Logfiles - Teil 2
GMER - erster Teil!!! Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-07-15 13:33:14
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 Samsung_SSD_840_EVO_250GB rev.EXT0BB6Q 232,88GB
Running: mq628yop.exe; Driver: C:\Users\Holger\AppData\Local\Temp\kxlirpob.sys
---- Kernel code sections - GMER 2.1 ----
.text C:\Windows\System32\win32k.sys!W32pServiceTable fffff96000153f00 7 bytes [00, 98, F3, FF, 01, A6, F0]
.text C:\Windows\System32\win32k.sys!W32pServiceTable + 8 fffff96000153f08 3 bytes [C0, 06, 02]
.text ... * 109
.text C:\Windows\System32\win32k.sys!BRUSHOBJ_pvGetRbrush + 432 fffff9600020ba18 8 bytes [58, 70, 2C, 04, 80, F8, FF, ...]
.text C:\Windows\System32\win32k.sys!CLIPOBJ_bEnum + 740 fffff9600020bee8 8 bytes [14, 71, 2C, 04, 80, F8, FF, ...]
.text C:\Windows\System32\win32k.sys!EngAcquireSemaphoreNoWait + 76 fffff9600020c578 8 bytes [E0, 71, 2C, 04, 80, F8, FF, ...]
.text C:\Windows\System32\win32k.sys!EngIsSemaphoreSharedByCurrentThread + 24 fffff9600020c658 8 bytes [F8, 73, 2C, 04, 80, F8, FF, ...]
.text C:\Windows\System32\win32k.sys!EngDeleteSafeSemaphore + 53 fffff9600020c729 7 bytes [7B, 2C, 04, 80, F8, FF, FF]
.text C:\Windows\System32\win32k.sys!EngGetProcessHandle + 398 fffff96000212a92 3 bytes [FF, 25, C0]
.text C:\Windows\System32\win32k.sys!EngGetProcessHandle + 402 fffff96000212a96 2 bytes [04, 00]
.text C:\Windows\System32\win32k.sys!EngMarkBandingSurface + 60 fffff96000214598 8 bytes [28, 81, 2C, 04, 80, F8, FF, ...]
.text C:\Windows\System32\win32k.sys!EngUnlockSurface + 52 fffff96000214698 8 bytes [38, 83, 2C, 04, 80, F8, FF, ...]
.text C:\Windows\System32\win32k.sys!EngCreateEvent + 88 fffff9600021cf78 8 bytes [E4, 74, 2C, 04, 80, F8, FF, ...]
.text C:\Windows\System32\win32k.sys!EngGetRgnBox + 48 fffff9600021d5c8 8 bytes [C8, 6D, 2C, 04, 80, F8, FF, ...]
.text C:\Windows\System32\win32k.sys!EngGetFileChangeTime + 304 fffff9600021da48 8 bytes [C0, 79, 2C, 04, 80, F8, FF, ...]
.text C:\Windows\System32\win32k.sys!EngFindResource + 840 fffff9600021dd98 8 bytes [A4, 7A, 2C, 04, 80, F8, FF, ...]
.text C:\Windows\System32\win32k.sys!EngWideCharToMultiByte + 28 fffff9600021ddf8 8 bytes [D0, 76, 2C, 04, 80, F8, FF, ...]
.text C:\Windows\System32\win32k.sys!EngDitherColor + 416 fffff9600023e368 8 bytes [74, 77, 2C, 04, 80, F8, FF, ...]
.text C:\Windows\System32\win32k.sys!EngFileWrite + 76 fffff9600023e418 8 bytes [D8, 77, 2C, 04, 80, F8, FF, ...]
.text C:\Windows\System32\win32k.sys!EngFileIoControl + 312 fffff9600023e558 8 bytes [F0, 78, 2C, 04, 80, F8, FF, ...]
.text C:\Windows\System32\win32k.sys!EngLoadModuleForWrite + 16 fffff9600024e628 8 bytes {CALL QWORD [RAX+0x42c7f64]}
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1400] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076a51465 2 bytes [A5, 76]
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1400] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076a514bb 2 bytes [A5, 76]
.text ... * 2
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3792] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076a51465 2 bytes [A5, 76]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3792] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076a514bb 2 bytes [A5, 76]
.text ... * 2
.text C:\Program Files (x86)\congstar\Internet-Manager\Bin\mcserver.exe[3964] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076a51465 2 bytes [A5, 76]
.text C:\Program Files (x86)\congstar\Internet-Manager\Bin\mcserver.exe[3964] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076a514bb 2 bytes [A5, 76]
.text ... * 2
.text C:\Users\Holger\AppData\Roaming\Dropbox\bin\Dropbox.exe[1892] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 69 0000000076a51465 2 bytes [A5, 76]
.text C:\Users\Holger\AppData\Roaming\Dropbox\bin\Dropbox.exe[1892] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 155 0000000076a514bb 2 bytes [A5, 76]
.text ... * 2
.text C:\Program Files (x86)\iSafe\iSafeTray.exe[3864] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076a51465 2 bytes [A5, 76]
.text C:\Program Files (x86)\iSafe\iSafeTray.exe[3864] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076a514bb 2 bytes [A5, 76]
.text ... * 2
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000770b11f5 8 bytes {JMP 0xd}
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 00000000770b1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000770b143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 00000000770b158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000770b191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 00000000770b1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 00000000770b1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 00000000770b1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 00000000770b1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 00000000770b1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 00000000770b1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 00000000770b1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 00000000770b1fd7 8 bytes {JMP 0xb}
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 00000000770b2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 00000000770b2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 00000000770b2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000770b27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000770b27d2 8 bytes {JMP 0x10}
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 00000000770b282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 00000000770b2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 00000000770b2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 00000000770b2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 00000000770b3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 00000000770b323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000770b33c0 16 bytes {JMP 0x4e}
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 00000000770b3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000770b3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000770b3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 00000000770b3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 00000000770b4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077101380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077101500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077101530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077101650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077101700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077101d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077101f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771027e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000074b913cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000074b9146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000074b916d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 0000000074b916e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000074b919db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000074b919fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 0000000074b91a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 0000000074b91a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074b91a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\cmd.exe[5252] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 0000000074b91a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000770b11f5 8 bytes {JMP 0xd}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 00000000770b1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000770b143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 00000000770b158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000770b191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 00000000770b1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 00000000770b1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 00000000770b1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 00000000770b1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 00000000770b1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 00000000770b1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 00000000770b1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 00000000770b1fd7 8 bytes {JMP 0xb}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 00000000770b2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 00000000770b2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 00000000770b2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000770b27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000770b27d2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 00000000770b282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 00000000770b2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 00000000770b2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 00000000770b2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 00000000770b3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 00000000770b323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000770b33c0 16 bytes {JMP 0x4e}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 00000000770b3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000770b3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000770b3b85 8 bytes [10, 6A, F8, FF, 00, 00, 00, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 00000000770b3d23 8 bytes [00, 6A, F8, FF, 00, 00, 00, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 00000000770b4190 8 bytes [A0, 69, F8, FF, 00, 00, 00, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077101380 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077101500 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077101530 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077101650 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077101700 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077101d30 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077101f80 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771027e0 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000074b913cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000074b9146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000074b916d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 0000000074b916e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000074b919db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000074b919fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 0000000074b91a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 0000000074b91a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074b91a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5436] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 0000000074b91a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000770b11f5 8 bytes {JMP 0xd}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 00000000770b1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000770b143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 00000000770b158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000770b191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 00000000770b1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 00000000770b1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 00000000770b1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 00000000770b1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 00000000770b1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 00000000770b1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 00000000770b1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 00000000770b1fd7 8 bytes {JMP 0xb}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 00000000770b2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 00000000770b2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 00000000770b2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000770b27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000770b27d2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 00000000770b282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 00000000770b2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 00000000770b2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 00000000770b2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 00000000770b3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 00000000770b323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000770b33c0 16 bytes {JMP 0x4e}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 00000000770b3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000770b3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000770b3b85 8 bytes [10, 6A, F8, FF, 00, 00, 00, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 00000000770b3d23 8 bytes [00, 6A, F8, FF, 00, 00, 00, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 00000000770b4190 8 bytes [A0, 69, F8, FF, 00, 00, 00, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077101380 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077101500 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077101530 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077101650 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077101700 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077101d30 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077101f80 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771027e0 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000074b913cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000074b9146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000074b916d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 0000000074b916e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000074b919db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000074b919fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 0000000074b91a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 0000000074b91a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074b91a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5528] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 0000000074b91a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000770b11f5 8 bytes {JMP 0xd}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 00000000770b1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000770b143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 00000000770b158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000770b191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 00000000770b1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 00000000770b1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 00000000770b1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 00000000770b1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 00000000770b1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 00000000770b1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 00000000770b1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 00000000770b1fd7 8 bytes {JMP 0xb}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 00000000770b2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 00000000770b2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 00000000770b2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000770b27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000770b27d2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 00000000770b282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 00000000770b2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 00000000770b2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 00000000770b2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 00000000770b3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 00000000770b323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000770b33c0 16 bytes {JMP 0x4e}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 00000000770b3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000770b3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000770b3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 00000000770b3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 00000000770b4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077101380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077101500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077101530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077101650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077101700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077101d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077101f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771027e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000074b913cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000074b9146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000074b916d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 0000000074b916e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000074b919db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000074b919fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 0000000074b91a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 0000000074b91a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074b91a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\plugin-nm-server.exe[5612] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 0000000074b91a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000770b11f5 8 bytes {JMP 0xd}
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 00000000770b1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000770b143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 00000000770b158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000770b191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 00000000770b1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 00000000770b1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 00000000770b1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 00000000770b1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 00000000770b1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 00000000770b1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 00000000770b1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 00000000770b1fd7 8 bytes {JMP 0xb}
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 00000000770b2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 00000000770b2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 00000000770b2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000770b27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000770b27d2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 00000000770b282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 00000000770b2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 00000000770b2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 00000000770b2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 00000000770b3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 00000000770b323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000770b33c0 16 bytes {JMP 0x4e}
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 00000000770b3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000770b3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000770b3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 00000000770b3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 00000000770b4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077101380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077101500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077101530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077101650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077101700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077101d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077101f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771027e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000074b913cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000074b9146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000074b916d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 0000000074b916e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000074b919db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000074b919fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 0000000074b91a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 0000000074b91a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074b91a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 0000000074b91a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076a51465 2 bytes [A5, 76]
.text C:\Program Files (x86)\Syncios\SynciosDeviceService.exe[5712] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076a514bb 2 bytes [A5, 76]
.text ... * 2
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000770b11f5 8 bytes {JMP 0xd}
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 00000000770b1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000770b143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 00000000770b158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000770b191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 00000000770b1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 00000000770b1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 00000000770b1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 00000000770b1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 00000000770b1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 00000000770b1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 00000000770b1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 00000000770b1fd7 8 bytes {JMP 0xb}
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 00000000770b2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 00000000770b2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 00000000770b2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000770b27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000770b27d2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 00000000770b282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 00000000770b2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 00000000770b2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 00000000770b2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 00000000770b3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 00000000770b323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000770b33c0 16 bytes {JMP 0x4e}
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 00000000770b3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000770b3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000770b3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 00000000770b3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 00000000770b4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077101380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077101500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077101530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077101650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077101700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077101d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077101f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771027e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000074b913cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000074b9146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000074b916d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 0000000074b916e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000074b919db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000074b919fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 0000000074b91a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 0000000074b91a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074b91a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 0000000074b91a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076a51465 2 bytes [A5, 76]
.text C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[5864] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076a514bb 2 bytes [A5, 76]
.text ... * 2
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000770b11f5 8 bytes {JMP 0xd}
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 00000000770b1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000770b143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 00000000770b158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000770b191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 00000000770b1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 00000000770b1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 00000000770b1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 00000000770b1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 00000000770b1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 00000000770b1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 00000000770b1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 00000000770b1fd7 8 bytes {JMP 0xb}
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 00000000770b2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 00000000770b2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 00000000770b2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000770b27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000770b27d2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 00000000770b282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 00000000770b2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 00000000770b2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 00000000770b2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 00000000770b3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 00000000770b323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000770b33c0 16 bytes {JMP 0x4e}
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 00000000770b3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000770b3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000770b3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 00000000770b3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 00000000770b4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077101380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077101500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077101530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077101650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077101700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077101d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077101f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771027e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000074b913cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000074b9146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000074b916d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 0000000074b916e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000074b919db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000074b919fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 0000000074b91a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 0000000074b91a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074b91a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\iSafe\ipcdl.exe[1444] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3
|
Lesestoff:
AdwCleaner auf deinen Desktop.
FRST 32-Bit | FRST 64-Bit