - Disabled)
Gast (S-1-5-21-1612083073-1725845651-2389301402-501 - Limited - Disabled)
Wuff (S-1-5-21-1612083073-1725845651-2389301402-1000 - Administrator - Enabled) => C:\Users\Wuff
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Kaspersky Internet Security (Enabled - Up to date) {B41C7598-35F6-4D89-7D0E-7ADE69B4047B}
AS: Kaspersky Internet Security (Enabled - Up to date) {0F7D947C-13CC-4207-47BE-41AC12334EC6}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
FW: Kaspersky Internet Security (Enabled) {8C27F4BD-7F99-4CD1-5651-D3EB97674300}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
µTorrent (HKU\S-1-5-21-1612083073-1725845651-2389301402-1000\...\uTorrent) (Version: 3.4.2.33870 - BitTorrent Inc.)
1Password 1.0.9.342 (HKLM-x32\...\1Password_is1) (Version: 1.0 - AgileBits)
3G V3.0 (HKLM-x32\...\{65A1BDC5-5EC3-4EA8-8C13-0885BA375162}) (Version: 3.0.7 - ALIGN)
3GX (HKLM-x32\...\{7378D82C-EAAB-41C2-B652-778FD5BF21C3}) (Version: 3.08.2308 - ALIGN)
7-Zip 9.38 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0938-000001000000}) (Version: 9.38.00.0 - Igor Pavlov)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.5.3.9120 - Adobe Systems Inc.)
Adobe Community Help (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.0.0.400 - Adobe Systems Incorporated)
Adobe Flash Player 19 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 19.0.0.207 - Adobe Systems Incorporated)
Adobe Flash Player 19 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 19.0.0.207 - Adobe Systems Incorporated)
Adobe Media Player (HKLM-x32\...\com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.8 - Adobe Systems Incorporated)
Adobe Photoshop CS5 (HKLM-x32\...\{15FEDA5F-141C-4127-8D7E-B962D1742728}) (Version: 12.0 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.13) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.13 - Adobe Systems Incorporated)
Advanced Office Password Recovery (HKLM-x32\...\{96C4DBF2-E573-40AE-9121-3A7AB2A28E04}) (Version: 5.5.578.1021 - Elcomsoft Co. Ltd.)
AI Suite II (HKLM-x32\...\{34D3688E-A737-44C5-9E2A-FF73618728E1}) (Version: 1.04.02 - ASUSTeK Computer Inc.)
Amazon Kindle (HKU\S-1-5-21-1612083073-1725845651-2389301402-1000\...\Amazon Kindle) (Version: - Amazon)
Amazon Music (HKU\S-1-5-21-1612083073-1725845651-2389301402-1000\...\Amazon Amazon Music) (Version: 3.7.1.698 - Amazon Services LLC)
Apple Application Support (32-Bit) (HKLM-x32\...\{A50679D9-6CBD-4FCD-BACB-62EF3894F6F3}) (Version: 4.0.3 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{1F72FDD5-A069-45B4-928F-D0F16492DC69}) (Version: 4.0.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{FD244E19-6EFE-4A2D-948A-0D45D4C168BE}) (Version: 9.0.0.26 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.)
ASCOM CMOS QHY5 Camera Driver 2.2.0.0 (04/2010) (HKLM-x32\...\ASCOM CMOS QHY5 Camera Driver_is1) (Version: 2.2.0.0 - Tom Van den Eede <t.vandeneede@pandora.be>)
ASCOM LittleFootClassic Telescope Driver 1.0 (HKLM-x32\...\ASCOM LittleFootClassic Telescope Driver_is1) (Version: 1.0 - Robert Kloiber <Compusys@chello.at>)
ASCOM Platform 6 - SP1 (HKLM-x32\...\ASCOM Platform 6 - SP1) (Version: 6.0.0.0 - ASCOM Initiative)
ASCOM Platform 6 - SP1 (Version: 6.0.0.0 - ASCOM Initiative) Hidden
Asmedia ASM104x USB 3.0 Host Controller Driver (HKLM-x32\...\{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}) (Version: 1.14.3.0 - Asmedia Technology)
ASUS PC Diagnostics (HKLM-x32\...\{D709005F-D8DC-42A8-8435-5AE880ECAF82}) (Version: 1.2.5 - ASUSTeK Computer Inc.)
Audacity 2.0.3 (HKLM-x32\...\Audacity_is1) (Version: 2.0.3 - Audacity Team)
Battlefield 4™ (HKLM-x32\...\{ABADE36E-EC37-413B-8179-B432AD3FACE7}) (Version: 1.5.2.34169 - Electronic Arts)
Battlelog Web Plugins (HKLM-x32\...\Battlelog Web Plugins) (Version: 2.7.1 - EA Digital Illusions CE AB)
bavarianDEMON (HKLM-x32\...\{C6982266-30B0-4C4C-AA7E-21A12636BC75}) (Version: 6.50.0 - captron electronic GmbH)
BlindWrite 6 (HKLM-x32\...\{005E738B-5A0A-4483-A900-877D183A8F45}_is1) (Version: 6.3.1.7 - VSO Software)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
Castle Link (HKLM-x32\...\{706EF14E-A25A-42B6-BE83-843A256AD5EC}) (Version: 3.57.39 - Castle Creations)
CCleaner (HKLM\...\CCleaner) (Version: 4.09 - Piriform)
ChessBase Reader (HKLM-x32\...\{D6330700-4083-48DD-A03C-E209674E7836}) (Version: 2 - )
Citrix Receiver (HKLM-x32\...\CitrixOnlinePluginPackWeb) (Version: 14.1.0.0 - Citrix Systems, Inc.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DAEMON Tools Lite (HKLM\...\DAEMON Tools Lite) (Version: 10.1.0.0074 - Disc Soft Ltd)
Deep Shredder 12 (HKLM-x32\...\{2612B89B-9820-49D1-82C1-20DFD346A46B}) (Version: 12.0.0 - ChessBase)
Deep Shredder 12 (x32 Version: 12.0.0 - ChessBase) Hidden
Defraggler (HKLM\...\Defraggler) (Version: 2.10 - Piriform)
Deponia (HKLM-x32\...\Deponia) (Version: 1.0 - Daedalic Entertainment)
DiskAid 5.45 (HKLM-x32\...\DiskAid_is1) (Version: 5.45 - DigiDNA)
Display Pilot (HKLM-x32\...\{6DD25D67-4339-47A1-950E-EEFC321CBB24}) (Version: 2.22.013 - Portrait Displays, Inc.)
DJI driver version 2.02 (HKLM-x32\...\{EDFDE5EE-84C7-4936-804C-6563943E5754}_is1) (Version: 2.02 - DJI)
DJI NAZAM Assistant version 2.40 (HKLM-x32\...\{CB374012-DAE0-4386-9E95-5D01033F6185}_is1) (Version: 2.40 - DJI)
Dropbox (HKU\S-1-5-21-1612083073-1725845651-2389301402-1000\...\Dropbox) (Version: 3.10.7 - Dropbox, Inc.)
DYMO Label v.8 (HKLM-x32\...\DYMO Label v.8) (Version: 8.5.1.1816 - Sanford, L.P.)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
FITS Liberator 3.0 (HKLM-x32\...\FITS Liberator) (Version: 3.0 - ESO/ESA/NASA)
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
FreeUndelete (HKLM-x32\...\{A35883BD-9C83-4625-82F3-90F86728C662}) (Version: 2.0 - Recoveronix)
Garmin BaseCamp (HKLM-x32\...\{F7CEFC8E-591B-4F02-96AC-44972E6EAC3F}) (Version: 4.5.0 - Garmin Ltd or its subsidiaries)
Garmin USB Drivers (HKLM\...\{DC7720F2-98BE-41C1-B0A8-E391362E86B8}) (Version: 2.3.1.1 - Garmin Ltd or its subsidiaries)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 45.0.2454.101 - Google Inc.)
Google Drive (HKLM-x32\...\{CF772DD2-4767-49AE-B764-EACA6F6CD9AE}) (Version: 1.25.0286.7715 - Google, Inc.)
Google Earth (HKLM-x32\...\{817750FA-EC6A-485D-9901-0683AE6FFDF1}) (Version: 7.1.5.1557 - Google)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.6904.2028 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.28.15 - Google Inc.) Hidden
GoPro App (x32 Version: 5.6.509 - GoPro, Inc.) Hidden
GoPro Studio 2.5.6 (HKLM-x32\...\{8850d4d9-a0fc-453f-ba03-ec084375d0c2}) (Version: 2.5.6.509 - GoPro, Inc.)
HNSKY 2.3.0N (HKLM-x32\...\Hallo northern sky planetarium program_is1) (Version: - Han Kleijn)
iCloud (HKLM\...\{709A2D23-C25E-47B5-9268-CB6FEE648504}) (Version: 4.1.1.53 - Apple Inc.)
INSTAR Camera Tool (HKLM-x32\...\{630473B5-3AA9-4477-B6DD-F9EA5BEEDD42}) (Version: 2.0.1.0 - INSTAR)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Network Connections 17.0.200.2 (HKLM\...\PROSetDX) (Version: 17.0.200.2 - Intel)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.1.0.1006 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.4.225 - Intel Corporation)
iTunes (HKLM\...\{96984DE8-1DB8-425C-AC8C-3098BC696F04}) (Version: 12.3.0.44 - Apple Inc.)
Java 8 Update 60 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218060F0}) (Version: 8.0.600.27 - Oracle Corporation)
JDownloader 0.9 (HKLM-x32\...\5513-1208-7298-9440) (Version: 0.9 - AppWork GmbH)
Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{77E7AE5C-181C-4CAF-ADBF-946F11C1CE26}) (Version: 16.0.0.614 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 16.0.0.614 - Kaspersky Lab) Hidden
KNX eteC Falcon Runtime v2.1 (x32 Version: 2.1.5213.27900 - KNX Association cvba) Hidden
Lidl-Fotos (HKLM-x32\...\Lidl-Fotos_is1) (Version: - )
Logitech GamePanel Software 3.06.109 (HKLM\...\{A1E85B9A-AFAD-4D38-AF01-6B020DD5213A}) (Version: 3.06.109 - Logitech Inc.)
MAGIX Speed burnR (MSI) (HKLM-x32\...\MX.{FBE6F998-E9A0-4A15-974B-6592DCEEE7AC}) (Version: 7.0.2.6 - MAGIX Software GmbH)
MAGIX Speed burnR (MSI) (Version: 7.0.2.6 - MAGIX Software GmbH) Hidden
MAGIX Video deluxe 2015 Premium (HKLM\...\MX.{EAC79752-A0A4-45DB-9F99-9F6445920F77}) (Version: 14.0.0.140 - MAGIX Software GmbH)
MAGIX Video deluxe 2015 Premium (Version: 14.0.0.140 - MAGIX Software GmbH) Hidden
Malwarebytes Anti-Malware Version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Access Runtime 2010 (HKLM\...\Office14.AccessRT) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Primary Interoperability Assemblies 2005 (HKLM-x32\...\{2C303EE0-A595-3543-A71A-931C7AC40EDE}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server 2008 R2 (64-bit) (HKLM\...\Microsoft SQL Server 2008 R2) (Version: - Microsoft Corporation)
Microsoft SQL Server 2008 R2 Setup (English) (HKLM\...\{C3525BF7-3698-4CD3-A8C3-69BD6F57BA3B}) (Version: 10.52.4000.0 - Microsoft Corporation)
Microsoft SQL Server 2008 Setup Support Files (HKLM\...\{B40EE88B-400A-4266-A17B-E3DE64E94431}) (Version: 10.1.2731.0 - Microsoft Corporation)
Microsoft SQL Server Native Client (HKLM\...\{6344718C-AE30-4C86-B5CD-459077A83623}) (Version: 9.00.2047.00 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\...\{4FFA2088-8317-3B14-93CD-4C699DB37843}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 40.0.3 (x86 de) (HKLM-x32\...\Mozilla Firefox 40.0.3 (x86 de)) (Version: 40.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 40.0.3.5716 - Mozilla)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
NVIDIA 3D Vision Controller-Treiber 352.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 352.65 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 355.82 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 355.82 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.5.14.5 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.5.14.5 - NVIDIA Corporation)
NVIDIA Grafiktreiber 355.82 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 355.82 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.34.3 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.34.3 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.15.0428 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.15.0428 - NVIDIA Corporation)
Online Plug-in (x32 Version: 14.1.0.0 - Citrix Systems, Inc.) Hidden
Origin (HKLM-x32\...\Origin) (Version: 9.0.13.2142 - Electronic Arts, Inc.)
Paragon Partition Manager™ 11 Professional (HKLM-x32\...\{A35001F0-F1E4-11DD-A38B-005056C00008}) (Version: 90.00.0003 - Paragon Software)
PDF Settings CS5 (x32 Version: 10.0 - Adobe Systems Incorporated) Hidden
Perfect Mask 5 (HKLM-x32\...\{2DFAC810-6DD8-4E23-96A4-BEB118408203}) (Version: 5.0.1 - onOne Software)
PHD Guiding 1.14a (HKLM-x32\...\PHD Guiding_is1) (Version: - Stark Labs)
Photomatix Pro version 4.2.5 (HKLM\...\PhotomatixPro42x64_is1) (Version: 4.2.5 - HDRsoft Ltd)
Picture2avi uninstaller (HKLM\...\Picture2avi_is1) (Version: 3.3.0.0 - picture2avi.com)
Pivot Pro Plugin (x32 Version: 9.61.004 - Portrait Displays, Inc.) Hidden
Portrait Professional Studio 10.9 (HKLM-x32\...\Portrait Professional Studio 10 PREACTIVATED by .:sHaRe:._is1) (Version: 10.9 - )
Portrait Professional Studio 10.9 (HKLM-x32\...\PortraitProfessionalStudio10_is1) (Version: 10.9 - Anthropics Technology Ltd.)
proDAD ProDRENALIN 1.0 (64bit) (HKLM\...\proDAD-ProDRENALIN-1.0) (Version: 1.0.62.1 - proDAD GmbH)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.)
QGVideo 4.1_0 (HKLM-x32\...\QGVideo_is1) (Version: - AstroSoft)
QHY5 2.2 Drivers (08/2010) (HKLM-x32\...\QHY5 Drivers_is1) (Version: 2.2 - AstroSoft.BE)
Qualcomm Atheros WiFi Driver Installation (HKLM-x32\...\{7D916FA5-DAE9-4A25-B089-655C70EAF607}) (Version: 3.0 - Qualcomm Atheros)
QuickTime 7 (HKLM-x32\...\{80CEEB1E-0A6C-45B9-A312-37A1D25FDEBC}) (Version: 7.78.80.95 - Apple Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6570 - Realtek Semiconductor Corp.)
REFLEX Modellflugsimulator (HKLM-x32\...\{7520D70B-F7C1-46F1-9B59-C8D828361BAA}) (Version: 5.05.0 - Dipl.-Ing. Stefan Kunde)
SDK (x32 Version: 2.40.012 - Portrait Displays, Inc.) Hidden
Self-Service Plug-in (x32 Version: 4.1.0.41738 - Citrix Systems, Inc.) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-001C-0000-1000-0000000FF1CE}_Office14.AccessRT_{08798025-46CC-4EB0-A0B3-4E25DA3BBC10}) (Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{91140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{A3364707-2F53-4C83-8F68-C9877A9080C7}) (Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version: - Microsoft) Hidden
Service Pack 2 for SQL Server 2008 R2 (KB2630458) (64-bit) (HKLM\...\KB2630458) (Version: 10.52.4000.0 - Microsoft Corporation)
SES Driver (HKLM\...\{D8CC254C-C671-4664-9A38-FA368D1E2C97}) (Version: 1.0.0 - Western Digital)
SHIELD Streaming (Version: 4.1.3000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 2.5.14.5 - NVIDIA Corporation) Hidden
Silver Efex Pro 2 (HKLM-x32\...\Silver Efex Pro 2) (Version: 2.0.0.6 - Nik Software, Inc.)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
SQL Server 2008 R2 SP2 Common Files (Version: 10.52.4000.0 - Microsoft Corporation) Hidden
SQL Server 2008 R2 SP2 Database Engine Shared (Version: 10.52.4000.0 - Microsoft Corporation) Hidden
Sql Server Customer Experience Improvement Program (Version: 10.50.1600.1 - Microsoft Corporation) Hidden
SteelSeries Engine 3.3.1 (HKLM\...\SteelSeries Engine 3) (Version: 3.3.1 - SteelSeries ApS)
TomTom HOME (HKLM-x32\...\{5DCB2EB3-87AD-426E-8D74-8B92C9D731C4}) (Version: 2.9.8 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
TrueCrypt (HKLM-x32\...\TrueCrypt) (Version: 7.1a - TrueCrypt Foundation)
UltraEdit 16.30 (HKLM-x32\...\{7111BB91-CC16-4EF7-8702-82E0F7890C8A}) (Version: 16.30.2 - IDM Computer Solutions, Inc.)
VFW_Codec32 (x32 Version: 0.1.160.0 - GoPro, Inc.) Hidden
VFW_Codec64 (Version: 0.1.160.0 - GoPro, Inc.) Hidden
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Voyager Image Viewer (HKLM-x32\...\{02D22735-3DA2-4D97-A74F-5CF7EB050066}) (Version: - )
web control version 3.0.2.3 (HKLM-x32\...\{20779EFD-5A24-45F7-A133-132975478C4E}_is1) (Version: 3.0.2.3 - )
Windows Driver Package - FTDI CDM Driver Package - Bus/D2XX Driver (01/18/2013 2.08.28) (HKLM\...\9E24492CE9279512BD465F61DB8523641BB7BBFC) (Version: 01/18/2013 2.08.28 - FTDI)
Windows Driver Package - FTDI CDM Driver Package - VCP Driver (01/18/2013 2.08.28) (HKLM\...\E61B77ECE57113AE1CA028BC7A8AD6C137BD13DD) (Version: 01/18/2013 2.08.28 - FTDI)
Windows Driver Package - Western Digital Technologies (WDC_SAM) WDC_SAM (01/19/2011 1.0.0009.0) (HKLM\...\4CA7CFBB29889F25ACB3DF6E3A42BAE29EB43B20) (Version: 01/19/2011 1.0.0009.0 - Western Digital Technologies)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
Windows-Treiberpaket - captron electronic GmbH CDM Driver Package (10/22/2009 2.06.00) (HKLM\...\3C146DB26794293E02F5A5C8DC3DD9D0525039F2) (Version: 10/22/2009 2.06.00 - captron electronic GmbH)
Windows-Treiberpaket - dji-innovations inc. (usbser) Ports (12/06/2012 5.1.2600.5512) (HKLM\...\F731C4A8B354FB9B7579C5D98402D2F988E8B95C) (Version: 12/06/2012 5.1.2600.5512 - dji-innovations inc.)
Windows-Treiberpaket - FTDI CDM Driver Package (10/22/2009 2.06.00) (HKLM\...\3134FEF0E1D959EC0CC2E458C94B7057B2AC0CC9) (Version: 10/22/2009 2.06.00 - FTDI)
Windows-Treiberpaket - FTDI CDM Driver Package (10/22/2009 2.06.00) (HKLM\...\88EB56038379B8B7DCFB4D2448A60F52E064B265) (Version: 10/22/2009 2.06.00 - FTDI)
Windows-Treiberpaket - Silicon Laboratories (silabenm) Ports (03/19/2014 6.7.0.0) (HKLM\...\B97004A400E30DCF940971EFA7A0C13C6B0A4B66) (Version: 03/19/2014 6.7.0.0 - Silicon Laboratories)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
Xilisoft YouTube HD Video Converter (HKLM-x32\...\Xilisoft YouTube HD Video Converter) (Version: 3.3.3.20120810 - Xilisoft)
XnView 1.99.6 (HKLM-x32\...\XnView_is1) (Version: 1.99.6 - Gougelet Pierre-e)
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
CustomCLSID: HKU\S-1-5-21-1612083073-1725845651-2389301402-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1612083073-1725845651-2389301402-1000_Classes\CLSID\{b5eedee0-c06e-11cf-8c56-444553540000}\InprocServer32 -> C:\Program Files (x86)\UltraEdit\ue64ctmn.dll ()
CustomCLSID: HKU\S-1-5-21-1612083073-1725845651-2389301402-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Wuff\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1612083073-1725845651-2389301402-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Wuff\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1612083073-1725845651-2389301402-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Wuff\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1612083073-1725845651-2389301402-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Wuff\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1612083073-1725845651-2389301402-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Wuff\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1612083073-1725845651-2389301402-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Wuff\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1612083073-1725845651-2389301402-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Wuff\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1612083073-1725845651-2389301402-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Wuff\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1612083073-1725845651-2389301402-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Wuff\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1612083073-1725845651-2389301402-1000_Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32 -> C:\Users\Wuff\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)
==================== Wiederherstellungspunkte =========================
04-10-2015 10:46:52 Windows Update
04-10-2015 10:50:43 Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501
14-10-2015 12:56:34 Removed PlayStation(R)Store.
14-10-2015 13:18:05 JRT Pre-Junkware Removal
14-10-2015 15:14:22 Prüfpunkt von HitmanPro
14-10-2015 15:15:18 Prüfpunkt von HitmanPro
14-10-2015 15:40:09 JRT Pre-Junkware Removal
==================== Hosts Inhalt: ==========================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2009-07-14 04:34 - 2014-12-25 15:05 - 00450771 ____R C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 123moviedownload.com
Da befinden sich 15467 zusätzliche Einträge.
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {19364F4C-CB3A-4A12-84F2-D64172EF5522} - System32\Tasks\ASUS\ASUS Network iControl Help Execute => C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\NetSvcHelpEntry.exe [2012-05-02] (ASUSTeK Computer Inc.)
Task: {2085F8D1-4E11-4768-8E94-F09BC29D8A34} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
Task: {261CEA98-0316-4382-9B9F-7F985E356207} - System32\Tasks\{9DD43648-5A2B-4EC1-878D-8843EAA21C60} => pcalua.exe -a "C:\Program Files (x86)\i-ekb.ru\iPhone4_Hacktivate_Tool\Uninstall.exe"
Task: {29697522-C734-48F7-BC05-DC9691BAE001} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-12-17] (Piriform Ltd)
Task: {34E4618B-F757-466A-B1A4-A08B4BD7950D} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {36A61551-5701-4433-AEBE-2C8675518380} - System32\Tasks\{74DA3C37-21BF-4E6B-A53B-A055D6825EAB} => pcalua.exe -a J:\Hauptprogramm\ActivationATIH-nova-s\ActivationAcronisTIH.exe -d J:\Hauptprogramm\ActivationATIH-nova-s
Task: {3AD62325-6787-4C2C-9801-A343BB62AE48} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)
Task: {5CF47A45-868A-4D35-AE8C-3C6CAA0D2ED7} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-10-14] (Adobe Systems Incorporated)
Task: {5FFD4A9B-1C14-45A1-BB76-60F19CFA2766} - System32\Tasks\AdobeAAMUpdater-1.0-Dose-Wuff => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-03-06] (Adobe Systems Incorporated)
Task: {6A690CE7-C6DD-43C8-98AF-577EE9612AC0} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-09-14] (Adobe Systems Incorporated)
Task: {6CB8C598-80FC-43AD-8D49-84FFEE4E6DE7} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1612083073-1725845651-2389301402-1000Core => C:\Users\Wuff\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-21] (Dropbox, Inc.)
Task: {7CBA844A-19F4-4668-93EB-2797EE4B9636} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1612083073-1725845651-2389301402-1000UA => C:\Users\Wuff\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-21] (Dropbox, Inc.)
Task: {8A611785-6CF7-4D0C-A1B0-9E249027BB0F} - System32\Tasks\{A5E7D206-EEC0-4106-8D05-17D5EF22B973} => C:\Program Files (x86)\Crysis 3 Digital Deluxe FULL UNLOCKED-SG\Bin32\Crysis3.exe
Task: {8D80C97C-D1FF-470A-9BD2-B6328B23DB6D} - System32\Tasks\AutoKMS => C:\Windows\AutoKMS.exe
Task: {8E66F4C6-50D2-492B-BB5B-543A56BAC090} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2015-08-27] (Apple Inc.)
Task: {B77E9C8C-0E91-4379-88A6-94FCAF21F47C} - System32\Tasks\{B6D0C1C1-98D5-46F8-8874-6F1AA2DED14B} => Iexplore.exe hxxp://ui.skype.com/ui/0/7.0.0.102/de/abandoninstall?page=tsMain
Task: {BA166F06-C3DA-4CA3-85E1-51338695AC24} - System32\Tasks\{54AA3DD9-949A-455A-9853-E00359E24CE9} => pcalua.exe -a E:\_Applikationen\I2P\i2pinstall_0.9.11_windows.exe -d E:\_Applikationen\I2P
Task: {C039014C-3937-4393-BFC0-4BFC45250BDF} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
Task: {C07D26FF-599B-4E4E-9BA1-F198FCE914C3} - System32\Tasks\{2C5C511B-4A95-466C-8DCA-654D6C1BDF73} => C:\Program Files (x86)\Crysis 3 Digital Deluxe FULL UNLOCKED-SG\Bin32\Crysis3.exe
Task: {DAD5F84C-2D77-4241-A498-27A8DAF0E1C3} - System32\Tasks\ASUS\ASUS AI Suite II Execute => C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe [2012-03-13] (ASUSTeK Computer Inc.)
Task: {DDE69FA6-F949-47BD-8B78-978C6FEA900E} - System32\Tasks\{5B863FFD-D3DE-401E-B1DA-0794263BA2D7} => Iexplore.exe hxxp://ui.skype.com/ui/0/7.0.0.102/de/abandoninstall?page=tsMain
Task: {E6951ACF-3A87-4611-9F40-F22A639D7F5D} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {E885DEE6-A9C0-4E15-BFBB-8891DE0BC605} - System32\Tasks\{E303E6A6-6DE0-4158-A5EA-6E3EAD1A8596} => pcalua.exe -a "E:\_Applikationen\TomTom\Tools und Blitzer\Aktivierer\EA5_v0.57.21\Easy Activator.exe" -d "E:\_Applikationen\TomTom\Tools und Blitzer\Aktivierer\EA5_v0.57.21"
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\AutoKMS.job => C:\Windows\AutoKMS.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1612083073-1725845651-2389301402-1000Core.job => C:\Users\Wuff\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1612083073-1725845651-2389301402-1000UA.job => C:\Users\Wuff\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2012-10-05 17:12 - 2015-08-25 16:24 - 00116344 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-08-04 18:42 - 2014-08-12 14:26 - 00098272 _____ () C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\DP\msgHook64.dll
2015-01-20 23:35 - 2015-01-20 23:35 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-09-23 16:47 - 2015-09-23 16:47 - 01328912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2012-10-05 23:17 - 2012-06-01 17:42 - 00920736 _____ () C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe
2014-07-12 22:40 - 2014-07-12 22:40 - 00076152 _____ () C:\Windows\system32\PnkBstrA.exe
2013-09-05 01:17 - 2013-09-05 01:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2015-08-04 18:41 - 2014-08-12 14:26 - 00275936 _____ () C:\Program Files (x86)\Common Files\Portrait Displays\Shared\dthook.dll
2015-02-15 14:14 - 2014-12-08 08:27 - 06277952 _____ () C:\Users\Wuff\AppData\Local\Amazon Music\Amazon Music Helper.exe
2014-11-13 23:19 - 2014-11-13 23:19 - 17542656 _____ () C:\Program Files\SteelSeries\SteelSeries Engine 3\SteelSeriesEngine3.exe
2014-10-14 16:10 - 2014-10-14 16:10 - 00047616 _____ () C:\Program Files\SteelSeries\SteelSeries Engine 3\x2api.dll
2015-08-03 19:11 - 2013-06-18 12:26 - 00677160 _____ () C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpctrl.exe
2015-08-03 19:11 - 2013-06-18 12:26 - 00714024 _____ () C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\floater.exe
2015-08-03 19:11 - 2014-08-12 14:26 - 00163296 _____ () C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\DP\DPHelper.exe
2015-08-03 19:11 - 2014-08-12 14:26 - 00197088 _____ () C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\DP\DPHelper64.exe
2012-10-05 23:17 - 2015-10-14 15:48 - 00030720 _____ () C:\Program Files (x86)\ASUS\AXSP\1.00.19\PEbiosinterface32.dll
2012-10-05 23:17 - 2010-06-29 10:58 - 00104448 _____ () C:\Program Files (x86)\ASUS\AXSP\1.00.19\ATKEX.dll
2015-07-08 23:18 - 2015-07-08 23:18 - 00794920 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\kpcengine.2.3.dll
2014-12-25 14:58 - 2014-05-13 13:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-12-25 14:58 - 2014-05-13 13:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-12-25 14:58 - 2014-05-13 13:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2014-12-25 14:58 - 2012-08-23 11:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-12-25 14:58 - 2012-04-03 18:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2015-08-04 18:42 - 2014-08-12 14:26 - 00093664 _____ () C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\DP\msgHook.dll
2015-07-17 21:21 - 2015-08-27 02:37 - 00011896 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll
2015-09-23 16:47 - 2015-09-23 16:47 - 01040144 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-02-12 20:58 - 2014-02-12 20:58 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2015-10-14 15:48 - 2015-10-14 15:48 - 00071168 _____ () c:\users\wuff\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpsnivpg.dll
2015-03-04 23:45 - 2015-09-24 01:07 - 00012800 _____ () C:\Users\Wuff\AppData\Roaming\Dropbox\bin\QtQuick.2\qtquick2plugin.dll
2015-03-04 23:45 - 2015-09-24 01:07 - 00779776 _____ () C:\Users\Wuff\AppData\Roaming\Dropbox\bin\QtQuick\Controls\qtquickcontrolsplugin.dll
2015-08-03 16:51 - 2015-09-24 01:07 - 00056320 _____ () C:\Users\Wuff\AppData\Roaming\Dropbox\bin\QtQuick\Layouts\qquicklayoutsplugin.dll
2015-03-04 23:45 - 2015-09-24 01:07 - 00012288 _____ () C:\Users\Wuff\AppData\Roaming\Dropbox\bin\QtQuick\Window.2\windowplugin.dll
2015-10-14 15:48 - 2015-10-14 15:48 - 00098816 _____ () C:\Users\Wuff\AppData\Local\Temp\_MEI53642\win32api.pyd
2015-10-14 15:48 - 2015-10-14 15:48 - 00110080 _____ () C:\Users\Wuff\AppData\Local\Temp\_MEI53642\pywintypes27.dll
2015-10-14 15:48 - 2015-10-14 15:48 - 00364544 _____ () C:\Users\Wuff\AppData\Local\Temp\_MEI53642\pythoncom27.dll
2015-10-14 15:48 - 2015-10-14 15:48 - 00046080 _____ () C:\Users\Wuff\AppData\Local\Temp\_MEI53642\_socket.pyd
2015-10-14 15:48 - 2015-10-14 15:48 - 01208320 _____ () C:\Users\Wuff\AppData\Local\Temp\_MEI53642\_ssl.pyd
2015-10-14 15:48 - 2015-10-14 15:48 - 00320512 _____ () C:\Users\Wuff\AppData\Local\Temp\_MEI53642\win32com.shell.shell.pyd
2015-10-14 15:48 - 2015-10-14 15:48 - 00776704 _____ () C:\Users\Wuff\AppData\Local\Temp\_MEI53642\_hashlib.pyd
2015-10-14 15:48 - 2015-10-14 15:48 - 01176576 _____ () C:\Users\Wuff\AppData\Local\Temp\_MEI53642\wx._core_.pyd
2015-10-14 15:48 - 2015-10-14 15:48 - 00806400 _____ () C:\Users\Wuff\AppData\Local\Temp\_MEI53642\wx._gdi_.pyd
2015-10-14 15:48 - 2015-10-14 15:48 - 00816128 _____ () C:\Users\Wuff\AppData\Local\Temp\_MEI53642\wx._windows_.pyd
2015-10-14 15:48 - 2015-10-14 15:48 - 01067008 _____ () C:\Users\Wuff\AppData\Local\Temp\_MEI53642\wx._controls_.pyd
2015-10-14 15:48 - 2015-10-14 15:48 - 00733184 _____ () C:\Users\Wuff\AppData\Local\Temp\_MEI53642\wx._misc_.pyd
2015-10-14 15:48 - 2015-10-14 15:48 - 00682496 _____ () C:\Users\Wuff\AppData\Local\Temp\_MEI53642\pysqlite2._sqlite.pyd
2015-10-14 15:48 - 2015-10-14 15:48 - 00088064 _____ () C:\Users\Wuff\AppData\Local\Temp\_MEI53642\_ctypes.pyd
2015-10-14 15:48 - 2015-10-14 15:48 - 00119808 _____ () C:\Users\Wuff\AppData\Local\Temp\_MEI53642\win32file.pyd
2015-10-14 15:48 - 2015-10-14 15:48 - 00108544 _____ () C:\Users\Wuff\AppData\Local\Temp\_MEI53642\win32security.pyd
2015-10-14 15:48 - 2015-10-14 15:48 - 00007168 _____ () C:\Users\Wuff\AppData\Local\Temp\_MEI53642\hashobjs_ext.pyd
2015-10-14 15:48 - 2015-10-14 15:48 - 00070144 _____ () C:\Users\Wuff\AppData\Local\Temp\_MEI53642\usb_ext.pyd
2015-10-14 15:48 - 2015-10-14 15:48 - 00167936 _____ () C:\Users\Wuff\AppData\Local\Temp\_MEI53642\win32gui.pyd
2015-10-14 15:48 - 2015-10-14 15:48 - 00018432 _____ () C:\Users\Wuff\AppData\Local\Temp\_MEI53642\win32event.pyd
2015-10-14 15:48 - 2015-10-14 15:48 - 00128512 _____ () C:\Users\Wuff\AppData\Local\Temp\_MEI53642\_elementtree.pyd
2015-10-14 15:48 - 2015-10-14 15:48 - 00127488 _____ () C:\Users\Wuff\AppData\Local\Temp\_MEI53642\pyexpat.pyd
2015-10-14 15:48 - 2015-10-14 15:48 - 00013824 _____ () C:\Users\Wuff\AppData\Local\Temp\_MEI53642\common.time34.pyd
2015-10-14 15:48 - 2015-10-14 15:48 - 00036864 _____ () C:\Users\Wuff\AppData\Local\Temp\_MEI53642\_psutil_windows.pyd
2015-10-14 15:48 - 2015-10-14 15:48 - 00038912 _____ () C:\Users\Wuff\AppData\Local\Temp\_MEI53642\win32inet.pyd
2015-10-14 15:48 - 2015-10-14 15:48 - 00011264 _____ () C:\Users\Wuff\AppData\Local\Temp\_MEI53642\win32crypt.pyd
2015-10-14 15:48 - 2015-10-14 15:48 - 00077312 _____ () C:\Users\Wuff\AppData\Local\Temp\_MEI53642\wx._html2.pyd
2015-10-14 15:48 - 2015-10-14 15:48 - 00027136 _____ () C:\Users\Wuff\AppData\Local\Temp\_MEI53642\_multiprocessing.pyd
2015-10-14 15:48 - 2015-10-14 15:48 - 00020480 _____ () C:\Users\Wuff\AppData\Local\Temp\_MEI53642\_yappi.pyd
2015-10-14 15:48 - 2015-10-14 15:48 - 00035840 _____ () C:\Users\Wuff\AppData\Local\Temp\_MEI53642\win32process.pyd
2015-10-14 15:48 - 2015-10-14 15:48 - 00686080 _____ () C:\Users\Wuff\AppData\Local\Temp\_MEI53642\unicodedata.pyd
2015-10-14 15:48 - 2015-10-14 15:48 - 00123392 _____ () C:\Users\Wuff\AppData\Local\Temp\_MEI53642\wx._wizard.pyd
2015-10-14 15:48 - 2015-10-14 15:48 - 00024064 _____ () C:\Users\Wuff\AppData\Local\Temp\_MEI53642\win32pipe.pyd
2015-10-14 15:48 - 2015-10-14 15:48 - 00010240 _____ () C:\Users\Wuff\AppData\Local\Temp\_MEI53642\select.pyd
2015-10-14 15:48 - 2015-10-14 15:48 - 00025600 _____ () C:\Users\Wuff\AppData\Local\Temp\_MEI53642\win32pdh.pyd
2015-10-14 15:48 - 2015-10-14 15:48 - 00525640 _____ () C:\Users\Wuff\AppData\Local\Temp\_MEI53642\windows._lib_cacheinvalidation.pyd
2015-10-14 15:48 - 2015-10-14 15:48 - 00017408 _____ () C:\Users\Wuff\AppData\Local\Temp\_MEI53642\win32profile.pyd
2015-10-14 15:48 - 2015-10-14 15:48 - 00022528 _____ () C:\Users\Wuff\AppData\Local\Temp\_MEI53642\win32ts.pyd
2015-10-14 15:48 - 2015-10-14 15:48 - 00078848 _____ () C:\Users\Wuff\AppData\Local\Temp\_MEI53642\wx._animate.pyd
2015-07-02 23:31 - 2015-07-02 23:31 - 02287616 _____ () C:\Program Files (x86)\GoPro\Tools\Importer\gopro-lib-win-analytics.dll
2015-08-03 19:10 - 2014-08-12 14:26 - 00191968 _____ () C:\Program Files (x86)\Common Files\Portrait Displays\Shared\PresetsCOM.dll
2012-10-05 20:53 - 2011-07-12 19:14 - 00147456 _____ () C:\Program Files (x86)\ASUS\AI Suite II\AssistFunc.dll
2012-10-05 20:53 - 2010-10-05 08:22 - 00253952 _____ () C:\Program Files (x86)\ASUS\AI Suite II\pngio.dll
2012-10-05 20:53 - 2012-03-21 12:07 - 00972288 _____ () C:\Program Files (x86)\ASUS\AI Suite II\BarGadget\BarGadget.dll
2012-10-05 23:18 - 2012-07-12 11:27 - 01125376 _____ () C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\Network iControl.dll
2012-10-05 20:53 - 2012-05-25 10:33 - 00883712 _____ () C:\Program Files (x86)\ASUS\AI Suite II\Sensor\Sensor.dll
2012-10-05 20:53 - 2012-05-28 21:27 - 01622528 _____ () C:\Program Files (x86)\ASUS\AI Suite II\Sensor Graph\SensorGraph.dll
2012-10-05 20:53 - 2011-09-19 20:18 - 01243136 _____ () C:\Program Files (x86)\ASUS\AI Suite II\Settings\Settings.dll
2012-10-05 20:53 - 2011-07-21 09:06 - 00846848 _____ () C:\Program Files (x86)\ASUS\AI Suite II\Splitter\Splitter.dll
2012-10-05 20:53 - 2011-10-14 20:03 - 00885248 _____ () C:\Program Files (x86)\ASUS\AI Suite II\TabGadget\TabGadget.dll
2012-10-05 20:53 - 2010-08-23 10:17 - 00662016 _____ () C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMLib.dll
2012-10-05 20:53 - 2010-10-05 08:22 - 00208896 _____ () C:\Program Files (x86)\ASUS\AI Suite II\ImageHelper.dll
2012-10-05 20:53 - 2009-08-12 20:15 - 00253952 _____ () C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\pngio.dll
2012-10-05 23:18 - 2012-05-10 16:38 - 00786432 _____ () C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\func.dll
2012-10-05 23:18 - 2010-10-05 08:22 - 00253952 _____ () C:\Program Files (x86)\ASUS\AI Suite II\Network iControl\NetSvcHelp\pngio.dll
2014-10-15 19:51 - 2014-10-15 19:51 - 00172544 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\3c9f9797004f6bd1e532b186b335ec1d\IsdiInterop.ni.dll
2012-10-05 23:12 - 2012-02-01 16:25 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
Addition.txt - Teil 2 Code:
ATTFilter
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
AlternateDataStreams: C:\Windows:nlsPreferences
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com
Da befinden sich 15751 mehr eingeschränkte Seiten.
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-1612083073-1725845651-2389301402-1000\Control Panel\Desktop\\Wallpaper ->
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
MSCONFIG\startupreg: BCSSync => "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
MSCONFIG\startupreg: TomTomHOME.exe => "C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe" -s
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [TCP Query User{6D26059E-471F-47E6-835B-5D711881AEE2}C:\program files (x86)\jdownloader\jre\bin\javaw.exe] => (Allow) C:\program files (x86)\jdownloader\jre\bin\javaw.exe
FirewallRules: [UDP Query User{206FEA87-25E6-4370-AAB3-1B933A6D26B1}C:\program files (x86)\jdownloader\jre\bin\javaw.exe] => (Allow) C:\program files (x86)\jdownloader\jre\bin\javaw.exe
FirewallRules: [{513086CF-0900-4B5F-9B8D-35D2D9333E73}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{D42B50CB-72CA-4BA4-B363-35A2725347EC}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{A83F00F0-D9A3-4204-8761-D72AB5D2007E}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{307B62CE-60FE-422D-A5EC-9020D6C25D7C}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{0A1A7A83-748E-4BF7-8B9D-ADA4015E0A0E}] => (Allow) C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{FFC6FFF7-4B63-4173-ACCD-F414779F890E}] => (Allow) C:\Users\Wuff\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{E940DC49-9522-4988-A7DF-017773ACD8BD}] => (Allow) C:\Program Files (x86)\Origin Games\Battlefield 3\bf3.exe
FirewallRules: [{0DC801B9-956E-4D6A-818E-B2B0AF8FB4B5}] => (Allow) C:\Program Files (x86)\Origin Games\Battlefield 3\bf3.exe
FirewallRules: [{79AC064C-365B-4CF2-92DC-FBDAA5BBA972}] => (Allow) C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe
FirewallRules: [{A575BBD7-D743-4B7B-9346-4F600D70F13E}] => (Allow) C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe
FirewallRules: [{887C96EF-B9F7-4B37-B7F3-0D713AAD4D9D}] => (Allow) C:\Windows\System32\hasplms.exe
FirewallRules: [{C621AC8E-BC8A-4E14-BCF5-6675BA57ABBB}] => (Allow) C:\Windows\System32\hasplms.exe
FirewallRules: [{D4A20739-324A-464E-A745-518D74EF5873}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{7929AC5D-3B58-4C3A-9B18-EE4E89352859}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{3EBAEA3A-43EA-4B94-BF2F-053DC5D5E64B}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{000C09BF-2ED4-4DF7-85BD-4BE7485D86D7}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{1C5A7BEA-D54C-4B5C-88DD-4DA390F4D048}] => (Allow) C:\Program Files (x86)\Far Cry 3\bin\FC3Editor.exe
FirewallRules: [{D2BA964D-90B5-4F5F-9767-1077EB1DA000}] => (Allow) C:\Program Files (x86)\Far Cry 3\bin\FC3Editor.exe
FirewallRules: [{ABFF8DA7-8FB8-4F14-A10D-A2DB721FDC82}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{E174EF10-FF3F-413E-B171-CE2A8F88D15C}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{D6B2FEC2-9113-4974-BDE9-9D9A1706AFB1}] => (Allow) C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\SonarHost.exe
FirewallRules: [{324802AA-4A20-4FE2-835F-08A99C5C746C}] => (Allow) C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\SonarHost.exe
FirewallRules: [{1D46AFA1-5AED-4801-BFDA-81490DD7878E}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{0364275B-F8B9-4B7A-AEAC-06C54A269621}] => (Allow) LPort=2869
FirewallRules: [{BEBC2447-D40B-4D9A-AAB1-C3050BA22B54}] => (Allow) LPort=1900
FirewallRules: [{0E6AAF5E-3B5F-40C6-9B4F-00FFD5AE5EFD}] => (Allow) C:\Program Files (x86)\Toolbar Cleaner\ToolbarCleaner.exe
FirewallRules: [{583F68D6-17BE-4DB8-89BD-3404B3899FF4}] => (Allow) C:\Program Files (x86)\Toolbar Cleaner\ToolbarCleaner.exe
FirewallRules: [{B56CED72-5C60-450B-9AA2-FCD949BE3DA4}] => (Allow) C:\Users\Wuff\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{3FC967F2-B2C5-42AE-A228-5D77FAC4765E}] => (Allow) C:\Users\Wuff\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{FC700153-618D-4CCF-85A9-7EB748468B18}] => (Allow) C:\Program Files (x86)\Origin Games\Battlefield 4\bf4_x86.exe
FirewallRules: [{E27B1042-6C59-449D-B246-32CD33E45C45}] => (Allow) C:\Program Files (x86)\Origin Games\Battlefield 4\bf4_x86.exe
FirewallRules: [{57432D25-98C4-45AF-801F-4868B36EB52E}] => (Allow) C:\Program Files (x86)\Origin Games\Battlefield 4\bf4.exe
FirewallRules: [{9988324B-2843-4B2D-9BE8-884B18BFEFE1}] => (Allow) C:\Program Files (x86)\Origin Games\Battlefield 4\bf4.exe
FirewallRules: [{B30AD362-B799-4C85-A87E-DD9A469DF9DD}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{32946477-317A-4E18-AF2C-6ED397F53EAF}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{4FF7840E-238C-4BFE-A09E-51F9D52C83FB}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{CB3183C5-7BEF-442B-BBA2-AF588D2AB321}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{017BA81D-9CCC-494F-B38E-5F17DCE6A819}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{527B4380-A3EB-4273-9461-00A7D412971E}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{69D4E267-BE59-4C46-9EEA-1522D7D7C972}] => (Allow) C:\Program Files (x86)\Sony Mobile\Update Engine\Sony Mobile Update Engine.exe
FirewallRules: [{CF3249B4-0191-423E-9812-D79C05E3D131}] => (Allow) C:\Program Files (x86)\Sony Mobile\Update Engine\Sony Mobile Update Engine.exe
FirewallRules: [{E64400D6-CBAA-4312-9A09-ADA80224FED6}] => (Block) C:\Program Files (x86)\Acronis\TrueImageHome\license_activator.exe
FirewallRules: [{8990F57D-7624-4BB4-BE3F-EED5E4968E4B}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{92860D1E-793D-481A-8ECE-7C084E7EEE92}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{B5197F1C-98FC-433E-B078-2AB5182FDBAD}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{ED4C3626-F7FC-4B6E-B7BA-2201641AEB80}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{0F4B8C72-8260-4089-94C7-0EE6314F046B}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{F5476A30-D4F0-427A-8DBF-8F9E6F18D356}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{387F990E-BF5B-4373-A18C-2A3A7A2E1172}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
FirewallRules: [{E00864A3-7EE1-4227-8254-8EEFB9B0192D}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{84098C16-0B73-44F8-A896-A89B4D47A939}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{D0712376-5DA0-4ACC-95DD-1F3D0E7761B1}] => (Allow) C:\Program Files (x86)\Origin Games\Battlefield 4\bf4_x86.exe
FirewallRules: [{79F3F5DB-B16B-47DA-8C0E-E679492BF713}] => (Allow) C:\Program Files (x86)\Origin Games\Battlefield 4\bf4_x86.exe
FirewallRules: [{B66F50C6-D722-4583-8B31-7B9C3FBBAB14}] => (Allow) C:\Program Files (x86)\Origin Games\Battlefield 4\bf4.exe
FirewallRules: [{883FD2E7-E155-4017-B9FC-0C90AC98811A}] => (Allow) C:\Program Files (x86)\Origin Games\Battlefield 4\bf4.exe
FirewallRules: [{F2A1D69F-19A1-4852-8868-FCF180F2A7C5}] => (Allow) C:\Program Files\MAGIX\Video deluxe 2015 Premium\Videodeluxe.exe
FirewallRules: [{8A33F4A8-BD44-4663-8E5B-702675BB344F}] => (Allow) C:\Program Files (x86)\Origin Games\Battlefield 4\BF4X86WebHelper.exe
FirewallRules: [{74345DB8-79BE-4B7D-9483-F2186A9D3133}] => (Allow) C:\Program Files (x86)\Origin Games\Battlefield 4\BF4X86WebHelper.exe
FirewallRules: [{47C9E027-D561-4CAE-95E4-E0249E05498D}] => (Allow) C:\Program Files (x86)\Origin Games\Battlefield 4\BF4WebHelper.exe
FirewallRules: [{B605136E-1536-4217-8665-497795501ACB}] => (Allow) C:\Program Files (x86)\Origin Games\Battlefield 4\BF4WebHelper.exe
FirewallRules: [{F9613240-BF06-42EA-9D29-758A2D59A4F4}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{1B2689F2-6339-43AC-9CA2-4E53DD3C59FB}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{577937FE-AB5E-4230-A0D0-A1E402AAD3C5}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{FAAC1F2C-3A18-4733-BB22-BFD171EB7D43}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{6B69013E-7631-4D0A-A1BB-1603F25023DD}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{0DDF8311-96C6-4D9E-8867-F062AA967DD9}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service
==================== Fehlerhafte Geräte im Gerätemanager =============
Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Name: WinpkFilter LightWeight Filter
Description: WinpkFilter LightWeight Filter
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: ndisrd
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
Name: Qualcomm Atheros AR9485 Wireless Network Adapter
Description: Qualcomm Atheros AR9485 Wireless Network Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Qualcomm Atheros Communications Inc.
Service: athr
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (10/14/2015 04:00:39 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 11.0.9600.18015, Zeitstempel: 0x55cec14a
Name des fehlerhaften Moduls: nvd3dum.dll, Version: 10.18.13.5582, Zeitstempel: 0x55dc6c29
Ausnahmecode: 0xc0000005
Fehleroffset: 0x007323eb
ID des fehlerhaften Prozesses: 0x2130
Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0
Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1
Pfad des fehlerhaften Moduls: IEXPLORE.EXE2
Berichtskennung: IEXPLORE.EXE3
Error: (10/14/2015 03:57:26 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifest.
Error: (10/14/2015 03:40:50 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: dthook.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x53ea8591
Ausnahmecode: 0xc000041d
Fehleroffset: 0x0000000180007d10
ID des fehlerhaften Prozesses: 0x1234
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3
Error: (10/14/2015 03:40:46 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: dthook.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x53ea8591
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000180007d10
ID des fehlerhaften Prozesses: 0x1234
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3
Error: (10/14/2015 03:36:15 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifest.
Error: (10/14/2015 03:19:53 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifest.
Error: (10/14/2015 03:19:51 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifest.
Error: (10/14/2015 03:19:51 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifest.
Error: (10/14/2015 03:15:24 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "RegSetValueExW(0x000002f4,SYSTEM\CurrentControlSet\Services\VSS\Diag\VssvcPublisher,0,REG_BINARY,000000000167EBC0.72)" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Error: (10/14/2015 03:15:24 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "RegSetValueExW(0x000002d0,(null),0,REG_BINARY,0000000001FBDFC0.72)" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Vorgang:
BackupShutdown-Ereignis
Kontext:
Ausführungskontext: Writer
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {a0bc1a8b-900f-451f-8257-1e89ce9c073b}
Systemfehler:
=============
Error: (10/14/2015 03:48:39 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
ndisrd
Error: (10/14/2015 03:48:36 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "SQL Server (KNXETS4)" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (10/14/2015 03:48:03 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {3EB3C877-1F16-487C-9050-104DBCD66683}
Error: (10/14/2015 03:40:41 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "iPod-Dienst" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (10/14/2015 03:40:40 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Disc Soft Lite Bus Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (10/14/2015 03:40:39 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Spybot-S&D 2 Security Center Service" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (10/14/2015 03:40:39 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Live ID Sign-in Assistant" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (10/14/2015 03:40:39 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "TomTomHOMEService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (10/14/2015 03:40:39 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Spybot-S&D 2 Updating Service" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (10/14/2015 03:40:39 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "PnkBstrA" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
CodeIntegrity:
===================================
Date: 2015-10-14 15:48:38.888
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\sxs.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-10-14 15:17:08.950
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\sxs.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-10-14 15:04:12.909
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\sxs.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-10-14 14:54:51.490
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\sxs.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-10-14 14:27:25.012
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\sxs.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-10-14 14:06:06.944
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\sxs.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-10-14 13:51:14.323
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\sxs.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-10-14 13:43:12.045
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\sxs.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-10-14 13:42:37.286
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\sxs.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-10-14 13:31:58.068
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\sxs.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Speicherinformationen ===========================
Prozessor: Intel(R) Core(TM) i5-3570K CPU @ 3.40GHz
Prozentuale Nutzung des RAM: 22%
Installierter physikalischer RAM: 16331.94 MB
Verfügbarer physikalischer RAM: 12591.35 MB
Summe virtueller Speicher: 32662.08 MB
Verfügbarer virtueller Speicher: 28343.91 MB
==================== Laufwerke ================================
Drive c: (System) (Fixed) (Total:238.37 GB) (Free:38.58 GB) NTFS
Drive d: (Spiele) (Fixed) (Total:298.08 GB) (Free:163.95 GB) NTFS
Drive e: (Daten) (Fixed) (Total:1397.25 GB) (Free:294.04 GB) NTFS
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 238.5 GB) (Disk ID: C49D22AE)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=238.4 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or Vista) (Size: 1397.3 GB) (Disk ID: 5BAF37F5)
Partition 1: (Not Active) - (Size=1397.3 GB) - (Type=OF Extended)
========================================================
Disk: 2 (Size: 298.1 GB) (Disk ID: 2CD62CD5)
Partition 1: (Not Active) - (Size=298.1 GB) - (Type=OF Extended)
==================== Ende von Addition.txt ============================
|
|
15.10.2015, 13:20
| #7 |
| |  Bitte Beitrag schließen - Lösung! Hallo Zusammen! Bitte schließt den Beitrag! Es funktioniert wieder ALLES! Lösung: Ich habe nochmals alles von euch vorgeschlagene durchgeführt. Hat wieder keine Verbesserung gebracht! Heute habe ich "einfach" mal den Internet Explorer zurückgesetzt. Neu gestartet....und siehe da....keine Werbung und Störung durch den DNSUnlocker mehr!!! DANKE schon mal für eure Bemühungen....aber im Moment schaut es so aus, als wenn ich eure Hilfe nicht benötigen würde!!! lg Wolfgang |
|
16.10.2015, 18:31
| #8 |
| /// the machine /// TB-Ausbilder | Windows 7: Auf den meisten Webseiten kommt Werbung von DNSUnlocker! ok.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Windows 7: Auf den meisten Webseiten kommt Werbung von DNSUnlocker! |
| .html, beitrag, compu, computer, dnsapi.dll, dnsunlocker, einfach, eingeblendet, hallo zusammen, helft, laesst, launch, locker, malware, nicht mehr, runter, schritte, tagen, webseite, webseiten, werbung, windows, windows 7, zusammen |
Linear-Darstellung
