|
Windows 7: Kaspersky findet C:\$RECYCLEBIN Trojaner und E-Mail account gehackt? Hallo, ich kam gerade von der Arbeit und ging an meinen PC als ich bei Kaspersky 2 Probleme gefunden habe, es wurden Trojaner mit dem namen C:\$RECYCLEBIN gefunden, der Name war länger aber ich habe Sie gleich bereinigt, weshalb ich jetzt den vollständigen Namen habe. Außerdem wurde mein web.de Konto eingefroren, weil laut BSI Datenklau betrieben wurde und ich eventuell betroffen bin. Ich habe wie bei web.de schon steht die Seite https://www.sicherheitstest.bsi.de/ geöffnet und einen Code zur Überprüfung erhalten, kann jedoch meine mails nicht checken und somit auch nicht sehen, ob ich denn nun eine E-Mail mit Code bekommen habe und betroffen bin. Jedenfalls geht es mir in erster Linie um die von Kaspersky gefundenen Trojaner. Logfiles folgen (als Archiv, weil zu viele Zeichen) FRST Logfile: Code: Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014Code: Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-03-2014 |
[CODE]GMER 2.1.19357 - hxxp://www.gmer.net Rootkit scan 2014-04-07 21:24:07 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP5T0L0-5 WDC_WD10EZEX-00RKKA0 rev.80.00A80 931,51GB Running: kmhuvc89.exe; Driver: C:\Users\Thomas\AppData\Local\Temp\uwdiipoc.sys ---- User code sections - GMER 2.1 ---- .text C:\Windows\SysWOW64\PnkBstrA.exe[1724] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322 0000000073971a22 2 bytes [97, 73] .text C:\Windows\SysWOW64\PnkBstrA.exe[1724] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496 0000000073971ad0 2 bytes [97, 73] .text C:\Windows\SysWOW64\PnkBstrA.exe[1724] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552 0000000073971b08 2 bytes [97, 73] .text C:\Windows\SysWOW64\PnkBstrA.exe[1724] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730 0000000073971bba 2 bytes [97, 73] .text C:\Windows\SysWOW64\PnkBstrA.exe[1724] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762 0000000073971bda 2 bytes [97, 73] .text C:\Windows\SysWOW64\PnkBstrA.exe[1724] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000754b1465 2 bytes [4B, 75] .text C:\Windows\SysWOW64\PnkBstrA.exe[1724] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000754b14bb 2 bytes [4B, 75] .text ... * 2 .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000776d11f5 8 bytes {JMP 0xd} .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 00000000776d1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000776d143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 00000000776d158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000776d191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 00000000776d1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 00000000776d1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 00000000776d1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 00000000776d1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 00000000776d1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 00000000776d1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 00000000776d1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 00000000776d1fd7 8 bytes {JMP 0xb} .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 00000000776d2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 00000000776d2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 00000000776d2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000776d27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000776d27d2 8 bytes {JMP 0x10} .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 00000000776d282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 00000000776d2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 00000000776d2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 00000000776d2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 00000000776d3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 00000000776d323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000776d33c0 16 bytes {JMP 0x4e} .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 00000000776d3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000776d3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000776d3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 00000000776d3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 00000000776d4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077721380 8 bytes {JMP QWORD [RIP-0x4d4cf]} .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077721500 8 bytes {JMP QWORD [RIP-0x4d498]} .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077721530 8 bytes {JMP QWORD [RIP-0x4d9b1]} .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077721650 8 bytes {JMP QWORD [RIP-0x4d7a7]} .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077721700 8 bytes {JMP QWORD [RIP-0x4d9e3]} .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077721d30 8 bytes {JMP QWORD [RIP-0x4dba6]} .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077721f80 8 bytes {JMP QWORD [RIP-0x4de55]} .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000777227e0 8 bytes {JMP QWORD [RIP-0x4e770]} .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000752a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000752a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000752a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1920] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000752a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000776d11f5 8 bytes {JMP 0xd} .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 00000000776d1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000776d143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 00000000776d158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000776d191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 00000000776d1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 00000000776d1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 00000000776d1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 00000000776d1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 00000000776d1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 00000000776d1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 00000000776d1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 00000000776d1fd7 8 bytes {JMP 0xb} .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 00000000776d2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 00000000776d2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 00000000776d2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000776d27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000776d27d2 8 bytes {JMP 0x10} .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 00000000776d282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 00000000776d2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 00000000776d2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 00000000776d2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 00000000776d3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 00000000776d323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000776d33c0 16 bytes {JMP 0x4e} .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 00000000776d3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000776d3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000776d3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 00000000776d3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 00000000776d4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077721380 8 bytes {JMP QWORD [RIP-0x4d4cf]} .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077721500 8 bytes {JMP QWORD [RIP-0x4d498]} .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077721530 8 bytes {JMP QWORD [RIP-0x4d9b1]} .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077721650 8 bytes {JMP QWORD [RIP-0x4d7a7]} .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077721700 8 bytes {JMP QWORD [RIP-0x4d9e3]} .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077721d30 8 bytes {JMP QWORD [RIP-0x4dba6]} .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077721f80 8 bytes {JMP QWORD [RIP-0x4de55]} .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000777227e0 8 bytes {JMP QWORD [RIP-0x4e770]} .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000752a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000752a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000752a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\Kies.exe[3328] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000752a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000776d11f5 8 bytes {JMP 0xd} .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 00000000776d1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000776d143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 00000000776d158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000776d191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 00000000776d1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 00000000776d1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 00000000776d1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 00000000776d1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 00000000776d1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 00000000776d1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 00000000776d1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 00000000776d1fd7 8 bytes {JMP 0xb} .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 00000000776d2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 00000000776d2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 00000000776d2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000776d27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000776d27d2 8 bytes {JMP 0x10} .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 00000000776d282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 00000000776d2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 00000000776d2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 00000000776d2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 00000000776d3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 00000000776d323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000776d33c0 16 bytes {JMP 0x4e} .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 00000000776d3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000776d3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000776d3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 00000000776d3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 00000000776d4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077721380 8 bytes {JMP QWORD [RIP-0x4d4cf]} .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077721500 8 bytes {JMP QWORD [RIP-0x4d498]} .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077721530 8 bytes {JMP QWORD [RIP-0x4d9b1]} .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077721650 8 bytes {JMP QWORD [RIP-0x4d7a7]} .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077721700 8 bytes {JMP QWORD [RIP-0x4d9e3]} .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077721d30 8 bytes {JMP QWORD [RIP-0x4dba6]} .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077721f80 8 bytes {JMP QWORD [RIP-0x4de55]} .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000777227e0 8 bytes {JMP QWORD [RIP-0x4e770]} .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000752a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000752a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000752a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000752a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SysWOW64\ntdll.dll!DbgBreakPoint 00000000778c000c 1 byte [C3] .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3336] C:\Windows\SysWOW64\ntdll.dll!DbgUiRemoteBreakin 000000007794f8ea 5 bytes JMP 00000001778fd5c1 .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000776d11f5 8 bytes {JMP 0xd} .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 00000000776d1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000776d143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 00000000776d158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000776d191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 00000000776d1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 00000000776d1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 00000000776d1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 00000000776d1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 00000000776d1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 00000000776d1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 00000000776d1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 00000000776d1fd7 8 bytes {JMP 0xb} .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 00000000776d2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 00000000776d2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 00000000776d2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000776d27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000776d27d2 8 bytes {JMP 0x10} .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 00000000776d282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 00000000776d2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 00000000776d2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 00000000776d2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 00000000776d3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 00000000776d323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000776d33c0 16 bytes {JMP 0x4e} .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 00000000776d3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000776d3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000776d3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 00000000776d3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 00000000776d4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...] .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077721380 8 bytes {JMP QWORD [RIP-0x4d4cf]} .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077721500 8 bytes {JMP QWORD [RIP-0x4d498]} .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077721530 8 bytes {JMP QWORD [RIP-0x4d9b1]} .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077721650 8 bytes {JMP QWORD [RIP-0x4d7a7]} .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077721700 8 bytes {JMP QWORD [RIP-0x4d9e3]} .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077721d30 8 bytes {JMP QWORD [RIP-0x4dba6]} .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077721f80 8 bytes {JMP QWORD [RIP-0x4de55]} .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000777227e0 8 bytes {JMP QWORD [RIP-0x4e770]} .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000752a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000752a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000752a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe[3380] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000752a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000776d11f5 8 bytes {JMP 0xd} .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 00000000776d1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000776d143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 00000000776d158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000776d191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 00000000776d1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 00000000776d1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 00000000776d1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 00000000776d1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 00000000776d1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 00000000776d1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 00000000776d1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 00000000776d1fd7 8 bytes {JMP 0xb} .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 00000000776d2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 00000000776d2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 00000000776d2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000776d27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000776d27d2 8 bytes {JMP 0x10} .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 00000000776d282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 00000000776d2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 00000000776d2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 00000000776d2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 00000000776d3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 00000000776d323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000776d33c0 16 bytes {JMP 0x4e} .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 00000000776d3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000776d3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000776d3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 00000000776d3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 00000000776d4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077721380 8 bytes {JMP QWORD [RIP-0x4d4cf]} .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077721500 8 bytes {JMP QWORD [RIP-0x4d498]} .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077721530 8 bytes {JMP QWORD [RIP-0x4d9b1]} .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077721650 8 bytes {JMP QWORD [RIP-0x4d7a7]} .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077721700 8 bytes {JMP QWORD [RIP-0x4d9e3]} .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077721d30 8 bytes {JMP QWORD [RIP-0x4dba6]} .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077721f80 8 bytes {JMP QWORD [RIP-0x4de55]} .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000777227e0 8 bytes {JMP QWORD [RIP-0x4e770]} .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000752a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000752a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000752a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000752a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000754b1465 2 bytes [4B, 75] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3388] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000754b14bb 2 bytes [4B, 75] .text ... * 2 .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000776d11f5 8 bytes {JMP 0xd} .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 00000000776d1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000776d143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 00000000776d158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000776d191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 00000000776d1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 00000000776d1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 00000000776d1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 00000000776d1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 00000000776d1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 00000000776d1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 00000000776d1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 00000000776d1fd7 8 bytes {JMP 0xb} .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 00000000776d2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 00000000776d2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 00000000776d2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000776d27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000776d27d2 8 bytes {JMP 0x10} .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 00000000776d282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 00000000776d2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 00000000776d2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 00000000776d2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 00000000776d3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 00000000776d323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000776d33c0 16 bytes {JMP 0x4e} .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 00000000776d3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000776d3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000776d3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 00000000776d3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 00000000776d4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077721380 8 bytes {JMP QWORD [RIP-0x4d4cf]} .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077721500 8 bytes {JMP QWORD [RIP-0x4d498]} .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077721530 8 bytes {JMP QWORD [RIP-0x4d9b1]} .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077721650 8 bytes {JMP QWORD [RIP-0x4d7a7]} .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077721700 8 bytes {JMP QWORD [RIP-0x4d9e3]} .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077721d30 8 bytes {JMP QWORD [RIP-0x4dba6]} .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077721f80 8 bytes {JMP QWORD [RIP-0x4de55]} .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000777227e0 8 bytes {JMP QWORD [RIP-0x4e770]} .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000752a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000752a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000752a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000752a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000754b1465 2 bytes [4B, 75] .text C:\Users\Thomas\AppData\Local\Akamai\netsession_win.exe[3508] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000754b14bb 2 bytes [4B, 75] .text ... * 2 .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000776d11f5 8 bytes {JMP 0xd} .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 00000000776d1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000776d143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 00000000776d158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000776d191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 00000000776d1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 00000000776d1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 00000000776d1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 00000000776d1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 00000000776d1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 00000000776d1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 00000000776d1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 00000000776d1fd7 8 bytes {JMP 0xb} .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 00000000776d2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 00000000776d2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 00000000776d2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000776d27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000776d27d2 8 bytes {JMP 0x10} .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 00000000776d282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 00000000776d2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 00000000776d2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 00000000776d2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 00000000776d3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 00000000776d323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000776d33c0 16 bytes {JMP 0x4e} .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 00000000776d3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000776d3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000776d3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 00000000776d3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 00000000776d4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077721380 8 bytes {JMP QWORD [RIP-0x4d4cf]} .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077721500 8 bytes {JMP QWORD [RIP-0x4d498]} .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077721530 8 bytes {JMP QWORD [RIP-0x4d9b1]} .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077721650 8 bytes {JMP QWORD [RIP-0x4d7a7]} .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077721700 8 bytes {JMP QWORD [RIP-0x4d9e3]} .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077721d30 8 bytes {JMP QWORD [RIP-0x4dba6]} .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077721f80 8 bytes {JMP QWORD [RIP-0x4de55]} .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000777227e0 8 bytes {JMP QWORD [RIP-0x4e770]} .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000752a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000752a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000752a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe[3660] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000752a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000776d11f5 8 bytes {JMP 0xd} .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 00000000776d1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000776d143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 00000000776d158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000776d191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 00000000776d1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 00000000776d1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 00000000776d1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 00000000776d1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 00000000776d1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 00000000776d1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 00000000776d1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 00000000776d1fd7 8 bytes {JMP 0xb} .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 00000000776d2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 00000000776d2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 00000000776d2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000776d27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000776d27d2 8 bytes {JMP 0x10} .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 00000000776d282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 00000000776d2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 00000000776d2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 00000000776d2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... |
* 3 .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 00000000776d3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 00000000776d323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000776d33c0 16 bytes {JMP 0x4e} .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 00000000776d3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000776d3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000776d3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 00000000776d3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 00000000776d4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077721380 8 bytes {JMP QWORD [RIP-0x4d4cf]} .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077721500 8 bytes {JMP QWORD [RIP-0x4d498]} .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077721530 8 bytes {JMP QWORD [RIP-0x4d9b1]} .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077721650 8 bytes {JMP QWORD [RIP-0x4d7a7]} .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077721700 8 bytes {JMP QWORD [RIP-0x4d9e3]} .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077721d30 8 bytes {JMP QWORD [RIP-0x4dba6]} .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077721f80 8 bytes {JMP QWORD [RIP-0x4de55]} .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000777227e0 8 bytes {JMP QWORD [RIP-0x4e770]} .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000752a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000752a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000752a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[3668] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000752a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000776d11f5 8 bytes {JMP 0xd} .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 00000000776d1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000776d143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 00000000776d158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000776d191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 00000000776d1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 00000000776d1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 00000000776d1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 00000000776d1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 00000000776d1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 00000000776d1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 00000000776d1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 00000000776d1fd7 8 bytes {JMP 0xb} .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 00000000776d2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 00000000776d2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 00000000776d2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000776d27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000776d27d2 8 bytes {JMP 0x10} .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 00000000776d282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 00000000776d2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 00000000776d2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 00000000776d2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 00000000776d3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 00000000776d323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000776d33c0 16 bytes {JMP 0x4e} .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 00000000776d3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000776d3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000776d3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 00000000776d3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 00000000776d4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077721380 8 bytes {JMP QWORD [RIP-0x4d4cf]} .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077721500 8 bytes {JMP QWORD [RIP-0x4d498]} .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077721530 8 bytes {JMP QWORD [RIP-0x4d9b1]} .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077721650 8 bytes {JMP QWORD [RIP-0x4d7a7]} .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077721700 8 bytes {JMP QWORD [RIP-0x4d9e3]} .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077721d30 8 bytes {JMP QWORD [RIP-0x4dba6]} .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077721f80 8 bytes {JMP QWORD [RIP-0x4de55]} .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000777227e0 8 bytes {JMP QWORD [RIP-0x4e770]} .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000752a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000752a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000752a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3684] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000752a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000776d11f5 8 bytes {JMP 0xd} .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 00000000776d1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000776d143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 00000000776d158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000776d191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 00000000776d1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 00000000776d1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 00000000776d1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 00000000776d1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 00000000776d1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 00000000776d1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 00000000776d1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 00000000776d1fd7 8 bytes {JMP 0xb} .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 00000000776d2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 00000000776d2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 00000000776d2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000776d27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000776d27d2 8 bytes {JMP 0x10} .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 00000000776d282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 00000000776d2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 00000000776d2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 00000000776d2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 00000000776d3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 00000000776d323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000776d33c0 16 bytes {JMP 0x4e} .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 00000000776d3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000776d3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000776d3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 00000000776d3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 00000000776d4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077721380 8 bytes {JMP QWORD [RIP-0x4d4cf]} .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077721500 8 bytes {JMP QWORD [RIP-0x4d498]} .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077721530 8 bytes {JMP QWORD [RIP-0x4d9b1]} .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077721650 8 bytes {JMP QWORD [RIP-0x4d7a7]} .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077721700 8 bytes {JMP QWORD [RIP-0x4d9e3]} .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077721d30 8 bytes {JMP QWORD [RIP-0x4dba6]} .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077721f80 8 bytes {JMP QWORD [RIP-0x4de55]} .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000777227e0 8 bytes {JMP QWORD [RIP-0x4e770]} .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000752a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000752a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000752a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3692] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000752a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000776d11f5 8 bytes {JMP 0xd} .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 00000000776d1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000776d143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 00000000776d158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000776d191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 00000000776d1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 00000000776d1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 00000000776d1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 00000000776d1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 00000000776d1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 00000000776d1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 00000000776d1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 00000000776d1fd7 8 bytes {JMP 0xb} .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 00000000776d2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 00000000776d2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 00000000776d2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000776d27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000776d27d2 8 bytes {JMP 0x10} .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 00000000776d282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 00000000776d2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 00000000776d2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 00000000776d2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 00000000776d3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 00000000776d323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000776d33c0 16 bytes {JMP 0x4e} .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 00000000776d3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000776d3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000776d3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 00000000776d3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 00000000776d4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...] .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077721380 8 bytes {JMP QWORD [RIP-0x4d4cf]} .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077721500 8 bytes {JMP QWORD [RIP-0x4d498]} .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077721530 8 bytes {JMP QWORD [RIP-0x4d9b1]} .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077721650 8 bytes {JMP QWORD [RIP-0x4d7a7]} .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077721700 8 bytes {JMP QWORD [RIP-0x4d9e3]} .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077721d30 8 bytes {JMP QWORD [RIP-0x4dba6]} .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077721f80 8 bytes {JMP QWORD [RIP-0x4de55]} .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000777227e0 8 bytes {JMP QWORD [RIP-0x4e770]} .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000752a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000752a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000752a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000752a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000754b1465 2 bytes [4B, 75] .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3296] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000754b14bb 2 bytes [4B, 75] .text ... * 2 .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000776d11f5 8 bytes {JMP 0xd} .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 00000000776d1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000776d143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 00000000776d158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000776d191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 00000000776d1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 00000000776d1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 00000000776d1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 00000000776d1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 00000000776d1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 00000000776d1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 00000000776d1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 00000000776d1fd7 8 bytes {JMP 0xb} .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 00000000776d2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 00000000776d2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 00000000776d2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000776d27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000776d27d2 8 bytes {JMP 0x10} .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 00000000776d282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 00000000776d2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 00000000776d2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 00000000776d2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 00000000776d3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 00000000776d323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000776d33c0 16 bytes {JMP 0x4e} .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 00000000776d3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000776d3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000776d3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 00000000776d3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 00000000776d4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077721380 8 bytes {JMP QWORD [RIP-0x4d4cf]} .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077721500 8 bytes {JMP QWORD [RIP-0x4d498]} .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077721530 8 bytes {JMP QWORD [RIP-0x4d9b1]} .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077721650 8 bytes {JMP QWORD [RIP-0x4d7a7]} .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077721700 8 bytes {JMP QWORD [RIP-0x4d9e3]} .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077721d30 8 bytes {JMP QWORD [RIP-0x4dba6]} .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077721f80 8 bytes {JMP QWORD [RIP-0x4de55]} .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000777227e0 8 bytes {JMP QWORD [RIP-0x4e770]} .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000752a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000752a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000752a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[4100] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000752a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000776d11f5 8 bytes {JMP 0xd} .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 00000000776d1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000776d143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 00000000776d158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000776d191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 00000000776d1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 00000000776d1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 00000000776d1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 00000000776d1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 00000000776d1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 00000000776d1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 00000000776d1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 00000000776d1fd7 8 bytes {JMP 0xb} .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 00000000776d2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 00000000776d2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 00000000776d2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000776d27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000776d27d2 8 bytes {JMP 0x10} .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 00000000776d282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 00000000776d2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 00000000776d2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 00000000776d2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 00000000776d3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 00000000776d323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000776d33c0 16 bytes {JMP 0x4e} .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 00000000776d3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000776d3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000776d3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 00000000776d3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 00000000776d4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077721380 8 bytes {JMP QWORD [RIP-0x4d4cf]} .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077721500 8 bytes {JMP QWORD [RIP-0x4d498]} .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077721530 8 bytes {JMP QWORD [RIP-0x4d9b1]} .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077721650 8 bytes {JMP QWORD [RIP-0x4d7a7]} .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077721700 8 bytes {JMP QWORD [RIP-0x4d9e3]} .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077721d30 8 bytes {JMP QWORD [RIP-0x4dba6]} .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077721f80 8 bytes {JMP QWORD [RIP-0x4de55]} .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000777227e0 8 bytes {JMP QWORD [RIP-0x4e770]} .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000752a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000752a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000752a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000752a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SysWOW64\ntdll.dll!DbgUserBreakPoint 00000000778c0008 1 byte [C3] .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SysWOW64\ntdll.dll!DbgBreakPoint 00000000778c000c 1 byte [C3] .text C:\Program Files (x86)\Garena Plus\ggdllhost.exe[4324] C:\Windows\SysWOW64\ntdll.dll!DbgUiRemoteBreakin 000000007794f8ea 5 bytes JMP 00000001778fd5c1 .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000776d11f5 8 bytes {JMP 0xd} .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 00000000776d1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000776d143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 00000000776d158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000776d191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 00000000776d1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 00000000776d1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 00000000776d1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 00000000776d1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 00000000776d1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 00000000776d1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 00000000776d1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 00000000776d1fd7 8 bytes {JMP 0xb} .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 00000000776d2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 00000000776d2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 00000000776d2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000776d27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000776d27d2 8 bytes {JMP 0x10} .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 00000000776d282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 00000000776d2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 00000000776d2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 00000000776d2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 00000000776d3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 00000000776d323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000776d33c0 16 bytes {JMP 0x4e} .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 00000000776d3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000776d3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000776d3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 00000000776d3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 00000000776d4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...] .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077721380 8 bytes {JMP QWORD [RIP-0x4d4cf]} .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077721500 8 bytes {JMP QWORD [RIP-0x4d498]} .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077721530 8 bytes {JMP QWORD [RIP-0x4d9b1]} .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077721650 8 bytes {JMP QWORD [RIP-0x4d7a7]} .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077721700 8 bytes {JMP QWORD [RIP-0x4d9e3]} .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077721d30 8 bytes {JMP QWORD [RIP-0x4dba6]} .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077721f80 8 bytes {JMP QWORD [RIP-0x4de55]} .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000777227e0 8 bytes {JMP QWORD [RIP-0x4e770]} .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000752a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000752a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000752a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000752a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000754b1465 2 bytes [4B, 75] .text C:\Users\Thomas\Downloads\Defogger.exe[4712] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000754b14bb 2 bytes [4B, 75] .text ... * 2 .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000776d11f5 8 bytes {JMP 0xd} .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 00000000776d1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000776d143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 00000000776d158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000776d191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 00000000776d1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 00000000776d1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 00000000776d1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 00000000776d1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 00000000776d1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 00000000776d1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 00000000776d1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 00000000776d1fd7 8 bytes {JMP 0xb} .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 00000000776d2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 00000000776d2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 00000000776d2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000776d27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000776d27d2 8 bytes {JMP 0x10} .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 00000000776d282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 00000000776d2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 00000000776d2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 00000000776d2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 00000000776d3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 00000000776d323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000776d33c0 16 bytes {JMP 0x4e} .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 00000000776d3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000776d3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000776d3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 00000000776d3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...] .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 00000000776d4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...] .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077721380 8 bytes {JMP QWORD [RIP-0x4d4cf]} .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077721500 8 bytes {JMP QWORD [RIP-0x4d498]} .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077721530 8 bytes {JMP QWORD [RIP-0x4d9b1]} .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077721650 8 bytes {JMP QWORD [RIP-0x4d7a7]} .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077721700 8 bytes {JMP QWORD [RIP-0x4d9e3]} .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077721d30 8 bytes {JMP QWORD [RIP-0x4dba6]} .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077721f80 8 bytes {JMP QWORD [RIP-0x4de55]} .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000777227e0 8 bytes {JMP QWORD [RIP-0x4e770]} .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752a13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752a146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752a16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000752a16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752a19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752a19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000752a1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000752a1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752a1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Thomas\Downloads\kmhuvc89.exe[3428] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000752a1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] ---- EOF - GMER 2.1 ---- [/CODE] |
HI, bitte noch das Log von Kaspersky posten. |
Der hat keinen Logfile erstellt, mir nur die Bedrohungen im Bericht angezeigt. Wenn ich diesen jedoch öffnen will (6 Bedrohungen neutralisiert) steht nur noch "keine Treffer" dort. Kann dir aber diesen Screenshot der Quarantäne anbieten :) http://s14.directupload.net/images/140410/vsrxangd.jpg |
passt :)  So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
Scan mit Combofix
|
Hier ist die Combofix-Logdatei :) Code: ComboFix 14-04-12.01 - Thomas 18.04.2014 1:19.1.4 - x64 |
Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte. |
Hallo, hab mir das Malwarebytes runtergeladen (falls das ne neuere Version ist als meine es war) aber da finde ich leider kein "Erkennung und Schutz", Suche nach Rootkits oder das Armaturenbrett. Ich kann nur nen Scan machen usw. Komisch. |
Dann mach nen Scan :) |
Hi, ich war in letzter Zeit etwas beschäftigt mit der Arbeit. Werde dir aber alles was du angefragt hattest jetzt posten :) Mbam File: Code: Malwarebytes Anti-MalwareCode: # AdwCleaner v3.205 - Bericht erstellt am 01/05/2014 um 18:39:18Code: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~FRST Logfile: Code: Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-05-2014 01 |
ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? :) |
Hab jetzt ein neues Problem... Kaspersky hat 9 Bedrohungen, alles Dateien von RadioRage_4j erkannt, den Order im Zielpfad also diesen Programfiles(x86) RadioRage4j kann ich auch nicht löschen, weil der Ordner oder eine Datei darin angeblich geöffnet ist. Wie soll ich den Mist denn jetzt löschen? :( |
Mach doch einfach was oben steht.... |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 10:29 Uhr. |
Copyright ©2000-2025, Trojaner-Board
