| Fellefant | 12.12.2014 10:12 |
Und hier der Rest Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-12-11 19:51:29
Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\0000002f WDC_WD10EZEX-22BN5A0 rev.01.01A01 931,51GB
Running: Gmer-19357.exe; Driver: C:\Users\Jochen\AppData\Local\Temp\axdirkod.sys
---- Kernel code sections - GMER 2.1 ----
.text C:\Windows\System32\win32k.sys!W32pServiceTable fffff960000b4e00 15 bytes [00, FA, 0E, 02, C0, 9C, 70, ...]
.text C:\Windows\System32\win32k.sys!W32pServiceTable + 16 fffff960000b4e10 11 bytes [00, 00, FC, FF, 80, FA, C0, ...]
---- User code sections - GMER 2.1 ----
.text C:\Windows\system32\dwm.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00007fffe6f167d0 4 bytes [FF, 25, 60, 98]
.text C:\Windows\system32\dwm.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 00007fffe6f167e0 5 bytes [FF, 25, 50, 98, 2B]
.text C:\Windows\system32\dwm.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00007fffe6f168a0 5 bytes [FF, 25, 90, 97, 29]
.text C:\Windows\system32\dwm.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fffe6f16ac0 5 bytes [FF, 25, 70, 95, 27]
.text C:\Windows\system32\dwm.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00007fffe6f16b70 5 bytes [FF, 25, C0, 94, 21]
.text C:\Windows\system32\dwm.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 00007fffe6f171d0 5 bytes [FF, 25, 60, 8E, 23]
.text C:\Windows\system32\dwm.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007fffe6f17c00 6 bytes {JMP QWORD [RIP+0x2d8430]}
.text C:\Windows\system32\dwm.exe[1016] C:\Windows\system32\KERNEL32.DLL!CreateProcessInternalW 00007fffe47ed268 6 bytes {JMP QWORD [RIP+0x1c2dc8]}
.text C:\Windows\system32\dwm.exe[1016] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 198 00007fffe45655e6 3 bytes [24, AA, 10]
.text C:\Windows\system32\dwm.exe[1016] C:\Windows\system32\USER32.dll!SendInput 00007fffe6bc1220 6 bytes {JMP QWORD [RIP+0x4cee10]}
.text C:\Windows\system32\dwm.exe[1016] C:\Windows\system32\USER32.dll!PostMessageW 00007fffe6bc2b00 6 bytes {JMP QWORD [RIP+0x54d530]}
.text C:\Windows\system32\dwm.exe[1016] C:\Windows\system32\USER32.dll!SendMessageW 00007fffe6bc6970 6 bytes {JMP QWORD [RIP+0x5096c0]}
.text C:\Windows\system32\dwm.exe[1016] C:\Windows\system32\USER32.dll!PostMessageA 00007fffe6bcbea0 6 bytes {JMP QWORD [RIP+0x524190]}
.text C:\Windows\system32\dwm.exe[1016] C:\Windows\system32\USER32.dll!SendMessageA 00007fffe6bdb640 6 bytes {JMP QWORD [RIP+0x4d49f0]}
.text C:\Windows\system32\dwm.exe[1016] C:\Windows\system32\USER32.dll!mouse_event 00007fffe6be2b88 6 bytes {JMP QWORD [RIP+0x46d4a8]}
.text C:\Windows\system32\dwm.exe[1016] C:\Windows\system32\USER32.dll!keybd_event 00007fffe6bf2bb0 6 bytes {JMP QWORD [RIP+0x47d480]}
.text C:\Windows\system32\dwm.exe[1016] C:\Windows\system32\ADVAPI32.dll!CreateServiceA 00007fffe553acc0 6 bytes {JMP QWORD [RIP+0x14c5370]}
.text C:\Windows\system32\dwm.exe[1016] C:\Windows\system32\ADVAPI32.dll!CreateServiceW 00007fffe553ad44 6 bytes {JMP QWORD [RIP+0x14e52ec]}
.text C:\Windows\system32\dwm.exe[1016] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fffe528169a 4 bytes [28, E5, FF, 7F]
.text C:\Windows\system32\dwm.exe[1016] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fffe52816a2 4 bytes [28, E5, FF, 7F]
.text C:\Windows\system32\dwm.exe[1016] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fffe528181a 4 bytes [28, E5, FF, 7F]
.text C:\Windows\system32\dwm.exe[1016] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fffe5281832 4 bytes [28, E5, FF, 7F]
.text C:\Windows\system32\nvvsvc.exe[432] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fffe528169a 4 bytes [28, E5, FF, 7F]
.text C:\Windows\system32\nvvsvc.exe[432] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fffe52816a2 4 bytes [28, E5, FF, 7F]
.text C:\Windows\system32\nvvsvc.exe[432] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fffe528181a 4 bytes [28, E5, FF, 7F]
.text C:\Windows\system32\nvvsvc.exe[432] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fffe5281832 4 bytes [28, E5, FF, 7F]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00007fffe6f167d0 4 bytes [FF, 25, 60, 98]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 00007fffe6f167e0 5 bytes [FF, 25, 50, 98, 2B]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00007fffe6f168a0 5 bytes [FF, 25, 90, 97, 29]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fffe6f16ac0 5 bytes [FF, 25, 70, 95, 27]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00007fffe6f16b70 5 bytes [FF, 25, C0, 94, 21]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 00007fffe6f171d0 5 bytes [FF, 25, 60, 8E, 23]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[812] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007fffe6f17c00 6 bytes {JMP QWORD [RIP+0x2d8430]}
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[812] C:\Windows\system32\KERNEL32.DLL!CreateProcessInternalW 00007fffe47ed268 6 bytes {JMP QWORD [RIP+0x1c2dc8]}
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[812] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 198 00007fffe45655e6 3 bytes [24, AA, 15]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[812] C:\Windows\system32\USER32.dll!SendInput 00007fffe6bc1220 6 bytes {JMP QWORD [RIP+0x4cee10]}
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[812] C:\Windows\system32\USER32.dll!PostMessageW 00007fffe6bc2b00 6 bytes {JMP QWORD [RIP+0x54d530]}
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[812] C:\Windows\system32\USER32.dll!SendMessageW 00007fffe6bc6970 6 bytes {JMP QWORD [RIP+0x5096c0]}
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[812] C:\Windows\system32\USER32.dll!PostMessageA 00007fffe6bcbea0 6 bytes {JMP QWORD [RIP+0x524190]}
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[812] C:\Windows\system32\USER32.dll!SendMessageA 00007fffe6bdb640 6 bytes {JMP QWORD [RIP+0x4d49f0]}
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[812] C:\Windows\system32\USER32.dll!mouse_event 00007fffe6be2b88 6 bytes {JMP QWORD [RIP+0x46d4a8]}
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[812] C:\Windows\system32\USER32.dll!keybd_event 00007fffe6bf2bb0 6 bytes {JMP QWORD [RIP+0x47d480]}
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[812] C:\Windows\SYSTEM32\WINSPOOL.DRV!AddPrintProvidorA 00007fffdfceb128 6 bytes {JMP QWORD [RIP+0xa4f08]}
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[812] C:\Windows\SYSTEM32\WINSPOOL.DRV!AddPrintProvidorW 00007fffdfcf36c8 6 bytes {JMP QWORD [RIP+0xbc968]}
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[812] C:\Windows\system32\ADVAPI32.dll!CreateServiceA 00007fffe553acc0 6 bytes {JMP QWORD [RIP+0x14c5370]}
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[812] C:\Windows\system32\ADVAPI32.dll!CreateServiceW 00007fffe553ad44 6 bytes {JMP QWORD [RIP+0x14e52ec]}
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[812] C:\Windows\system32\WS2_32.dll!WSALookupServiceBeginW 00000000038f3330 6 bytes {JMP QWORD [RIP+0x47cd00]}
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[812] C:\Windows\system32\WS2_32.dll!connect + 1 00000000039007f1 5 bytes {JMP QWORD [RIP+0x3bf840]}
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[812] C:\Windows\system32\WS2_32.dll!listen 0000000003904160 6 bytes {JMP QWORD [RIP+0x43bed0]}
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[812] C:\Windows\system32\WS2_32.dll!WSAConnect 00000000039069b0 6 bytes {JMP QWORD [RIP+0x3f9680]}
.text C:\Windows\system32\DllHost.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00007fffe6f167d0 4 bytes [FF, 25, 60, 98]
.text C:\Windows\system32\DllHost.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 00007fffe6f167e0 5 bytes [FF, 25, 50, 98, 2B]
.text C:\Windows\system32\DllHost.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00007fffe6f168a0 5 bytes [FF, 25, 90, 97, 29]
.text C:\Windows\system32\DllHost.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fffe6f16ac0 5 bytes [FF, 25, 70, 95, 27]
.text C:\Windows\system32\DllHost.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00007fffe6f16b70 5 bytes [FF, 25, C0, 94, 21]
.text C:\Windows\system32\DllHost.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 00007fffe6f171d0 5 bytes [FF, 25, 60, 8E, 23]
.text C:\Windows\system32\DllHost.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007fffe6f17c00 6 bytes {JMP QWORD [RIP+0x2d8430]}
.text C:\Windows\system32\DllHost.exe[3852] C:\Windows\system32\KERNEL32.DLL!CreateProcessInternalW 00007fffe47ed268 6 bytes {JMP QWORD [RIP+0x1c2dc8]}
.text C:\Windows\system32\DllHost.exe[3852] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 198 00007fffe45655e6 3 bytes [24, AA, 10]
.text C:\Windows\system32\DllHost.exe[3852] C:\Windows\system32\USER32.dll!SendInput 00007fffe6bc1220 6 bytes {JMP QWORD [RIP+0x4cee10]}
.text C:\Windows\system32\DllHost.exe[3852] C:\Windows\system32\USER32.dll!PostMessageW 00007fffe6bc2b00 6 bytes {JMP QWORD [RIP+0x54d530]}
.text C:\Windows\system32\DllHost.exe[3852] C:\Windows\system32\USER32.dll!SendMessageW 00007fffe6bc6970 6 bytes {JMP QWORD [RIP+0x5096c0]}
.text C:\Windows\system32\DllHost.exe[3852] C:\Windows\system32\USER32.dll!PostMessageA 00007fffe6bcbea0 6 bytes {JMP QWORD [RIP+0x524190]}
.text C:\Windows\system32\DllHost.exe[3852] C:\Windows\system32\USER32.dll!SendMessageA 00007fffe6bdb640 6 bytes {JMP QWORD [RIP+0x4d49f0]}
.text C:\Windows\system32\DllHost.exe[3852] C:\Windows\system32\USER32.dll!mouse_event 00007fffe6be2b88 6 bytes {JMP QWORD [RIP+0x46d4a8]}
.text C:\Windows\system32\DllHost.exe[3852] C:\Windows\system32\USER32.dll!keybd_event 00007fffe6bf2bb0 6 bytes {JMP QWORD [RIP+0x47d480]}
.text C:\Windows\system32\DllHost.exe[3852] C:\Windows\system32\ADVAPI32.dll!CreateServiceA 00007fffe553acc0 6 bytes {JMP QWORD [RIP+0x14c5370]}
.text C:\Windows\system32\DllHost.exe[3852] C:\Windows\system32\ADVAPI32.dll!CreateServiceW 00007fffe553ad44 6 bytes {JMP QWORD [RIP+0x14e52ec]}
.text C:\Windows\System32\skydrive.exe[4300] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00007fffe6f167d0 4 bytes [FF, 25, 60, 98]
.text C:\Windows\System32\skydrive.exe[4300] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 00007fffe6f167e0 5 bytes [FF, 25, 50, 98, 2B]
.text C:\Windows\System32\skydrive.exe[4300] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00007fffe6f168a0 5 bytes [FF, 25, 90, 97, 29]
.text C:\Windows\System32\skydrive.exe[4300] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fffe6f16ac0 5 bytes [FF, 25, 70, 95, 27]
.text C:\Windows\System32\skydrive.exe[4300] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00007fffe6f16b70 5 bytes [FF, 25, C0, 94, 21]
.text C:\Windows\System32\skydrive.exe[4300] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 00007fffe6f171d0 5 bytes [FF, 25, 60, 8E, 23]
.text C:\Windows\System32\skydrive.exe[4300] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007fffe6f17c00 6 bytes {JMP QWORD [RIP+0x2d8430]}
.text C:\Windows\System32\skydrive.exe[4300] C:\Windows\system32\KERNEL32.DLL!CreateProcessInternalW 00007fffe47ed268 6 bytes {JMP QWORD [RIP+0x922dc8]}
.text C:\Windows\System32\skydrive.exe[4300] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 198 00007fffe45655e6 3 bytes [24, AA, 10]
.text C:\Windows\System32\skydrive.exe[4300] C:\Windows\system32\USER32.dll!SendInput 00007fffe6bc1220 6 bytes {JMP QWORD [RIP+0x4cee10]}
.text C:\Windows\System32\skydrive.exe[4300] C:\Windows\system32\USER32.dll!PostMessageW 00007fffe6bc2b00 6 bytes {JMP QWORD [RIP+0x54d530]}
.text C:\Windows\System32\skydrive.exe[4300] C:\Windows\system32\USER32.dll!SendMessageW 00007fffe6bc6970 6 bytes {JMP QWORD [RIP+0x5096c0]}
.text C:\Windows\System32\skydrive.exe[4300] C:\Windows\system32\USER32.dll!PostMessageA 00007fffe6bcbea0 6 bytes {JMP QWORD [RIP+0x524190]}
.text C:\Windows\System32\skydrive.exe[4300] C:\Windows\system32\USER32.dll!SendMessageA 00007fffe6bdb640 6 bytes {JMP QWORD [RIP+0x4d49f0]}
.text C:\Windows\System32\skydrive.exe[4300] C:\Windows\system32\USER32.dll!mouse_event 00007fffe6be2b88 6 bytes {JMP QWORD [RIP+0x46d4a8]}
.text C:\Windows\System32\skydrive.exe[4300] C:\Windows\system32\USER32.dll!keybd_event 00007fffe6bf2bb0 6 bytes {JMP QWORD [RIP+0x47d480]}
.text C:\Windows\System32\skydrive.exe[4300] C:\Windows\system32\WS2_32.dll!WSALookupServiceBeginW 00007fffe4993330 6 bytes {JMP QWORD [RIP+0x75cd00]}
.text C:\Windows\System32\skydrive.exe[4300] C:\Windows\system32\WS2_32.dll!connect + 1 00007fffe49a07f1 5 bytes {JMP QWORD [RIP+0x6f840]}
.text C:\Windows\System32\skydrive.exe[4300] C:\Windows\system32\WS2_32.dll!listen 00007fffe49a4160 6 bytes {JMP QWORD [RIP+0x49bed0]}
.text C:\Windows\System32\skydrive.exe[4300] C:\Windows\system32\WS2_32.dll!WSAConnect 00007fffe49a69b0 6 bytes {JMP QWORD [RIP+0x89680]}
.text C:\Windows\System32\skydrive.exe[4300] C:\Windows\SYSTEM32\advapi32.dll!CreateServiceA 00007fffe553acc0 6 bytes {JMP QWORD [RIP+0x14c5370]}
.text C:\Windows\System32\skydrive.exe[4300] C:\Windows\SYSTEM32\advapi32.dll!CreateServiceW 00007fffe553ad44 6 bytes {JMP QWORD [RIP+0x14e52ec]}
.text C:\Windows\System32\RuntimeBroker.exe[4372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00007fffe6f167d0 4 bytes [FF, 25, 60, 98]
.text C:\Windows\System32\RuntimeBroker.exe[4372] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 00007fffe6f167e0 5 bytes [FF, 25, 50, 98, 2B]
.text C:\Windows\System32\RuntimeBroker.exe[4372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00007fffe6f168a0 5 bytes [FF, 25, 90, 97, 29]
.text C:\Windows\System32\RuntimeBroker.exe[4372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fffe6f16ac0 5 bytes [FF, 25, 70, 95, 27]
.text C:\Windows\System32\RuntimeBroker.exe[4372] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00007fffe6f16b70 5 bytes [FF, 25, C0, 94, 21]
.text C:\Windows\System32\RuntimeBroker.exe[4372] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 00007fffe6f171d0 5 bytes [FF, 25, 60, 8E, 23]
.text C:\Windows\System32\RuntimeBroker.exe[4372] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007fffe6f17c00 6 bytes {JMP QWORD [RIP+0x2d8430]}
.text C:\Windows\System32\RuntimeBroker.exe[4372] C:\Windows\system32\KERNEL32.DLL!CreateProcessInternalW 00007fffe47ed268 6 bytes {JMP QWORD [RIP+0x1c2dc8]}
.text C:\Windows\System32\RuntimeBroker.exe[4372] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 198 00007fffe45655e6 3 bytes [24, AA, 10]
.text C:\Windows\System32\RuntimeBroker.exe[4372] C:\Windows\system32\USER32.dll!SendInput 00007fffe6bc1220 6 bytes {JMP QWORD [RIP+0x4cee10]}
.text C:\Windows\System32\RuntimeBroker.exe[4372] C:\Windows\system32\USER32.dll!PostMessageW 00007fffe6bc2b00 6 bytes {JMP QWORD [RIP+0x54d530]}
.text C:\Windows\System32\RuntimeBroker.exe[4372] C:\Windows\system32\USER32.dll!SendMessageW 00007fffe6bc6970 6 bytes {JMP QWORD [RIP+0x5096c0]}
.text C:\Windows\System32\RuntimeBroker.exe[4372] C:\Windows\system32\USER32.dll!PostMessageA 00007fffe6bcbea0 6 bytes {JMP QWORD [RIP+0x524190]}
.text C:\Windows\System32\RuntimeBroker.exe[4372] C:\Windows\system32\USER32.dll!SendMessageA 00007fffe6bdb640 6 bytes {JMP QWORD [RIP+0x4d49f0]}
.text C:\Windows\System32\RuntimeBroker.exe[4372] C:\Windows\system32\USER32.dll!mouse_event 00007fffe6be2b88 6 bytes {JMP QWORD [RIP+0x46d4a8]}
.text C:\Windows\System32\RuntimeBroker.exe[4372] C:\Windows\system32\USER32.dll!keybd_event 00007fffe6bf2bb0 6 bytes {JMP QWORD [RIP+0x47d480]}
.text C:\Windows\System32\RuntimeBroker.exe[4372] C:\Windows\system32\ADVAPI32.dll!CreateServiceA 00007fffe553acc0 6 bytes {JMP QWORD [RIP+0x14c5370]}
.text C:\Windows\System32\RuntimeBroker.exe[4372] C:\Windows\system32\ADVAPI32.dll!CreateServiceW 00007fffe553ad44 6 bytes {JMP QWORD [RIP+0x14e52ec]}
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[4564] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00007fffe6f167d0 5 bytes [FF, 25, 60, 98, 29]
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[4564] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 00007fffe6f167e0 5 bytes [FF, 25, 50, 98, 2F]
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[4564] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00007fffe6f168a0 5 bytes [FF, 25, 90, 97, 2D]
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[4564] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fffe6f16ac0 5 bytes [FF, 25, 70, 95, 2B]
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[4564] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00007fffe6f16b70 5 bytes [FF, 25, C0, 94, 25]
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[4564] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 00007fffe6f171d0 5 bytes [FF, 25, 60, 8E, 27]
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[4564] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007fffe6f17c00 6 bytes {JMP QWORD [RIP+0x318430]}
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[4564] C:\Windows\system32\KERNEL32.DLL!CreateProcessInternalW 00007fffe47ed268 6 bytes {JMP QWORD [RIP+0x1c2dc8]}
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[4564] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 198 00007fffe45655e6 3 bytes [24, AA, 15]
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[4564] C:\Windows\system32\USER32.dll!SendInput 00007fffe6bc1220 6 bytes {JMP QWORD [RIP+0x4cee10]}
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[4564] C:\Windows\system32\USER32.dll!PostMessageW 00007fffe6bc2b00 6 bytes {JMP QWORD [RIP+0x54d530]}
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[4564] C:\Windows\system32\USER32.dll!SendMessageW 00007fffe6bc6970 6 bytes {JMP QWORD [RIP+0x5096c0]}
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[4564] C:\Windows\system32\USER32.dll!PostMessageA 00007fffe6bcbea0 6 bytes {JMP QWORD [RIP+0x524190]}
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[4564] C:\Windows\system32\USER32.dll!SendMessageA 00007fffe6bdb640 6 bytes {JMP QWORD [RIP+0x4d49f0]}
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[4564] C:\Windows\system32\USER32.dll!mouse_event 00007fffe6be2b88 6 bytes {JMP QWORD [RIP+0x46d4a8]}
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[4564] C:\Windows\system32\USER32.dll!keybd_event 00007fffe6bf2bb0 6 bytes {JMP QWORD [RIP+0x47d480]}
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[4564] C:\Windows\SYSTEM32\WINSPOOL.DRV!AddPrintProvidorA 00007fffdfceb128 6 bytes {JMP QWORD [RIP+0xa4f08]}
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[4564] C:\Windows\SYSTEM32\WINSPOOL.DRV!AddPrintProvidorW 00007fffdfcf36c8 6 bytes {JMP QWORD [RIP+0xbc968]}
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[4564] C:\Windows\system32\ADVAPI32.dll!CreateServiceA 00007fffe553acc0 6 bytes {JMP QWORD [RIP+0x1bf5370]}
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[4564] C:\Windows\system32\ADVAPI32.dll!CreateServiceW 00007fffe553ad44 6 bytes {JMP QWORD [RIP+0x1c152ec]}
.text C:\Windows\System32\SettingSyncHost.exe[3060] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00007fffe6f167d0 4 bytes [FF, 25, 60, 98]
.text C:\Windows\System32\SettingSyncHost.exe[3060] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 00007fffe6f167e0 5 bytes [FF, 25, 50, 98, 2B]
.text C:\Windows\System32\SettingSyncHost.exe[3060] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00007fffe6f168a0 5 bytes [FF, 25, 90, 97, 29]
.text C:\Windows\System32\SettingSyncHost.exe[3060] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fffe6f16ac0 5 bytes [FF, 25, 70, 95, 27]
.text C:\Windows\System32\SettingSyncHost.exe[3060] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00007fffe6f16b70 5 bytes [FF, 25, C0, 94, 21]
.text C:\Windows\System32\SettingSyncHost.exe[3060] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 00007fffe6f171d0 5 bytes [FF, 25, 60, 8E, 23]
.text C:\Windows\System32\SettingSyncHost.exe[3060] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007fffe6f17c00 6 bytes {JMP QWORD [RIP+0x2d8430]}
.text C:\Windows\System32\SettingSyncHost.exe[3060] C:\Windows\system32\KERNEL32.DLL!CreateProcessInternalW 00007fffe47ed268 6 bytes {JMP QWORD [RIP+0x1c2dc8]}
.text C:\Windows\System32\SettingSyncHost.exe[3060] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 198 00007fffe45655e6 3 bytes [24, AA, 10]
.text C:\Windows\System32\SettingSyncHost.exe[3060] C:\Windows\SYSTEM32\advapi32.dll!CreateServiceA 00007fffe553acc0 6 bytes {JMP QWORD [RIP+0x14c5370]}
.text C:\Windows\System32\SettingSyncHost.exe[3060] C:\Windows\SYSTEM32\advapi32.dll!CreateServiceW 00007fffe553ad44 6 bytes {JMP QWORD [RIP+0x14e52ec]}
.text C:\Windows\System32\SettingSyncHost.exe[3060] C:\Windows\system32\USER32.dll!SendInput 00007fffe6bc1220 6 bytes {JMP QWORD [RIP+0x4cee10]}
.text C:\Windows\System32\SettingSyncHost.exe[3060] C:\Windows\system32\USER32.dll!PostMessageW 00007fffe6bc2b00 6 bytes {JMP QWORD [RIP+0x54d530]}
.text C:\Windows\System32\SettingSyncHost.exe[3060] C:\Windows\system32\USER32.dll!SendMessageW 00007fffe6bc6970 6 bytes {JMP QWORD [RIP+0x5096c0]}
.text C:\Windows\System32\SettingSyncHost.exe[3060] C:\Windows\system32\USER32.dll!PostMessageA 00007fffe6bcbea0 6 bytes {JMP QWORD [RIP+0x524190]}
.text C:\Windows\System32\SettingSyncHost.exe[3060] C:\Windows\system32\USER32.dll!SendMessageA 00007fffe6bdb640 6 bytes {JMP QWORD [RIP+0x4d49f0]}
.text C:\Windows\System32\SettingSyncHost.exe[3060] C:\Windows\system32\USER32.dll!mouse_event 00007fffe6be2b88 6 bytes {JMP QWORD [RIP+0x46d4a8]}
.text C:\Windows\System32\SettingSyncHost.exe[3060] C:\Windows\system32\USER32.dll!keybd_event 00007fffe6bf2bb0 6 bytes {JMP QWORD [RIP+0x47d480]}
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4732] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00007fffe6f167d0 5 bytes [FF, 25, 60, 98, 29]
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4732] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 00007fffe6f167e0 5 bytes JMP 491
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4732] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00007fffe6f168a0 5 bytes [FF, 25, 90, 97, 2D]
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4732] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fffe6f16ac0 5 bytes JMP 650072
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4732] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00007fffe6f16b70 5 bytes [FF, 25, C0, 94, 25]
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4732] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 00007fffe6f171d0 5 bytes [FF, 25, 60, 8E, 27]
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4732] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007fffe6f17c00 6 bytes {JMP QWORD [RIP+0x318430]}
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4732] C:\Windows\system32\KERNEL32.DLL!CreateProcessInternalW 00007fffe47ed268 6 bytes JMP 0
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4732] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 198 00007fffe45655e6 3 bytes [24, AA, 15]
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4732] C:\Windows\system32\USER32.dll!SendInput 00007fffe6bc1220 6 bytes {JMP QWORD [RIP+0x4cee10]}
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4732] C:\Windows\system32\USER32.dll!PostMessageW 00007fffe6bc2b00 6 bytes {JMP QWORD [RIP+0x54d530]}
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4732] C:\Windows\system32\USER32.dll!SendMessageW 00007fffe6bc6970 6 bytes {JMP QWORD [RIP+0x5096c0]}
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4732] C:\Windows\system32\USER32.dll!PostMessageA 00007fffe6bcbea0 6 bytes {JMP QWORD [RIP+0x524190]}
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4732] C:\Windows\system32\USER32.dll!SendMessageA 00007fffe6bdb640 6 bytes {JMP QWORD [RIP+0x4d49f0]}
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4732] C:\Windows\system32\USER32.dll!mouse_event 00007fffe6be2b88 6 bytes {JMP QWORD [RIP+0x46d4a8]}
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4732] C:\Windows\system32\USER32.dll!keybd_event 00007fffe6bf2bb0 6 bytes {JMP QWORD [RIP+0x47d480]}
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4732] C:\Windows\SYSTEM32\WINSPOOL.DRV!AddPrintProvidorA 00007fffdfceb128 6 bytes {JMP QWORD [RIP+0x84f08]}
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4732] C:\Windows\SYSTEM32\WINSPOOL.DRV!AddPrintProvidorW 00007fffdfcf36c8 6 bytes {JMP QWORD [RIP+0x9c968]}
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4732] C:\Windows\system32\ADVAPI32.dll!CreateServiceA 00007fffe553acc0 6 bytes {JMP QWORD [RIP+0x1bf5370]}
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4732] C:\Windows\system32\ADVAPI32.dll!CreateServiceW 00007fffe553ad44 6 bytes {JMP QWORD [RIP+0x1c152ec]}
.text C:\Windows\System32\spool\drivers\x64\3\E_IATICLE.EXE[4592] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00007fffe6f167d0 4 bytes JMP 12600020
.text C:\Windows\System32\spool\drivers\x64\3\E_IATICLE.EXE[4592] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 00007fffe6f167e0 5 bytes [FF, 25, 50, 98, 2B]
.text C:\Windows\System32\spool\drivers\x64\3\E_IATICLE.EXE[4592] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00007fffe6f168a0 5 bytes JMP 0
.text C:\Windows\System32\spool\drivers\x64\3\E_IATICLE.EXE[4592] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fffe6f16ac0 5 bytes [FF, 25, 70, 95, 27]
.text C:\Windows\System32\spool\drivers\x64\3\E_IATICLE.EXE[4592] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00007fffe6f16b70 5 bytes [FF, 25, C0, 94, 21]
.text C:\Windows\System32\spool\drivers\x64\3\E_IATICLE.EXE[4592] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 00007fffe6f171d0 5 bytes [FF, 25, 60, 8E, 23]
.text C:\Windows\System32\spool\drivers\x64\3\E_IATICLE.EXE[4592] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007fffe6f17c00 6 bytes {JMP QWORD [RIP+0x2d8430]}
.text C:\Windows\System32\spool\drivers\x64\3\E_IATICLE.EXE[4592] C:\Windows\system32\KERNEL32.DLL!CreateProcessInternalW 00007fffe47ed268 6 bytes {JMP QWORD [RIP+0x1c2dc8]}
.text C:\Windows\System32\spool\drivers\x64\3\E_IATICLE.EXE[4592] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 198 00007fffe45655e6 3 bytes [24, AA, 10]
.text C:\Windows\System32\spool\drivers\x64\3\E_IATICLE.EXE[4592] C:\Windows\system32\USER32.dll!SendInput 00007fffe6bc1220 6 bytes {JMP QWORD [RIP+0x4cee10]}
.text C:\Windows\System32\spool\drivers\x64\3\E_IATICLE.EXE[4592] C:\Windows\system32\USER32.dll!PostMessageW 00007fffe6bc2b00 6 bytes {JMP QWORD [RIP+0x54d530]}
.text C:\Windows\System32\spool\drivers\x64\3\E_IATICLE.EXE[4592] C:\Windows\system32\USER32.dll!SendMessageW 00007fffe6bc6970 6 bytes {JMP QWORD [RIP+0x5096c0]}
.text C:\Windows\System32\spool\drivers\x64\3\E_IATICLE.EXE[4592] C:\Windows\system32\USER32.dll!PostMessageA 00007fffe6bcbea0 6 bytes {JMP QWORD [RIP+0x524190]}
.text C:\Windows\System32\spool\drivers\x64\3\E_IATICLE.EXE[4592] C:\Windows\system32\USER32.dll!SendMessageA 00007fffe6bdb640 6 bytes {JMP QWORD [RIP+0x4d49f0]}
.text C:\Windows\System32\spool\drivers\x64\3\E_IATICLE.EXE[4592] C:\Windows\system32\USER32.dll!mouse_event 00007fffe6be2b88 6 bytes {JMP QWORD [RIP+0x46d4a8]}
.text C:\Windows\System32\spool\drivers\x64\3\E_IATICLE.EXE[4592] C:\Windows\system32\USER32.dll!keybd_event 00007fffe6bf2bb0 6 bytes {JMP QWORD [RIP+0x47d480]}
.text C:\Windows\System32\spool\drivers\x64\3\E_IATICLE.EXE[4592] C:\Windows\system32\ADVAPI32.dll!CreateServiceA 00007fffe553acc0 6 bytes {JMP QWORD [RIP+0x14c5370]}
.text C:\Windows\System32\spool\drivers\x64\3\E_IATICLE.EXE[4592] C:\Windows\system32\ADVAPI32.dll!CreateServiceW 00007fffe553ad44 6 bytes {JMP QWORD [RIP+0x14e52ec]}
.text C:\Windows\System32\spool\drivers\x64\3\E_IATICLE.EXE[4592] C:\Windows\SYSTEM32\WINSPOOL.DRV!AddPrintProvidorA 00007fffdfceb128 6 bytes {JMP QWORD [RIP+0x74f08]}
.text C:\Windows\System32\spool\drivers\x64\3\E_IATICLE.EXE[4592] C:\Windows\SYSTEM32\WINSPOOL.DRV!AddPrintProvidorW 00007fffdfcf36c8 6 bytes {JMP QWORD [RIP+0x8c968]}
.text C:\Windows\System32\spool\drivers\x64\3\E_IATICLE.EXE[4956] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00007fffe6f167d0 4 bytes [FF, 25, 60, 98]
.text C:\Windows\System32\spool\drivers\x64\3\E_IATICLE.EXE[4956] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 00007fffe6f167e0 5 bytes JMP 4350524c
.text C:\Windows\System32\spool\drivers\x64\3\E_IATICLE.EXE[4956] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00007fffe6f168a0 5 bytes [FF, 25, 90, 97, 29]
.text C:\Windows\System32\spool\drivers\x64\3\E_IATICLE.EXE[4956] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fffe6f16ac0 5 bytes [FF, 25, 70, 95, 27]
.text C:\Windows\System32\spool\drivers\x64\3\E_IATICLE.EXE[4956] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00007fffe6f16b70 5 bytes [FF, 25, C0, 94, 21]
.text C:\Windows\System32\spool\drivers\x64\3\E_IATICLE.EXE[4956] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 00007fffe6f171d0 5 bytes [FF, 25, 60, 8E, 23]
.text C:\Windows\System32\spool\drivers\x64\3\E_IATICLE.EXE[4956] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007fffe6f17c00 6 bytes JMP 6f0064
.text C:\Windows\System32\spool\drivers\x64\3\E_IATICLE.EXE[4956] C:\Windows\system32\KERNEL32.DLL!CreateProcessInternalW 00007fffe47ed268 6 bytes {JMP QWORD [RIP+0x1c2dc8]}
.text C:\Windows\System32\spool\drivers\x64\3\E_IATICLE.EXE[4956] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 198 00007fffe45655e6 3 bytes CALL 30002
.text C:\Windows\System32\spool\drivers\x64\3\E_IATICLE.EXE[4956] C:\Windows\system32\USER32.dll!SendInput 00007fffe6bc1220 6 bytes {JMP QWORD [RIP+0x4cee10]}
.text C:\Windows\System32\spool\drivers\x64\3\E_IATICLE.EXE[4956] C:\Windows\system32\USER32.dll!PostMessageW 00007fffe6bc2b00 6 bytes {JMP QWORD [RIP+0x54d530]}
.text C:\Windows\System32\spool\drivers\x64\3\E_IATICLE.EXE[4956] C:\Windows\system32\USER32.dll!SendMessageW 00007fffe6bc6970 6 bytes {JMP QWORD [RIP+0x5096c0]}
.text C:\Windows\System32\spool\drivers\x64\3\E_IATICLE.EXE[4956] C:\Windows\system32\USER32.dll!PostMessageA 00007fffe6bcbea0 6 bytes {JMP QWORD [RIP+0x524190]}
.text C:\Windows\System32\spool\drivers\x64\3\E_IATICLE.EXE[4956] C:\Windows\system32\USER32.dll!SendMessageA 00007fffe6bdb640 6 bytes {JMP QWORD [RIP+0x4d49f0]}
.text C:\Windows\System32\spool\drivers\x64\3\E_IATICLE.EXE[4956] C:\Windows\system32\USER32.dll!mouse_event 00007fffe6be2b88 6 bytes {JMP QWORD [RIP+0x46d4a8]}
.text C:\Windows\System32\spool\drivers\x64\3\E_IATICLE.EXE[4956] C:\Windows\system32\USER32.dll!keybd_event 00007fffe6bf2bb0 6 bytes {JMP QWORD [RIP+0x47d480]}
.text C:\Windows\System32\spool\drivers\x64\3\E_IATICLE.EXE[4956] C:\Windows\system32\ADVAPI32.dll!CreateServiceA 00007fffe553acc0 6 bytes {JMP QWORD [RIP+0x14c5370]}
.text C:\Windows\System32\spool\drivers\x64\3\E_IATICLE.EXE[4956] C:\Windows\system32\ADVAPI32.dll!CreateServiceW 00007fffe553ad44 6 bytes {JMP QWORD [RIP+0x14e52ec]}
.text C:\Windows\System32\spool\drivers\x64\3\E_IATICLE.EXE[4956] C:\Windows\SYSTEM32\WINSPOOL.DRV!AddPrintProvidorA 00007fffdfceb128 6 bytes {JMP QWORD [RIP+0x74f08]}
.text C:\Windows\System32\spool\drivers\x64\3\E_IATICLE.EXE[4956] C:\Windows\SYSTEM32\WINSPOOL.DRV!AddPrintProvidorW 00007fffdfcf36c8 6 bytes {JMP QWORD [RIP+0x8c968]}
.text C:\Windows\WinStore\WSHost.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00007fffe6f167d0 4 bytes [FF, 25, 60, 98]
.text C:\Windows\WinStore\WSHost.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 00007fffe6f167e0 5 bytes [FF, 25, 50, 98, 2B]
.text C:\Windows\WinStore\WSHost.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00007fffe6f168a0 5 bytes [FF, 25, 90, 97, 29]
.text C:\Windows\WinStore\WSHost.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fffe6f16ac0 5 bytes [FF, 25, 70, 95, 27]
.text C:\Windows\WinStore\WSHost.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00007fffe6f16b70 5 bytes [FF, 25, C0, 94, 21]
.text C:\Windows\WinStore\WSHost.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 00007fffe6f171d0 5 bytes [FF, 25, 60, 8E, 23]
.text C:\Windows\WinStore\WSHost.exe[5400] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007fffe6f17c00 6 bytes {JMP QWORD [RIP+0x2d8430]}
.text C:\Windows\WinStore\WSHost.exe[5400] C:\Windows\system32\KERNEL32.DLL!CreateProcessInternalW 00007fffe47ed268 6 bytes {JMP QWORD [RIP+0x1c2dc8]}
.text C:\Windows\WinStore\WSHost.exe[5400] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 198 00007fffe45655e6 3 bytes [24, AA, 10]
.text C:\Windows\WinStore\WSHost.exe[5400] C:\Windows\system32\USER32.dll!SendInput 00007fffe6bc1220 6 bytes {JMP QWORD [RIP+0x4cee10]}
.text C:\Windows\WinStore\WSHost.exe[5400] C:\Windows\system32\USER32.dll!PostMessageW 00007fffe6bc2b00 6 bytes {JMP QWORD [RIP+0x54d530]}
.text C:\Windows\WinStore\WSHost.exe[5400] C:\Windows\system32\USER32.dll!SendMessageW 00007fffe6bc6970 6 bytes {JMP QWORD [RIP+0x5096c0]}
.text C:\Windows\WinStore\WSHost.exe[5400] C:\Windows\system32\USER32.dll!PostMessageA 00007fffe6bcbea0 6 bytes {JMP QWORD [RIP+0x524190]}
.text C:\Windows\WinStore\WSHost.exe[5400] C:\Windows\system32\USER32.dll!SendMessageA 00007fffe6bdb640 6 bytes {JMP QWORD [RIP+0x4d49f0]}
.text C:\Windows\WinStore\WSHost.exe[5400] C:\Windows\system32\USER32.dll!mouse_event 00007fffe6be2b88 6 bytes {JMP QWORD [RIP+0x46d4a8]}
.text C:\Windows\WinStore\WSHost.exe[5400] C:\Windows\system32\USER32.dll!keybd_event 00007fffe6bf2bb0 6 bytes {JMP QWORD [RIP+0x47d480]}
.text C:\Windows\WinStore\WSHost.exe[5400] C:\Windows\system32\ADVAPI32.dll!CreateServiceA 00007fffe553acc0 6 bytes {JMP QWORD [RIP+0x14c5370]}
.text C:\Windows\WinStore\WSHost.exe[5400] C:\Windows\system32\ADVAPI32.dll!CreateServiceW 00007fffe553ad44 6 bytes {JMP QWORD [RIP+0x14e52ec]}
.text C:\Windows\WinStore\WSHost.exe[5400] C:\Windows\System32\msi.dll!MsiSetInternalUI 00007fffd2b2b484 6 bytes {JMP QWORD [RIP+0x304bac]}
.text C:\Windows\WinStore\WSHost.exe[5400] C:\Windows\System32\msi.dll!MsiInstallProductA 00007fffd2ba9114 6 bytes {JMP QWORD [RIP+0x246f1c]}
.text C:\Windows\WinStore\WSHost.exe[5400] C:\Windows\System32\msi.dll!MsiInstallProductW 00007fffd2ba93b4 6 bytes {JMP QWORD [RIP+0x266c7c]}
.text C:\Windows\WinStore\WSHost.exe[5400] C:\Windows\system32\WS2_32.dll!WSALookupServiceBeginW 000000c99a303330 6 bytes {JMP QWORD [RIP+0xeacd00]}
.text C:\Windows\WinStore\WSHost.exe[5400] C:\Windows\system32\WS2_32.dll!connect + 1 000000c99a3107f1 5 bytes {JMP QWORD [RIP+0xe0f840]}
.text C:\Windows\WinStore\WSHost.exe[5400] C:\Windows\system32\WS2_32.dll!listen 000000c99a314160 6 bytes {JMP QWORD [RIP+0xe6bed0]}
.text C:\Windows\WinStore\WSHost.exe[5400] C:\Windows\system32\WS2_32.dll!WSAConnect 000000c99a3169b0 6 bytes {JMP QWORD [RIP+0xe39680]}
.text C:\Windows\explorer.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00007fffe6f167d0 4 bytes [FF, 25, 60, 98]
.text C:\Windows\explorer.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 00007fffe6f167e0 5 bytes [FF, 25, 50, 98, 2B]
.text C:\Windows\explorer.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00007fffe6f168a0 5 bytes [FF, 25, 90, 97, 29]
.text C:\Windows\explorer.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fffe6f16ac0 5 bytes [FF, 25, 70, 95, 27]
.text C:\Windows\explorer.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00007fffe6f16b70 5 bytes [FF, 25, C0, 94, 21]
.text C:\Windows\explorer.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 00007fffe6f171d0 5 bytes [FF, 25, 60, 8E, 23]
.text C:\Windows\explorer.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007fffe6f17c00 6 bytes {JMP QWORD [RIP+0x2d8430]}
.text C:\Windows\explorer.exe[4892] C:\Windows\system32\KERNEL32.DLL!CreateProcessInternalW 00007fffe47ed268 6 bytes {JMP QWORD [RIP+0x1c2dc8]}
.text C:\Windows\explorer.exe[4892] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 198 00007fffe45655e6 3 bytes [24, AA, 10]
.text C:\Windows\explorer.exe[4892] C:\Windows\SYSTEM32\advapi32.dll!CreateServiceA 00007fffe553acc0 6 bytes JMP 1
.text C:\Windows\explorer.exe[4892] C:\Windows\SYSTEM32\advapi32.dll!CreateServiceW 00007fffe553ad44 6 bytes JMP 0
.text C:\Windows\explorer.exe[4892] C:\Windows\system32\USER32.dll!SendInput 00007fffe6bc1220 6 bytes JMP 140a1211
.text C:\Windows\explorer.exe[4892] C:\Windows\system32\USER32.dll!PostMessageW 00007fffe6bc2b00 6 bytes JMP 0
.text C:\Windows\explorer.exe[4892] C:\Windows\system32\USER32.dll!SendMessageW 00007fffe6bc6970 6 bytes JMP 0
.text C:\Windows\explorer.exe[4892] C:\Windows\system32\USER32.dll!PostMessageA 00007fffe6bcbea0 6 bytes {JMP QWORD [RIP+0x524190]}
.text C:\Windows\explorer.exe[4892] C:\Windows\system32\USER32.dll!SendMessageA 00007fffe6bdb640 6 bytes JMP ff000000
.text C:\Windows\explorer.exe[4892] C:\Windows\system32\USER32.dll!mouse_event 00007fffe6be2b88 6 bytes {JMP QWORD [RIP+0x46d4a8]}
.text C:\Windows\explorer.exe[4892] C:\Windows\system32\USER32.dll!keybd_event 00007fffe6bf2bb0 6 bytes {JMP QWORD [RIP+0x47d480]}
.text C:\Windows\explorer.exe[4892] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fffe528169a 4 bytes [28, E5, FF, 7F]
.text C:\Windows\explorer.exe[4892] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fffe52816a2 4 bytes [28, E5, FF, 7F]
.text C:\Windows\explorer.exe[4892] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fffe528181a 4 bytes [28, E5, FF, 7F]
.text C:\Windows\explorer.exe[4892] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fffe5281832 4 bytes [28, E5, FF, 7F]
.text C:\Windows\explorer.exe[4892] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorA 00007fffdfceb128 6 bytes {JMP QWORD [RIP+0x74f08]}
.text C:\Windows\explorer.exe[4892] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorW 00007fffdfcf36c8 6 bytes {JMP QWORD [RIP+0xfc968]}
.text C:\Windows\explorer.exe[4892] C:\Windows\system32\WS2_32.dll!WSALookupServiceBeginW 000000000e5b3330 6 bytes {JMP QWORD [RIP+0x14cd00]}
.text C:\Windows\explorer.exe[4892] C:\Windows\system32\WS2_32.dll!connect + 1 000000000e5c07f1 5 bytes {JMP QWORD [RIP+0xcf840]}
.text C:\Windows\explorer.exe[4892] C:\Windows\system32\WS2_32.dll!listen 000000000e5c4160 6 bytes {JMP QWORD [RIP+0x10bed0]}
.text C:\Windows\explorer.exe[4892] C:\Windows\system32\WS2_32.dll!WSAConnect 000000000e5c69b0 6 bytes {JMP QWORD [RIP+0xe9680]}
.text C:\Windows\explorer.exe[4892] C:\Windows\SYSTEM32\msi.dll!MsiSetInternalUI 00007fffd2b2b484 6 bytes {JMP QWORD [RIP+0x304bac]}
.text C:\Windows\explorer.exe[4892] C:\Windows\SYSTEM32\msi.dll!MsiInstallProductA 00007fffd2ba9114 6 bytes {JMP QWORD [RIP+0x246f1c]}
.text C:\Windows\explorer.exe[4892] C:\Windows\SYSTEM32\msi.dll!MsiInstallProductW 00007fffd2ba93b4 6 bytes {JMP QWORD [RIP+0x266c7c]}
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSPanel.exe[5724] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00007fffe6f167d0 4 bytes [FF, 25, 60, 98]
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSPanel.exe[5724] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 00007fffe6f167e0 5 bytes [FF, 25, 50, 98, 2B]
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSPanel.exe[5724] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00007fffe6f168a0 5 bytes [FF, 25, 90, 97, 29]
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSPanel.exe[5724] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fffe6f16ac0 5 bytes [FF, 25, 70, 95, 27]
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSPanel.exe[5724] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00007fffe6f16b70 5 bytes [FF, 25, C0, 94, 21]
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSPanel.exe[5724] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 00007fffe6f171d0 5 bytes [FF, 25, 60, 8E, 23]
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSPanel.exe[5724] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007fffe6f17c00 6 bytes {JMP QWORD [RIP+0x2d8430]}
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSPanel.exe[5724] C:\Windows\system32\KERNEL32.dll!CreateProcessInternalW 00007fffe47ed268 6 bytes {JMP QWORD [RIP+0x1c2dc8]}
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSPanel.exe[5724] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 198 00007fffe45655e6 3 bytes [24, AA, 10]
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSPanel.exe[5724] C:\Windows\system32\USER32.dll!SendInput 00007fffe6bc1220 6 bytes {JMP QWORD [RIP+0x4cee10]}
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSPanel.exe[5724] C:\Windows\system32\USER32.dll!PostMessageW 00007fffe6bc2b00 6 bytes {JMP QWORD [RIP+0x54d530]}
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSPanel.exe[5724] C:\Windows\system32\USER32.dll!SendMessageW 00007fffe6bc6970 6 bytes {JMP QWORD [RIP+0x5096c0]}
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSPanel.exe[5724] C:\Windows\system32\USER32.dll!PostMessageA 00007fffe6bcbea0 6 bytes {JMP QWORD [RIP+0x524190]}
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSPanel.exe[5724] C:\Windows\system32\USER32.dll!SendMessageA 00007fffe6bdb640 6 bytes {JMP QWORD [RIP+0x4d49f0]}
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSPanel.exe[5724] C:\Windows\system32\USER32.dll!mouse_event 00007fffe6be2b88 6 bytes {JMP QWORD [RIP+0x46d4a8]}
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSPanel.exe[5724] C:\Windows\system32\USER32.dll!keybd_event 00007fffe6bf2bb0 6 bytes {JMP QWORD [RIP+0x47d480]}
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSPanel.exe[5724] C:\Windows\system32\ADVAPI32.dll!CreateServiceA 00007fffe553acc0 6 bytes {JMP QWORD [RIP+0x14c5370]}
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSPanel.exe[5724] C:\Windows\system32\ADVAPI32.dll!CreateServiceW 00007fffe553ad44 6 bytes {JMP QWORD [RIP+0x14e52ec]}
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSPanel.exe[5724] C:\Windows\system32\ws2_32.dll!WSALookupServiceBeginW 000000001d4d3330 6 bytes {JMP QWORD [RIP+0x13cd00]}
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSPanel.exe[5724] C:\Windows\system32\ws2_32.dll!connect + 1 000000001d4e07f1 5 bytes {JMP QWORD [RIP+0xcf840]}
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSPanel.exe[5724] C:\Windows\system32\ws2_32.dll!listen 000000001d4e4160 6 bytes {JMP QWORD [RIP+0x10bed0]}
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSPanel.exe[5724] C:\Windows\system32\ws2_32.dll!WSAConnect 000000001d4e69b0 6 bytes {JMP QWORD [RIP+0xe9680]}
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSPanel.exe[5724] C:\Windows\SYSTEM32\rasapi32.dll!RasDialW + 1 00007fffc47db571 5 bytes {JMP QWORD [RIP+0x94ac0]}
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSService.exe[5976] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00007fffe6f167d0 4 bytes [FF, 25, 60, 98]
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSService.exe[5976] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 00007fffe6f167e0 5 bytes [FF, 25, 50, 98, 2B]
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSService.exe[5976] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00007fffe6f168a0 5 bytes [FF, 25, 90, 97, 29]
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSService.exe[5976] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fffe6f16ac0 5 bytes [FF, 25, 70, 95, 27]
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSService.exe[5976] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00007fffe6f16b70 5 bytes [FF, 25, C0, 94, 21]
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSService.exe[5976] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 00007fffe6f171d0 5 bytes [FF, 25, 60, 8E, 23]
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSService.exe[5976] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007fffe6f17c00 6 bytes {JMP QWORD [RIP+0x2d8430]}
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSService.exe[5976] C:\Windows\system32\KERNEL32.dll!CreateProcessInternalW 00007fffe47ed268 6 bytes {JMP QWORD [RIP+0x1c2dc8]}
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSService.exe[5976] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 198 00007fffe45655e6 3 bytes [24, AA, 10]
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSService.exe[5976] C:\Windows\system32\USER32.dll!SendInput 00007fffe6bc1220 6 bytes {JMP QWORD [RIP+0x4cee10]}
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSService.exe[5976] C:\Windows\system32\USER32.dll!PostMessageW 00007fffe6bc2b00 6 bytes {JMP QWORD [RIP+0x54d530]}
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSService.exe[5976] C:\Windows\system32\USER32.dll!SendMessageW 00007fffe6bc6970 6 bytes {JMP QWORD [RIP+0x5096c0]}
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSService.exe[5976] C:\Windows\system32\USER32.dll!PostMessageA 00007fffe6bcbea0 6 bytes {JMP QWORD [RIP+0x524190]}
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSService.exe[5976] C:\Windows\system32\USER32.dll!SendMessageA 00007fffe6bdb640 6 bytes {JMP QWORD [RIP+0x4d49f0]}
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSService.exe[5976] C:\Windows\system32\USER32.dll!mouse_event 00007fffe6be2b88 6 bytes {JMP QWORD [RIP+0x46d4a8]}
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSService.exe[5976] C:\Windows\system32\USER32.dll!keybd_event 00007fffe6bf2bb0 6 bytes {JMP QWORD [RIP+0x47d480]}
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSService.exe[5976] C:\Windows\system32\ADVAPI32.dll!CreateServiceA 00007fffe553acc0 6 bytes JMP 2c0f0000
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSService.exe[5976] C:\Windows\system32\ADVAPI32.dll!CreateServiceW 00007fffe553ad44 6 bytes {JMP QWORD [RIP+0x14e52ec]}
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSService.exe[5976] C:\Windows\system32\WS2_32.dll!WSALookupServiceBeginW 000000001b6b3330 6 bytes {JMP QWORD [RIP+0x16cd00]}
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSService.exe[5976] C:\Windows\system32\WS2_32.dll!connect + 1 000000001b6c07f1 5 bytes {JMP QWORD [RIP+0xdf840]}
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSService.exe[5976] C:\Windows\system32\WS2_32.dll!listen 000000001b6c4160 6 bytes {JMP QWORD [RIP+0x12bed0]}
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSService.exe[5976] C:\Windows\system32\WS2_32.dll!WSAConnect 000000001b6c69b0 6 bytes {JMP QWORD [RIP+0xf9680]}
.text C:\Program Files (x86)\ASUS\WebStorage\2.1.15.438\AsusWSService.exe[5976] C:\Windows\SYSTEM32\rasapi32.dll!RasDialW + 1 00007fffc47db571 5 bytes {JMP QWORD [RIP+0x94ac0]}
.text C:\Windows\system32\conhost.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00007fffe6f167d0 4 bytes [FF, 25, 60, 98]
.text C:\Windows\system32\conhost.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 00007fffe6f167e0 5 bytes [FF, 25, 50, 98, 2B]
.text C:\Windows\system32\conhost.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00007fffe6f168a0 5 bytes [FF, 25, 90, 97, 29]
.text C:\Windows\system32\conhost.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00007fffe6f16ac0 5 bytes [FF, 25, 70, 95, 27]
.text C:\Windows\system32\conhost.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00007fffe6f16b70 5 bytes [FF, 25, C0, 94, 21]
.text C:\Windows\system32\conhost.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 00007fffe6f171d0 5 bytes [FF, 25, 60, 8E, 23]
.text C:\Windows\system32\conhost.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007fffe6f17c00 6 bytes {JMP QWORD [RIP+0x2d8430]}
.text C:\Windows\system32\conhost.exe[2916] C:\Windows\system32\KERNEL32.DLL!CreateProcessInternalW 00007fffe47ed268 6 bytes {JMP QWORD [RIP+0x1c2dc8]}
.text C:\Windows\system32\conhost.exe[2916] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 198 00007fffe45655e6 3 bytes [24, AA, 10]
.text C:\Windows\system32\conhost.exe[2916] C:\Windows\system32\USER32.dll!SendInput 00007fffe6bc1220 6 bytes {JMP QWORD [RIP+0x4cee10]}
.text C:\Windows\system32\conhost.exe[2916] C:\Windows\system32\USER32.dll!PostMessageW 00007fffe6bc2b00 6 bytes {JMP QWORD [RIP+0x54d530]}
.text C:\Windows\system32\conhost.exe[2916] C:\Windows\system32\USER32.dll!SendMessageW 00007fffe6bc6970 6 bytes {JMP QWORD [RIP+0x5096c0]}
.text C:\Windows\system32\conhost.exe[2916] C:\Windows\system32\USER32.dll!PostMessageA 00007fffe6bcbea0 6 bytes {JMP QWORD [RIP+0x524190]}
.text C:\Windows\system32\conhost.exe[2916] C:\Windows\system32\USER32.dll!SendMessageA 00007fffe6bdb640 6 bytes {JMP QWORD [RIP+0x4d49f0]}
.text C:\Windows\system32\conhost.exe[2916] C:\Windows\system32\USER32.dll!mouse_event 00007fffe6be2b88 6 bytes {JMP QWORD [RIP+0x46d4a8]}
.text C:\Windows\system32\conhost.exe[2916] C:\Windows\system32\USER32.dll!keybd_event 00007fffe6bf2bb0 6 bytes {JMP QWORD [RIP+0x47d480]}
.text C:\Windows\system32\conhost.exe[2916] C:\Windows\system32\ADVAPI32.dll!CreateServiceA 00007fffe553acc0 6 bytes {JMP QWORD [RIP+0x14c5370]}
.text C:\Windows\system32\conhost.exe[2916] C:\Windows\system32\ADVAPI32.dll!CreateServiceW 00007fffe553ad44 6 bytes {JMP QWORD [RIP+0x14e52ec]}
---- Threads - GMER 2.1 ----
Thread C:\Windows\system32\csrss.exe [640:668] fffff960008154d0
Thread C:\Windows\explorer.exe [4892:556] 00007fffd03dd6bc
Thread C:\Windows\explorer.exe [4892:5176] 00007fffd03dd6bc
Thread C:\Windows\explorer.exe [4892:5172] 00007fffd03dd6bc
Thread C:\Windows\explorer.exe [4892:5540] 00007fffd03dd6bc
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.0 (11.29.2014:1)
OS: Windows 8.1 x64
Ran by Jochen on 11.12.2014 at 19:17:49,76
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 11.12.2014 at 19:23:58,91
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Code:
Malwarebytes Anti-Malware
www.malwarebytes.org
Suchlauf Datum: 11.12.2014
Suchlauf-Zeit: 18:52:21
Logdatei: MALWAREBYTES.txt
Administrator: Ja
Version: 2.00.4.1028
Malware Datenbank: v2014.12.11.04
Rootkit Datenbank: v2014.12.08.03
Lizenz: Premium
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Selbstschutz: Aktiviert
Betriebssystem: Windows 8.1
CPU: x64
Dateisystem: NTFS
Benutzer: Jochen
Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 384991
Verstrichene Zeit: 5 Min, 59 Sek
Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert
Prozesse: 0
(Keine schädliche Elemente erkannt)
Module: 0
(Keine schädliche Elemente erkannt)
Registrierungsschlüssel: 0
(Keine schädliche Elemente erkannt)
Registrierungswerte: 0
(Keine schädliche Elemente erkannt)
Registrierungsdaten: 0
(Keine schädliche Elemente erkannt)
Ordner: 0
(Keine schädliche Elemente erkannt)
Dateien: 0
(Keine schädliche Elemente erkannt)
Physische Sektoren: 0
(Keine schädliche Elemente erkannt)
(end)
OK, scheint verschwunden zu sein.
Dankeschön für Deine Zeit. |
