Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-03-16 14:22:55
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 Crucial_CT240M500SSD1 rev.MU03 223,57GB
Running: Gmer-19357.exe; Driver: C:\Users\Monika\AppData\Local\Temp\pxliauoc.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1956] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075c91465 2 bytes [C9, 75]
.text C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1956] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075c914bb 2 bytes [C9, 75]
.text ... * 2
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[2000] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075c91465 2 bytes [C9, 75]
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[2000] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075c914bb 2 bytes [C9, 75]
.text ... * 2
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[3388] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075c91465 2 bytes [C9, 75]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[3388] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075c914bb 2 bytes [C9, 75]
.text ... * 2
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 0000000077b611f5 8 bytes {JMP 0xd}
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077b61390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000077b6143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 0000000077b6158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000077b6191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077b61b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077b61bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077b61d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077b61eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077b61edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077b61f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077b61fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077b61fd7 8 bytes {JMP 0xb}
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077b62272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077b62301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077b62792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000077b627b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000077b627d2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000077b6282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077b62890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077b62d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077b62d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077b63023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000077b6323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 0000000077b633c0 16 bytes {JMP 0x4e}
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077b63a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077b63ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077b63b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077b63d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077b64190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077bb1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077bb1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077bb1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077bb1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077bb1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077bb1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077bb1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077bb27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000755d13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000755d146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000755d16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000755d16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000755d19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000755d19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000755d1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000755d1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000755d1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[2988] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000755d1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 0000000077b611f5 8 bytes {JMP 0xd}
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077b61390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000077b6143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 0000000077b6158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000077b6191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077b61b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077b61bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077b61d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077b61eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077b61edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077b61f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077b61fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077b61fd7 8 bytes {JMP 0xb}
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077b62272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077b62301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077b62792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000077b627b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000077b627d2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000077b6282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077b62890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077b62d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077b62d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077b63023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000077b6323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 0000000077b633c0 16 bytes {JMP 0x4e}
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077b63a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077b63ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077b63b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077b63d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077b64190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077bb1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077bb1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077bb1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077bb1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077bb1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077bb1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077bb1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077bb27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000755d13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000755d146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000755d16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000755d16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000755d19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000755d19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000755d1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000755d1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000755d1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[1284] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000755d1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 0000000077b611f5 8 bytes {JMP 0xd}
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077b61390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000077b6143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 0000000077b6158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000077b6191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077b61b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077b61bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077b61d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077b61eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077b61edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077b61f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077b61fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077b61fd7 8 bytes {JMP 0xb}
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077b62272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077b62301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077b62792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000077b627b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000077b627d2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000077b6282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077b62890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077b62d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077b62d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077b63023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000077b6323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 0000000077b633c0 16 bytes {JMP 0x4e}
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077b63a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077b63ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077b63b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077b63d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077b64190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077bb1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077bb1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077bb1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077bb1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077bb1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077bb1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077bb1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077bb27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000755d13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000755d146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000755d16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000755d16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000755d19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000755d19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000755d1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000755d1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000755d1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[4400] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000755d1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 0000000077b611f5 8 bytes {JMP 0xd}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077b61390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000077b6143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 0000000077b6158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000077b6191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077b61b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077b61bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077b61d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077b61eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077b61edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077b61f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077b61fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077b61fd7 8 bytes {JMP 0xb}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077b62272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077b62301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077b62792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000077b627b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000077b627d2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000077b6282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077b62890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077b62d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077b62d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077b63023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000077b6323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 0000000077b633c0 16 bytes {JMP 0x4e}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077b63a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077b63ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077b63b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077b63d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077b64190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077bb1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077bb1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077bb1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077bb1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077bb1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077bb1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077bb1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077bb27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000755d13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000755d146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000755d16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000755d16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000755d19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000755d19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000755d1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000755d1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000755d1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000755d1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075c91465 2 bytes [C9, 75]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1504] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075c914bb 2 bytes [C9, 75]
.text ... * 2
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 0000000077b611f5 8 bytes {JMP 0xd}
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077b61390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000077b6143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 0000000077b6158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000077b6191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077b61b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077b61bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077b61d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077b61eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077b61edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077b61f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077b61fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077b61fd7 8 bytes {JMP 0xb}
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077b62272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077b62301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077b62792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000077b627b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000077b627d2 8 bytes {JMP 0x10}
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000077b6282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077b62890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077b62d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077b62d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077b63023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000077b6323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 0000000077b633c0 16 bytes {JMP 0x4e}
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077b63a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077b63ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077b63b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077b63d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077b64190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077bb1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077bb1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077bb1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077bb1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077bb1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077bb1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077bb1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077bb27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000755d13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000755d146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000755d16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000755d16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000755d19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000755d19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000755d1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000755d1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000755d1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Monika\Desktop\Gmer-19357.exe[5192] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000755d1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\KLIF\Parameters@LastProcessedRevision 32019174
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts@C:\Users\Monika\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HP\HP\xa0Update.lnk 1
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts@C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP\HP\xa0Update.lnk 1
---- EOF - GMER 2.1 ----
Den FRST.log kann ich leider ned posten der ist zu lang.
ich hänge Ihn hier nochmals einzeln an. |
Lesestoff:
Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
AdwCleaner auf deinen Desktop.
FRST 32-Bit | FRST 64-Bit
TFC (TempFileCleaner von Oldtimer) herunter und speichere es auf den Desktop.
