| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Back to Desktop + ladender MauszeigerWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
23.05.2015, 20:33
| #1 |
| |  Back to Desktop + ladender Mauszeiger Hallo, Ich werde beim Spielen von Witcher 3 in unregelmäßigen Abständen (~30-60 min) zurück auf zum Desktop geschickt und der Mauszeiger lässt auf das Ausführen eines Programmes schließen(blauer Ladering). Das Spiel wird nicht beendet und ich kann auch sofort wieder reintabben. Weiß nicht ob es am Spiel liegt, aber ich habe noch von keinen ähnlichen Problemen gehört.. Kaspersky findet nichts. Defogger wurde ohne Probleme ausgeführt. Hier meine Logs: FRST.txt: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 22-05-2015 01
Ran by Jannik (administrator) on JANNIK-PC on 23-05-2015 21:12:35
Running from C:\Users\Jannik\Desktop
Loaded Profiles: Jannik (Available Profiles: Jannik)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\avp.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\avpui.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Nota Inc.) C:\Program Files (x86)\Gyazo\GyStation.exe
(Akamai Technologies, Inc.) C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe
(Flux Software LLC) C:\Users\Jannik\AppData\Local\FluxSoftware\Flux\flux.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_YATIKAE.EXE
(Akamai Technologies, Inc.) C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe
(EIZO Corporation) C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe
(Dropbox, Inc.) C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM-x32\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM-x32\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2685072 2015-05-08] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-03-27] (Intel Corporation)
HKU\S-1-5-21-4043579312-2739093779-986575188-1000\...\Run: [Gyazo] => C:\Program Files (x86)\Gyazo\GyStation.exe [3293288 2013-08-02] (Nota Inc.)
HKU\S-1-5-21-4043579312-2739093779-986575188-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2888384 2015-05-15] (Valve Corporation)
HKU\S-1-5-21-4043579312-2739093779-986575188-1000\...\Run: [GarenaPlus] => "C:\Program Files (x86)\Garena Plus\GarenaMessenger.exe" -autolaunch
HKU\S-1-5-21-4043579312-2739093779-986575188-1000\...\Run: [Akamai NetSession Interface] => C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-30] (Akamai Technologies, Inc.)
HKU\S-1-5-21-4043579312-2739093779-986575188-1000\...\Run: [GoogleChromeAutoLaunch_5C32303875095B3A38033A6F03B4CED8] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [813896 2015-05-13] (Google Inc.)
HKU\S-1-5-21-4043579312-2739093779-986575188-1000\...\Run: [f.lux] => C:\Users\Jannik\AppData\Local\FluxSoftware\Flux\flux.exe [1017224 2013-10-24] (Flux Software LLC)
HKU\S-1-5-21-4043579312-2739093779-986575188-1000\...\Run: [GalaxyClient] => C:\Program Files (x86)\GalaxyClient\GalaxyClient.exe [7435320 2015-05-23] (GOG.com)
HKU\S-1-5-21-4043579312-2739093779-986575188-1000\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIKAE.EXE [298560 2013-09-12] (SEIKO EPSON CORPORATION)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2013-08-07] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ScreenManager Pro for LCD (DDCCI) Ver.2.4.0.lnk [2014-08-09]
ShortcutTarget: ScreenManager Pro for LCD (DDCCI) Ver.2.4.0.lnk -> C:\Windows\Installer\{DAB265AD-27B2-4651-B8D8-F4F3A8ECC705}\LcdctrlDdcci.exe1_A2457035AC9A449AAFF91D310EF3707A.exe (Macrovision Corporation)
Startup: C:\Users\Jannik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2014-08-05]
ShortcutTarget: Dropbox.lnk -> C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jannik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jannik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jannik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jannik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jannik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jannik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jannik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jannik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.mysearchdial.com/?f=1&a=MSD2&cd=2XzuyEtN2Y1L1QzuzytDtB0BtAyE0DyE0CtD0Bzz0D0DyDyDtN0D0Tzu0CyBzzzztN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=755617206&ir=
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.mysearchdial.com/?f=1&a=MSD2&cd=2XzuyEtN2Y1L1QzuzytDtB0BtAyE0DyE0CtD0Bzz0D0DyDyDtN0D0Tzu0CyBzzzztN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=755617206&ir=
HKU\S-1-5-21-4043579312-2739093779-986575188-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=MSD2&cd=2XzuyEtN2Y1L1QzuzytDtB0BtAyE0DyE0CtD0Bzz0D0DyDyDtN0D0Tzu0CyBzzzztN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=755617206&ir=
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=MSD2&cd=2XzuyEtN2Y1L1QzuzytDtB0BtAyE0DyE0CtD0Bzz0D0DyDyDtN0D0Tzu0CyBzzzztN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=755617206&ir=
SearchScopes: HKU\S-1-5-21-4043579312-2739093779-986575188-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=MSD2&cd=2XzuyEtN2Y1L1QzuzytDtB0BtAyE0DyE0CtD0Bzz0D0DyDyDtN0D0Tzu0CyBzzzztN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=755617206&ir=
SearchScopes: HKU\S-1-5-21-4043579312-2739093779-986575188-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=MSD2&cd=2XzuyEtN2Y1L1QzuzytDtB0BtAyE0DyE0CtD0Bzz0D0DyDyDtN0D0Tzu0CyBzzzztN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=755617206&ir=
BHO: Virtual Keyboard Plugin -> {4A66AD60-A03D-4D01-86F0-5F0F7C0EF1AD} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\x64\IEExt\ie_plugin.dll [2014-12-23] (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll [2014-11-30] (Oracle Corporation)
BHO: Content Blocker Plugin -> {93BC2EA7-2F17-4729-948A-D2E03FFB2412} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\x64\IEExt\ie_plugin.dll [2014-12-23] (Kaspersky Lab ZAO)
BHO: Safe Money Plugin -> {AB379017-4C03-4E00-8EDF-E6D6AF7CCF82} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\x64\IEExt\ie_plugin.dll [2014-12-23] (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2012-10-01] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-11-30] (Oracle Corporation)
BHO-x32: Virtual Keyboard Plugin -> {4A66AD60-A03D-4D01-86F0-5F0F7C0EF1AD} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\IEExt\ie_plugin.dll [2014-12-23] (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll [2014-10-28] (Oracle Corporation)
BHO-x32: Content Blocker Plugin -> {93BC2EA7-2F17-4729-948A-D2E03FFB2412} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\IEExt\ie_plugin.dll [2014-12-23] (Kaspersky Lab ZAO)
BHO-x32: Safe Money Plugin -> {AB379017-4C03-4E00-8EDF-E6D6AF7CCF82} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\IEExt\ie_plugin.dll [2014-12-23] (Kaspersky Lab ZAO)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2012-10-01] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2012-10-01] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-10-28] (Oracle Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2012-10-01] (Microsoft Corporation)
Tcpip\..\Interfaces\{25B6911B-C9DA-47BF-9AA9-AF5466213304}: [NameServer] 192.168.6.1
Tcpip\..\Interfaces\{F2F8EB4A-CDA3-4ED8-8051-167C065378C4}: [NameServer] 192.168.6.1
FireFox:
========
FF ProfilePath: C:\Users\Jannik\AppData\Roaming\Mozilla\Firefox\Profiles\4k2j71og.default-1415316742647
FF NetworkProxy: "http", "72.159.148.20"
FF NetworkProxy: "http_port", 10000
FF NetworkProxy: "share_proxy_settings", true
FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2014-11-30] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2014-11-30] (Oracle Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.7 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2013-06-11] (VideoLAN)
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2014-10-28] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2014-10-28] (Oracle Corporation)
FF Plugin-x32: @kaspersky.com/content_blocker_663BE84DBCC949E88C7600F63CA7F098 -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\FFExt\content_blocker@kaspersky.com [2015-05-17] ()
FF Plugin-x32: @kaspersky.com/online_banking_08806E753BE44495B44E90AA2513BDC5 -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\FFExt\online_banking@kaspersky.com [2015-05-17] ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard_07402848C2F6470194F131B0F3DE025E -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\FFExt\virtual_keyboard@kaspersky.com [2015-05-17] ()
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-05-12] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-05-12] (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @t.garena.com/garenatalk -> C:\Program Files (x86)\Garena Plus\bbtalk\plugins\npPlugin\npGarenaTalkPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-16] (Google Inc.)
FF user.js: detected! => C:\Users\Jannik\AppData\Roaming\Mozilla\Firefox\Profiles\4k2j71og.default-1415316742647\user.js [2015-05-21]
FF Extension: FoxyProxy Standard - C:\Users\Jannik\AppData\Roaming\Mozilla\Firefox\Profiles\4k2j71og.default-1415316742647\Extensions\foxyproxy@eric.h.jung [2015-04-13]
FF Extension: YouTube Unblocker - C:\Users\Jannik\AppData\Roaming\Mozilla\Firefox\Profiles\4k2j71og.default-1415316742647\Extensions\youtubeunblocker@unblocker.yt [2015-04-13]
FF Extension: Proxy-Listen.de - Proxyswitcher - C:\Users\Jannik\AppData\Roaming\Mozilla\Firefox\Profiles\4k2j71og.default-1415316742647\Extensions\admin@proxy-listen.de.xpi [2015-04-13]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker_663BE84DBCC949E88C7600F63CA7F098@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\FFExt\content_blocker@kaspersky.com
FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\FFExt\content_blocker@kaspersky.com [2015-05-17]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard_07402848C2F6470194F131B0F3DE025E@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\FFExt\virtual_keyboard@kaspersky.com [2015-05-17]
FF HKLM-x32\...\Firefox\Extensions: [online_banking_08806E753BE44495B44E90AA2513BDC5@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\FFExt\online_banking@kaspersky.com [2015-05-17]
Chrome:
=======
CHR Profile: C:\Users\Jannik\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Jannik\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-03-30]
CHR Extension: (Google Docs) - C:\Users\Jannik\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-03-30]
CHR Extension: (Google Drive) - C:\Users\Jannik\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-03-30]
CHR Extension: (YouTube) - C:\Users\Jannik\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-03-30]
CHR Extension: (FlashBlock) - C:\Users\Jannik\AppData\Local\Google\Chrome\User Data\Default\Extensions\cdngiadmnkhgemkimkhiilgffbjijcie [2015-04-05]
CHR Extension: (Adblock Plus) - C:\Users\Jannik\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2015-04-13]
CHR Extension: (Google Search) - C:\Users\Jannik\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-03-30]
CHR Extension: (Kaspersky Protection) - C:\Users\Jannik\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbhjdbfgekjfcfkkfjjmlmojhbllhbho [2015-05-17]
CHR Extension: (Google Sheets) - C:\Users\Jannik\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-03-30]
CHR Extension: (Bookmark Manager) - C:\Users\Jannik\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-22]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Jannik\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-30]
CHR Extension: (Google Wallet) - C:\Users\Jannik\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-03-30]
CHR Extension: (Gmail) - C:\Users\Jannik\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-30]
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AVP15.0.2; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\avp.exe [193400 2014-12-23] (Kaspersky Lab ZAO)
R2 DiagTrack; C:\Windows\system32\diagtrack.dll [1254400 2015-04-27] (Microsoft Corporation)
S3 GalaxyClientService; C:\Program Files (x86)\GalaxyClient\GalaxyClientService.exe [1743928 2015-05-23] (GOG.com)
S3 GalaxyCommunication; C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe [6516792 2015-05-23] (GOG.com)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1152656 2015-05-08] (NVIDIA Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1884304 2015-05-08] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [22997648 2015-05-08] (NVIDIA Corporation)
S3 PAExec; C:\Windows\PAExec.exe [207872 2015-05-12] (Power Admin LLC) []
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-09-30] ()
S3 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [792016 2015-02-09] (Tunngle.net GmbH)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R0 cm_km_w; C:\Windows\System32\DRIVERS\cm_km_w.sys [238288 2013-01-14] (Kaspersky Lab UK Ltd)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [468576 2014-03-31] (Kaspersky Lab ZAO)
R2 kldisk; C:\Windows\System32\DRIVERS\kldisk.sys [56008 2015-05-17] (Kaspersky Lab ZAO)
R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [151240 2014-11-28] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [245960 2014-10-22] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [842440 2015-05-17] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [30920 2014-10-10] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [30920 2014-10-30] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [57032 2014-10-09] (Kaspersky Lab ZAO)
R1 Klwtp; C:\Windows\System32\DRIVERS\klwtp.sys [77000 2014-11-22] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [181960 2014-11-10] (Kaspersky Lab ZAO)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-05-08] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2015-04-09] (NVIDIA Corporation)
S3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2014-05-17] (Anchorfree Inc.)
S3 xb1usb; C:\Windows\System32\DRIVERS\xb1usb.sys [34016 2014-05-27] (Microsoft Corporation)
S3 BTCFilterService; system32\DRIVERS\motfilt.sys [X]
S3 GGSAFERDriver; \??\C:\Program Files (x86)\Garena Plus\Room\safedrv.sys [X]
S3 motandroidusb; System32\Drivers\motoandroid.sys [X]
S3 motccgp; system32\DRIVERS\motccgp.sys [X]
S3 motccgpfl; system32\DRIVERS\motccgpfl.sys [X]
S3 MotoSwitchService; system32\DRIVERS\motswch.sys [X]
S3 Motousbnet; system32\DRIVERS\Motousbnet.sys [X]
S3 motusbdevice; system32\DRIVERS\motusbdevice.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-05-23 21:12 - 2015-05-23 21:12 - 00023338 _____ () C:\Users\Jannik\Desktop\FRST.txt
2015-05-23 21:12 - 2015-05-23 21:12 - 00000000 ____D () C:\FRST
2015-05-23 21:11 - 2015-05-23 21:11 - 00000474 _____ () C:\Users\Jannik\Desktop\defogger_disable.log
2015-05-23 21:11 - 2015-05-23 21:11 - 00000112 _____ () C:\Users\Jannik\Desktop\Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten- - Trojaner-Board.url
2015-05-23 21:11 - 2015-05-23 21:11 - 00000000 _____ () C:\Users\Jannik\defogger_reenable
2015-05-23 21:10 - 2015-05-23 21:10 - 02108416 _____ (Farbar) C:\Users\Jannik\Desktop\FRST64.exe
2015-05-23 21:10 - 2015-05-23 21:10 - 00380416 _____ () C:\Users\Jannik\Desktop\Gmer-19357.exe
2015-05-22 16:15 - 2015-05-22 16:15 - 00000220 _____ () C:\Users\Jannik\Desktop\Sid Meier's Civilization V.url
2015-05-21 20:27 - 2015-05-21 20:27 - 00000081 _____ () C:\Users\Jannik\Desktop\My amazing girlfriend gives the best handjob.mp4 - Pornhub.com.url
2015-05-21 07:14 - 2015-05-21 07:14 - 00000072 _____ () C:\Users\Jannik\Desktop\de.spankbang.com-2lqq-video-rachel+fb18.url
2015-05-20 01:43 - 2015-05-20 01:43 - 00000079 _____ () C:\Users\Jannik\Desktop\abiunity - Vorabi- Nationalsozialismus und Krise der Römischen Republik.url
2015-05-20 01:43 - 2015-05-20 01:43 - 00000079 _____ () C:\Users\Jannik\Desktop\abiunity - Geschichte mündlich.url
2015-05-20 01:42 - 2015-05-20 01:42 - 00000079 _____ () C:\Users\Jannik\Desktop\abiunity - Rahmenthema 4 ''Mythen''.url
2015-05-20 01:21 - 2015-05-20 01:21 - 00000069 _____ () C:\Users\Jannik\Desktop\Lil Dicky - Ex-Boyfriend (Official Video) - YouTube.url
2015-05-18 23:59 - 2015-05-23 14:24 - 00000000 ____D () C:\Users\Jannik\Documents\The Witcher 3
2015-05-18 23:59 - 2015-05-18 23:59 - 00000000 ____D () C:\Users\Jannik\AppData\Local\GalaxyCommunicationService
2015-05-18 18:04 - 2015-05-18 18:04 - 00000058 _____ () C:\Users\Jannik\Desktop\MRW I lose my precious but hear a hobbit in the distance - Imgur.url
2015-05-18 17:39 - 2015-05-12 04:34 - 00571024 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2015-05-18 17:38 - 2015-05-13 08:52 - 00195912 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys
2015-05-18 17:38 - 2015-05-13 08:52 - 00031552 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 42718864 _____ () C:\Windows\system32\nvcompiler.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 37741712 _____ () C:\Windows\SysWOW64\nvcompiler.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 30478992 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 22945424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 17540416 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 16145176 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 15858728 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 14455296 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 13263568 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 11790144 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 10972304 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2015-05-18 17:38 - 2015-05-12 08:27 - 02932368 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 02599056 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 01898312 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6435286.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 01557648 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6435286.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 01099808 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 01059984 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 01050256 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 00982672 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 00974480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 00939080 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 00502896 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 00408208 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 00407296 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 00364176 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 00176064 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 00154256 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 00150832 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 00128512 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2015-05-17 20:39 - 2015-05-17 20:39 - 00000060 _____ () C:\Users\Jannik\Desktop\RocketBeansTV - Twitch.url
2015-05-17 20:34 - 2015-05-23 13:48 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2015-05-17 20:34 - 2015-05-17 20:40 - 00842440 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2015-05-17 20:34 - 2015-05-17 20:34 - 00002330 _____ () C:\Users\Jannik\Desktop\Sicherer Zahlungsverkehr.lnk
2015-05-17 20:34 - 2015-05-17 20:34 - 00002140 _____ () C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
2015-05-17 20:34 - 2015-05-17 20:34 - 00000000 ____D () C:\Windows\ELAMBKUP
2015-05-17 20:34 - 2015-05-17 20:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security
2015-05-17 20:34 - 2015-05-17 20:34 - 00000000 ____D () C:\Program Files (x86)\Kaspersky Lab
2015-05-17 20:34 - 2014-10-22 21:13 - 00245960 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klhk.sys
2015-05-17 20:34 - 2013-05-06 08:13 - 00110176 _____ (Kaspersky Lab ZAO) C:\Windows\system32\klfphc.dll
2015-05-17 20:31 - 2015-05-17 20:31 - 00097709 _____ () C:\ProgramData\1431887412.bdinstall.bin
2015-05-17 20:30 - 2015-05-17 20:30 - 00037824 _____ () C:\ProgramData\1431887411.bdinstall.bin
2015-05-15 18:01 - 2015-05-23 21:01 - 00000911 _____ () C:\Windows\Tasks\EPSON WF-7620 Series Update {CCDB001A-670E-49E6-A899-CE6982815934}.job
2015-05-15 18:01 - 2015-05-23 21:01 - 00000725 _____ () C:\Windows\Tasks\EPSON WF-7620 Series Invitation {CCDB001A-670E-49E6-A899-CE6982815934}.job
2015-05-15 18:01 - 2015-05-15 19:01 - 00000000 ____D () C:\ProgramData\EPSON
2015-05-15 18:01 - 2015-05-15 18:01 - 00003978 _____ () C:\Windows\System32\Tasks\EPSON WF-7620 Series Update {CCDB001A-670E-49E6-A899-CE6982815934}
2015-05-15 18:01 - 2015-05-15 18:01 - 00003792 _____ () C:\Windows\System32\Tasks\EPSON WF-7620 Series Invitation {CCDB001A-670E-49E6-A899-CE6982815934}
2015-05-15 18:01 - 2015-05-15 18:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON
2015-05-15 18:01 - 2015-05-15 18:01 - 00000000 ____D () C:\Program Files\Common Files\EPSON
2015-05-15 18:01 - 2013-10-22 04:04 - 00179712 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\E_YLMBKAE.DLL
2015-05-15 18:01 - 2011-03-15 03:03 - 00083968 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\E_YD4BKAE.DLL
2015-05-15 18:01 - 2007-04-10 01:06 - 00010752 _____ (SEIKO EPSON CORP.) C:\Windows\system32\E_GCINST.DLL
2015-05-15 00:47 - 2015-05-15 00:47 - 00000086 _____ () C:\Users\Jannik\Desktop\Golden Goal Videobrille Fotball Video Glasses Football - YouTube.url
2015-05-15 00:23 - 2015-05-15 00:23 - 00000994 _____ () C:\Users\Jannik\Desktop\Neues Textdokument.txt
2015-05-14 19:18 - 2015-05-14 19:24 - 00000000 ____D () C:\Users\Jannik\Documents\Mount&Blade Warband Savegames
2015-05-14 19:17 - 2015-05-14 19:22 - 00000000 ____D () C:\Users\Jannik\Documents\Mount&Blade Warband
2015-05-14 19:17 - 2015-05-14 19:17 - 00000000 ____D () C:\Users\Jannik\AppData\Roaming\Mount&Blade Warband
2015-05-14 18:07 - 2015-05-14 18:07 - 00000050 _____ () C:\Users\Jannik\Desktop\isi - ask.fm-isi_isabel.url
2015-05-14 02:42 - 2015-05-01 15:17 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-14 02:42 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 10:49 - 2015-05-05 03:29 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-13 10:49 - 2015-05-05 03:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-05-13 10:49 - 2015-04-22 04:28 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-13 10:49 - 2015-04-22 03:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-05-13 10:49 - 2015-04-21 19:14 - 24971776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-13 10:49 - 2015-04-21 19:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-05-13 10:49 - 2015-04-21 19:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-05-13 10:49 - 2015-04-21 18:51 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-05-13 10:49 - 2015-04-21 18:50 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-13 10:49 - 2015-04-21 18:50 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-13 10:49 - 2015-04-21 18:50 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-05-13 10:49 - 2015-04-21 18:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-13 10:49 - 2015-04-21 18:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-05-13 10:49 - 2015-04-21 18:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-05-13 10:49 - 2015-04-21 18:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-05-13 10:49 - 2015-04-21 18:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-13 10:49 - 2015-04-21 18:35 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-13 10:49 - 2015-04-21 18:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-05-13 10:49 - 2015-04-21 18:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-05-13 10:49 - 2015-04-21 18:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-05-13 10:49 - 2015-04-21 18:31 - 06025728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-13 10:49 - 2015-04-21 18:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-05-13 10:49 - 2015-04-21 18:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-05-13 10:49 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-05-13 10:49 - 2015-04-21 18:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-05-13 10:49 - 2015-04-21 18:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-05-13 10:49 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-05-13 10:49 - 2015-04-21 18:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-05-13 10:49 - 2015-04-21 18:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-05-13 10:49 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-05-13 10:49 - 2015-04-21 18:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-05-13 10:49 - 2015-04-21 18:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-13 10:49 - 2015-04-21 18:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-05-13 10:49 - 2015-04-21 18:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-13 10:49 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-05-13 10:49 - 2015-04-21 18:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-05-13 10:49 - 2015-04-21 18:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-05-13 10:49 - 2015-04-21 18:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-05-13 10:49 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-05-13 10:49 - 2015-04-21 17:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-05-13 10:49 - 2015-04-21 17:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-05-13 10:49 - 2015-04-21 17:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-13 10:49 - 2015-04-21 17:49 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-13 10:49 - 2015-04-21 17:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-05-13 10:49 - 2015-04-21 17:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-05-13 10:49 - 2015-04-21 17:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-13 10:49 - 2015-04-21 17:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-05-13 10:49 - 2015-04-21 17:40 - 14401536 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-13 10:49 - 2015-04-21 17:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-05-13 10:49 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-05-13 10:49 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-05-13 10:49 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-05-13 10:49 - 2015-04-21 17:27 - 02352128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-13 10:49 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-05-13 10:49 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-05-13 10:49 - 2015-04-21 17:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-05-13 10:49 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-05-13 10:49 - 2015-04-21 17:15 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-13 10:49 - 2015-04-21 17:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-13 10:49 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-05-13 10:49 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-05-13 10:49 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-05-13 10:49 - 2015-04-18 05:10 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-13 10:49 - 2015-04-18 04:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-05-13 10:48 - 2015-04-27 21:28 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-05-13 10:48 - 2015-04-27 21:28 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-05-13 10:48 - 2015-04-27 21:28 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-05-13 10:48 - 2015-04-27 21:26 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 01254400 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-05-13 10:48 - 2015-04-27 21:22 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-05-13 10:48 - 2015-04-27 21:22 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-05-13 10:48 - 2015-04-27 21:22 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-05-13 10:48 - 2015-04-27 21:22 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-05-13 10:48 - 2015-04-27 21:22 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-05-13 10:48 - 2015-04-27 21:22 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-05-13 10:48 - 2015-04-27 21:22 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-05-13 10:48 - 2015-04-27 21:22 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-05-13 10:48 - 2015-04-27 21:22 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-05-13 10:48 - 2015-04-27 21:21 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-05-13 10:48 - 2015-04-27 21:18 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-05-13 10:48 - 2015-04-27 21:18 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:11 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-05-13 10:48 - 2015-04-27 21:11 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-05-13 10:48 - 2015-04-27 21:08 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-05-13 10:48 - 2015-04-27 21:05 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-05-13 10:48 - 2015-04-27 21:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-05-13 10:48 - 2015-04-27 21:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-05-13 10:48 - 2015-04-27 21:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-05-13 10:48 - 2015-04-27 21:05 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2015-05-13 10:48 - 2015-04-27 21:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-05-13 10:48 - 2015-04-27 21:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-05-13 10:48 - 2015-04-27 21:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-05-13 10:48 - 2015-04-27 21:05 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-05-13 10:48 - 2015-04-27 21:04 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-05-13 10:48 - 2015-04-27 21:04 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-05-13 10:48 - 2015-04-27 21:04 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2015-05-13 10:48 - 2015-04-27 21:04 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2015-05-13 10:48 - 2015-04-27 21:04 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe
2015-05-13 10:48 - 2015-04-27 21:04 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2015-05-13 10:48 - 2015-04-27 21:04 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-05-13 10:48 - 2015-04-27 21:04 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-05-13 10:48 - 2015-04-27 21:03 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-05-13 10:48 - 2015-04-27 21:03 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-05-13 10:48 - 2015-04-27 21:03 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-05-13 10:48 - 2015-04-27 21:03 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-05-13 10:48 - 2015-04-27 21:03 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe
2015-05-13 10:48 - 2015-04-27 21:03 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-05-13 10:48 - 2015-04-27 21:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-05-13 10:48 - 2015-04-27 21:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:06 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-05-13 10:48 - 2015-04-27 19:57 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-05-13 10:48 - 2015-04-27 19:57 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-05-13 10:48 - 2015-04-27 19:55 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 19:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-05-13 10:48 - 2015-04-13 05:28 - 00328704 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-13 10:44 - 2015-04-20 05:17 - 01647104 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-13 10:44 - 2015-04-20 05:17 - 01179136 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-13 10:44 - 2015-04-20 04:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-05-13 10:44 - 2015-04-20 04:11 - 03204608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-13 10:44 - 2015-04-08 05:29 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-05-13 10:44 - 2015-04-08 05:29 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-05-13 10:44 - 2015-04-08 05:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-05-13 10:44 - 2015-03-04 06:41 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-05-13 10:44 - 2015-03-04 06:41 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll
2015-05-13 10:44 - 2015-03-04 06:41 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-05-13 10:44 - 2015-03-04 06:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll
2015-05-13 10:44 - 2015-03-04 06:11 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimeng.dll
2015-05-13 10:44 - 2015-03-04 06:10 - 00295936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll
2015-05-13 10:44 - 2015-03-04 06:10 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe
2015-05-13 10:44 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2015-05-13 10:44 - 2015-02-18 09:04 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-05-13 10:44 - 2015-01-29 05:19 - 02543104 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2015-05-13 10:44 - 2015-01-29 05:02 - 02311168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll
2015-05-12 22:10 - 2015-05-13 12:54 - 00000000 ____D () C:\GOG Games
2015-05-12 18:05 - 2015-05-21 17:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com
2015-05-12 18:05 - 2015-05-12 18:12 - 00000000 ____D () C:\Program Files (x86)\GalaxyClient
2015-05-12 18:05 - 2015-05-12 18:05 - 00000000 ____D () C:\ProgramData\GOG.com
2015-05-12 16:15 - 2015-05-14 18:19 - 00000000 ____D () C:\Users\Jannik\AppData\Roaming\NVIDIA
2015-05-12 16:15 - 2015-05-12 16:15 - 01713824 _____ (techPowerUp (www.techpowerup.com)) C:\Users\Jannik\Desktop\GPU-Z.0.8.2.exe
2015-05-12 16:14 - 2015-05-12 16:14 - 00000000 ____D () C:\Users\Jannik\AppData\Local\NVIDIA Corporation
2015-05-12 16:14 - 2015-05-12 16:14 - 00000000 ____D () C:\Users\Jannik\AppData\Local\NVIDIA
2015-05-12 16:13 - 2015-05-18 17:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2015-05-12 16:13 - 2015-05-12 05:30 - 06872392 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2015-05-12 16:13 - 2015-05-12 05:30 - 03490448 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2015-05-12 16:13 - 2015-05-12 05:30 - 02558608 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2015-05-12 16:13 - 2015-05-12 05:30 - 00937288 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2015-05-12 16:13 - 2015-05-12 05:30 - 00385352 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2015-05-12 16:13 - 2015-05-12 05:30 - 00062608 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2015-05-12 16:13 - 2015-05-11 19:01 - 04391871 _____ () C:\Windows\system32\nvcoproc.bin
2015-05-12 16:13 - 2015-05-08 02:35 - 01316184 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2015-05-12 16:13 - 2015-05-08 02:35 - 01316000 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2015-05-12 16:13 - 2015-05-08 02:34 - 01756424 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2015-05-12 16:13 - 2015-05-08 02:34 - 01570672 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2015-05-12 16:12 - 2015-05-18 17:39 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2015-05-12 16:12 - 2015-05-13 08:52 - 01558848 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll
2015-05-12 16:12 - 2015-05-12 16:13 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2015-05-12 16:12 - 2015-05-12 08:27 - 15048816 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2015-05-12 16:12 - 2015-05-12 08:27 - 12849056 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2015-05-12 16:12 - 2015-05-12 08:27 - 03363224 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2015-05-12 16:12 - 2015-05-12 08:27 - 02971776 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2015-05-12 16:12 - 2015-05-12 08:27 - 00112784 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2015-05-12 16:12 - 2015-05-12 08:27 - 00105288 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
2015-05-12 16:12 - 2015-05-12 08:27 - 00031710 _____ () C:\Windows\system32\nvinfo.pb
2015-05-12 16:12 - 2015-04-09 02:58 - 01895568 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6435012.dll
2015-05-12 16:12 - 2015-04-09 02:58 - 01557648 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6435012.dll
2015-05-12 16:12 - 2015-04-09 02:58 - 00038032 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2015-05-12 16:12 - 2015-04-09 02:58 - 00035472 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll
2015-05-12 16:12 - 2015-04-09 02:58 - 00032400 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2015-05-12 15:07 - 2015-05-12 15:08 - 00207872 _____ (Power Admin LLC) C:\Windows\PAExec.exe
2015-05-12 11:01 - 2015-05-21 06:54 - 00000056 _____ () C:\Users\Jannik\Desktop\pr0gramm.com.url
2015-05-12 11:01 - 2015-05-16 19:55 - 00000056 _____ () C:\Users\Jannik\Desktop\gfdgdfgg.url
2015-05-12 11:01 - 2015-05-13 22:59 - 00000056 _____ () C:\Users\Jannik\Desktop\asdasd.url
2015-05-12 11:01 - 2015-05-12 11:01 - 00000056 _____ () C:\Users\Jannik\Desktop\l.url
2015-05-12 10:28 - 2015-05-12 10:28 - 00000000 _____ () C:\Users\Jannik\Desktop\GEp5 22.5 1245.txt
2015-05-12 00:25 - 2015-05-12 00:25 - 03272668 _____ () C:\Users\Jannik\Desktop\VID-20150511-WA0048.mp4
2015-05-11 23:57 - 2015-05-19 01:29 - 00000000 ____D () C:\Users\Jannik\Documents\Witcher 2
2015-05-11 20:44 - 2015-05-11 20:44 - 00000000 ____D () C:\Users\Jannik\AppData\Local\OCCT_-_Ocbase_-_Adrien_Me
2015-05-11 20:43 - 2015-05-12 16:18 - 00000000 ____D () C:\Users\Jannik\Documents\OCCT
2015-05-11 20:39 - 2014-01-24 08:21 - 00000000 ____D () C:\Users\Jannik\Desktop\OCCTPT
2015-05-11 20:38 - 2015-05-11 20:38 - 00000108 _____ () C:\Users\Jannik\Desktop\Overclock3D -- Review -- Gigabyte Z77 Overclocking Guide -- Setup and BIOS.url
2015-05-10 10:54 - 2015-05-10 10:54 - 00000958 _____ () C:\Users\Public\Desktop\CPUID CPU-Z.lnk
2015-05-10 10:54 - 2015-05-10 10:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CPUID
2015-05-10 10:54 - 2015-05-10 10:54 - 00000000 ____D () C:\Program Files (x86)\CPU-Z
2015-05-02 22:10 - 2015-05-02 22:10 - 00000000 ____D () C:\Program Files (x86)\DigitalSimulatorV5.57
2015-05-02 02:07 - 2015-05-02 03:27 - 00000000 ____D () C:\Users\Jannik\Documents\StarCraft II
2015-04-25 12:48 - 2015-04-25 12:48 - 00000000 ____D () C:\Program Files\Microsoft Xbox One Controller for Windows
2015-04-24 21:58 - 2015-04-24 21:58 - 00000000 ____D () C:\Users\Jannik\AppData\Roaming\MK10
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-05-23 21:12 - 2014-12-26 23:21 - 00000000 ____D () C:\Users\Jannik\Desktop\Papierkorb
2015-05-23 21:11 - 2013-08-05 19:17 - 00000000 ____D () C:\Users\Jannik
2015-05-23 21:10 - 2014-08-03 01:00 - 00652883 _____ () C:\Windows\setupact.log
2015-05-23 21:01 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2015-05-23 20:44 - 2013-08-05 19:17 - 01634646 _____ () C:\Windows\WindowsUpdate.log
2015-05-23 20:27 - 2013-08-05 19:33 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-05-23 15:15 - 2009-07-14 06:45 - 00023168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-23 15:15 - 2009-07-14 06:45 - 00023168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-23 13:39 - 2009-07-14 19:58 - 05600070 _____ () C:\Windows\system32\perfh007.dat
2015-05-23 13:39 - 2009-07-14 19:58 - 01672122 _____ () C:\Windows\system32\perfc007.dat
2015-05-23 13:39 - 2009-07-14 07:13 - 00006256 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-23 13:35 - 2013-08-05 20:35 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-05-23 13:34 - 2014-08-05 16:54 - 00000000 ___RD () C:\Users\Jannik\Dropbox
2015-05-23 13:34 - 2014-08-05 16:52 - 00000000 ____D () C:\Users\Jannik\AppData\Roaming\Dropbox
2015-05-23 13:34 - 2013-08-05 19:33 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-05-23 13:33 - 2013-08-05 19:51 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-05-23 13:33 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-22 16:31 - 2015-04-04 20:40 - 00000000 ____D () C:\ProgramData\Tunngle
2015-05-22 16:31 - 2014-07-20 16:04 - 00000000 ____D () C:\Users\Jannik\AppData\Roaming\Tunngle
2015-05-21 17:29 - 2013-08-05 22:01 - 00508890 _____ () C:\Windows\DirectX.log
2015-05-20 21:05 - 2015-04-05 03:00 - 00000000 ___SD () C:\Windows\SysWOW64\GWX
2015-05-20 21:05 - 2015-04-05 03:00 - 00000000 ___SD () C:\Windows\system32\GWX
2015-05-20 01:56 - 2013-08-05 20:28 - 00000000 ____D () C:\Users\Jannik\AppData\Roaming\Skype
2015-05-19 00:44 - 2013-10-16 21:04 - 00000000 ____D () C:\Users\Jannik\AppData\Local\Battle.net
2015-05-18 17:39 - 2013-08-08 20:56 - 00000000 ____D () C:\Temp
2015-05-18 17:38 - 2013-08-05 19:50 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2015-05-17 20:54 - 2015-03-30 17:41 - 00002247 _____ () C:\Users\Jannik\Desktop\Google Chrome.lnk
2015-05-17 20:39 - 2014-08-19 12:31 - 00056008 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kldisk.sys
2015-05-17 20:18 - 2013-08-28 20:38 - 00000000 ____D () C:\Users\Jannik\AppData\Roaming\vlc
2015-05-16 13:22 - 2013-08-05 19:33 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-05-16 13:22 - 2013-08-05 19:33 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-05-15 21:36 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2015-05-15 17:57 - 2013-08-05 19:38 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-05-14 12:37 - 2013-10-16 21:04 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2015-05-14 11:51 - 2009-07-14 20:18 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-14 11:51 - 2009-07-14 06:45 - 00495624 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-05-14 11:51 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\AdvancedInstallers
2015-05-14 02:45 - 2013-08-15 22:27 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-14 02:43 - 2013-08-05 23:04 - 140425016 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-05-13 12:55 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-05-12 16:13 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Help
2015-05-11 20:24 - 2013-08-05 22:09 - 00000000 ___HD () C:\Windows\msdownld.tmp
2015-05-11 20:24 - 2013-08-05 22:09 - 00000000 ____D () C:\Windows\SysWOW64\directx
2015-05-09 12:26 - 2014-08-05 16:53 - 00000000 ____D () C:\Users\Jannik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-05-02 15:12 - 2013-08-05 20:28 - 00000000 ____D () C:\ProgramData\Skype
2015-05-02 12:26 - 2013-08-05 19:46 - 00198760 _____ () C:\Windows\PFRO.log
2015-05-02 02:07 - 2015-04-02 19:16 - 00000000 ____D () C:\Program Files (x86)\Pidgin
==================== Files in the root of some directories =======
2013-11-10 21:43 - 2014-01-18 20:48 - 0045270 _____ () C:\Users\Jannik\AppData\Roaming\room_v3.dat
2014-08-25 18:19 - 2014-08-25 18:29 - 0001407 _____ () C:\Users\Jannik\AppData\Roaming\SpeedRunnersLog.txt
2014-02-26 19:08 - 2014-02-26 19:08 - 0000044 _____ () C:\Users\Jannik\AppData\Roaming\WB.CFG
2008-02-05 14:28 - 2008-02-05 14:28 - 0000051 _____ () C:\Users\Jannik\AppData\Local\setup.txt
2014-09-27 09:05 - 2014-09-27 09:05 - 0170896 _____ () C:\ProgramData\1411801518.bdinstall.bin
2015-05-17 20:30 - 2015-05-17 20:30 - 0037824 _____ () C:\ProgramData\1431887411.bdinstall.bin
2015-05-17 20:31 - 2015-05-17 20:31 - 0097709 _____ () C:\ProgramData\1431887412.bdinstall.bin
Some files in TEMP:
====================
C:\Users\Jannik\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpqmtvai.dll
C:\Users\Jannik\AppData\Local\Temp\FoxitUpdater.exe
C:\Users\Jannik\AppData\Local\Temp\Nv3DVisionIePlugin.dll
C:\Users\Jannik\AppData\Local\Temp\Nv3DVStreaming.dll
C:\Users\Jannik\AppData\Local\Temp\Nv3DVStreaming64.dll
C:\Users\Jannik\AppData\Local\Temp\Nv3DVStreamingIePlugin.dll
C:\Users\Jannik\AppData\Local\Temp\Nv3DVStreamingIePlugin64.dll
C:\Users\Jannik\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\Jannik\AppData\Local\Temp\nvSCPAPI64.dll
C:\Users\Jannik\AppData\Local\Temp\nvStInst.exe
C:\Users\Jannik\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Jannik\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\Jannik\AppData\Local\Temp\tmp3E4D.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-05-15 21:29
==================== End of log ============================
|
|
23.05.2015, 20:34
| #2 |
| | Back to Desktop + ladender Mauszeiger Addition.txt:
__________________Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-05-2015 01
Ran by Jannik at 2015-05-23 21:12:51
Running from C:\Users\Jannik\Desktop
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-4043579312-2739093779-986575188-500 - Administrator - Disabled)
Gast (S-1-5-21-4043579312-2739093779-986575188-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-4043579312-2739093779-986575188-1002 - Limited - Enabled)
Jannik (S-1-5-21-4043579312-2739093779-986575188-1000 - Administrator - Enabled) => C:\Users\Jannik
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.189 - Adobe Systems Incorporated)
Akamai NetSession Interface (HKU\S-1-5-21-4043579312-2739093779-986575188-1000\...\Akamai) (Version: - Akamai Technologies, Inc)
Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
BlueJ (HKLM-x32\...\{7D66971C-652B-4065-A6B1-B3EE313C254B}) (Version: 3.1.1 - BlueJ Team)
CPUID CPU-Z 1.72 (HKLM\...\CPUID CPU-Z_is1) (Version: - )
DigitalSimulatorV5.57 (remove only) (HKLM-x32\...\DigitalSimulatorV5.57) (Version: - )
Dropbox (HKU\S-1-5-21-4043579312-2739093779-986575188-1000\...\Dropbox) (Version: 3.4.6 - Dropbox, Inc.)
Druckerdeinstallation für EPSON WF-7620 Series (HKLM\...\EPSON WF-7620 Series) (Version: - SEIKO EPSON Corporation)
f.lux (HKU\S-1-5-21-4043579312-2739093779-986575188-1000\...\Flux) (Version: - )
GOG Galaxy (HKLM-x32\...\{7258BA11-600C-430E-A759-27E2C691A335}_is1) (Version: - GOG.com)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 43.0.2357.65 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
Gyazo 1.2 (HKLM-x32\...\{6DB8C365-E719-4BA5-9594-10DFC244D3FD}_is1) (Version: - Nota Inc. & Toshiyuki Masui)
Hex-Editor MX (HKLM-x32\...\{7FC7AD70-1DF3-4B84-9AA2-4FB680F45572}_is1) (Version: 6.0 - NEXT-Soft)
Intel(R) Network Connections 17.2.154.0 (HKLM\...\PROSetDX) (Version: 17.2.154.0 - Intel)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.4.225 - Intel Corporation)
Intel® Chipsatz-Gerätesoftware (x32 Version: 10.0.13 - Intel(R) Corporation) Hidden
IsoBuster 3.3 (HKLM-x32\...\IsoBuster3_is1) (Version: 3.3 - Smart Projects)
Java 8 Update 25 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418025F0}) (Version: 8.0.250 - Oracle Corporation)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
Java SE Development Kit 8 Update 25 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0180250}) (Version: 8.0.250.18 - Oracle Corporation)
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{02FECEE0-16B2-43DB-BC3B-C844477FC142}) (Version: 15.0.2.361 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 15.0.2.361 - Kaspersky Lab) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUSR) (Version: 15.0.4420.1017 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4048 (HKLM\...\{91415F19-4C22-3609-A105-92ED3522D83C}) (Version: 9.0.30729.4048 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4048 (HKLM-x32\...\{5B1F2843-B379-3FF2-B0D3-64DD143ED53A}) (Version: 9.0.30729.4048 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Xbox One Controller for Windows (HKLM\...\{DC2CB48C-FD96-48EB-A36A-7D995BB587EB}) (Version: 1.0.2 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 Refresh (HKLM-x32\...\{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}) (Version: 4.0.30901.0 - Microsoft Corporation)
Mozilla Firefox 33.0.2 (x86 de) (HKLM-x32\...\Mozilla Firefox 33.0.2 (x86 de)) (Version: 33.0.2 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
NVIDIA 3D Vision Controller-Treiber 352.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 352.65 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 352.86 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 352.86 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.4.3.31 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.4.3.31 - NVIDIA Corporation)
NVIDIA Grafiktreiber 352.86 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 352.86 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.34.3 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.34.3 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.15.0428 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.15.0428 - NVIDIA Corporation)
Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Paint.NET v3.5.11 (HKLM\...\{72EF03F5-0507-4861-9A44-D99FD4C41418}) (Version: 3.61.0 - dotPDN LLC)
Pokémon Trading Card Game Online (HKLM-x32\...\{496D7B7E-EBDC-4E2B-B021-4FF03B188B69}) (Version: 1.0.0 - The Pokémon Company International)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.992 - Even Balance, Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6662 - Realtek Semiconductor Corp.)
ScreenManager Pro for LCD (DDC/CI) (HKLM-x32\...\{DAB265AD-27B2-4651-B8D8-F4F3A8ECC705}) (Version: 2.4.0 - EIZO Corporation)
SHIELD Streaming (Version: 4.1.1000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 2.4.3.31 - NVIDIA Corporation) Hidden
Sid Meier's Civilization V (HKLM-x32\...\Steam App 8930) (Version: - Firaxis Games)
Skype™ 7.4 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.4.102 - Skype Technologies S.A.)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.11 - TeamSpeak Systems GmbH)
The Witcher 3 - Wild Hunt (HKLM-x32\...\1207664643_is1) (Version: 1.0.3.0 - GOG.com)
Tibia (HKLM-x32\...\Tibia_is1) (Version: 10.76 - CipSoft GmbH)
TP-LINK TL-WDN4800 Driver (HKLM-x32\...\{FDA7E907-6539-42C1-9721-0239C281B336}) (Version: 1.3.1 - TP-LINK)
Tunngle (HKLM-x32\...\Tunngle_is1) (Version: 5.2 - Tunngle.net GmbH)
VLC media player 2.0.7 (HKLM\...\VLC media player) (Version: 2.0.7 - VideoLAN)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-4043579312-2739093779-986575188-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4043579312-2739093779-986575188-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Jannik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4043579312-2739093779-986575188-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jannik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4043579312-2739093779-986575188-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jannik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4043579312-2739093779-986575188-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jannik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4043579312-2739093779-986575188-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jannik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4043579312-2739093779-986575188-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jannik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4043579312-2739093779-986575188-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jannik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4043579312-2739093779-986575188-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jannik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4043579312-2739093779-986575188-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jannik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
==================== Restore Points =========================
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {26CF4213-B0C7-4D96-B4FA-8848318BFBAF} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-08-05] (Google Inc.)
Task: {277F79DB-B22E-47F0-91BF-80A838500D50} - System32\Tasks\MSIAfterburner => C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe
Task: {2911ACC6-1A5C-48F8-9DD6-64DB9665C26C} - System32\Tasks\EPSON WF-7620 Series Update {CCDB001A-670E-49E6-A899-CE6982815934} => C:\Windows\system32\spool\DRIVERS\x64\3\E_YTSKAE.EXE [2013-02-28] (SEIKO EPSON CORPORATION)
Task: {69681046-EAD0-4426-8428-A92C0799835E} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-07] (Microsoft Corporation)
Task: {6DAC7799-5B2D-4365-A885-240881D9CE01} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation)
Task: {891E5229-1264-42FE-86DE-BBF4118CB9D8} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2012-10-01] (Microsoft Corporation)
Task: {B82EC97B-5A11-4774-9C07-648AC72C3A13} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation)
Task: {D9A6E785-85A9-4810-A2A9-3049EBD49839} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)
Task: {DEC92C4A-A29D-4D16-AA6A-4C4D886A817F} - System32\Tasks\EPSON WF-7620 Series Invitation {CCDB001A-670E-49E6-A899-CE6982815934} => C:\Windows\system32\spool\DRIVERS\x64\3\E_YTSKAE.EXE [2013-02-28] (SEIKO EPSON CORPORATION)
Task: {FE848A78-6E7B-4087-87A1-7D64B73A4049} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-08-05] (Google Inc.)
Task: C:\Windows\Tasks\EPSON WF-7620 Series Invitation {CCDB001A-670E-49E6-A899-CE6982815934}.job => C:\Windows\system32\spool\DRIVERS\x64\3\E_YTSKAE.EXE
Task: C:\Windows\Tasks\EPSON WF-7620 Series Update {CCDB001A-670E-49E6-A899-CE6982815934}.job => C:\Windows\system32\spool\DRIVERS\x64\3\E_YTSKAE.EXE:/EXE:{CCDB001A-670E-49E6-A899-CE6982815934} /F:UpdateSYSTEM
Searches for EPSON software updates, and notifies you when updates are available.If this task is disabled or stopped, your EPSON software will not be automatically kept up to date.Thi
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (Whitelisted) ==============
2015-05-12 16:13 - 2015-05-12 05:30 - 00116368 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2013-09-30 18:51 - 2013-09-30 19:03 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2015-05-12 16:13 - 2015-05-08 02:36 - 00011920 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll
2015-05-23 13:34 - 2015-05-23 13:34 - 00043008 _____ () c:\users\jannik\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpqmtvai.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00750080 _____ () C:\Users\Jannik\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00047616 _____ () C:\Users\Jannik\AppData\Roaming\Dropbox\bin\libEGL.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00865280 _____ () C:\Users\Jannik\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00200704 _____ () C:\Users\Jannik\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
2015-05-21 07:28 - 2015-05-13 18:48 - 01281864 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.65\libglesv2.dll
2015-05-21 07:28 - 2015-05-13 18:48 - 00080712 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.65\libegl.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\Users\Jannik\Desktop\GPU-Z.0.8.2.exe:BDU
==================== Safe Mode (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-4043579312-2739093779-986575188-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Jannik\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.6.1
==================== MSCONFIG/TASK MANAGER Error getting ==
(Currently there is no automatic fix for this section.)
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [{30D02F7C-72CD-4D58-99D6-74602393CC73}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{9BF77738-90CA-4E29-9836-B1AAE25F41E0}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{92CAA2A5-758F-4952-8655-FDB833EA0524}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{28954C98-1E54-4285-93C4-4F2331765CD7}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{61D707CA-9BE6-438C-A055-C44B35BDEF92}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{35DA7867-5B9A-40A8-A72F-68A1D202911E}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{351F400E-7B9E-41F3-9FB1-D078C31ED9E5}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{75C0178B-4444-42AF-8F74-94ADBBAC0D3B}] => (Allow) C:\Program Files (x86)\Garena Plus\ggdllhost.exe
FirewallRules: [{526DE124-C4BE-4862-ADB6-C1F8C2E27204}] => (Allow) C:\Program Files (x86)\Garena Plus\Room\garena_room.exe
FirewallRules: [{0259A236-69E2-4241-93C1-733BB92E09FB}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2380\Agent.exe
FirewallRules: [{12379D6A-2AD0-4BA2-8AB0-6B641153F8C3}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2380\Agent.exe
FirewallRules: [TCP Query User{5CDE45AD-39C1-4B03-941B-97DBB73C5245}C:\program files (x86)\hearthstone\hearthstone.exe] => (Allow) C:\program files (x86)\hearthstone\hearthstone.exe
FirewallRules: [UDP Query User{80F6756C-70DD-4419-916E-4E6C1C011970}C:\program files (x86)\hearthstone\hearthstone.exe] => (Allow) C:\program files (x86)\hearthstone\hearthstone.exe
FirewallRules: [{2D7624A1-E0D9-48BA-9057-DD06D6D43303}] => (Allow) C:\Program Files (x86)\Diablo III\Diablo III.exe
FirewallRules: [{CA301678-831F-4DE0-BA16-7C62DD0B8B8A}] => (Allow) C:\Program Files (x86)\Diablo III\Diablo III.exe
FirewallRules: [{F0352C91-4B2A-4287-AE20-912267E361A5}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2391\Agent.exe
FirewallRules: [{92D42491-7D88-40A2-9224-E943BDFA3969}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2391\Agent.exe
FirewallRules: [{346EF31F-58BD-4371-9F1C-0359F71DB575}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2417\Agent.exe
FirewallRules: [{3E99130B-A34A-4394-ABBE-B4240DEEB96A}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2417\Agent.exe
FirewallRules: [{3A86EAF6-CF86-47F7-9B3E-E26DE927BEB8}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2426\Agent.exe
FirewallRules: [{56048861-51AC-4B29-9C64-681B81866CC4}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2426\Agent.exe
FirewallRules: [{EE8EE328-DE2C-4D8B-8162-4EE844750814}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2514\Agent.exe
FirewallRules: [{D0CC9F00-33BA-4E89-BBCD-A8D78D8571BA}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2514\Agent.exe
FirewallRules: [TCP Query User{F5D8BF55-E102-42FA-8D7F-4E49FA125716}C:\program files (x86)\steam\steamapps\common\crusader kings ii\ck2.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\crusader kings ii\ck2.exe
FirewallRules: [UDP Query User{3CAAE14B-A390-4C2E-B687-1C6E707549E2}C:\program files (x86)\steam\steamapps\common\crusader kings ii\ck2.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\crusader kings ii\ck2.exe
FirewallRules: [TCP Query User{9D1C2A57-5B88-436D-ABD3-1A47E7C11186}C:\users\jannik\desktop\sumgames\warcraft iii\war3.exe] => (Allow) C:\users\jannik\desktop\sumgames\warcraft iii\war3.exe
FirewallRules: [UDP Query User{847E8982-839C-48DD-85FD-0E4DED0982A3}C:\users\jannik\desktop\sumgames\warcraft iii\war3.exe] => (Allow) C:\users\jannik\desktop\sumgames\warcraft iii\war3.exe
FirewallRules: [TCP Query User{44D9A510-89ED-499E-9A05-9219A103E0E3}C:\users\jannik\desktop\call of duty 4 - moder warfare (tausch)\call of duty 4 - modern warfare\iw3mp.exe] => (Allow) C:\users\jannik\desktop\call of duty 4 - moder warfare (tausch)\call of duty 4 - modern warfare\iw3mp.exe
FirewallRules: [UDP Query User{D5D18A8B-7572-4517-BFE0-D6FC57405391}C:\users\jannik\desktop\call of duty 4 - moder warfare (tausch)\call of duty 4 - modern warfare\iw3mp.exe] => (Allow) C:\users\jannik\desktop\call of duty 4 - moder warfare (tausch)\call of duty 4 - modern warfare\iw3mp.exe
FirewallRules: [TCP Query User{0375DDF0-2B9A-4E0F-976D-60B0408A3862}C:\program files (x86)\steam\steamapps\common\medieval ii total war\kingdoms.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\medieval ii total war\kingdoms.exe
FirewallRules: [UDP Query User{0873D78C-51CA-4982-B33A-39BF6F2EDC21}C:\program files (x86)\steam\steamapps\common\medieval ii total war\kingdoms.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\medieval ii total war\kingdoms.exe
FirewallRules: [TCP Query User{20B76AAB-D250-459C-B1FF-DD07A3E35334}C:\program files\java\jdk1.7.0_45\bin\javaw.exe] => (Allow) C:\program files\java\jdk1.7.0_45\bin\javaw.exe
FirewallRules: [UDP Query User{4ED9822A-2A19-4483-BAFE-253AA82913B7}C:\program files\java\jdk1.7.0_45\bin\javaw.exe] => (Allow) C:\program files\java\jdk1.7.0_45\bin\javaw.exe
FirewallRules: [TCP Query User{9B775881-CD24-4112-9FE7-C6B40C8E5F2C}C:\program files\java\jdk1.7.0_45\jre\bin\java.exe] => (Allow) C:\program files\java\jdk1.7.0_45\jre\bin\java.exe
FirewallRules: [UDP Query User{27F7D9A2-833C-40A7-A4E2-84E2F22FBEE1}C:\program files\java\jdk1.7.0_45\jre\bin\java.exe] => (Allow) C:\program files\java\jdk1.7.0_45\jre\bin\java.exe
FirewallRules: [{C95208D6-7747-479B-94F7-54C91D8A5AA6}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2581\Agent.exe
FirewallRules: [{65BAAE58-C727-4B4C-856F-05BBB734B2B6}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2581\Agent.exe
FirewallRules: [{24FD674E-FEB3-4924-847A-AC56FA0FBD91}] => (Allow) C:\Program Files (x86)\StarCraft II\StarCraft II.exe
FirewallRules: [{593F5592-9B45-40B8-A0F8-C425E078A93F}] => (Allow) C:\Program Files (x86)\StarCraft II\StarCraft II.exe
FirewallRules: [{1390DFBB-1822-4BA9-8AE3-DD08CFE369ED}] => (Allow) C:\Program Files (x86)\StarCraft II\StarCraft II Public Test.exe
FirewallRules: [{9F2D6974-5CB8-4949-A741-1035FF4670E3}] => (Allow) C:\Program Files (x86)\StarCraft II\StarCraft II Public Test.exe
FirewallRules: [TCP Query User{99634732-B760-439A-A316-45759CF63544}C:\program files (x86)\starcraft ii\versions\base28667\sc2.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base28667\sc2.exe
FirewallRules: [UDP Query User{C1784830-AA4F-41A0-9BC0-5CA5430E0868}C:\program files (x86)\starcraft ii\versions\base28667\sc2.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base28667\sc2.exe
FirewallRules: [{530829BB-28CF-4D82-8FAB-AF7F3E8B613D}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2680\Agent.exe
FirewallRules: [{5D6A11C1-19E8-4DCB-956D-6F5A731AF572}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2680\Agent.exe
FirewallRules: [{6A2C12D0-0313-4F7D-8E1D-E4FC1C9D5A5E}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{D50CC1BC-FA1D-4787-AE14-B5BEB034D8E8}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{E26C1FC7-7E30-4054-AABB-41B1E9345BAB}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{1FB1B81C-0BBD-4DC2-9AFB-4695CE49DA5E}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{17A9CD60-989C-48FB-92C9-9A8336B156E0}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2689\Agent.exe
FirewallRules: [{4FC8E182-A263-4A9D-84A5-8F6D25B0F493}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2689\Agent.exe
FirewallRules: [TCP Query User{F9EA0945-6711-4958-882B-80C16AD4365C}C:\users\jannik\appdata\local\akamai\netsession_win.exe] => (Block) C:\users\jannik\appdata\local\akamai\netsession_win.exe
FirewallRules: [UDP Query User{530EB872-B7CF-4302-BE07-95760F0B12B4}C:\users\jannik\appdata\local\akamai\netsession_win.exe] => (Block) C:\users\jannik\appdata\local\akamai\netsession_win.exe
FirewallRules: [{9F7BF35A-EF6F-48DF-8B2E-16B4C183615D}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3023\Agent.exe
FirewallRules: [{D7308A75-9F58-4F56-8C62-971F0714659D}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3023\Agent.exe
FirewallRules: [{FD6A409F-FB36-4721-B0FC-7EB509C536BF}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Total War Rome II\launcher\launcher.exe
FirewallRules: [{6B07D6A6-3791-4FBD-B73D-7F2C1560FA51}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Total War Rome II\launcher\launcher.exe
FirewallRules: [{97B56603-5544-4A48-8E7E-A0F6139F63B5}] => (Allow) C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{C856F146-544F-48AA-B249-B827D3288481}] => (Allow) C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{D959B845-1F38-4EE3-9C7E-90F697BC401A}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3182\Agent.exe
FirewallRules: [{352FD50A-D2E2-4B47-A192-7FA32E12B460}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3182\Agent.exe
FirewallRules: [TCP Query User{811878B7-98E5-4AF7-B4F2-0048849D255B}C:\users\jannik\desktop\warcraft iii\war3.exe] => (Allow) C:\users\jannik\desktop\warcraft iii\war3.exe
FirewallRules: [UDP Query User{19A9C13B-AC5B-42FB-AB29-30D9F78E2A26}C:\users\jannik\desktop\warcraft iii\war3.exe] => (Allow) C:\users\jannik\desktop\warcraft iii\war3.exe
FirewallRules: [{D742AFFD-E8FD-47D1-AF08-6A6A32461F7A}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3235\Agent.exe
FirewallRules: [{CF0070BA-3A95-408F-A56C-D19CEF014F47}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3235\Agent.exe
FirewallRules: [{4D1FC643-640B-4003-AA7E-D66A00C96F28}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Risen 3\system\Risen3.exe
FirewallRules: [{8B93DAA0-3269-4214-BE47-15B2C013D75E}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Risen 3\system\Risen3.exe
FirewallRules: [{63CF7E70-DE89-4C65-AA16-02D1C4259497}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{051388E1-A8DD-4CC9-9139-DB933659A3C5}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [TCP Query User{696CE46C-99AB-47FE-B7AA-3AF5628E2B1C}C:\users\jannik\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\jannik\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{FE7389A1-E4DE-4259-84CF-6F1BA0F2A7EE}C:\users\jannik\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\jannik\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{039794A4-BDAB-4157-B4BB-6FA939068E4C}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3286\Agent.exe
FirewallRules: [{3812F235-48BF-473B-A13C-7077E831910E}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3286\Agent.exe
FirewallRules: [TCP Query User{DE237B8D-68CE-48E1-BAB3-8C7BD3613F3B}C:\users\jannik\desktop\retroshare\retroshare.exe] => (Allow) C:\users\jannik\desktop\retroshare\retroshare.exe
FirewallRules: [UDP Query User{EB2CCB8D-9CE9-4226-8D77-52A95E0FF25A}C:\users\jannik\desktop\retroshare\retroshare.exe] => (Allow) C:\users\jannik\desktop\retroshare\retroshare.exe
FirewallRules: [TCP Query User{3AE129BA-0D1A-47D2-BA8D-9DE11E546D71}C:\program files (x86)\steam\steamapps\common\war thunder\aces.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\war thunder\aces.exe
FirewallRules: [UDP Query User{B1955574-C52E-416E-AE4D-C509C5B24CDC}C:\program files (x86)\steam\steamapps\common\war thunder\aces.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\war thunder\aces.exe
FirewallRules: [{B014D17A-060B-42AB-8C66-567BF984AD3E}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3322\Agent.exe
FirewallRules: [{9BD35473-65E6-442B-AAA4-32CCB077AAAD}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3322\Agent.exe
FirewallRules: [{18D67C4A-19DC-446F-872C-953D55DCA69A}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3323\Agent.exe
FirewallRules: [{52487619-FA96-4B36-A19C-694A5795101D}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3323\Agent.exe
FirewallRules: [TCP Query User{040155F1-AE02-4523-866A-287A69948BC7}C:\programdata\battle.net\agent\agent.3332\agent.exe] => (Block) C:\programdata\battle.net\agent\agent.3332\agent.exe
FirewallRules: [UDP Query User{F9B360C5-3153-4E00-910C-BB87606DB2E0}C:\programdata\battle.net\agent\agent.3332\agent.exe] => (Block) C:\programdata\battle.net\agent\agent.3332\agent.exe
FirewallRules: [{B27B177D-3D60-44A4-8B29-F7B226F3AB44}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3334\Agent.exe
FirewallRules: [{8AABDB2E-3F36-40C6-92FB-00CD47A87AFF}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3334\Agent.exe
FirewallRules: [{A21895EC-3BF5-42C1-B7BC-E9CF70DBE4B1}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3346\Agent.exe
FirewallRules: [{5FB7D7DB-9D71-4550-8097-791653A10D97}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3346\Agent.exe
FirewallRules: [TCP Query User{75D96F8E-B7A3-40FA-A77E-53A761DEBD47}C:\programdata\battle.net\agent\agent.3372\agent.exe] => (Allow) C:\programdata\battle.net\agent\agent.3372\agent.exe
FirewallRules: [UDP Query User{F333FA29-2942-4650-8A7C-1B11B9867A6D}C:\programdata\battle.net\agent\agent.3372\agent.exe] => (Allow) C:\programdata\battle.net\agent\agent.3372\agent.exe
FirewallRules: [{CDE9442A-9A13-4D2F-AE90-AE92F07BB1DA}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3427\Agent.exe
FirewallRules: [{550C6459-1EC6-47BC-9916-012FBDBE7170}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3427\Agent.exe
FirewallRules: [{E69195A5-9E9C-4FBB-83A2-1CC69537487D}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3454\Agent.exe
FirewallRules: [{AE2EFD52-1BE0-4928-9F09-AE4F98A04BDC}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3454\Agent.exe
FirewallRules: [{1224C385-090D-433E-8753-7B7D79A6FD5F}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3478\Agent.exe
FirewallRules: [{CC398CD5-F54C-4AF7-9940-80B46346E2DB}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3478\Agent.exe
FirewallRules: [TCP Query User{CF2DCBD6-07C3-4BF9-B34A-AACB636F651E}C:\programdata\battle.net\agent\agent.3507\agent.exe] => (Allow) C:\programdata\battle.net\agent\agent.3507\agent.exe
FirewallRules: [UDP Query User{9F35EBD6-48FC-4298-A0B7-0F266D08580E}C:\programdata\battle.net\agent\agent.3507\agent.exe] => (Allow) C:\programdata\battle.net\agent\agent.3507\agent.exe
FirewallRules: [TCP Query User{3F9C519C-917D-4B55-8CFC-1719485953EC}C:\users\jannik\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\jannik\appdata\local\akamai\netsession_win.exe
FirewallRules: [UDP Query User{825DF382-0145-49BB-91A2-5CBD3F6AEE9B}C:\users\jannik\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\jannik\appdata\local\akamai\netsession_win.exe
FirewallRules: [{CDBABCF5-3810-4F8B-A4EC-3D258836D23C}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3526\Agent.exe
FirewallRules: [{5FEA1D45-C116-46DD-8C4F-11F1DA37293D}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3526\Agent.exe
FirewallRules: [TCP Query User{F3E8BF83-66A1-436D-95B1-1C844A0A8075}C:\program files\java\jdk1.8.0_25\bin\jmc.exe] => (Allow) C:\program files\java\jdk1.8.0_25\bin\jmc.exe
FirewallRules: [UDP Query User{5E68E40A-D375-4078-AE53-B2472B22C167}C:\program files\java\jdk1.8.0_25\bin\jmc.exe] => (Allow) C:\program files\java\jdk1.8.0_25\bin\jmc.exe
FirewallRules: [{57BE7777-909B-49A3-813A-6EAD8E357D19}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3634\Agent.exe
FirewallRules: [{1B884CF8-9229-4DD1-A68C-2962C838DCB0}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3634\Agent.exe
FirewallRules: [{479A5314-36E8-4F84-A04E-F2192C21C807}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Don't Starve Together Beta\bin\dontstarve_steam.exe
FirewallRules: [{34C2F363-F116-448D-989E-807C072E7BA4}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Don't Starve Together Beta\bin\dontstarve_steam.exe
FirewallRules: [TCP Query User{2C23000C-0FF8-4DB9-AA36-73A684EA8E66}E:\call of duty 4 - moder warfare (tausch)\call of duty 4 - modern warfare\iw3mp.exe] => (Allow) E:\call of duty 4 - moder warfare (tausch)\call of duty 4 - modern warfare\iw3mp.exe
FirewallRules: [UDP Query User{B92A9E50-E2F4-47F5-90AE-0878EE30A078}E:\call of duty 4 - moder warfare (tausch)\call of duty 4 - modern warfare\iw3mp.exe] => (Allow) E:\call of duty 4 - moder warfare (tausch)\call of duty 4 - modern warfare\iw3mp.exe
FirewallRules: [TCP Query User{6C08079F-1A58-4E59-BCCA-D733B12E5F2B}C:\users\jannik\desktop\papierkorb\desktop\call of duty 4 - moder warfare (tausch)\call of duty 4 - modern warfare\iw3mp.exe] => (Allow) C:\users\jannik\desktop\papierkorb\desktop\call of duty 4 - moder warfare (tausch)\call of duty 4 - modern warfare\iw3mp.exe
FirewallRules: [UDP Query User{0AEEF2EF-09AC-4CE1-B22C-C50EC9AFD607}C:\users\jannik\desktop\papierkorb\desktop\call of duty 4 - moder warfare (tausch)\call of duty 4 - modern warfare\iw3mp.exe] => (Allow) C:\users\jannik\desktop\papierkorb\desktop\call of duty 4 - moder warfare (tausch)\call of duty 4 - modern warfare\iw3mp.exe
FirewallRules: [{15B866BA-866A-45DE-9EF0-2DE7EDE95DF4}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3669\Agent.exe
FirewallRules: [{577FC633-FBCF-47BD-870C-81CF45AB295F}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3669\Agent.exe
FirewallRules: [{71771A92-44C3-4602-9CE7-95217EF4B69E}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3688\Agent.exe
FirewallRules: [{9013473E-CCC2-4860-9CFA-620F37B796AD}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3688\Agent.exe
FirewallRules: [{9F9C58A4-2D90-4C69-8CFE-BDA7C2558922}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3689\Agent.exe
FirewallRules: [{AB8D099D-B5AE-4074-A1F4-03CA48F84A5D}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3689\Agent.exe
FirewallRules: [{BC8B9342-F477-44F0-BA2A-FF0FF28231E7}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3715\Agent.exe
FirewallRules: [{F72BE471-51C8-4A76-B910-91A6B4CA97DD}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3715\Agent.exe
FirewallRules: [TCP Query User{ECE407D3-3684-45C0-A471-3A5F64191068}C:\program files (x86)\myphoneexplorer\myphoneexplorer.exe] => (Allow) C:\program files (x86)\myphoneexplorer\myphoneexplorer.exe
FirewallRules: [UDP Query User{3068B0A0-0A3A-4D87-B5FD-2DF9D0B76F4B}C:\program files (x86)\myphoneexplorer\myphoneexplorer.exe] => (Allow) C:\program files (x86)\myphoneexplorer\myphoneexplorer.exe
FirewallRules: [TCP Query User{7DAE47E9-ADA7-4A4F-A332-8AC8C3B6F550}C:\program files (x86)\heroes of the storm\versions\base34190\heroesofthestorm_x64.exe] => (Allow) C:\program files (x86)\heroes of the storm\versions\base34190\heroesofthestorm_x64.exe
FirewallRules: [UDP Query User{D5B36EAD-5EAE-421A-BE38-7D1621E57F8E}C:\program files (x86)\heroes of the storm\versions\base34190\heroesofthestorm_x64.exe] => (Allow) C:\program files (x86)\heroes of the storm\versions\base34190\heroesofthestorm_x64.exe
FirewallRules: [{D12C260B-2779-4123-A8C0-A35528E1AF8F}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\ShadowOfMordor\x64\ShadowOfMordor.exe
FirewallRules: [{531EC746-8636-4E4A-94F3-77A1591624FD}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\ShadowOfMordor\x64\ShadowOfMordor.exe
FirewallRules: [{9B0073F4-1B7E-40DF-BDF5-DE90E3CC2FDE}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Divinity - Original Sin\Shipping\EoCApp.exe
FirewallRules: [{047E9E12-B1FC-4E58-AB77-6E48FEA8CAAF}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Divinity - Original Sin\Shipping\EoCApp.exe
FirewallRules: [TCP Query User{C5AB1F96-14B4-409C-A0DC-79222A8E7796}C:\program files (x86)\heroes of the storm\versions\base34659\heroesofthestorm_x64.exe] => (Allow) C:\program files (x86)\heroes of the storm\versions\base34659\heroesofthestorm_x64.exe
FirewallRules: [UDP Query User{C4BA9DAE-FD5C-4DE0-BB11-E3AC8EC5D9F2}C:\program files (x86)\heroes of the storm\versions\base34659\heroesofthestorm_x64.exe] => (Allow) C:\program files (x86)\heroes of the storm\versions\base34659\heroesofthestorm_x64.exe
FirewallRules: [TCP Query User{BAC9939A-5D7E-40FC-AAB1-84E3BA268EEE}C:\program files\starcitizen\citizenclient\bin64\starcitizen.exe] => (Allow) C:\program files\starcitizen\citizenclient\bin64\starcitizen.exe
FirewallRules: [UDP Query User{FF85A0B7-0D16-4122-A245-8BE4CA43FB07}C:\program files\starcitizen\citizenclient\bin64\starcitizen.exe] => (Allow) C:\program files\starcitizen\citizenclient\bin64\starcitizen.exe
FirewallRules: [TCP Query User{A3FD71C2-D49A-47AB-84E8-43BA7BD999C0}C:\program files (x86)\ccp\eve\bin\exefile.exe] => (Allow) C:\program files (x86)\ccp\eve\bin\exefile.exe
FirewallRules: [UDP Query User{698C8148-D3F0-4989-8710-054E61C1EE35}C:\program files (x86)\ccp\eve\bin\exefile.exe] => (Allow) C:\program files (x86)\ccp\eve\bin\exefile.exe
FirewallRules: [{942B3847-825B-48C0-A99F-DDB13081FBF9}] => (Allow) C:\Program Files (x86)\Tunngle\TnglCtrl.exe
FirewallRules: [{2B5A38E5-0B52-42A3-BED7-1BEB89D36034}] => (Allow) C:\Program Files (x86)\Tunngle\TnglCtrl.exe
FirewallRules: [{ADDA9D15-6CCC-4F23-985E-D6AA6286A9E2}] => (Allow) C:\Program Files (x86)\Tunngle\Tunngle.exe
FirewallRules: [{C2373056-8BB6-4D67-9D1E-5CCD98A547FE}] => (Allow) C:\Program Files (x86)\Tunngle\Tunngle.exe
FirewallRules: [{AE746600-9477-47B3-A3BE-EEA2265EE2FE}] => (Allow) C:\Program Files (x86)\Fiddler2\Fiddler.exe
FirewallRules: [TCP Query User{60FC49CD-98BD-415F-B454-E8EB878B4EC8}C:\program files (x86)\heroes of the storm\versions\base34846\heroesofthestorm_x64.exe] => (Allow) C:\program files (x86)\heroes of the storm\versions\base34846\heroesofthestorm_x64.exe
FirewallRules: [UDP Query User{7BBE69DF-1814-4F66-83CC-438C1A46C4A8}C:\program files (x86)\heroes of the storm\versions\base34846\heroesofthestorm_x64.exe] => (Allow) C:\program files (x86)\heroes of the storm\versions\base34846\heroesofthestorm_x64.exe
FirewallRules: [TCP Query User{1479CCAC-22F1-4D01-8C64-CEBEE826847F}C:\users\jannik\desktop\adhocserver\adhocsever.exe] => (Allow) C:\users\jannik\desktop\adhocserver\adhocsever.exe
FirewallRules: [UDP Query User{2EA309E7-59D7-470B-A9E8-2A94F3B69EA7}C:\users\jannik\desktop\adhocserver\adhocsever.exe] => (Allow) C:\users\jannik\desktop\adhocserver\adhocsever.exe
FirewallRules: [TCP Query User{A4F90A4E-13B4-4762-AAB2-BC654755CDC9}C:\users\jannik\desktop\ppsspp\ppssppwindows64.exe] => (Allow) C:\users\jannik\desktop\ppsspp\ppssppwindows64.exe
FirewallRules: [UDP Query User{F9CD5FEC-C7FE-458F-A5CD-162A2DB4CD1D}C:\users\jannik\desktop\ppsspp\ppssppwindows64.exe] => (Allow) C:\users\jannik\desktop\ppsspp\ppssppwindows64.exe
FirewallRules: [TCP Query User{B6FA7CDD-D64B-4000-B27B-ACA9A0047DDE}C:\program files (x86)\starcraft ii\versions\base32283\sc2.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base32283\sc2.exe
FirewallRules: [UDP Query User{571D0508-F856-4B70-97B7-B90E1B351254}C:\program files (x86)\starcraft ii\versions\base32283\sc2.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base32283\sc2.exe
FirewallRules: [TCP Query User{7FEF8C7A-83A6-4CC3-9F3F-FC24167EB3F8}C:\users\jannik\desktop\papierkorb\desktop\warcraft iii\war3.exe] => (Allow) C:\users\jannik\desktop\papierkorb\desktop\warcraft iii\war3.exe
FirewallRules: [UDP Query User{44AF77BA-ECD7-4D0D-A758-3FF59F689EFA}C:\users\jannik\desktop\papierkorb\desktop\warcraft iii\war3.exe] => (Allow) C:\users\jannik\desktop\papierkorb\desktop\warcraft iii\war3.exe
FirewallRules: [TCP Query User{382BCAA9-6E4C-4046-AEDD-8E40BC26C23C}C:\program files (x86)\steam\steamapps\common\the witcher 2\bin\witcher2.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\the witcher 2\bin\witcher2.exe
FirewallRules: [UDP Query User{6D3512A7-CA8F-40A7-B4C4-84F0203E25DA}C:\program files (x86)\steam\steamapps\common\the witcher 2\bin\witcher2.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\the witcher 2\bin\witcher2.exe
FirewallRules: [{54584A45-071D-4A2C-8D52-ED90FB526234}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{30F68D47-6E4B-45A9-AA7D-8062BF134F71}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{83CFA5BF-2F19-46BA-B385-EB505E2627C0}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{76EF55EC-ED34-4178-8B0F-39D80C951416}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{BB2CB526-4E43-4330-AD8E-C7AFF185B802}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{CE7D83CA-BCB9-4B5D-8A9F-46B2AB298BB1}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [TCP Query User{20DE9092-1DFD-4D85-A526-FFAAE903FEC6}C:\program files (x86)\starcitizen\citizenclient\bin64\starcitizen.exe] => (Allow) C:\program files (x86)\starcitizen\citizenclient\bin64\starcitizen.exe
FirewallRules: [UDP Query User{0D92FF15-F1B2-462A-BEC6-F0B2F1019151}C:\program files (x86)\starcitizen\citizenclient\bin64\starcitizen.exe] => (Allow) C:\program files (x86)\starcitizen\citizenclient\bin64\starcitizen.exe
FirewallRules: [{E2E9FB37-6C04-433C-8AE3-6CBFC5ED51EE}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Hammerwatch\editor\HammerEditor.exe
FirewallRules: [{CB7D8D99-4A68-44F9-8FBD-C4F00DF7D81D}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Hammerwatch\editor\HammerEditor.exe
FirewallRules: [{352B90CA-5C4A-4B99-8AD3-4413D410E8D6}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{AF82F08C-C3D3-4B39-B64E-0B6085C03AD4}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sid Meier's Civilization V\Launcher.exe
FirewallRules: [{05B13642-571D-47DD-86FC-47934AC44AE5}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sid Meier's Civilization V\Launcher.exe
==================== Faulty Device Manager Devices =============
Name: TP-LINK 450Mbps Wireless N Adapter
Description: TP-LINK 450Mbps Wireless N Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: TP-LINK
Service: athr
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: TAP-Win32 Adapter V9 (Tunngle)
Description: TAP-Win32 Adapter V9 (Tunngle)
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: TAP-Win32 Provider V9 (Tunngle)
Service: tap0901t
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (05/23/2015 01:39:47 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
Error: (05/23/2015 01:39:47 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error: (05/23/2015 01:39:47 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error: (05/23/2015 01:05:23 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073418231
Error: (05/22/2015 02:31:00 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073418231
Error: (05/22/2015 02:26:53 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
Error: (05/22/2015 02:26:53 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error: (05/22/2015 02:26:53 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error: (05/21/2015 08:48:16 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
Error: (05/21/2015 08:48:16 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
System errors:
=============
Error: (05/23/2015 01:35:33 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
Error: (05/23/2015 01:33:51 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom
Error: (05/22/2015 05:51:57 PM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
Error: (05/22/2015 02:22:19 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
Error: (05/22/2015 02:21:00 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom
Error: (05/21/2015 08:43:24 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
Error: (05/21/2015 08:42:22 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom
Error: (05/21/2015 00:29:12 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
Error: (05/21/2015 00:27:57 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom
Error: (05/21/2015 06:35:42 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
Microsoft Office:
=========================
Error: (05/23/2015 01:39:47 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000
Error: (05/23/2015 01:39:47 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000
Error: (05/23/2015 01:39:47 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000
Error: (05/23/2015 01:05:23 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073418231
Error: (05/22/2015 02:31:00 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073418231
Error: (05/22/2015 02:26:53 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000
Error: (05/22/2015 02:26:53 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000
Error: (05/22/2015 02:26:53 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000
Error: (05/21/2015 08:48:16 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000
Error: (05/21/2015 08:48:16 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000
CodeIntegrity Errors:
===================================
Date: 2014-09-16 19:44:20.613
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-09-16 19:44:20.613
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-09-16 19:44:20.611
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-09-16 19:44:20.609
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-09-16 19:44:20.607
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-09-16 19:44:20.605
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-09-11 13:43:22.775
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-09-11 13:43:22.774
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-09-11 13:43:22.771
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-09-11 13:43:22.770
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-3570K CPU @ 3.40GHz
Percentage of memory in use: 25%
Total physical RAM: 8152.67 MB
Available physical RAM: 6107.62 MB
Total Pagefile: 16303.54 MB
Available Pagefile: 13874.18 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:119.14 GB) (Free:22.17 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 119.2 GB) (Disk ID: F5DADA83)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=119.1 GB) - (Type=07 NTFS)
==================== End of log ============================
|
|
23.05.2015, 20:36
| #3 |
| | Back to Desktop + ladender Mauszeiger Gmer.txt: (Teil 1)
__________________Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-05-23 21:18:49
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2 Samsung_SSD_840_PRO_Series rev.DXM04B0Q 119,24GB
Running: Gmer-19357.exe; Driver: C:\Users\Jannik\AppData\Local\Temp\pfdiqpog.sys
---- User code sections - GMER 2.1 ----
.text C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\SysWOW64\WSOCK32.dll!recv + 82 00000000715f17fa 2 bytes CALL 767111a9 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\SysWOW64\WSOCK32.dll!recvfrom + 88 00000000715f1860 2 bytes CALL 767111a9 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 98 00000000715f1942 2 bytes JMP 74ef7089 C:\Windows\syswow64\WS2_32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 109 00000000715f194d 2 bytes JMP 74efcba6 C:\Windows\syswow64\WS2_32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076351401 2 bytes JMP 7673b21b C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076351419 2 bytes JMP 7673b346 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076351431 2 bytes JMP 767b8f29 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007635144a 2 bytes CALL 7671489d C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000763514dd 2 bytes JMP 767b8822 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000763514f5 2 bytes JMP 767b89f8 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007635150d 2 bytes JMP 767b8718 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076351525 2 bytes JMP 767b8ae2 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007635153d 2 bytes JMP 7672fca8 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076351555 2 bytes JMP 767368ef C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007635156d 2 bytes JMP 767b8fe3 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076351585 2 bytes JMP 767b8b42 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007635159d 2 bytes JMP 767b86dc C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000763515b5 2 bytes JMP 7672fd41 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000763515cd 2 bytes JMP 7673b2dc C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000763516b2 2 bytes JMP 767b8ea4 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000763516bd 2 bytes JMP 767b8671 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000772413ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077241544 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000772418ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077241ba8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077241d25 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077241e8f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077241f75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077242238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 531 0000000077242683 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000772426a0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000772426c2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007724271f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184 0000000077242788 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 4
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077242b4b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375 0000000077242b97 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007724306b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920 00000000772431f8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 000000007724388e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000772438e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000772439b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077243f50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161 0000000077244001 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277 0000000077244075 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214 00000000772441b6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276 00000000772441f4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 609 0000000077244461 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284 000000007724464c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483 0000000077244713 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231 0000000077244807 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518 0000000077244926 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256 0000000077244a50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67 0000000077244aa3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501 0000000077244ca5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256 0000000077244ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247 0000000077244fa7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 483 0000000077245193 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438 0000000077245f46 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!EtwEventProviderEnabled + 198 0000000077246016 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!atol + 194 000000007724610e 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76 00000000772462fc 8 bytes [50, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45 000000007724633d 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4 0000000077246354 8 bytes [30, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92 00000000772463ac 8 bytes [20, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790 0000000077246b76 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007728dc80 8 bytes {JMP QWORD [RIP-0x47949]}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007728de00 8 bytes {JMP QWORD [RIP-0x47ab2]}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007728de30 8 bytes {JMP QWORD [RIP-0x47e20]}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007728df50 8 bytes {JMP QWORD [RIP-0x47c5a]}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007728e000 8 bytes {JMP QWORD [RIP-0x47ef8]}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007728e630 8 bytes {JMP QWORD [RIP-0x47102]}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007728e880 8 bytes {JMP QWORD [RIP-0x47d10]}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007728f0e0 8 bytes {JMP QWORD [RIP-0x48d3a]}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000074cd13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000074cd146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000074cd16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000074cd19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000074cd19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074cd1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000075f02ab1 5 bytes JMP 00000001002c2dcc
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000772413ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077241544 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000772418ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077241ba8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077241d25 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077241e8f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077241f75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077242238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 531 0000000077242683 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000772426a0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000772426c2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007724271f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184 0000000077242788 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 4
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077242b4b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375 0000000077242b97 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007724306b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920 00000000772431f8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 000000007724388e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000772438e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000772439b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077243f50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161 0000000077244001 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277 0000000077244075 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214 00000000772441b6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276 00000000772441f4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 609 0000000077244461 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284 000000007724464c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483 0000000077244713 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231 0000000077244807 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518 0000000077244926 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256 0000000077244a50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67 0000000077244aa3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501 0000000077244ca5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256 0000000077244ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247 0000000077244fa7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 483 0000000077245193 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438 0000000077245f46 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!EtwEventProviderEnabled + 198 0000000077246016 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!atol + 194 000000007724610e 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76 00000000772462fc 8 bytes [50, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45 000000007724633d 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4 0000000077246354 8 bytes [30, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92 00000000772463ac 8 bytes [20, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790 0000000077246b76 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007728dc80 8 bytes {JMP QWORD [RIP-0x47949]}
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007728de00 8 bytes {JMP QWORD [RIP-0x47ab2]}
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007728de30 8 bytes {JMP QWORD [RIP-0x47e20]}
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007728df50 8 bytes {JMP QWORD [RIP-0x47c5a]}
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007728e000 8 bytes {JMP QWORD [RIP-0x47ef8]}
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007728e630 8 bytes {JMP QWORD [RIP-0x47102]}
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007728e880 8 bytes {JMP QWORD [RIP-0x47d10]}
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007728f0e0 8 bytes {JMP QWORD [RIP-0x48d3a]}
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000074cd13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000074cd146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000074cd16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000074cd19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000074cd19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074cd1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000772413ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077241544 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000772418ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077241ba8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077241d25 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077241e8f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077241f75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077242238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 531 0000000077242683 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000772426a0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000772426c2 8 bytes {JMP 0x10}
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007724271f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184 0000000077242788 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 4
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077242b4b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375 0000000077242b97 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007724306b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920 00000000772431f8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 000000007724388e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000772438e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000772439b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077243f50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161 0000000077244001 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277 0000000077244075 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214 00000000772441b6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276 00000000772441f4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 609 0000000077244461 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284 000000007724464c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483 0000000077244713 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231 0000000077244807 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518 0000000077244926 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256 0000000077244a50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67 0000000077244aa3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501 0000000077244ca5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256 0000000077244ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247 0000000077244fa7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 483 0000000077245193 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438 0000000077245f46 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!EtwEventProviderEnabled + 198 0000000077246016 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!atol + 194 000000007724610e 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76 00000000772462fc 8 bytes [50, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45 000000007724633d 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4 0000000077246354 8 bytes [30, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92 00000000772463ac 8 bytes [20, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790 0000000077246b76 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007728dc80 8 bytes {JMP QWORD [RIP-0x47949]}
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007728de00 8 bytes {JMP QWORD [RIP-0x47ab2]}
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007728de30 8 bytes {JMP QWORD [RIP-0x47e20]}
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007728df50 8 bytes {JMP QWORD [RIP-0x47c5a]}
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007728e000 8 bytes {JMP QWORD [RIP-0x47ef8]}
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007728e630 8 bytes {JMP QWORD [RIP-0x47102]}
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007728e880 8 bytes {JMP QWORD [RIP-0x47d10]}
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007728f0e0 8 bytes {JMP QWORD [RIP-0x48d3a]}
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000074cd13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000074cd146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000074cd16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000074cd19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000074cd19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074cd1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076351401 2 bytes JMP 7673b21b C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076351419 2 bytes JMP 7673b346 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076351431 2 bytes JMP 767b8f29 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007635144a 2 bytes CALL 7671489d C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000763514dd 2 bytes JMP 767b8822 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000763514f5 2 bytes JMP 767b89f8 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007635150d 2 bytes JMP 767b8718 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076351525 2 bytes JMP 767b8ae2 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007635153d 2 bytes JMP 7672fca8 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076351555 2 bytes JMP 767368ef C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007635156d 2 bytes JMP 767b8fe3 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076351585 2 bytes JMP 767b8b42 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007635159d 2 bytes JMP 767b86dc C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000763515b5 2 bytes JMP 7672fd41 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000763515cd 2 bytes JMP 7673b2dc C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000763516b2 2 bytes JMP 767b8ea4 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000763516bd 2 bytes JMP 767b8671 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000772413ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077241544 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000772418ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077241ba8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077241d25 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077241e8f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077241f75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077242238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 531 0000000077242683 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000772426a0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000772426c2 8 bytes {JMP 0x10}
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007724271f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184 0000000077242788 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 4
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077242b4b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375 0000000077242b97 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ...
|
|
24.05.2015, 00:48
| #4 |
| | Back to Desktop + ladender Mauszeiger Gmer.txt: (Teil 2) Code:
ATTFilter * 2
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007724306b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920 00000000772431f8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 000000007724388e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000772438e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000772439b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077243f50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161 0000000077244001 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277 0000000077244075 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214 00000000772441b6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276 00000000772441f4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 609 0000000077244461 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284 000000007724464c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483 0000000077244713 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231 0000000077244807 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518 0000000077244926 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256 0000000077244a50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67 0000000077244aa3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501 0000000077244ca5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256 0000000077244ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247 0000000077244fa7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 483 0000000077245193 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438 0000000077245f46 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!EtwEventProviderEnabled + 198 0000000077246016 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!atol + 194 000000007724610e 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76 00000000772462fc 8 bytes [50, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45 000000007724633d 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4 0000000077246354 8 bytes [30, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92 00000000772463ac 8 bytes [20, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790 0000000077246b76 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007728dc80 8 bytes {JMP QWORD [RIP-0x47949]}
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007728de00 8 bytes {JMP QWORD [RIP-0x47ab2]}
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007728de30 8 bytes {JMP QWORD [RIP-0x47e20]}
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007728df50 8 bytes {JMP QWORD [RIP-0x47c5a]}
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007728e000 8 bytes {JMP QWORD [RIP-0x47ef8]}
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007728e630 8 bytes {JMP QWORD [RIP-0x47102]}
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007728e880 8 bytes {JMP QWORD [RIP-0x47d10]}
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007728f0e0 8 bytes {JMP QWORD [RIP-0x48d3a]}
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000074cd13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000074cd146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000074cd16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000074cd19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000074cd19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074cd1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076351401 2 bytes JMP 7673b21b C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076351419 2 bytes JMP 7673b346 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076351431 2 bytes JMP 767b8f29 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007635144a 2 bytes CALL 7671489d C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000763514dd 2 bytes JMP 767b8822 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000763514f5 2 bytes JMP 767b89f8 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007635150d 2 bytes JMP 767b8718 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076351525 2 bytes JMP 767b8ae2 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007635153d 2 bytes JMP 7672fca8 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076351555 2 bytes JMP 767368ef C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007635156d 2 bytes JMP 767b8fe3 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076351585 2 bytes JMP 767b8b42 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007635159d 2 bytes JMP 767b86dc C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000763515b5 2 bytes JMP 7672fd41 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000763515cd 2 bytes JMP 7673b2dc C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000763516b2 2 bytes JMP 767b8ea4 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000763516bd 2 bytes JMP 767b8671 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000772413ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077241544 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000772418ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077241ba8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077241d25 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077241e8f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077241f75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077242238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 531 0000000077242683 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000772426a0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000772426c2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007724271f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184 0000000077242788 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 4
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077242b4b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375 0000000077242b97 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007724306b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920 00000000772431f8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 000000007724388e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000772438e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000772439b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077243f50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161 0000000077244001 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277 0000000077244075 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214 00000000772441b6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276 00000000772441f4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 609 0000000077244461 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284 000000007724464c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483 0000000077244713 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231 0000000077244807 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518 0000000077244926 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256 0000000077244a50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67 0000000077244aa3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501 0000000077244ca5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256 0000000077244ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247 0000000077244fa7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 483 0000000077245193 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438 0000000077245f46 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!EtwEventProviderEnabled + 198 0000000077246016 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!atol + 194 000000007724610e 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76 00000000772462fc 8 bytes [50, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45 000000007724633d 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4 0000000077246354 8 bytes [30, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92 00000000772463ac 8 bytes [20, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790 0000000077246b76 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007728dc80 8 bytes {JMP QWORD [RIP-0x47949]}
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007728de00 8 bytes {JMP QWORD [RIP-0x47ab2]}
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007728de30 8 bytes {JMP QWORD [RIP-0x47e20]}
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007728df50 8 bytes {JMP QWORD [RIP-0x47c5a]}
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007728e000 8 bytes {JMP QWORD [RIP-0x47ef8]}
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007728e630 8 bytes {JMP QWORD [RIP-0x47102]}
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007728e880 8 bytes {JMP QWORD [RIP-0x47d10]}
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007728f0e0 8 bytes {JMP QWORD [RIP-0x48d3a]}
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000074cd13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000074cd146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000074cd16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000074cd19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000074cd19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074cd1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000772413ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077241544 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000772418ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077241ba8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077241d25 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077241e8f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077241f75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077242238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 531 0000000077242683 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000772426a0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000772426c2 8 bytes {JMP 0x10}
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007724271f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184 0000000077242788 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 4
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077242b4b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375 0000000077242b97 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007724306b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920 00000000772431f8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 000000007724388e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000772438e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000772439b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077243f50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161 0000000077244001 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277 0000000077244075 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214 00000000772441b6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276 00000000772441f4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 609 0000000077244461 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284 000000007724464c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483 0000000077244713 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231 0000000077244807 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518 0000000077244926 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256 0000000077244a50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67 0000000077244aa3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501 0000000077244ca5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256 0000000077244ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247 0000000077244fa7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 483 0000000077245193 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438 0000000077245f46 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!EtwEventProviderEnabled + 198 0000000077246016 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!atol + 194 000000007724610e 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76 00000000772462fc 8 bytes [50, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45 000000007724633d 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4 0000000077246354 8 bytes [30, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92 00000000772463ac 8 bytes [20, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790 0000000077246b76 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007728dc80 8 bytes {JMP QWORD [RIP-0x47949]}
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007728de00 8 bytes {JMP QWORD [RIP-0x47ab2]}
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007728de30 8 bytes {JMP QWORD [RIP-0x47e20]}
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007728df50 8 bytes {JMP QWORD [RIP-0x47c5a]}
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007728e000 8 bytes {JMP QWORD [RIP-0x47ef8]}
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007728e630 8 bytes {JMP QWORD [RIP-0x47102]}
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007728e880 8 bytes {JMP QWORD [RIP-0x47d10]}
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007728f0e0 8 bytes {JMP QWORD [RIP-0x48d3a]}
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000074cd13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000074cd146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000074cd16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000074cd19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000074cd19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074cd1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\syswow64\Psapi.dll!GetModuleFileNameExW + 17 0000000076351401 2 bytes JMP 7673b21b C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\syswow64\Psapi.dll!EnumProcessModules + 17 0000000076351419 2 bytes JMP 7673b346 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 17 0000000076351431 2 bytes JMP 767b8f29 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 42 000000007635144a 2 bytes CALL 7671489d C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\syswow64\Psapi.dll!EnumDeviceDrivers + 17 00000000763514dd 2 bytes JMP 767b8822 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\syswow64\Psapi.dll!GetDeviceDriverBaseNameA + 17 00000000763514f5 2 bytes JMP 767b89f8 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\syswow64\Psapi.dll!QueryWorkingSetEx + 17 000000007635150d 2 bytes JMP 767b8718 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\syswow64\Psapi.dll!GetDeviceDriverBaseNameW + 17 0000000076351525 2 bytes JMP 767b8ae2 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\syswow64\Psapi.dll!GetModuleBaseNameW + 17 000000007635153d 2 bytes JMP 7672fca8 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\syswow64\Psapi.dll!EnumProcesses + 17 0000000076351555 2 bytes JMP 767368ef C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\syswow64\Psapi.dll!GetProcessMemoryInfo + 17 000000007635156d 2 bytes JMP 767b8fe3 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\syswow64\Psapi.dll!GetPerformanceInfo + 17 0000000076351585 2 bytes JMP 767b8b42 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\syswow64\Psapi.dll!QueryWorkingSet + 17 000000007635159d 2 bytes JMP 767b86dc C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\syswow64\Psapi.dll!GetModuleBaseNameA + 17 00000000763515b5 2 bytes JMP 7672fd41 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\syswow64\Psapi.dll!GetModuleFileNameExA + 17 00000000763515cd 2 bytes JMP 7673b2dc C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\syswow64\Psapi.dll!GetProcessImageFileNameW + 20 00000000763516b2 2 bytes JMP 767b8ea4 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\syswow64\Psapi.dll!GetProcessImageFileNameW + 31 00000000763516bd 2 bytes JMP 767b8671 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000772413ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077241544 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000772418ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077241ba8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077241d25 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077241e8f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077241f75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077242238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 531 0000000077242683 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000772426a0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000772426c2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007724271f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184 0000000077242788 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 4
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077242b4b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375 0000000077242b97 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007724306b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920 00000000772431f8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 000000007724388e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000772438e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000772439b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077243f50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161 0000000077244001 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277 0000000077244075 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214 00000000772441b6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276 00000000772441f4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 609 0000000077244461 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284 000000007724464c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483 0000000077244713 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231 0000000077244807 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518 0000000077244926 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256 0000000077244a50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67 0000000077244aa3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501 0000000077244ca5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256 0000000077244ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247 0000000077244fa7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 483 0000000077245193 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438 0000000077245f46 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!EtwEventProviderEnabled + 198 0000000077246016 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!atol + 194 000000007724610e 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76 00000000772462fc 8 bytes [50, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45 000000007724633d 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4 0000000077246354 8 bytes [30, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92 00000000772463ac 8 bytes [20, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790 0000000077246b76 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007728dc80 8 bytes {JMP QWORD [RIP-0x47949]}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007728de00 8 bytes {JMP QWORD [RIP-0x47ab2]}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007728de30 8 bytes {JMP QWORD [RIP-0x47e20]}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007728df50 8 bytes {JMP QWORD [RIP-0x47c5a]}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007728e000 8 bytes {JMP QWORD [RIP-0x47ef8]}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007728e630 8 bytes {JMP QWORD [RIP-0x47102]}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007728e880 8 bytes {JMP QWORD [RIP-0x47d10]}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007728f0e0 8 bytes {JMP QWORD [RIP-0x48d3a]}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000074cd13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000074cd146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000074cd16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000074cd19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000074cd19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074cd1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000772413ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077241544 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000772418ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077241ba8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077241d25 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077241e8f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077241f75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077242238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 531 0000000077242683 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000772426a0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000772426c2 8 bytes {JMP 0x10}
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007724271f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184 0000000077242788 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 4
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077242b4b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375 0000000077242b97 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007724306b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920 00000000772431f8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 000000007724388e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000772438e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000772439b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077243f50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161 0000000077244001 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277 0000000077244075 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214 00000000772441b6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276 00000000772441f4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 609 0000000077244461 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284 000000007724464c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483 0000000077244713 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231 0000000077244807 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518 0000000077244926 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256 0000000077244a50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67 0000000077244aa3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501 0000000077244ca5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256 0000000077244ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247 0000000077244fa7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 483 0000000077245193 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438 0000000077245f46 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!EtwEventProviderEnabled + 198 0000000077246016 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!atol + 194 000000007724610e 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76 00000000772462fc 8 bytes [50, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45 000000007724633d 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4 0000000077246354 8 bytes [30, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92 00000000772463ac 8 bytes [20, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790 0000000077246b76 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007728dc80 8 bytes {JMP QWORD [RIP-0x47949]}
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007728de00 8 bytes {JMP QWORD [RIP-0x47ab2]}
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007728de30 8 bytes {JMP QWORD [RIP-0x47e20]}
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007728df50 8 bytes {JMP QWORD [RIP-0x47c5a]}
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007728e000 8 bytes {JMP QWORD [RIP-0x47ef8]}
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007728e630 8 bytes {JMP QWORD [RIP-0x47102]}
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007728e880 8 bytes {JMP QWORD [RIP-0x47d10]}
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007728f0e0 8 bytes {JMP QWORD [RIP-0x48d3a]}
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000074cd13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000074cd146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000074cd16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000074cd19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000074cd19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074cd1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
---- Threads - GMER 2.1 ----
Thread C:\Windows\System32\svchost.exe [3428:6484] 000007feef729688
---- Processes - GMER 2.1 ----
Library c:\users\jannik\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpqmtvai.dll (*** suspicious ***) @ C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe [2204](2015-05-23 11:34:36) 0000000003e60000
Library C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Qt5Core.dll (*** suspicious ***) @ C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe [2204] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:24) 0000000069b30000
Library C:\Users\Jannik\AppData\Roaming\Dropbox\bin\icuin52.dll (*** suspicious ***) @ C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe [2204] (ICU I18N DLL/The ICU Project)(2015-03-04 21:45:30) 000000004a900000
Library C:\Users\Jannik\AppData\Roaming\Dropbox\bin\icuuc52.dll (*** suspicious ***) @ C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe [2204] (ICU Common DLL/The ICU Project)(2015-03-04 21:45:30) 0000000005e10000
Library C:\Users\Jannik\AppData\Roaming\Dropbox\bin\icudt52.dll (*** suspicious ***) @ C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe [2204] (ICU Data DLL/The ICU Project)(2015-03-04 21:45:30) 000000004ad00000
Library C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Qt5Widgets.dll (*** suspicious ***) @ C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe [2204] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:28) 00000000626e0000
Library C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Qt5Gui.dll (*** suspicious ***) @ C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe [2204] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 00000000623f0000
Library C:\Users\Jannik\AppData\Roaming\Dropbox\bin\libGLESv2.dll (*** suspicious ***) @ C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe [2204](2015-03-04 21:45:30) 0000000069430000
Library C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Qt5Network.dll (*** suspicious ***) @ C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe [2204] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 0000000062210000
Library C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Qt5WebKit.dll (*** suspicious ***) @ C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe [2204] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 0000000060330000
Library C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Qt5Quick.dll (*** suspicious ***) @ C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe [2204] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 0000000060110000
Library C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Qt5Qml.dll (*** suspicious ***) @ C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe [2204] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 000000005feb0000
Library C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Qt5Sql.dll (*** suspicious ***) @ C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe [2204] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 00000000696e0000
Library C:\Users\Jannik\AppData\Roaming\Dropbox\bin\libEGL.dll (*** suspicious ***) @ C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe [2204](2015-03-04 21:45:30) 0000000069a70000
Library C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Qt5WebKitWidgets.dll (*** suspicious ***) @ C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe [2204] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:28) 0000000069010000
Library C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Qt5OpenGL.dll (*** suspicious ***) @ C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe [2204] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 0000000068fd0000
Library C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Qt5PrintSupport.dll (*** suspicious ***) @ C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe [2204] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 0000000068f80000
Library C:\Users\Jannik\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll (*** suspicious ***) @ C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe [2204](2015-03-04 21:45:30) 0000000068c60000
Library C:\Users\Jannik\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll (*** suspicious ***) @ C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe [2204](2015-03-04 21:45:30) 0000000068c20000
---- EOF - GMER 2.1 ----
Grüße und  ,Kaprisonne Edit: Es liegt übrigens nicht am Spiel. Auch wenn ich nur am rumsurfen bin kommt der ladene Mauszeiger ab und zu. |
|
26.05.2015, 11:56
| #5 |
| /// the machine /// TB-Ausbilder    | Back to Desktop + ladender Mauszeiger hi, Downloade dir bitte  Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers Downloade dir bitte  TDSSKiller.exe und speichere diese Datei auf dem Desktop
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
26.05.2015, 12:57
| #6 |
| | Back to Desktop + ladender Mauszeiger Hab bereits meinen PC formatiert, wurde sowieso mal wieder Zeit, kann also geclosed werden. Trotzdem danke  |
|
27.05.2015, 06:50
| #7 |
| /// the machine /// TB-Ausbilder | Back to Desktop + ladender Mauszeiger ok 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Back to Desktop + ladender Mauszeiger |
| abständen, ausführen, beendet, beim spielen, blauer, desktop, geschickt, kaspersky, mauszeiger, min, probleme, problemen, programmes, regelmäßigen, schließe, schließen, sofort, spiele, unregelmäßige |
Linear-Darstellung
