Vielleicht bin ich auch nur einfach wieder mal paranoid..
Ich konnte meinen Post oben nicht mehr editieren
GMER Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-07-13 01:40:24
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 TOSHIBA_ rev.AM00 465,76GB
Running: ij2jhrkq.exe; Driver: C:\Users\Andreas\AppData\Local\Temp\fgldqpod.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000774d11f5 8 bytes {JMP 0xd}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 00000000774d1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000774d143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 00000000774d158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000774d191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 00000000774d1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 00000000774d1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 00000000774d1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 00000000774d1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 00000000774d1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 00000000774d1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 00000000774d1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 00000000774d1fd7 8 bytes {JMP 0xb}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 00000000774d2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 00000000774d2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 00000000774d2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000774d27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000774d27d2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 00000000774d282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 00000000774d2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 00000000774d2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 00000000774d2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 00000000774d3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 00000000774d323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000774d33c0 16 bytes {JMP 0x4e}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 00000000774d3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000774d3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000774d3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 00000000774d3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 00000000774d4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077521380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077521500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077521530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077521650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077521700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077521d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077521f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775227e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000074ff13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000074ff146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000074ff16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 0000000074ff16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000074ff19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000074ff19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 0000000074ff1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 0000000074ff1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074ff1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3916] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 0000000074ff1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000774d11f5 8 bytes {JMP 0xd}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 00000000774d1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000774d143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 00000000774d158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000774d191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 00000000774d1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 00000000774d1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 00000000774d1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 00000000774d1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 00000000774d1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 00000000774d1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 00000000774d1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 00000000774d1fd7 8 bytes {JMP 0xb}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 00000000774d2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 00000000774d2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 00000000774d2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000774d27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000774d27d2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 00000000774d282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 00000000774d2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 00000000774d2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 00000000774d2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 00000000774d3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 00000000774d323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000774d33c0 16 bytes {JMP 0x4e}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 00000000774d3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000774d3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000774d3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 00000000774d3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 00000000774d4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077521380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077521500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077521530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077521650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077521700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077521d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077521f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775227e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000074ff13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000074ff146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000074ff16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 0000000074ff16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000074ff19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000074ff19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 0000000074ff1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 0000000074ff1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074ff1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3972] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 0000000074ff1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000774d11f5 8 bytes {JMP 0xd}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 00000000774d1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000774d143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 00000000774d158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000774d191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 00000000774d1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 00000000774d1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 00000000774d1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 00000000774d1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 00000000774d1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 00000000774d1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 00000000774d1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 00000000774d1fd7 8 bytes {JMP 0xb}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 00000000774d2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 00000000774d2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 00000000774d2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000774d27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000774d27d2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 00000000774d282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 00000000774d2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 00000000774d2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 00000000774d2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 00000000774d3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 00000000774d323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000774d33c0 16 bytes {JMP 0x4e}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 00000000774d3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000774d3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000774d3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 00000000774d3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 00000000774d4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077521380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077521500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077521530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077521650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077521700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077521d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077521f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775227e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000074ff13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000074ff146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000074ff16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 0000000074ff16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000074ff19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000074ff19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 0000000074ff1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 0000000074ff1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074ff1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2884] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 0000000074ff1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000774d11f5 8 bytes {JMP 0xd}
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 00000000774d1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000774d143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 00000000774d158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000774d191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 00000000774d1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 00000000774d1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 00000000774d1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 00000000774d1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 00000000774d1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 00000000774d1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 00000000774d1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 00000000774d1fd7 8 bytes {JMP 0xb}
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 00000000774d2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 00000000774d2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 00000000774d2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000774d27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000774d27d2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 00000000774d282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 00000000774d2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 00000000774d2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 00000000774d2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 00000000774d3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 00000000774d323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000774d33c0 16 bytes {JMP 0x4e}
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 00000000774d3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000774d3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000774d3b85 8 bytes [10, 6A, F8, FF, 00, 00, 00, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 00000000774d3d23 8 bytes [00, 6A, F8, FF, 00, 00, 00, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 00000000774d4190 8 bytes [A0, 69, F8, FF, 00, 00, 00, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077521380 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077521500 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077521530 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077521650 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077521700 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077521d30 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077521f80 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775227e0 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000074ff13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000074ff146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000074ff16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 0000000074ff16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000074ff19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000074ff19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 0000000074ff1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 0000000074ff1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074ff1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[3884] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 0000000074ff1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000774d11f5 8 bytes {JMP 0xd}
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 00000000774d1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000774d143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 00000000774d158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000774d191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 00000000774d1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 00000000774d1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 00000000774d1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 00000000774d1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 00000000774d1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 00000000774d1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 00000000774d1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 00000000774d1fd7 8 bytes {JMP 0xb}
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 00000000774d2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 00000000774d2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 00000000774d2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000774d27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000774d27d2 8 bytes {JMP 0x10}
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 00000000774d282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 00000000774d2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 00000000774d2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 00000000774d2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 00000000774d3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 00000000774d323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000774d33c0 16 bytes {JMP 0x4e}
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 00000000774d3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000774d3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000774d3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 00000000774d3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 00000000774d4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077521380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077521500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077521530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077521650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077521700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077521d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077521f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000775227e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000074ff13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000074ff146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000074ff16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 0000000074ff16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000074ff19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000074ff19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 0000000074ff1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 0000000074ff1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074ff1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 0000000074ff1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess 00000000776cfc20 3 bytes JMP 718a000a
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4 00000000776cfc24 2 bytes JMP 718a000a
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile 00000000776cfc38 3 bytes JMP 7181000a
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 4 00000000776cfc3c 2 bytes JMP 7181000a
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile 00000000776cfd64 3 bytes JMP 7184000a
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4 00000000776cfd68 2 bytes JMP 7184000a
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile 00000000776d00b4 3 bytes JMP 7187000a
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4 00000000776d00b8 2 bytes JMP 7187000a
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 00000000776d01c4 3 bytes JMP 7190000a
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4 00000000776d01c8 2 bytes JMP 7190000a
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey 00000000776d0a44 3 bytes JMP 718d000a
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4 00000000776d0a48 2 bytes JMP 718d000a
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 00000000776d1920 3 bytes JMP 717e000a
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4 00000000776d1924 2 bytes JMP 717e000a
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 00000000769f3bbb 3 bytes JMP 717b000a
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4 00000000769f3bbf 2 bytes JMP 717b000a
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493 00000000756e2c9e 4 bytes CALL 71af0000
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\syswow64\USER32.dll!SendMessageW 0000000077079679 6 bytes JMP 719f000a
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\syswow64\USER32.dll!PostMessageW 00000000770812a5 6 bytes JMP 7199000a
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\syswow64\USER32.dll!PostMessageA 0000000077083baa 6 bytes JMP 719c000a
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\syswow64\USER32.dll!SendMessageA 000000007708612e 6 bytes JMP 71a2000a
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\syswow64\USER32.dll!SendInput 000000007709ff4a 3 bytes JMP 71a5000a
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\syswow64\USER32.dll!SendInput + 4 000000007709ff4e 2 bytes JMP 71a5000a
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\syswow64\USER32.dll!mouse_event 00000000770d027b 6 bytes JMP 71ab000a
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\syswow64\USER32.dll!keybd_event 00000000770d02bf 6 bytes JMP 71a8000a
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW 00000000751d70c4 6 bytes JMP 7193000a
.text C:\Users\Andreas\Desktop\ij2jhrkq.exe[1340] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA 00000000751f3264 6 bytes JMP 7196000a
---- EOF - GMER 2.1 ----
|
