| DerDocker | 10.08.2015 22:02 |
GMER Logfile: Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-08-10 23:01:32
Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\00000031 WDC_WD10JPVX-22JC3T0 rev.01.01A01 931,51GB
Running: Gmer-19357.exe; Driver: C:\Users\Mike\AppData\Local\Temp\fwldypow.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 132 00007ffbbdb34b04 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 316 00007ffbbdb34f2c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!TpAllocIoCompletion + 710 00007ffbbdb35206 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitForWnfMetaNotification + 479 00007ffbbdb353ff 8 bytes {JMP 0xffffffffffffffee}
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlUserThreadStart + 911 00007ffbbdb3579f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWork + 420 00007ffbbdb35954 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitOnAddress + 657 00007ffbbdb35ef1 8 bytes {JMP 0xffffffffffffff9e}
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfNotificationWaitForCompletion + 78 00007ffbbdb35f4e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlWakeAddressAll + 399 00007ffbbdb360ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfStateChangeNotification + 977 00007ffbbdb364d1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 310 00007ffbbdb36616 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 491 00007ffbbdb366cb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlReportSilentProcessExit + 359 00007ffbbdb38397 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 67 00007ffbbdb38a13 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 864 00007ffbbdb38d30 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllHandleByName + 143 00007ffbbdb38e9f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 510 00007ffbbdb390ae 8 bytes {JMP 0xffffffffffffff96}
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 715 00007ffbbdb3917b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlQueueWorkItem + 772 00007ffbbdb39d14 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!LdrAddRefDll + 685 00007ffbbdb39fcd 8 bytes {JMP 0xffffffffffffffaf}
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 352 00007ffbbdb3aae0 8 bytes {JMP 0xffffffffffffffcd}
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 488 00007ffbbdb3ab68 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlGetVersion + 565 00007ffbbdb3b2e5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlGetNtProductType + 78 00007ffbbdb3b33e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 311 00007ffbbdb3c4d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 528 00007ffbbdb3c5b0 8 bytes {JMP 0xffffffffffffffc7}
.text ... * 2
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlAllocateActivationContextStack + 579 00007ffbbdb3d0d3 8 bytes {JMP 0xffffffffffffffef}
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlFreeThreadActivationContextStack + 47 00007ffbbdb3d10f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlProcessFlsData + 495 00007ffbbdb3d57f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 43 00007ffbbdb3d6eb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 456 00007ffbbdb3d888 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseWait + 180 00007ffbbdb3d944 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlRegisterWait + 596 00007ffbbdb3dba4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWait + 424 00007ffbbdb3dd58 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 771 00007ffbbdb3e073 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 948 00007ffbbdb3e124 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsA + 48 00007ffbbdb3e160 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlRandomEx + 756 00007ffbbdb3eb74 8 bytes {JMP 0xffffffffffffffd0}
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteFunctionTable + 371 00007ffbbdb3fe63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlAddFunctionTable + 556 00007ffbbdb4009c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlProtectHeap + 171 00007ffbbdb4015b 8 bytes [70, 6C, 78, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 744 00007ffbbdb41438 8 bytes [40, 6C, 78, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsW + 214 00007ffbbdb415e6 8 bytes [30, 6C, 78, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!EtwNotificationRegister + 567 00007ffbbdb41877 8 bytes [20, 6C, 78, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 429 00007ffbbdb41a2d 8 bytes [10, 6C, 78, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceExecuteOnce + 213 00007ffbbdb41c35 8 bytes [00, 6C, 78, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00007ffbbdbb1290 8 bytes {JMP QWORD [RIP-0x6fe5e]}
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00007ffbbdbb1410 8 bytes {JMP QWORD [RIP-0x6fe30]}
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00007ffbbdbb1440 8 bytes {JMP QWORD [RIP-0x712eb]}
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffbbdbb1560 8 bytes {JMP QWORD [RIP-0x70c1e]}
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00007ffbbdbb1610 8 bytes {JMP QWORD [RIP-0x71122]}
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007ffbbdbb1cd0 8 bytes {JMP QWORD [RIP-0x700a1]}
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00007ffbbdbb1fd0 8 bytes {JMP QWORD [RIP-0x705a9]}
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007ffbbdbb2850 8 bytes {JMP QWORD [RIP-0x70fdf]}
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 438 00000000776113f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 387 0000000077611583 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49 0000000077611621 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68 0000000077611674 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23 00000000776116d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 9 00000000776116e9 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 71 0000000077611727 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 7
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16 00000000776125d0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308 0000000077612714 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 529 0000000077612961 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3200] C:\Windows\system32\wow64cpu.dll!CpuProcessTerm + 595 0000000077612bd3 8 bytes [DC, 6A, 78, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 132 00007ffbbdb34b04 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 316 00007ffbbdb34f2c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!TpAllocIoCompletion + 710 00007ffbbdb35206 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitForWnfMetaNotification + 479 00007ffbbdb353ff 8 bytes {JMP 0xffffffffffffffee}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlUserThreadStart + 911 00007ffbbdb3579f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWork + 420 00007ffbbdb35954 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitOnAddress + 657 00007ffbbdb35ef1 8 bytes {JMP 0xffffffffffffff9e}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfNotificationWaitForCompletion + 78 00007ffbbdb35f4e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlWakeAddressAll + 399 00007ffbbdb360ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfStateChangeNotification + 977 00007ffbbdb364d1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 310 00007ffbbdb36616 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 491 00007ffbbdb366cb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlReportSilentProcessExit + 359 00007ffbbdb38397 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 67 00007ffbbdb38a13 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 864 00007ffbbdb38d30 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllHandleByName + 143 00007ffbbdb38e9f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 510 00007ffbbdb390ae 8 bytes {JMP 0xffffffffffffff96}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 715 00007ffbbdb3917b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlQueueWorkItem + 772 00007ffbbdb39d14 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!LdrAddRefDll + 685 00007ffbbdb39fcd 8 bytes {JMP 0xffffffffffffffaf}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 352 00007ffbbdb3aae0 8 bytes {JMP 0xffffffffffffffcd}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 488 00007ffbbdb3ab68 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlGetVersion + 565 00007ffbbdb3b2e5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlGetNtProductType + 78 00007ffbbdb3b33e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 311 00007ffbbdb3c4d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 528 00007ffbbdb3c5b0 8 bytes {JMP 0xffffffffffffffc7}
.text ... * 2
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlAllocateActivationContextStack + 579 00007ffbbdb3d0d3 8 bytes {JMP 0xffffffffffffffef}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlFreeThreadActivationContextStack + 47 00007ffbbdb3d10f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlProcessFlsData + 495 00007ffbbdb3d57f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 43 00007ffbbdb3d6eb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 456 00007ffbbdb3d888 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseWait + 180 00007ffbbdb3d944 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlRegisterWait + 596 00007ffbbdb3dba4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWait + 424 00007ffbbdb3dd58 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 771 00007ffbbdb3e073 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 948 00007ffbbdb3e124 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsA + 48 00007ffbbdb3e160 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlRandomEx + 756 00007ffbbdb3eb74 8 bytes {JMP 0xffffffffffffffd0}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteFunctionTable + 371 00007ffbbdb3fe63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlAddFunctionTable + 556 00007ffbbdb4009c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlProtectHeap + 171 00007ffbbdb4015b 8 bytes [70, 6C, B5, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 744 00007ffbbdb41438 8 bytes [40, 6C, B5, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsW + 214 00007ffbbdb415e6 8 bytes [30, 6C, B5, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!EtwNotificationRegister + 567 00007ffbbdb41877 8 bytes [20, 6C, B5, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 429 00007ffbbdb41a2d 8 bytes [10, 6C, B5, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceExecuteOnce + 213 00007ffbbdb41c35 8 bytes [00, 6C, B5, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00007ffbbdbb1290 8 bytes {JMP QWORD [RIP-0x6fe5e]}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00007ffbbdbb1410 8 bytes {JMP QWORD [RIP-0x6fe30]}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00007ffbbdbb1440 8 bytes {JMP QWORD [RIP-0x712eb]}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffbbdbb1560 8 bytes {JMP QWORD [RIP-0x70c1e]}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00007ffbbdbb1610 8 bytes {JMP QWORD [RIP-0x71122]}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007ffbbdbb1cd0 8 bytes {JMP QWORD [RIP-0x700a1]}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00007ffbbdbb1fd0 8 bytes {JMP QWORD [RIP-0x705a9]}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007ffbbdbb2850 8 bytes {JMP QWORD [RIP-0x70fdf]}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 438 00000000776113f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 387 0000000077611583 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49 0000000077611621 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68 0000000077611674 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23 00000000776116d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 9 00000000776116e9 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 71 0000000077611727 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 7
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16 00000000776125d0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308 0000000077612714 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 529 0000000077612961 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\system32\wow64cpu.dll!CpuProcessTerm + 595 0000000077612bd3 8 bytes [DC, 6A, B5, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 132 00007ffbbdb34b04 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 316 00007ffbbdb34f2c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!TpAllocIoCompletion + 710 00007ffbbdb35206 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitForWnfMetaNotification + 479 00007ffbbdb353ff 8 bytes {JMP 0xffffffffffffffee}
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlUserThreadStart + 911 00007ffbbdb3579f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWork + 420 00007ffbbdb35954 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitOnAddress + 657 00007ffbbdb35ef1 8 bytes {JMP 0xffffffffffffff9e}
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfNotificationWaitForCompletion + 78 00007ffbbdb35f4e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlWakeAddressAll + 399 00007ffbbdb360ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfStateChangeNotification + 977 00007ffbbdb364d1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 310 00007ffbbdb36616 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 491 00007ffbbdb366cb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlReportSilentProcessExit + 359 00007ffbbdb38397 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 67 00007ffbbdb38a13 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 864 00007ffbbdb38d30 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllHandleByName + 143 00007ffbbdb38e9f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 510 00007ffbbdb390ae 8 bytes {JMP 0xffffffffffffff96}
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 715 00007ffbbdb3917b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlQueueWorkItem + 772 00007ffbbdb39d14 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!LdrAddRefDll + 685 00007ffbbdb39fcd 8 bytes {JMP 0xffffffffffffffaf}
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 352 00007ffbbdb3aae0 8 bytes {JMP 0xffffffffffffffcd}
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 488 00007ffbbdb3ab68 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlGetVersion + 565 00007ffbbdb3b2e5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlGetNtProductType + 78 00007ffbbdb3b33e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 311 00007ffbbdb3c4d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 528 00007ffbbdb3c5b0 8 bytes {JMP 0xffffffffffffffc7}
.text ... * 2
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlAllocateActivationContextStack + 579 00007ffbbdb3d0d3 8 bytes {JMP 0xffffffffffffffef}
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlFreeThreadActivationContextStack + 47 00007ffbbdb3d10f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlProcessFlsData + 495 00007ffbbdb3d57f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 43 00007ffbbdb3d6eb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 456 00007ffbbdb3d888 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseWait + 180 00007ffbbdb3d944 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlRegisterWait + 596 00007ffbbdb3dba4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWait + 424 00007ffbbdb3dd58 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 771 00007ffbbdb3e073 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 948 00007ffbbdb3e124 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsA + 48 00007ffbbdb3e160 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlRandomEx + 756 00007ffbbdb3eb74 8 bytes {JMP 0xffffffffffffffd0}
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteFunctionTable + 371 00007ffbbdb3fe63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlAddFunctionTable + 556 00007ffbbdb4009c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlProtectHeap + 171 00007ffbbdb4015b 8 bytes [70, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 744 00007ffbbdb41438 8 bytes [40, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsW + 214 00007ffbbdb415e6 8 bytes [30, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!EtwNotificationRegister + 567 00007ffbbdb41877 8 bytes [20, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 429 00007ffbbdb41a2d 8 bytes [10, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceExecuteOnce + 213 00007ffbbdb41c35 8 bytes [00, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00007ffbbdbb1290 8 bytes {JMP QWORD [RIP-0x6fe5e]}
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00007ffbbdbb1410 8 bytes {JMP QWORD [RIP-0x6fe30]}
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00007ffbbdbb1440 8 bytes {JMP QWORD [RIP-0x712eb]}
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffbbdbb1560 8 bytes {JMP QWORD [RIP-0x70c1e]}
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00007ffbbdbb1610 8 bytes {JMP QWORD [RIP-0x71122]}
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007ffbbdbb1cd0 8 bytes {JMP QWORD [RIP-0x700a1]}
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00007ffbbdbb1fd0 8 bytes {JMP QWORD [RIP-0x705a9]}
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007ffbbdbb2850 8 bytes {JMP QWORD [RIP-0x70fdf]}
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 438 00000000776113f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 387 0000000077611583 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49 0000000077611621 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68 0000000077611674 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23 00000000776116d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 9 00000000776116e9 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 71 0000000077611727 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 7
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16 00000000776125d0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308 0000000077612714 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 529 0000000077612961 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\system32\wow64cpu.dll!CpuProcessTerm + 595 0000000077612bd3 8 bytes [DC, 6A, F8, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 132 00007ffbbdb34b04 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 316 00007ffbbdb34f2c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!TpAllocIoCompletion + 710 00007ffbbdb35206 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitForWnfMetaNotification + 479 00007ffbbdb353ff 8 bytes {JMP 0xffffffffffffffee}
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlUserThreadStart + 911 00007ffbbdb3579f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWork + 420 00007ffbbdb35954 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitOnAddress + 657 00007ffbbdb35ef1 8 bytes {JMP 0xffffffffffffff9e}
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfNotificationWaitForCompletion + 78 00007ffbbdb35f4e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlWakeAddressAll + 399 00007ffbbdb360ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfStateChangeNotification + 977 00007ffbbdb364d1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 310 00007ffbbdb36616 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 491 00007ffbbdb366cb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlReportSilentProcessExit + 359 00007ffbbdb38397 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 67 00007ffbbdb38a13 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 864 00007ffbbdb38d30 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllHandleByName + 143 00007ffbbdb38e9f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 510 00007ffbbdb390ae 8 bytes {JMP 0xffffffffffffff96}
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 715 00007ffbbdb3917b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlQueueWorkItem + 772 00007ffbbdb39d14 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!LdrAddRefDll + 685 00007ffbbdb39fcd 8 bytes {JMP 0xffffffffffffffaf}
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 352 00007ffbbdb3aae0 8 bytes {JMP 0xffffffffffffffcd}
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 488 00007ffbbdb3ab68 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlGetVersion + 565 00007ffbbdb3b2e5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlGetNtProductType + 78 00007ffbbdb3b33e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 311 00007ffbbdb3c4d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 528 00007ffbbdb3c5b0 8 bytes {JMP 0xffffffffffffffc7}
.text ... * 2
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlAllocateActivationContextStack + 579 00007ffbbdb3d0d3 8 bytes {JMP 0xffffffffffffffef}
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlFreeThreadActivationContextStack + 47 00007ffbbdb3d10f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlProcessFlsData + 495 00007ffbbdb3d57f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 43 00007ffbbdb3d6eb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 456 00007ffbbdb3d888 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseWait + 180 00007ffbbdb3d944 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlRegisterWait + 596 00007ffbbdb3dba4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWait + 424 00007ffbbdb3dd58 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 771 00007ffbbdb3e073 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 948 00007ffbbdb3e124 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsA + 48 00007ffbbdb3e160 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlRandomEx + 756 00007ffbbdb3eb74 8 bytes {JMP 0xffffffffffffffd0}
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteFunctionTable + 371 00007ffbbdb3fe63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlAddFunctionTable + 556 00007ffbbdb4009c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlProtectHeap + 171 00007ffbbdb4015b 8 bytes [70, 6C, 64, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 744 00007ffbbdb41438 8 bytes [40, 6C, 64, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsW + 214 00007ffbbdb415e6 8 bytes [30, 6C, 64, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!EtwNotificationRegister + 567 00007ffbbdb41877 8 bytes [20, 6C, 64, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 429 00007ffbbdb41a2d 8 bytes [10, 6C, 64, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceExecuteOnce + 213 00007ffbbdb41c35 8 bytes [00, 6C, 64, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00007ffbbdbb1290 8 bytes {JMP QWORD [RIP-0x6fe5e]}
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00007ffbbdbb1410 8 bytes {JMP QWORD [RIP-0x6fe30]}
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00007ffbbdbb1440 8 bytes {JMP QWORD [RIP-0x712eb]}
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffbbdbb1560 8 bytes {JMP QWORD [RIP-0x70c1e]}
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00007ffbbdbb1610 8 bytes {JMP QWORD [RIP-0x71122]}
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007ffbbdbb1cd0 8 bytes {JMP QWORD [RIP-0x700a1]}
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00007ffbbdbb1fd0 8 bytes {JMP QWORD [RIP-0x705a9]}
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007ffbbdbb2850 8 bytes {JMP QWORD [RIP-0x70fdf]}
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 438 00000000776113f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 387 0000000077611583 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49 0000000077611621 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68 0000000077611674 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23 00000000776116d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 9 00000000776116e9 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 71 0000000077611727 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 7
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16 00000000776125d0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308 0000000077612714 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 529 0000000077612961 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\system32\wow64cpu.dll!CpuProcessTerm + 595 0000000077612bd3 8 bytes [DC, 6A, 64, 7F, 00, 00, 00, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 132 00007ffbbdb34b04 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 316 00007ffbbdb34f2c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!TpAllocIoCompletion + 710 00007ffbbdb35206 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitForWnfMetaNotification + 479 00007ffbbdb353ff 8 bytes {JMP 0xffffffffffffffee}
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlUserThreadStart + 911 00007ffbbdb3579f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWork + 420 00007ffbbdb35954 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitOnAddress + 657 00007ffbbdb35ef1 8 bytes {JMP 0xffffffffffffff9e}
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfNotificationWaitForCompletion + 78 00007ffbbdb35f4e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlWakeAddressAll + 399 00007ffbbdb360ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfStateChangeNotification + 977 00007ffbbdb364d1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 310 00007ffbbdb36616 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 491 00007ffbbdb366cb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlReportSilentProcessExit + 359 00007ffbbdb38397 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 67 00007ffbbdb38a13 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 864 00007ffbbdb38d30 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllHandleByName + 143 00007ffbbdb38e9f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 510 00007ffbbdb390ae 8 bytes {JMP 0xffffffffffffff96}
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 715 00007ffbbdb3917b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlQueueWorkItem + 772 00007ffbbdb39d14 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!LdrAddRefDll + 685 00007ffbbdb39fcd 8 bytes {JMP 0xffffffffffffffaf}
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 352 00007ffbbdb3aae0 8 bytes {JMP 0xffffffffffffffcd}
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 488 00007ffbbdb3ab68 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlGetVersion + 565 00007ffbbdb3b2e5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlGetNtProductType + 78 00007ffbbdb3b33e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 311 00007ffbbdb3c4d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 528 00007ffbbdb3c5b0 8 bytes {JMP 0xffffffffffffffc7}
.text ... * 2
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlAllocateActivationContextStack + 579 00007ffbbdb3d0d3 8 bytes {JMP 0xffffffffffffffef}
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlFreeThreadActivationContextStack + 47 00007ffbbdb3d10f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlProcessFlsData + 495 00007ffbbdb3d57f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 43 00007ffbbdb3d6eb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 456 00007ffbbdb3d888 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseWait + 180 00007ffbbdb3d944 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlRegisterWait + 596 00007ffbbdb3dba4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWait + 424 00007ffbbdb3dd58 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 771 00007ffbbdb3e073 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 948 00007ffbbdb3e124 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsA + 48 00007ffbbdb3e160 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlRandomEx + 756 00007ffbbdb3eb74 8 bytes {JMP 0xffffffffffffffd0}
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteFunctionTable + 371 00007ffbbdb3fe63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlAddFunctionTable + 556 00007ffbbdb4009c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlProtectHeap + 171 00007ffbbdb4015b 8 bytes [70, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 744 00007ffbbdb41438 8 bytes [40, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsW + 214 00007ffbbdb415e6 8 bytes [30, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!EtwNotificationRegister + 567 00007ffbbdb41877 8 bytes [20, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 429 00007ffbbdb41a2d 8 bytes [10, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceExecuteOnce + 213 00007ffbbdb41c35 8 bytes [00, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00007ffbbdbb1290 8 bytes {JMP QWORD [RIP-0x6fe5e]}
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00007ffbbdbb1410 8 bytes {JMP QWORD [RIP-0x6fe30]}
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00007ffbbdbb1440 8 bytes {JMP QWORD [RIP-0x712eb]}
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffbbdbb1560 8 bytes {JMP QWORD [RIP-0x70c1e]}
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00007ffbbdbb1610 8 bytes {JMP QWORD [RIP-0x71122]}
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007ffbbdbb1cd0 8 bytes {JMP QWORD [RIP-0x700a1]}
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00007ffbbdbb1fd0 8 bytes {JMP QWORD [RIP-0x705a9]}
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007ffbbdbb2850 8 bytes {JMP QWORD [RIP-0x70fdf]}
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 438 00000000776113f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 387 0000000077611583 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49 0000000077611621 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68 0000000077611674 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23 00000000776116d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 9 00000000776116e9 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 71 0000000077611727 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 7
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16 00000000776125d0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308 0000000077612714 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 529 0000000077612961 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\system32\wow64cpu.dll!CpuProcessTerm + 595 0000000077612bd3 8 bytes [DC, 6A, F8, 7F, 00, 00, 00, ...]
---- Threads - GMER 2.1 ----
Thread C:\Windows\system32\csrss.exe [708:732] fffff960008ae2d0
Thread C:\Windows\Explorer.EXE [2408:5388] 00007ffbad4be630
---- Processes - GMER 2.1 ----
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\uds.dll.000000000006ad50-01d049ed6378490f-01d0a1f94e82ee12 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1784] (FILE NOT FOUND) 0000000071a90000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\avengine.dll.9ee8bd3c2dfe2b51237b1662e1c9ede4 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1784] (FILE NOT FOUND) 0000000071a00000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\kavbase.kdl.ec30a0e81f3e302a0b46ce9429e61be5 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1784] (FILE NOT FOUND) 0000000071960000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\klavemu.kdl.b6b6dd223ad2aad28374217a028b59b0 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1784] (FILE NOT FOUND) 00000000712e0000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\kjim.kdl.e30a2afa3b21fc3c867bdf51ac89005f (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1784] (FILE NOT FOUND) 0000000071060000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\mark.kdl.841a103288da704ab47258a8a435c8d1 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1784] (FILE NOT FOUND) 0000000071000000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\qscan.kdl.930f4350f703b72d5b371e32d0b0a20b (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1784] (FILE NOT FOUND) 0000000070ed0000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\arkmon.kdl.05412b88de65b3a6617f42e1fbad772c (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1784] (FILE NOT FOUND) 0000000070d60000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\kavsys.kdl.8ddf5e38536ca52585f7111e29787d9b (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1784] (FILE NOT FOUND) 0000000070ce0000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\intctrl.kdl.0000000000090000-01d049ed627928ba-01d04813eb1eff00 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1784] (FILE NOT FOUND) 0000000070800000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\swmon.kdl.0000000000019800-01d049ed6318e9bd-01d0aeb067f58b79 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1784] (FILE NOT FOUND) 000000006fee0000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\swmon_drv.kdl.0000000000018600-01d049ed63417292-01d04813f3773a00 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1784] (FILE NOT FOUND) 000000006f9b0000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\vlns.kdl.485c531d29ec65f537ebf368a496dbad (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1784] (FILE NOT FOUND) 000000006de30000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\pbs.kdl.eefcc4c76375abb2b40e8e5c00c7eccf (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1784] (FILE NOT FOUND) 000000006dcd0000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\pdm.kdl.0000000000069740-01d049ed62e6d694-01d04813ed815900 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1784] (FILE NOT FOUND) 000000006ecc0000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\bsshlp2.kdl.7b5ed3ca6d3d7225b866af3c09484fec (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1784] (FILE NOT FOUND) 000000006ebc0000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\klavasyswatch.dll.000000000012e400-01d049ed62804f5e-01d0a96d089d22bb (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1784] (FILE NOT FOUND) 00000000625b0000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\sys_critical_obj.dll.0000000000023800-01d049ed6356e803-01d04813aabf8100 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1784] (FILE NOT FOUND) 00000000624b0000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\heurap.dll.7aaa0a24800a0898e1e21547cd09831d (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1784] (FILE NOT FOUND) 00000000623d0000
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
--- --- --- |
FRST 32-Bit | FRST 64-Bit
Lesestoff:
Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
dann auf 
und dann auf 
.