| muy_raro | 10.04.2015 18:56 |
Gmer.log
GMER Logfile: Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-04-10 17:09:59
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk2\DR2 -> \Device\Ide\IdeDeviceP2T0L0-2 ST1000DM005_HD103SJ rev.1AJ100E5 931,51GB
Running: Gmer-19357.exe; Driver: C:\Users\admin\AppData\Local\Temp\pxlirpob.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 424 0000000076d61398 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000076d6143f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000076d61594 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000076d6191e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000076d61bf8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000076d61d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000076d61edf 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000076d61fc5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000076d627b0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000076d627d2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000076d6282f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184 0000000076d62898 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000076d62d1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375 0000000076d62d67 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000076d6323b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920 0000000076d633c8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000076d63a5e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000076d63ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000076d63b85 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000076d64190 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161 0000000076d64241 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277 0000000076d642b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214 0000000076d643f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276 0000000076d64434 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 408 0000000076d645d8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 657 0000000076d646d1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284 0000000076d64a9c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483 0000000076d64b63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231 0000000076d64c57 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518 0000000076d64d76 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256 0000000076d64ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67 0000000076d64ef3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501 0000000076d650f5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256 0000000076d652f0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247 0000000076d653f7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 484 0000000076d655e4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438 0000000076d664d6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!atol + 194 0000000076d6668e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76 0000000076d6687c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45 0000000076d668bd 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4 0000000076d668d4 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92 0000000076d6692c 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790 0000000076d67166 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseCleanupGroupMembers + 241 0000000076d67dd1 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseCleanupGroup + 119 0000000076d67e57 8 bytes [00, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000076db1380 8 bytes {JMP QWORD [RIP-0x4a220]}
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000076db1500 8 bytes {JMP QWORD [RIP-0x49cef]}
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000076db1530 8 bytes {JMP QWORD [RIP-0x4ac62]}
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076db1650 8 bytes {JMP QWORD [RIP-0x4a80f]}
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076db1700 8 bytes {JMP QWORD [RIP-0x4adda]}
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076db1d30 8 bytes {JMP QWORD [RIP-0x49edf]}
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076db1f80 8 bytes {JMP QWORD [RIP-0x4a1b5]}
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076db27e0 8 bytes {JMP QWORD [RIP-0x4ab13]}
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000748013cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 000000007480146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000748016d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000748019db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000748019fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe[5640] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074801a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 424 0000000076d61398 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000076d6143f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000076d61594 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000076d6191e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000076d61bf8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000076d61d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000076d61edf 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000076d61fc5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000076d627b0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000076d627d2 8 bytes {JMP 0x10}
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000076d6282f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184 0000000076d62898 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000076d62d1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375 0000000076d62d67 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000076d6323b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920 0000000076d633c8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000076d63a5e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000076d63ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000076d63b85 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000076d64190 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161 0000000076d64241 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277 0000000076d642b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214 0000000076d643f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276 0000000076d64434 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 408 0000000076d645d8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 657 0000000076d646d1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284 0000000076d64a9c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483 0000000076d64b63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231 0000000076d64c57 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518 0000000076d64d76 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256 0000000076d64ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67 0000000076d64ef3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501 0000000076d650f5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256 0000000076d652f0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247 0000000076d653f7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 484 0000000076d655e4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438 0000000076d664d6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!atol + 194 0000000076d6668e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76 0000000076d6687c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45 0000000076d668bd 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4 0000000076d668d4 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92 0000000076d6692c 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790 0000000076d67166 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseCleanupGroupMembers + 241 0000000076d67dd1 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseCleanupGroup + 119 0000000076d67e57 8 bytes [00, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000076db1380 8 bytes {JMP QWORD [RIP-0x4a220]}
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000076db1500 8 bytes {JMP QWORD [RIP-0x49cef]}
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000076db1530 8 bytes {JMP QWORD [RIP-0x4ac62]}
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076db1650 8 bytes {JMP QWORD [RIP-0x4a80f]}
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076db1700 8 bytes {JMP QWORD [RIP-0x4adda]}
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076db1d30 8 bytes {JMP QWORD [RIP-0x49edf]}
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076db1f80 8 bytes {JMP QWORD [RIP-0x4a1b5]}
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076db27e0 8 bytes {JMP QWORD [RIP-0x4ab13]}
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000748013cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 000000007480146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000748016d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000748019db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000748019fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074801a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\syswow64\Psapi.dll!GetModuleFileNameExW + 17 0000000076871401 2 bytes JMP 75c9b21b C:\Windows\syswow64\kernel32.dll
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\syswow64\Psapi.dll!EnumProcessModules + 17 0000000076871419 2 bytes JMP 75c9b346 C:\Windows\syswow64\kernel32.dll
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 17 0000000076871431 2 bytes JMP 75d18ea9 C:\Windows\syswow64\kernel32.dll
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 42 000000007687144a 2 bytes CALL 75c748ad C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\syswow64\Psapi.dll!EnumDeviceDrivers + 17 00000000768714dd 2 bytes JMP 75d187a2 C:\Windows\syswow64\kernel32.dll
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\syswow64\Psapi.dll!GetDeviceDriverBaseNameA + 17 00000000768714f5 2 bytes JMP 75d18978 C:\Windows\syswow64\kernel32.dll
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\syswow64\Psapi.dll!QueryWorkingSetEx + 17 000000007687150d 2 bytes JMP 75d18698 C:\Windows\syswow64\kernel32.dll
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\syswow64\Psapi.dll!GetDeviceDriverBaseNameW + 17 0000000076871525 2 bytes JMP 75d18a62 C:\Windows\syswow64\kernel32.dll
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\syswow64\Psapi.dll!GetModuleBaseNameW + 17 000000007687153d 2 bytes JMP 75c8fca8 C:\Windows\syswow64\kernel32.dll
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\syswow64\Psapi.dll!EnumProcesses + 17 0000000076871555 2 bytes JMP 75c968ef C:\Windows\syswow64\kernel32.dll
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\syswow64\Psapi.dll!GetProcessMemoryInfo + 17 000000007687156d 2 bytes JMP 75d18f61 C:\Windows\syswow64\kernel32.dll
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\syswow64\Psapi.dll!GetPerformanceInfo + 17 0000000076871585 2 bytes JMP 75d18ac2 C:\Windows\syswow64\kernel32.dll
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\syswow64\Psapi.dll!QueryWorkingSet + 17 000000007687159d 2 bytes JMP 75d1865c C:\Windows\syswow64\kernel32.dll
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\syswow64\Psapi.dll!GetModuleBaseNameA + 17 00000000768715b5 2 bytes JMP 75c8fd41 C:\Windows\syswow64\kernel32.dll
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\syswow64\Psapi.dll!GetModuleFileNameExA + 17 00000000768715cd 2 bytes JMP 75c9b2dc C:\Windows\syswow64\kernel32.dll
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\syswow64\Psapi.dll!GetProcessImageFileNameW + 20 00000000768716b2 2 bytes JMP 75d18e24 C:\Windows\syswow64\kernel32.dll
.text C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe[1680] C:\Windows\syswow64\Psapi.dll!GetProcessImageFileNameW + 31 00000000768716bd 2 bytes JMP 75d185f1 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 424 0000000076d61398 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000076d6143f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000076d61594 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000076d6191e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000076d61bf8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000076d61d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000076d61edf 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000076d61fc5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000076d627b0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000076d627d2 8 bytes {JMP 0x10}
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000076d6282f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184 0000000076d62898 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000076d62d1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375 0000000076d62d67 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000076d6323b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920 0000000076d633c8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000076d63a5e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000076d63ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000076d63b85 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000076d64190 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161 0000000076d64241 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277 0000000076d642b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214 0000000076d643f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276 0000000076d64434 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 408 0000000076d645d8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 657 0000000076d646d1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284 0000000076d64a9c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483 0000000076d64b63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231 0000000076d64c57 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518 0000000076d64d76 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256 0000000076d64ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67 0000000076d64ef3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501 0000000076d650f5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256 0000000076d652f0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247 0000000076d653f7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 484 0000000076d655e4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438 0000000076d664d6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!atol + 194 0000000076d6668e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76 0000000076d6687c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45 0000000076d668bd 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4 0000000076d668d4 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92 0000000076d6692c 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790 0000000076d67166 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseCleanupGroupMembers + 241 0000000076d67dd1 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseCleanupGroup + 119 0000000076d67e57 8 bytes [00, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000076db1380 8 bytes {JMP QWORD [RIP-0x4a220]}
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000076db1500 8 bytes {JMP QWORD [RIP-0x49cef]}
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000076db1530 8 bytes {JMP QWORD [RIP-0x4ac62]}
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076db1650 8 bytes {JMP QWORD [RIP-0x4a80f]}
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076db1700 8 bytes {JMP QWORD [RIP-0x4adda]}
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076db1d30 8 bytes {JMP QWORD [RIP-0x49edf]}
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076db1f80 8 bytes {JMP QWORD [RIP-0x4a1b5]}
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076db27e0 8 bytes {JMP QWORD [RIP-0x4ab13]}
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000748013cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 000000007480146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000748016d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000748019db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000748019fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Windows\sysWOW64\wbem\wmiprvse.exe[4976] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074801a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 424 0000000076d61398 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000076d6143f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000076d61594 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000076d6191e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000076d61bf8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000076d61d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000076d61edf 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000076d61fc5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000076d627b0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000076d627d2 8 bytes {JMP 0x10}
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000076d6282f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184 0000000076d62898 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000076d62d1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375 0000000076d62d67 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000076d6323b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920 0000000076d633c8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000076d63a5e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000076d63ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000076d63b85 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000076d64190 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161 0000000076d64241 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277 0000000076d642b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214 0000000076d643f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276 0000000076d64434 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 408 0000000076d645d8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 657 0000000076d646d1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284 0000000076d64a9c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483 0000000076d64b63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231 0000000076d64c57 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518 0000000076d64d76 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256 0000000076d64ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67 0000000076d64ef3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501 0000000076d650f5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256 0000000076d652f0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247 0000000076d653f7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 484 0000000076d655e4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438 0000000076d664d6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!atol + 194 0000000076d6668e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76 0000000076d6687c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45 0000000076d668bd 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4 0000000076d668d4 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92 0000000076d6692c 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790 0000000076d67166 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseCleanupGroupMembers + 241 0000000076d67dd1 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseCleanupGroup + 119 0000000076d67e57 8 bytes [00, 6C, F8, 7E, 00, 00, 00, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000076db1380 8 bytes {JMP QWORD [RIP-0x4a220]}
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000076db1500 8 bytes {JMP QWORD [RIP-0x49cef]}
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000076db1530 8 bytes {JMP QWORD [RIP-0x4ac62]}
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076db1650 8 bytes {JMP QWORD [RIP-0x4a80f]}
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076db1700 8 bytes {JMP QWORD [RIP-0x4adda]}
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076db1d30 8 bytes {JMP QWORD [RIP-0x49edf]}
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076db1f80 8 bytes {JMP QWORD [RIP-0x4a1b5]}
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076db27e0 8 bytes {JMP QWORD [RIP-0x4ab13]}
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000748013cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 000000007480146b 8 bytes {JMP 0xffffffffffffffb0}
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000748016d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000748019db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000748019fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text Z:\Dropbox\Virenscan\Gmer-19357.exe[5444] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074801a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
---- Threads - GMER 2.1 ----
Thread C:\Windows\system32\mmc.exe [1072:2016] 000007feea9efe98
Thread C:\Windows\system32\mmc.exe [1072:712] 000007feeab300bc
Thread C:\Windows\system32\mmc.exe [1072:6104] 000007fefb1d2bf8
Thread C:\Windows\system32\mmc.exe [1072:6112] 000007fee4451748
Thread C:\Windows\system32\mmc.exe [1072:4604] 000007feeab300bc
Thread C:\Windows\system32\mmc.exe [1072:5784] 000007feeab39cc0
Thread C:\Windows\system32\mmc.exe [1072:808] 000007feeab300bc
Thread C:\Windows\system32\mmc.exe [1072:6064] 000007feeab300bc
Thread C:\Windows\system32\mmc.exe [1072:1944] 000007feeab300bc
Thread C:\Windows\system32\mmc.exe [1072:5952] 000007feeab300bc
Thread C:\Windows\system32\mmc.exe [1072:5956] 000007feeaa1d9ac
Thread C:\Windows\system32\mmc.exe [1072:6000] 000007fee493bce8
---- Processes - GMER 2.1 ----
Library C:\Users\crocuz\AppData\Local\Temp\_MEI28922\python27.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [1984] (Python Core/Python Software Foundation)(2015-04-10 14:35:10) 000000001e000000
Library C:\Users\crocuz\AppData\Local\Temp\_MEI28922\win32api.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [1984](2015-04-10 14:35:08) 000000001e8c0000
Library C:\Users\crocuz\AppData\Local\Temp\_MEI28922\pywintypes27.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [1984](2015-04-10 14:35:10) 000000001e7a0000
Library C:\Users\crocuz\AppData\Local\Temp\_MEI28922\pythoncom27.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [1984](2015-04-10 14:35:07) 0000000000360000
Library C:\Users\crocuz\AppData\Local\Temp\_MEI28922\_socket.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [1984](2015-04-10 14:35:09) 0000000000240000
Library C:\Users\crocuz\AppData\Local\Temp\_MEI28922\_ssl.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [1984](2015-04-10 14:35:10) 0000000010000000
Library C:\Users\crocuz\AppData\Local\Temp\_MEI28922\win32com.shell.shell.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [1984](2015-04-10 14:35:08) 000000001e800000
Library C:\Users\crocuz\AppData\Local\Temp\_MEI28922\_hashlib.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [1984](2015-04-10 14:35:10) 0000000002f10000
Library C:\Users\crocuz\AppData\Local\Temp\_MEI28922\wx._core_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [1984](2015-04-10 14:35:08) 0000000002fd0000
Library c:\users\crocuz\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp6heue7.dll (*** suspicious ***) @ C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe [1680](2015-04-10 14:54:05) 0000000002510000
Library C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Qt5Core.dll (*** suspicious ***) @ C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe [1680] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:24) 0000000073900000
Library C:\Users\crocuz\AppData\Roaming\Dropbox\bin\icuin52.dll (*** suspicious ***) @ C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe [1680] (ICU I18N DLL/The ICU Project)(2015-03-04 21:45:30) 000000004a900000
Library C:\Users\crocuz\AppData\Roaming\Dropbox\bin\icuuc52.dll (*** suspicious ***) @ C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe [1680] (ICU Common DLL/The ICU Project)(2015-03-04 21:45:30) 0000000005f70000
Library C:\Users\crocuz\AppData\Roaming\Dropbox\bin\icudt52.dll (*** suspicious ***) @ C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe [1680] (ICU Data DLL/The ICU Project)(2015-03-04 21:45:30) 000000004ad00000
Library C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Qt5Widgets.dll (*** suspicious ***) @ C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe [1680] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:28) 0000000064ec0000
Library C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Qt5Gui.dll (*** suspicious ***) @ C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe [1680] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 0000000073610000
Library C:\Users\crocuz\AppData\Roaming\Dropbox\bin\libGLESv2.dll (*** suspicious ***) @ C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe [1680](2015-03-04 21:45:30) 000000006e2a0000
Library C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Qt5Network.dll (*** suspicious ***) @ C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe [1680] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 000000006e0c0000
Library C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Qt5WebKit.dll (*** suspicious ***) @ C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe [1680] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 0000000051eb0000
Library C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Qt5Quick.dll (*** suspicious ***) @ C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe [1680] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 0000000066500000
Library C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Qt5Qml.dll (*** suspicious ***) @ C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe [1680] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 000000005a4f0000
Library C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Qt5Sql.dll (*** suspicious ***) @ C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe [1680] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 0000000074050000
Library C:\Users\crocuz\AppData\Roaming\Dropbox\bin\libEGL.dll (*** suspicious ***) @ C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe [1680](2015-03-04 21:45:30) 0000000074010000
Library C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Qt5WebKitWidgets.dll (*** suspicious ***) @ C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe [1680] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:28) 0000000073fe0000
Library C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Qt5OpenGL.dll (*** suspicious ***) @ C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe [1680] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 00000000735d0000
Library C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Qt5PrintSupport.dll (*** suspicious ***) @ C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe [1680] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 000000006e070000
Library C:\Users\crocuz\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll (*** suspicious ***) @ C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe [1680](2015-03-04 21:45:30) 000000006df90000
Library C:\Users\crocuz\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll (*** suspicious ***) @ C:\Users\crocuz\AppData\Roaming\Dropbox\bin\Dropbox.exe [1680](2015-03-04 21:45:30) 0000000066970000
---- EOF - GMER 2.1 ----
--- --- ---
Das Defogger-Logfile war unspezifisch.
Besten Gruss
Karl |
So funktioniert es:
Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
TDSSKiller.exe und speichere diese Datei auf dem Desktop
Malwarebytes Anti-Malware 
AdwCleaner auf deinen Desktop.
SecurityCheck und:
