| Lolbobolp | 25.10.2014 14:24 |
Code:
.text ... * 3
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077233023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007723323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000772333c0 16 bytes {JMP 0x4e}
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077233a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077233ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077233b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077233d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077234190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077281380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077281500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077281530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077281650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077281700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077281d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077281f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000772827e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000739c13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000739c146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000739c16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000739c16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000739c19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000739c19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000739c1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000739c1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000739c1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000739c1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076cf1401 2 bytes JMP 7567b21b C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076cf1419 2 bytes JMP 7567b346 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076cf1431 2 bytes JMP 756f8ea9 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000076cf144a 2 bytes CALL 756548ad C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000076cf14dd 2 bytes JMP 756f87a2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000076cf14f5 2 bytes JMP 756f8978 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000076cf150d 2 bytes JMP 756f8698 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076cf1525 2 bytes JMP 756f8a62 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000076cf153d 2 bytes JMP 7566fca8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076cf1555 2 bytes JMP 756768ef C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000076cf156d 2 bytes JMP 756f8f61 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076cf1585 2 bytes JMP 756f8ac2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000076cf159d 2 bytes JMP 756f865c C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000076cf15b5 2 bytes JMP 7566fd41 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000076cf15cd 2 bytes JMP 7567b2dc C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000076cf16b2 2 bytes JMP 756f8e24 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[6204] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000076cf16bd 2 bytes JMP 756f85f1 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000772311f5 8 bytes {JMP 0xd}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077231390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 000000007723143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 000000007723158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 000000007723191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077231b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077231bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077231d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077231eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077231edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077231f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077231fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077231fd7 8 bytes {JMP 0xb}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077232272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077232301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077232792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000772327b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000772327d2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007723282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077232890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077232d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077232d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077233023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007723323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000772333c0 16 bytes {JMP 0x4e}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077233a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077233ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077233b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077233d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077234190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077281380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077281500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077281530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077281650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077281700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077281d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077281f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000772827e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000739c13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000739c146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000739c16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000739c16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000739c19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000739c19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000739c1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000739c1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000739c1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000739c1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\syswow64\kernel32.dll!RegQueryValueExW 0000000075651f0e 7 bytes JMP 00000001711c4b10
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\syswow64\kernel32.dll!RegSetValueExW 0000000075655bad 7 bytes JMP 00000001711c54b0
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\syswow64\kernel32.dll!RegSetValueExA 0000000075661409 7 bytes JMP 00000001711c4e50
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\syswow64\kernel32.dll!RegDeleteValueW 000000007566ea45 7 bytes JMP 00000001711c4b00
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 00000000756f8e24 7 bytes JMP 00000001711c45c0
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\syswow64\kernel32.dll!K32GetModuleInformation 00000000756f8ea9 5 bytes JMP 00000001711c4670
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000756f91ff 5 bytes JMP 00000001711c45d0
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleW 00000000753a1d29 5 bytes JMP 00000001711c4580
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 00000000753a1dd7 5 bytes JMP 00000001711c4540
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\syswow64\KERNELBASE.dll!LoadLibraryExW 00000000753a2ab1 5 bytes JMP 00000001711c4680
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\syswow64\KERNELBASE.dll!FreeLibrary 00000000753a2d17 5 bytes JMP 00000001711c4360
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\syswow64\USER32.dll!CreateWindowExW 0000000075d28a29 5 bytes JMP 00000001711c3a40
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000075d34572 5 bytes JMP 00000001711c42e0
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\syswow64\USER32.dll!EnumDisplayDevicesW 0000000075d4e567 5 bytes JMP 00000001711c4350
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 0000000075d707d7 5 bytes JMP 00000001711c3850
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 0000000075d87a5c 5 bytes JMP 00000001711c42d0
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007579e96b 5 bytes JMP 00000001711c3b60
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007579eba5 5 bytes JMP 00000001711c3b80
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000075835ea5 5 bytes JMP 00000001711c3a00
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[3192] C:\windows\syswow64\ole32.dll!CoCreateInstance 0000000075869d0b 5 bytes JMP 00000001711c3990
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000772311f5 8 bytes {JMP 0xd}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077231390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 000000007723143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 000000007723158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 000000007723191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077231b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077231bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077231d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077231eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077231edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077231f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077231fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077231fd7 8 bytes {JMP 0xb}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077232272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077232301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077232792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000772327b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000772327d2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007723282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077232890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077232d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077232d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077233023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007723323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000772333c0 16 bytes {JMP 0x4e}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077233a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077233ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077233b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077233d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077234190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077281380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077281500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077281530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077281650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077281700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077281d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077281f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000772827e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000739c13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000739c146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000739c16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000739c16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000739c19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000739c19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000739c1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000739c1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000739c1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000739c1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\syswow64\kernel32.dll!RegQueryValueExW 0000000075651f0e 7 bytes JMP 00000001711c4b10
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\syswow64\kernel32.dll!RegSetValueExW 0000000075655bad 7 bytes JMP 00000001711c54b0
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\syswow64\kernel32.dll!RegSetValueExA 0000000075661409 7 bytes JMP 00000001711c4e50
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\syswow64\kernel32.dll!RegDeleteValueW 000000007566ea45 7 bytes JMP 00000001711c4b00
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 00000000756f8e24 7 bytes JMP 00000001711c45c0
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\syswow64\kernel32.dll!K32GetModuleInformation 00000000756f8ea9 5 bytes JMP 00000001711c4670
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000756f91ff 5 bytes JMP 00000001711c45d0
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleW 00000000753a1d29 5 bytes JMP 00000001711c4580
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 00000000753a1dd7 5 bytes JMP 00000001711c4540
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\syswow64\KERNELBASE.dll!LoadLibraryExW 00000000753a2ab1 5 bytes JMP 00000001711c4680
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\syswow64\KERNELBASE.dll!FreeLibrary 00000000753a2d17 5 bytes JMP 00000001711c4360
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\syswow64\USER32.dll!CreateWindowExW 0000000075d28a29 5 bytes JMP 00000001711c3a40
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000075d34572 5 bytes JMP 00000001711c42e0
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\syswow64\USER32.dll!EnumDisplayDevicesW 0000000075d4e567 5 bytes JMP 00000001711c4350
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 0000000075d707d7 5 bytes JMP 00000001711c3850
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 0000000075d87a5c 5 bytes JMP 00000001711c42d0
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007579e96b 5 bytes JMP 00000001711c3b60
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007579eba5 5 bytes JMP 00000001711c3b80
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076cf1401 2 bytes JMP 7567b21b C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076cf1419 2 bytes JMP 7567b346 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076cf1431 2 bytes JMP 756f8ea9 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000076cf144a 2 bytes CALL 756548ad C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000076cf14dd 2 bytes JMP 756f87a2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000076cf14f5 2 bytes JMP 756f8978 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000076cf150d 2 bytes JMP 756f8698 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076cf1525 2 bytes JMP 756f8a62 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000076cf153d 2 bytes JMP 7566fca8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076cf1555 2 bytes JMP 756768ef C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000076cf156d 2 bytes JMP 756f8f61 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076cf1585 2 bytes JMP 756f8ac2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000076cf159d 2 bytes JMP 756f865c C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000076cf15b5 2 bytes JMP 7566fd41 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000076cf15cd 2 bytes JMP 7567b2dc C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000076cf16b2 2 bytes JMP 756f8e24 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtbws.exe[7012] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000076cf16bd 2 bytes JMP 756f85f1 C:\windows\syswow64\kernel32.dll
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000772311f5 8 bytes {JMP 0xd}
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077231390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 000000007723143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 000000007723158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 000000007723191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077231b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077231bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077231d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077231eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077231edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077231f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077231fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077231fd7 8 bytes {JMP 0xb}
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077232272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077232301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077232792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000772327b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000772327d2 8 bytes {JMP 0x10}
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007723282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077232890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077232d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077232d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077233023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007723323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000772333c0 16 bytes {JMP 0x4e}
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077233a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077233ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077233b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077233d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077234190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077281380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077281500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077281530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077281650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077281700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077281d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077281f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000772827e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000739c13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000739c146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000739c16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000739c16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000739c19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000739c19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 00000000739c1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 00000000739c1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000739c1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000739c1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\syswow64\kernel32.dll!RegQueryValueExW 0000000075651f0e 7 bytes JMP 00000001711c4b10
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\syswow64\kernel32.dll!RegSetValueExW 0000000075655bad 7 bytes JMP 00000001711c54b0
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\syswow64\kernel32.dll!RegSetValueExA 0000000075661409 7 bytes JMP 00000001711c4e50
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\syswow64\kernel32.dll!RegDeleteValueW 000000007566ea45 7 bytes JMP 00000001711c4b00
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 00000000756f8e24 7 bytes JMP 00000001711c45c0
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\syswow64\kernel32.dll!K32GetModuleInformation 00000000756f8ea9 5 bytes JMP 00000001711c4670
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000756f91ff 5 bytes JMP 00000001711c45d0
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleW 00000000753a1d29 5 bytes JMP 00000001711c4580
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 00000000753a1dd7 5 bytes JMP 00000001711c4540
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\syswow64\KERNELBASE.dll!LoadLibraryExW 00000000753a2ab1 5 bytes JMP 00000001711c4680
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\syswow64\KERNELBASE.dll!FreeLibrary 00000000753a2d17 5 bytes JMP 00000001711c4360
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007579e96b 5 bytes JMP 00000001711c3b60
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007579eba5 5 bytes JMP 00000001711c3b80
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\syswow64\USER32.dll!CreateWindowExW 0000000075d28a29 5 bytes JMP 00000001711c3a40
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000075d34572 5 bytes JMP 00000001711c42e0
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\syswow64\USER32.dll!EnumDisplayDevicesW 0000000075d4e567 5 bytes JMP 00000001711c4350
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 0000000075d707d7 5 bytes JMP 00000001711c3850
.text C:\Users\Phillip\Desktop\Gmer-19357.exe[1460] C:\windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 0000000075d87a5c 5 bytes JMP 00000001711c42d0
---- Threads - GMER 2.1 ----
Thread C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [5436:4012] 0000000075807587
Thread C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [5436:1340] 0000000067447712
Thread C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [5436:2068] 0000000077462e65
Thread C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [5436:7128] 0000000077463e85
Thread C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [5436:6088] 000000007584d864
Thread C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [5436:1908] 0000000077463e85
Thread C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [5436:2984] 0000000077463e85
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\88532e003e75
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\b4749f59338f
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\dca97107b376
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\88532e003e75 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\b4749f59338f (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\dca97107b376 (not active ControlSet)
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
|
GMER herunter: (Dateiname zufällig) 
Tauchen Probleme auf?