| MasterChaos | 29.10.2014 18:27 |
gmer
GMER Logfile: Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-10-11 15:55:20
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 SAMSUNG_HM250HI rev.2AC101C4 232,89GB
Running: Gmer-19357.exe; Driver: C:\Users\WARKEN~1\AppData\Local\Temp\uxliiuoc.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff80003005000 8 bytes [00, 00, 16, 02, 4E, 74, 66, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 544 fffff80003005010 29 bytes [43, 07, 50, 01, 80, FA, FF, ...]
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\AdFender\AdFender.exe[3008] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075b71465 2 bytes [B7, 75]
.text C:\Program Files (x86)\AdFender\AdFender.exe[3008] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075b714bb 2 bytes [B7, 75]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3116] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075b71465 2 bytes [B7, 75]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3116] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075b714bb 2 bytes [B7, 75]
.text ... * 2
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000774411f5 8 bytes {JMP 0xd}
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077441390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 000000007744143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 000000007744158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 000000007744191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077441b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077441bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077441d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077441eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077441edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077441f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077441fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077441fd7 8 bytes {JMP 0xb}
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077442272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077442301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077442792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000774427b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000774427d2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007744282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077442890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077442d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077442d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077443023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007744323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000774433c0 16 bytes {JMP 0x4e}
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077443a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077443ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077443b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077443d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077444190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077491380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077491500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077491530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077491650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077491700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077491d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077491f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000774927e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000073be13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000073be146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000073be16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 0000000073be16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000073be19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000073be19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 0000000073be1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 0000000073be1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000073be1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Nero\Update\NASvc.exe[4880] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 0000000073be1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000774411f5 8 bytes {JMP 0xd}
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077441390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 000000007744143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 000000007744158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 000000007744191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077441b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077441bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077441d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077441eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077441edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077441f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077441fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077441fd7 8 bytes {JMP 0xb}
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077442272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077442301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077442792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000774427b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000774427d2 8 bytes {JMP 0x10}
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007744282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077442890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077442d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077442d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077443023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007744323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000774433c0 16 bytes {JMP 0x4e}
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077443a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077443ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077443b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077443d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077444190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077491380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077491500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077491530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077491650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077491700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077491d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077491f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000774927e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000073be13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000073be146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000073be16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 0000000073be16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000073be19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000073be19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 0000000073be1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 0000000073be1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000073be1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\SysWOW64\DllHost.exe[4512] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 0000000073be1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000774411f5 8 bytes {JMP 0xd}
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077441390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 000000007744143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 000000007744158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 000000007744191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077441b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077441bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077441d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077441eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077441edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077441f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077441fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077441fd7 8 bytes {JMP 0xb}
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077442272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077442301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077442792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000774427b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000774427d2 8 bytes {JMP 0x10}
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007744282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077442890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077442d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077442d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077443023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007744323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000774433c0 16 bytes {JMP 0x4e}
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077443a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077443ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077443b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077443d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077444190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077491380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077491500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077491530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077491650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077491700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077491d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077491f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000774927e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000073be13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000073be146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000073be16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 0000000073be16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000073be19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000073be19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 0000000073be1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 0000000073be1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000073be1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 0000000073be1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075b71465 2 bytes [B7, 75]
.text C:\Users\WARKEN~1\AppData\Local\Temp\MxUninstall\MxUninstall.exe[1972] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075b714bb 2 bytes [B7, 75]
.text ... * 2
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000774411f5 8 bytes {JMP 0xd}
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077441390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 000000007744143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 000000007744158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 000000007744191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077441b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077441bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077441d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077441eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077441edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077441f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077441fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077441fd7 8 bytes {JMP 0xb}
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077442272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077442301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077442792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000774427b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000774427d2 8 bytes {JMP 0x10}
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007744282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077442890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077442d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077442d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077443023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007744323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000774433c0 16 bytes {JMP 0x4e}
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077443a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077443ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077443b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077443d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077444190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077491380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077491500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077491530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077491650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077491700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077491d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077491f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000774927e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000073be13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000073be146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000073be16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 0000000073be16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000073be19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000073be19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 0000000073be1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 0000000073be1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000073be1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalwareService.exe[2916] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 0000000073be1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000774411f5 8 bytes {JMP 0xd}
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077441390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 000000007744143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 000000007744158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 000000007744191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077441b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077441bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077441d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077441eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077441edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077441f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077441fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077441fd7 8 bytes {JMP 0xb}
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077442272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077442301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077442792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000774427b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000774427d2 8 bytes {JMP 0x10}
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007744282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077442890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077442d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077442d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077443023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007744323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000774433c0 16 bytes {JMP 0x4e}
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077443a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077443ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077443b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077443d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077444190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077491380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077491500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077491530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077491650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077491700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077491d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077491f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000774927e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000073be13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000073be146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000073be16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 0000000073be16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000073be19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000073be19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 0000000073be1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 0000000073be1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000073be1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 0000000073be1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\syswow64\PSAPI.dll!GetModuleInformation + 69 0000000075b71465 2 bytes [B7, 75]
.text C:\Trojaner programme\Stronghold AntiMalware\StrongholdAntiMalware.exe[784] C:\Windows\syswow64\PSAPI.dll!GetModuleInformation + 155 0000000075b714bb 2 bytes [B7, 75]
.text ... * 2
? C:\Windows\system32\mssprxy.dll [784] entry point in ".rdata" section 000000006e1d71e6
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000774411f5 8 bytes {JMP 0xd}
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077441390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 000000007744143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 000000007744158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 000000007744191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077441b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077441bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077441d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077441eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077441edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077441f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077441fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077441fd7 8 bytes {JMP 0xb}
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077442272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077442301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077442792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000774427b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000774427d2 8 bytes {JMP 0x10}
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007744282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077442890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077442d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077442d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077443023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007744323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000774433c0 16 bytes {JMP 0x4e}
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077443a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077443ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077443b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077443d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077444190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077491380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077491500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077491530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077491650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077491700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077491d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077491f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000774927e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000073be13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000073be146b 8 bytes {JMP 0xffffffffffffffb0}
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000073be16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 0000000073be16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000073be19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000073be19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 0000000073be1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 0000000073be1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000073be1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text H:\Trojana Programme\Gmer-19357.exe[9136] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 0000000073be1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
---- Threads - GMER 2.1 ----
Thread C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2056:5912] 000007fef6b04094
Thread C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2056:6068] 000007fef5087c4c
Thread C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2056:1356] 000007fef6b04094
Thread C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2056:6092] 000007fef4a5c0d0
Thread C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2056:6100] 000007fef6b04094
Thread C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [1980:2728] 000007fef6b04094
Thread C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [1980:2320] 000007fef6b04094
Thread C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [1980:2396] 000007fef4a5c0d0
---- EOF - GMER 2.1 ----
--- --- --- |
So funktioniert es:
Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
Malwarebytes Anti-Malware 
AdwCleaner auf deinen Desktop.
SecurityCheck und:
dann auf 
und dann auf 
. 
