Hallo,
ich habe wie schon ein paar andere ein Problem, dass das Programm "Detekt" eine Malware namens "Xtreme RAT" gefunden hat. Ich habe mir wie in den Tipps beschrieben Defrogger, FRST und GMER runtergeladen, und durchlaufen lassen und drei der Logs nachfolgend aufgeschrieben. Gmer war zu groß konnte ich es leider auch nicht hochladen. Ich hoffe das sind genug Informationen und jemand kann mir helfen.
Lg
Angel

Defrogger

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 12:51 on 21/11/2014 ()

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

FRST

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 20-11-2014
Ran by (administrator) on  on 21-11-2014 12:56:27
Running from C:\Users\Frederick\Desktop
Loaded Profiles:  (Available profiles: )
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics) C:\Program Files\Synaptics\SynTP\SynLenovoGestureMgr.exe
() C:\Program Files\Realtek\Audio\HDA\FMAPP.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Users\Benutzer\Desktop\Defogger.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12343400 2011-12-27] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1156712 2011-11-15] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2866960 2011-12-16] (Synaptics Incorporated)
HKLM\...\Run: [UpdatePRCShortCut] => C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe [222504 2009-05-13] (CyberLink Corp.)
HKLM\...\Run: [SynLenovoGestureMgr] => C:\Program Files\Synaptics\SynTP\SynLenovoGestureMgr.exe [410896 2011-12-16] (Synaptics)
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [8079408 2014-10-01] (Lenovo (Beijing) Limited)
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [6200368 2014-10-01] (Lenovo(beijing) Limited)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-03-12] (Intel Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [260928 2012-02-23] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [215360 2012-02-23] (NVIDIA Corporation)
Lsa: [Notification Packages] scecli C:\Program Files\Lenovo\Bluetooth Software\BtwProximityCP.dll

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-762633330-1124833633-351263833-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-762633330-1124833633-351263833-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKU\S-1-5-21-762633330-1124833633-351263833-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xA6927F8DD0DCCF01
HKU\S-1-5-21-762633330-1124833633-351263833-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKU\S-1-5-21-762633330-1124833633-351263833-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Benutzer\AppData\Roaming\Mozilla\Firefox\Profiles\94vywk16.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @kaspersky.com/content_blocker -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com ()
FF Plugin-x32: @kaspersky.com/online_banking -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com ()
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\Benutzer\AppData\Roaming\Mozilla\Firefox\Profiles\94vywk16.default\user.js
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Ngăn chặn trang web nguy hiểm - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-09-30]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Bàn phím ảo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-09-30]
FF HKLM-x32\...\Firefox\Extensions:  - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Công cụ kiểm tra liên kết của Kaspersky - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com [2014-09-30]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Chặn quảng cáo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com [2014-09-30]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com
FF Extension: An toàn giao dịch tài chính - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-09-30]

Chrome: 
=======
CHR Profile: C:\Users\Benutzer\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\Benutzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-10-01]
CHR Extension: (Google Docs) - C:\Users\Benutzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-10-01]
CHR Extension: (Google Drive) - C:\Users\Benutzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-10-01]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Benutzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-10-01]
CHR Extension: (YouTube) - C:\Users\Benutzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-10-01]
CHR Extension: (Google-Suche) - C:\Users\Benutzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-10-01]
CHR Extension: (Kaspersky Protection) - C:\Users\Benutzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbhjdbfgekjfcfkkfjjmlmojhbllhbho [2014-10-09]
CHR Extension: (Google Tabellen) - C:\Users\Benutzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-10-01]
CHR Extension: (AdBlock Plus) - C:\Users\Benutzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\kfcfceejhleedfbabanmaamfiagjhncj [2014-11-10]
CHR Extension: (Adblock Super) - C:\Users\Benutzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\knebimhcckndhiglamoabbnifdkijidd [2014-11-11]
CHR Extension: (Google Wallet) - C:\Users\Benutzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-10-01]
CHR Extension: (Google Mail) - C:\Users\Benutzer\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-10-01]
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho []
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho []

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVP15.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO)
R2 btwdins; C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe [945440 2012-02-01] (Broadcom Corporation.)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-28] (Intel Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273168 2011-12-08] ()
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [174600 2014-10-14] (Sandboxie Holdings, LLC)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [594704 2011-12-08] (Intel® Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 AVer7231_x64; C:\Windows\System32\DRIVERS\AVer7231_x64.sys [1800448 2011-03-31] (AVerMedia TECHNOLOGIES, Inc.) [File not signed]
R3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [134696 2012-02-02] (Broadcom Corporation.)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [457824 2014-02-20] (Kaspersky Lab ZAO)
R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [141320 2014-10-09] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [243808 2014-04-10] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [793800 2014-10-09] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2014-03-25] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [179296 2014-03-26] (Kaspersky Lab ZAO)
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [185352 2014-10-14] (Sandboxie Holdings, LLC)
S3 JMCR; system32\DRIVERS\jmcr.sys [X]
S3 L1C; system32\DRIVERS\L1C62x64.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S3 vm331avs; System32\Drivers\vm331avs.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-21 12:56 - 2014-11-21 12:56 - 00016848 _____ () C:\Users\Benutzer\Desktop\FRST.txt
2014-11-21 12:56 - 2014-11-21 12:56 - 00000000 ____D () C:\FRST
2014-11-21 12:54 - 2014-11-21 12:54 - 02117632 _____ (Farbar) C:\Users\Benutzer\Desktop\FRST64.exe
2014-11-21 12:51 - 2014-11-21 12:51 - 00000480 _____ () C:\Users\Benutzer\Desktop\defogger_disable.log
2014-11-21 12:51 - 2014-11-21 12:51 - 00000000 _____ () C:\Users\Benutzer\defogger_reenable
2014-11-21 12:49 - 2014-11-21 12:50 - 00000000 ____D () C:\Users\Benutzer\Desktop\Stuff
2014-11-21 12:49 - 2014-11-21 12:49 - 00050477 _____ () C:\Users\Benutzer\Desktop\Defogger.exe
2014-11-21 12:39 - 2014-11-21 12:39 - 00000378 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-11-20 23:04 - 2014-11-20 23:04 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-11-20 22:43 - 2014-11-20 22:43 - 00000000 ____D () C:\Windows\pss
2014-11-20 21:16 - 2014-11-20 23:52 - 00006818 _____ () C:\Users\Benutzer\Downloads\detekt.log
2014-11-20 21:13 - 2014-11-20 21:16 - 27810288 _____ () C:\Users\Benutzer\Downloads\detekt.exe
2014-11-20 00:17 - 2014-11-20 00:17 - 00000000 ____D () C:\Users\Benutzer\AppData\Local\Microsoft Games
2014-11-19 11:01 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll
2014-11-19 11:01 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2014-11-19 11:01 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2014-11-19 11:01 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll
2014-11-19 11:01 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2014-11-19 11:00 - 2010-05-26 11:41 - 02401112 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_43.dll
2014-11-19 11:00 - 2007-04-04 18:54 - 00107368 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_3.dll
2014-11-19 10:45 - 2014-11-11 04:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-11-19 10:45 - 2014-11-11 04:08 - 00241152 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll
2014-11-19 10:45 - 2014-11-11 03:44 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-11-19 10:45 - 2014-11-11 03:44 - 00186880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pku2u.dll
2014-11-18 16:10 - 2014-11-18 16:10 - 00012162 _____ () C:\Users\Benutzer\Downloads\Produktanlegen (5).xlsx
2014-11-17 23:36 - 2014-11-17 23:36 - 00032768 _____ () C:\Users\Benutzer\Downloads\C&A Produkte (1) (1).xls
2014-11-15 21:57 - 2006-09-28 16:05 - 03977496 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_31.dll
2014-11-15 21:57 - 2006-09-28 16:05 - 02414360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_31.dll
2014-11-15 21:57 - 2006-09-28 16:05 - 00237848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_4.dll
2014-11-15 21:57 - 2006-07-28 09:31 - 00083736 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_2.dll
2014-11-15 21:57 - 2006-07-28 09:30 - 00363288 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_3.dll
2014-11-15 21:57 - 2006-07-28 09:30 - 00236824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_3.dll
2014-11-15 21:57 - 2006-07-28 09:30 - 00062744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_2.dll
2014-11-15 21:57 - 2006-05-31 07:24 - 00230168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_2.dll
2014-11-15 21:57 - 2006-05-31 07:22 - 00354072 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_2.dll
2014-11-15 21:57 - 2006-03-31 12:41 - 03927248 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_30.dll
2014-11-15 21:57 - 2006-03-31 12:40 - 02388176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_30.dll
2014-11-15 21:57 - 2006-03-31 12:40 - 00352464 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_1.dll
2014-11-15 21:57 - 2006-03-31 12:39 - 00229584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_1.dll
2014-11-15 21:57 - 2006-03-31 12:39 - 00083664 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_1.dll
2014-11-15 21:57 - 2006-03-31 12:39 - 00062672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_1.dll
2014-11-15 21:57 - 2006-02-03 08:43 - 03830992 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_29.dll
2014-11-15 21:57 - 2006-02-03 08:43 - 02332368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_29.dll
2014-11-15 21:57 - 2006-02-03 08:42 - 00355536 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_0.dll
2014-11-15 21:57 - 2006-02-03 08:42 - 00230096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_0.dll
2014-11-15 21:57 - 2006-02-03 08:41 - 00016592 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_0.dll
2014-11-15 21:57 - 2006-02-03 08:41 - 00014032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_0.dll
2014-11-15 21:56 - 2005-12-05 18:09 - 03815120 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_28.dll
2014-11-15 21:56 - 2005-12-05 18:09 - 02323664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_28.dll
2014-11-15 21:56 - 2005-07-22 19:59 - 03807440 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_27.dll
2014-11-15 21:56 - 2005-07-22 19:59 - 02319568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_27.dll
2014-11-15 21:56 - 2005-05-26 15:34 - 03767504 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_26.dll
2014-11-15 21:56 - 2005-05-26 15:34 - 02297552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_26.dll
2014-11-15 21:56 - 2005-03-18 17:19 - 03823312 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_25.dll
2014-11-15 21:56 - 2005-03-18 17:19 - 02337488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_25.dll
2014-11-15 21:56 - 2005-02-05 19:45 - 03544272 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_24.dll
2014-11-15 21:56 - 2005-02-05 19:45 - 02222800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_24.dll
2014-11-15 21:11 - 2014-11-15 21:11 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-11-14 19:39 - 2014-11-17 23:35 - 00032768 _____ () C:\Users\Benutzer\Downloads\C&A Produkte (1).xls
2014-11-14 19:37 - 2014-11-17 16:02 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-11-14 19:37 - 2014-11-14 19:37 - 00000000 ____D () C:\ProgramData\Mozilla
2014-11-14 18:20 - 2014-11-14 18:20 - 00012288 _____ () C:\Users\Benutzer\Documents\Exercise 1.xls
2014-11-14 17:46 - 2014-11-14 17:46 - 00046072 _____ () C:\Users\Benutzer\Downloads\BMW.xlsx
2014-11-13 11:11 - 2014-11-13 11:11 - 00042959 _____ () C:\Users\Benutzer\Downloads\C&A Produkte.xlsx
2014-11-13 11:11 - 2014-11-13 11:11 - 00042959 _____ () C:\Users\Benutzer\Downloads\C&A Produkte (1).xlsx
2014-11-11 19:59 - 2014-11-07 20:49 - 00388272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-11-11 19:59 - 2014-11-07 20:23 - 00341168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-11-11 19:59 - 2014-11-06 05:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-11-11 19:59 - 2014-11-06 05:03 - 25110016 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-11-11 19:59 - 2014-11-06 05:03 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-11-11 19:59 - 2014-11-06 04:47 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-11-11 19:59 - 2014-11-06 04:46 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-11-11 19:59 - 2014-11-06 04:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-11-11 19:59 - 2014-11-06 04:44 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-11-11 19:59 - 2014-11-06 04:43 - 02884096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-11-11 19:59 - 2014-11-06 04:36 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-11-11 19:59 - 2014-11-06 04:35 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-11-11 19:59 - 2014-11-06 04:31 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-11-11 19:59 - 2014-11-06 04:30 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-11-11 19:59 - 2014-11-06 04:30 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-11-11 19:59 - 2014-11-06 04:29 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-11-11 19:59 - 2014-11-06 04:28 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-11-11 19:59 - 2014-11-06 04:23 - 06040064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-11-11 19:59 - 2014-11-06 04:20 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-11-11 19:59 - 2014-11-06 04:16 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-11-11 19:59 - 2014-11-06 04:13 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-11-11 19:59 - 2014-11-06 04:13 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-11-11 19:59 - 2014-11-06 04:12 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-11-11 19:59 - 2014-11-06 04:10 - 19781632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-11-11 19:59 - 2014-11-06 04:10 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-11-11 19:59 - 2014-11-06 04:07 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-11-11 19:59 - 2014-11-06 04:05 - 02277376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-11-11 19:59 - 2014-11-06 04:04 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-11-11 19:59 - 2014-11-06 04:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-11-11 19:59 - 2014-11-06 04:02 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-11-11 19:59 - 2014-11-06 04:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-11-11 19:59 - 2014-11-06 04:00 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-11-11 19:59 - 2014-11-06 03:59 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-11-11 19:59 - 2014-11-06 03:58 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-11-11 19:59 - 2014-11-06 03:57 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-11-11 19:59 - 2014-11-06 03:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-11-11 19:59 - 2014-11-06 03:42 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-11-11 19:59 - 2014-11-06 03:41 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-11-11 19:59 - 2014-11-06 03:41 - 00716800 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-11-11 19:59 - 2014-11-06 03:39 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-11-11 19:59 - 2014-11-06 03:38 - 02124288 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-11-11 19:59 - 2014-11-06 03:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-11-11 19:59 - 2014-11-06 03:36 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-11-11 19:59 - 2014-11-06 03:34 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-11-11 19:59 - 2014-11-06 03:30 - 14390272 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-11-11 19:59 - 2014-11-06 03:22 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-11-11 19:59 - 2014-11-06 03:21 - 04298240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-11-11 19:59 - 2014-11-06 03:21 - 02051072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-11-11 19:59 - 2014-11-06 03:20 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-11-11 19:59 - 2014-11-06 03:17 - 02365440 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-11-11 19:59 - 2014-11-06 03:04 - 01550336 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-11-11 19:59 - 2014-11-06 03:03 - 12819456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-11-11 19:59 - 2014-11-06 02:53 - 00799232 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-11-11 19:59 - 2014-11-06 02:52 - 01892864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-11-11 19:59 - 2014-11-06 02:48 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-11-11 19:59 - 2014-11-06 02:47 - 00708096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-11-11 19:59 - 2014-11-05 18:56 - 00304640 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-11-11 19:59 - 2014-11-05 18:56 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-11-11 19:59 - 2014-11-05 18:52 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-11-11 19:59 - 2014-10-14 03:16 - 00155064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-11-11 19:59 - 2014-10-14 03:13 - 00683520 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-11-11 19:59 - 2014-10-14 03:12 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-11-11 19:59 - 2014-10-14 03:09 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2014-11-11 19:59 - 2014-10-14 03:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2014-11-11 19:59 - 2014-10-14 02:50 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-11-11 19:59 - 2014-10-14 02:49 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-11-11 19:59 - 2014-10-14 02:47 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2014-11-11 19:59 - 2014-10-14 02:46 - 00681984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2014-11-11 19:57 - 2014-10-25 02:57 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-11-11 19:57 - 2014-10-25 02:32 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-11-11 19:57 - 2014-10-18 03:05 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2014-11-11 19:57 - 2014-10-18 02:33 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2014-11-11 19:57 - 2014-10-14 03:13 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-11-11 19:57 - 2014-10-14 02:50 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-11-11 19:57 - 2014-10-10 01:57 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-11-11 19:57 - 2014-10-03 03:12 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2014-11-11 19:57 - 2014-10-03 03:11 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2014-11-11 19:57 - 2014-10-03 03:11 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2014-11-11 19:57 - 2014-10-03 03:11 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2014-11-11 19:57 - 2014-10-03 03:11 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2014-11-11 19:57 - 2014-10-03 02:44 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2014-11-11 19:57 - 2014-10-03 02:44 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2014-11-11 19:57 - 2014-10-03 02:44 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2014-11-11 19:57 - 2014-09-19 10:42 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-11-11 19:57 - 2014-09-19 10:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-11-11 19:57 - 2014-09-19 10:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-11-11 19:57 - 2014-09-19 10:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-11-11 19:57 - 2014-09-19 10:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-11-11 19:57 - 2014-09-19 10:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-11-11 19:57 - 2014-09-19 10:23 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-11-11 19:57 - 2014-09-19 10:23 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-11-11 19:57 - 2014-09-19 10:23 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-11-11 19:57 - 2014-09-19 10:23 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-11-11 19:57 - 2014-09-19 10:23 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-11-11 19:57 - 2014-09-19 10:23 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-11-11 19:57 - 2014-08-21 07:43 - 01882624 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-11-11 19:57 - 2014-08-21 07:40 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-11-11 19:57 - 2014-08-21 07:26 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-11-11 19:57 - 2014-08-21 07:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-11-11 19:57 - 2014-08-12 03:02 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL
2014-11-11 19:57 - 2014-08-12 02:36 - 00701440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IMJP10K.DLL
2014-11-09 22:23 - 2014-11-09 22:23 - 00000000 ____D () C:\Users\Benutzer\AppData\Local\Macromedia
2014-11-04 23:03 - 2014-11-04 23:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sandboxie
2014-11-04 21:40 - 2014-11-04 21:40 - 00011790 _____ () C:\Users\Benutzer\Downloads\Autositze ADAC und Stiftung Warentest 11_2014 - Augen auf beim Billigkauf.xlsx
2014-11-04 21:39 - 2014-11-04 21:39 - 00012371 _____ () C:\Users\Benutzer\Downloads\Produktanlegen (4) (1).xlsx
2014-11-04 21:38 - 2014-11-04 21:38 - 00015360 _____ () C:\Users\Benutzer\Downloads\Produktanlegen (4).xls
2014-11-04 20:21 - 2014-11-04 20:21 - 00012371 _____ () C:\Users\Benutzer\Downloads\Produktanlegen (4).xlsx
2014-11-04 11:14 - 2014-11-15 13:22 - 00000000 ____D () C:\Users\Benutzer\opl
2014-11-03 19:55 - 2014-11-03 19:55 - 00000000 ____D () C:\Users\Benutzer\AppData\Local\PDF24
2014-11-03 17:34 - 2014-11-03 17:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF24
2014-10-29 20:31 - 2014-10-29 20:31 - 00000000 ____D () C:\Users\Benutzer\Documents\GUILD WARS
2014-10-29 20:31 - 2014-10-29 20:31 - 00000000 ____D () C:\Users\Benutzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2014-10-29 20:31 - 2014-10-29 20:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GUILD WARS
2014-10-28 20:43 - 2014-10-28 20:43 - 00000000 ____D () C:\Users\Benutzer\AppData\Roaming\IBM
2014-10-27 17:03 - 2014-10-27 17:03 - 00000000 ____D () C:\Users\Benutzer\AppData\Local\Blizzard
2014-10-27 12:28 - 2014-10-27 12:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hearthstone
2014-10-25 15:45 - 2014-10-25 15:45 - 00010240 _____ () C:\Users\Benutzer\Downloads\Sicherheit im Kinderzimmer - Spielen in geschützter Umgebung (1).xls
2014-10-25 15:07 - 2014-10-25 15:07 - 00011236 _____ () C:\Users\Benutzer\Downloads\Sicherheit im Kinderzimmer - Spielen in geschützter Umgebung (1).xlsx
2014-10-24 16:45 - 2014-10-24 16:45 - 00011236 _____ () C:\Users\Benutzer\Downloads\Sicherheit im Kinderzimmer - Spielen in geschützter Umgebung.xlsx
2014-10-24 15:04 - 2014-11-20 18:13 - 00000000 ___RD () C:\Users\Benutzer\Dropbox
2014-10-24 15:03 - 2014-11-15 08:30 - 00000000 ____D () C:\Users\Benutzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-10-24 15:02 - 2014-11-20 18:12 - 00000000 ____D () C:\Users\Benutzer\AppData\Roaming\Dropbox
2014-10-23 13:44 - 2014-10-24 07:21 - 00013419 _____ () C:\Users\Benutzer\Downloads\Halloween-2 (1).ods

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-21 12:55 - 2014-09-30 18:52 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-11-21 12:53 - 2014-10-01 09:32 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-11-21 12:51 - 2014-09-28 20:42 - 00000000 ____D () C:\Users\Benutzer
2014-11-21 12:47 - 2009-07-14 05:45 - 00026544 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-11-21 12:47 - 2009-07-14 05:45 - 00026544 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-11-21 12:44 - 2014-09-28 20:39 - 01284949 _____ () C:\Windows\WindowsUpdate.log
2014-11-21 12:44 - 2011-04-12 08:43 - 00699666 _____ () C:\Windows\system32\perfh007.dat
2014-11-21 12:44 - 2011-04-12 08:43 - 00149774 _____ () C:\Windows\system32\perfc007.dat
2014-11-21 12:44 - 2009-07-14 06:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-11-21 12:39 - 2014-10-01 09:32 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-11-21 12:39 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-11-21 12:39 - 2009-07-14 05:51 - 00040691 _____ () C:\Windows\setupact.log
2014-11-20 23:19 - 2014-09-30 17:35 - 00028096 _____ () C:\Windows\DPINST.LOG
2014-11-20 23:18 - 2014-09-30 17:50 - 00000000 ____D () C:\Program Files (x86)\Lenovo
2014-11-20 23:18 - 2014-09-30 17:21 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-11-20 23:17 - 2014-09-30 17:51 - 00000000 ____D () C:\Users\Benutzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo
2014-11-20 23:16 - 2014-09-30 17:45 - 00000000 ____D () C:\Program Files (x86)\USB Camera
2014-11-20 23:15 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system
2014-11-20 22:59 - 2014-09-30 17:47 - 00000000 ____D () C:\Windows\Driver Cache
2014-11-20 22:25 - 2014-09-30 18:57 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-11-20 20:08 - 2014-09-30 18:16 - 00000000 ____D () C:\Users\Benutzer\AppData\Roaming\TS3Client
2014-11-20 20:05 - 2014-10-02 13:12 - 00001496 _____ () C:\Windows\Sandboxie.ini
2014-11-19 23:24 - 2014-10-16 09:49 - 00000000 ____D () C:\Users\Benutzer\AppData\Local\Battle.net
2014-11-19 13:04 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-11-19 11:00 - 2014-10-01 19:32 - 00025452 _____ () C:\Windows\DirectX.log
2014-11-18 20:59 - 2014-10-01 14:14 - 00000000 ____D () C:\Users\Benutzer\AppData\Roaming\Skype
2014-11-18 17:49 - 2014-10-01 09:31 - 00000000 ____D () C:\Users\Benutzer\AppData\Local\Deployment
2014-11-16 21:37 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\LiveKernelReports
2014-11-13 15:35 - 2014-09-30 18:07 - 00000000 ____D () C:\Program Files\Opera x64
2014-11-13 11:48 - 2014-10-01 09:32 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-11-13 11:48 - 2014-10-01 09:32 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-11-13 10:47 - 2009-07-14 05:45 - 00289848 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-11-13 10:43 - 2014-10-01 09:18 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-11-11 23:45 - 2014-10-05 19:37 - 00000000 ____D () C:\Windows\system32\MRT
2014-11-11 23:42 - 2014-10-05 19:37 - 103374192 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-11-04 14:30 - 2010-11-21 04:27 - 00275080 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-10-31 16:35 - 2014-10-01 14:14 - 00000000 ____D () C:\ProgramData\Skype
2014-10-27 12:25 - 2014-10-16 09:49 - 00000000 ____D () C:\Users\Benutzer\AppData\Roaming\Battle.net

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-11-19 12:56

==================== End Of Log ============================
         

Addition.txt

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 20-11-2014
Ran by Benutzer at 2014-11-21 12:57:01
Running from C:\Users\Benutzer\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.09) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
Always Sometimes Monsters (HKLM-x32\...\Steam App 274310) (Version:  - Vagabond Dog)
Bastion (HKLM-x32\...\Steam App 107100) (Version:  - Supergiant Games)
Batman: Arkham Asylum GOTY Edition (HKLM-x32\...\Steam App 35140) (Version:  - Rocksteady Studios)
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
BioShock (HKLM-x32\...\Steam App 7670) (Version:  - 2K Boston)
BioShock 2 (HKLM-x32\...\Steam App 8850) (Version:  - 2K Marin)
BioShock Infinite (HKLM-x32\...\Steam App 8870) (Version:  - Irrational Games)
Blackguards (HKLM-x32\...\Steam App 249650) (Version:  - Daedalic Entertainment)
Darksiders II (HKLM-x32\...\Steam App 50650) (Version:  - Vigil Games)
Dead Island: Epidemic (HKLM-x32\...\Steam App 222900) (Version:  - Stunlock Studios)
Don't Starve (HKLM-x32\...\Steam App 219740) (Version:  - Klei Entertainment)
Dota 2 (HKLM-x32\...\Steam App 570) (Version:  - Valve)
Dota 2 Test (HKLM-x32\...\Steam App 205790) (Version:  - )
Dropbox (HKU\S-1-5-21-762633330-1124833633-351263833-1000\...\Dropbox) (Version: 2.10.52 - Dropbox, Inc.)
Energy Management (HKLM-x32\...\InstallShield_{D0956C11-0F60-43FE-99AD-524E833471BB}) (Version: 7.0.3.8 - Lenovo)
Energy Management (x32 Version: 7.0.3.8 - Lenovo) Hidden
Euro Truck Simulator 2 (HKLM-x32\...\Steam App 227300) (Version:  - SCS Software)
Far Cry® 3 (HKLM-x32\...\Steam App 220240) (Version:  - Ubisoft Montreal, Massive Entertainment, and Ubisoft Shanghai)
Frozen Synapse (HKLM-x32\...\Steam App 98200) (Version:  - Mode 7)
Full Mojo Rampage (HKLM-x32\...\Steam App 225280) (Version:  - Over the Top Games)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 39.0.2171.65 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
GRID (HKLM-x32\...\Steam App 12750) (Version:  - Codemasters Studios)
GRID 2 (HKLM-x32\...\Steam App 44350) (Version:  - Codemasters Racing)
GUILD WARS (HKLM-x32\...\Guild Wars) (Version:  - )
Half Minute Hero: Super Mega Neo Climax Ultimate Boy (HKLM-x32\...\Steam App 214830) (Version:  - Opus)
Hammerwatch (HKLM-x32\...\Steam App 239070) (Version:  - )
Hearthstone (HKLM-x32\...\Hearthstone) (Version:  - Blizzard Entertainment)
IBM ILOG CPLEX Optimization Studio (64 bit) 12.6 (HKLM\...\IBM ILOG CPLEX Optimization Studio (64 bit) 12.6) (Version: 12.6.0.0 - IBM)
Insurgency (HKLM-x32\...\Steam App 222880) (Version:  - New World Interactive)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.3.1427 - Intel Corporation)
Intel(R) OpenCL CPU Runtime (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version:  - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2656 - Intel Corporation)
Intel(R) PROSet/Wireless for Bluetooth(R) 3.0 + High Speed (HKLM\...\{2C0E6BD4-65B1-4E82-B2AC-43EFFC8F100C}) (Version: 15.0.0.0059 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.0.0.1032 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.4.220 - Intel Corporation)
Intel® PROSet/Wireless WiFi-Software (HKLM\...\{DF7756DD-656A-45C3-BA71-74673E8259A9}) (Version: 15.00.0000.0642 - Intel Corporation)
Intel® Trusted Connect Service Client (HKLM\...\{09536BA1-E498-4CC3-B834-D884A67D7E34}) (Version: 1.23.605.1 - Intel Corporation)
JPEGmini (HKU\S-1-5-21-762633330-1124833633-351263833-1000\...\5d2010e174743543) (Version: 1.8.23.0 - ICVT Ltd)
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{653C1B5A-3287-47B1-8613-0745D4E771C4}) (Version: 15.0.0.463 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 15.0.0.463 - Kaspersky Lab) Hidden
KickBeat Steam Edition (HKLM-x32\...\Steam App 255370) (Version:  - Zen Studios)
Left 4 Dead 2 (HKLM-x32\...\Steam App 550) (Version:  - Valve)
Lenovo Bluetooth with Enhanced Data Rate Software (HKLM\...\{A1439D4F-FD46-47F2-A1D3-FEE097C29A09}) (Version: 6.5.1.2300 - Broadcom Corporation)
Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 7.0.0.3712 - CyberLink Corp.)
Lenovo OneKey Recovery (Version: 7.0.0.3712 - CyberLink Corp.) Hidden
Marlow Briggs (HKLM-x32\...\Steam App 249680) (Version:  - Zootfly)
Metro 2033 (HKLM-x32\...\Steam App 43110) (Version:  - 4A Games)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 Refresh (HKLM-x32\...\{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}) (Version: 4.0.30901.0 - Microsoft Corporation)
Middle-earth: Shadow of Mordor (HKLM-x32\...\Steam App 241930) (Version:  - Monolith Productions, Inc.)
Monaco (HKLM-x32\...\Steam App 113020) (Version:  - Pocketwatch Games)
Mount Your Friends (HKLM-x32\...\Steam App 296470) (Version:  - Stegersaurus Software Inc.)
Mozilla Firefox 33.1.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 33.1.1 (x86 de)) (Version: 33.1.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 33.0.3 - Mozilla)
Nosgoth (HKLM-x32\...\Steam App 200110) (Version:  - Psyonix)
NVIDIA Grafiktreiber 295.93 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 295.93 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.11.1111 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.11.1111 - NVIDIA Corporation)
NVIDIA Update 1.7.12 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.7.12 - NVIDIA Corporation)
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
OpenOffice 4.1.1 (HKLM-x32\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)
Papers, Please (HKLM-x32\...\Steam App 239030) (Version:  - 3909)
PDF24 Creator 6.8.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6543 - Realtek Semiconductor Corp.)
Reus (HKLM-x32\...\Steam App 222730) (Version:  - Abbey Games)
RIFT™ (HKLM-x32\...\Steam App 39120) (Version:  - Trion Worlds)
Saints Row IV (HKLM-x32\...\Steam App 206420) (Version:  - Deep Silver Volition)
Sandboxie 4.14 (64-bit) (HKLM\...\Sandboxie) (Version: 4.14 - Sandboxie Holdings, LLC)
Skype™ 6.21 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.21.104 - Skype Technologies S.A.)
Sonic & All-Stars Racing Transformed (HKLM-x32\...\Steam App 212480) (Version:  - Sumo Digital)
Spiral Knights (HKLM-x32\...\Steam App 99900) (Version:  - Three Rings)
Steam (HKLM-x32\...\Steam) (Version:  - Valve Corporation)
Surgeon Simulator (HKLM-x32\...\Steam App 233720) (Version:  - Bossa Studios)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.3.38.0 - Synaptics Incorporated)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
Terraria (HKLM-x32\...\Steam App 105600) (Version:  - Re-Logic)
The Mighty Quest For Epic Loot (HKLM-x32\...\Steam App 239220) (Version:  - Ubisoft Montreal)
The Stanley Parable (HKLM-x32\...\Steam App 221910) (Version:  - Galactic Cafe)
The Witcher 2: Assassins of Kings Enhanced Edition (HKLM-x32\...\Steam App 20920) (Version:  - CD Projekt RED)
The Witcher: Enhanced Edition (HKLM-x32\...\Steam App 20900) (Version:  - CD Projekt RED)
Tomb Raider (HKLM-x32\...\Steam App 203160) (Version:  - Crystal Dynamics)
Total War: SHOGUN 2 (HKLM-x32\...\Steam App 34330) (Version:  - The Creative Assembly)
WinRAR 5.11 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.11.0 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-762633330-1124833633-351263833-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Benutzer\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-762633330-1124833633-351263833-1000_Classes\CLSID\{087B3AE3-E237-4467-B8DB-5A38AB959AC9}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-762633330-1124833633-351263833-1000_Classes\CLSID\{3B092F0C-7696-40E3-A80F-68D74DA84210}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-762633330-1124833633-351263833-1000_Classes\CLSID\{63542C48-9552-494A-84F7-73AA6A7C99C1}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-762633330-1124833633-351263833-1000_Classes\CLSID\{7BC0E710-5703-45BE-A29D-5D46D8B39262}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\ooofilt_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-762633330-1124833633-351263833-1000_Classes\CLSID\{AE424E85-F6DF-4910-A6A9-438797986431}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\propertyhdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-762633330-1124833633-351263833-1000_Classes\CLSID\{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}\InprocServer32 -> C:\Program Files (x86)\OpenOffice 4\program\shlxthdl\shlxthdl_x64.dll (Apache Software Foundation)
CustomCLSID: HKU\S-1-5-21-762633330-1124833633-351263833-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Benutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-762633330-1124833633-351263833-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Benutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-762633330-1124833633-351263833-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Benutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-762633330-1124833633-351263833-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Benutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-762633330-1124833633-351263833-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Benutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-762633330-1124833633-351263833-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Benutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-762633330-1124833633-351263833-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Benutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-762633330-1124833633-351263833-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Benutzer\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

==================== Restore Points  =========================

08-11-2014 18:32:38 Windows Update
11-11-2014 18:57:09 Windows Update
11-11-2014 22:41:56 Windows Update
15-11-2014 20:55:32 DirectX wurde installiert
18-11-2014 12:30:04 Windows Update
19-11-2014 10:00:43 DirectX wurde installiert
19-11-2014 13:01:48 Windows Update
20-11-2014 22:01:06 Removed Intel(R) PROSet/Wireless for Bluetooth(R) 3.0 + High Speed
20-11-2014 22:15:15 Entfernt Lenovo EasyCamera
20-11-2014 22:17:07 Entfernt Onekey Theater
20-11-2014 22:18:12 Entfernt UserGuide
20-11-2014 22:19:27 Removed Lenovo Bluetooth with Enhanced Data Rate Software
20-11-2014 22:19:52 Entfernt Atheros Communications Inc.(R) AR81Family Gigabit/Fast ÅO

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {5DDFDA5E-1C86-4289-8F5E-7C5AAF3427BD} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-01] (Google Inc.)
Task: {77157FF3-3353-4280-9585-238216A76C60} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-01] (Google Inc.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2014-09-30 17:24 - 2012-02-17 17:21 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-09-30 17:30 - 2010-10-26 06:40 - 00049056 _____ () C:\Program Files\Realtek\Audio\HDA\FMAPP.exe
2008-12-20 02:20 - 2014-10-01 11:25 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\kbdhook.dll
2014-11-19 17:55 - 2014-11-14 21:28 - 01408328 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.65\libglesv2.dll
2014-11-19 17:55 - 2014-11-14 21:28 - 00204616 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.65\libegl.dll
2014-11-19 17:55 - 2014-11-14 21:28 - 10689352 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.65\pdf.dll
2014-11-19 17:55 - 2014-11-14 21:28 - 01856840 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.65\ffmpegsumo.dll
2014-11-21 12:49 - 2014-11-21 12:49 - 00050477 _____ () C:\Users\Benutzer\Desktop\Defogger.exe
2014-03-06 14:00 - 2014-03-06 14:00 - 01269952 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\kpcengine.2.3.dll
2014-10-17 12:18 - 2014-10-17 12:18 - 00172032 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\92a1650dbe9fad5f46633b835420e1a8\IsdiInterop.ni.dll
2014-09-30 17:21 - 2011-11-29 19:00 - 00059392 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2014-09-30 17:20 - 2012-02-21 05:09 - 01198872 ____R () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^Users^Benutzer^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk => C:\Windows\pss\Dropbox.lnk.Startup
MSCONFIG\startupreg: 331BigDog => C:\Program Files (x86)\USB Camera\VM331_STI.EXE
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: IAStorIcon => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
MSCONFIG\startupreg: OnekeyStudio => C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe
MSCONFIG\startupreg: PDFPrint => D:\PDF24\pdf24.exe
MSCONFIG\startupreg: SandboxieControl => "C:\Program Files\Sandboxie\SbieCtrl.exe"
MSCONFIG\startupreg: UpdatePRCShortCut => "C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe" "C:\Program Files\Lenovo\OneKey App\OneKey Recovery" UpdateWithCreateOnce "Software\Lenovo\OneKey App\OneKey Recovery"

========================= Accounts: ==========================

Administrator (S-1-5-21-762633330-1124833633-351263833-500 - Administrator - Disabled)
Benutzer (S-1-5-21-762633330-1124833633-351263833-1000 - Administrator - Enabled) => C:\Users\Benutzer
Gast (S-1-5-21-762633330-1124833633-351263833-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-762633330-1124833633-351263833-1003 - Limited - Enabled)
UpdatusUser (S-1-5-21-762633330-1124833633-351263833-1001 - Limited - Enabled) => C:\Users\UpdatusUser

==================== Faulty Device Manager Devices =============

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Ethernet-Controller
Description: Ethernet-Controller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Basissystemgerät
Description: Basissystemgerät
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Basissystemgerät
Description: Basissystemgerät
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Basissystemgerät
Description: Basissystemgerät
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Multimediacontroller
Description: Multimediacontroller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (11/21/2014 00:39:37 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/20/2014 11:06:54 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Die abhängige Assemblierung "Microsoft.VC90.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (11/20/2014 11:05:02 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Die abhängige Assemblierung "Microsoft.VC90.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (11/20/2014 09:19:33 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Die abhängige Assemblierung "Microsoft.VC90.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (11/20/2014 09:16:45 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Die abhängige Assemblierung "Microsoft.VC90.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (11/20/2014 00:06:29 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/19/2014 05:13:10 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/19/2014 02:01:18 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 33.1.1.5430, Zeitstempel: 0x54656826
Name des fehlerhaften Moduls: mozalloc.dll, Version: 33.1.1.5430, Zeitstempel: 0x54654321
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001425
ID des fehlerhaften Prozesses: 0x1a70
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (11/19/2014 11:27:04 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 33.1.1.5430, Zeitstempel: 0x54656826
Name des fehlerhaften Moduls: mozalloc.dll, Version: 33.1.1.5430, Zeitstempel: 0x54654321
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001425
ID des fehlerhaften Prozesses: 0x19dc
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (11/19/2014 11:27:04 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 33.1.1.5430, Zeitstempel: 0x54656826
Name des fehlerhaften Moduls: mozalloc.dll, Version: 33.1.1.5430, Zeitstempel: 0x54654321
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001425
ID des fehlerhaften Prozesses: 0x199c
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3


System errors:
=============
Error: (11/21/2014 00:43:10 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 70. Der interne Fehlerstatus lautet: 105.

Error: (11/20/2014 00:09:46 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (11/20/2014 00:09:46 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Steam Client Service erreicht.

Error: (11/19/2014 11:59:57 AM) (Source: Schannel) (EventID: 4119) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung empfangen: 40.

Error: (11/19/2014 11:47:51 AM) (Source: Schannel) (EventID: 4119) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung empfangen: 40.

Error: (11/19/2014 11:47:21 AM) (Source: Schannel) (EventID: 4119) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung empfangen: 40.

Error: (11/15/2014 01:19:02 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Kaspersky Anti-Virus Service 15.0.0" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (11/15/2014 08:26:28 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎14.‎11.‎2014 um 23:00:16 unerwartet heruntergefahren.

Error: (11/14/2014 07:34:03 PM) (Source: Microsoft-Windows-Kernel-General) (EventID: 5) (User: NT-AUTORITÄT)
Description: 0x8000002a36\SystemRoot\System32\Config\SOFTWARE

Error: (11/13/2014 11:14:06 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053


Microsoft Office Sessions:
=========================
Error: (11/21/2014 00:39:37 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/20/2014 11:06:54 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC90.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Users\FREDER~1\AppData\Local\Temp\_MEI58722\detekt.exe.manifest

Error: (11/20/2014 11:05:02 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC90.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Users\FREDER~1\AppData\Local\Temp\_MEI45562\detekt.exe.manifest

Error: (11/20/2014 09:19:33 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC90.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Users\FREDER~1\AppData\Local\Temp\_MEI34322\detekt.exe.manifest

Error: (11/20/2014 09:16:45 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC90.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Users\FREDER~1\AppData\Local\Temp\_MEI82962\detekt.exe.manifest

Error: (11/20/2014 00:06:29 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/19/2014 05:13:10 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/19/2014 02:01:18 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe33.1.1.543054656826mozalloc.dll33.1.1.54305465432180000003000014251a7001d003f1e3cca2ceC:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll266109b2-6fec-11e4-91a7-b888e38a28f5

Error: (11/19/2014 11:27:04 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe33.1.1.543054656826mozalloc.dll33.1.1.543054654321800000030000142519dc01d003dcd51fff27C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll9a8243bc-6fd6-11e4-91a7-b888e38a28f5

Error: (11/19/2014 11:27:04 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe33.1.1.543054656826mozalloc.dll33.1.1.5430546543218000000300001425199c01d003dcd4f52662C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll9a7fd2b3-6fd6-11e4-91a7-b888e38a28f5


CodeIntegrity Errors:
===================================
  Date: 2014-11-20 18:17:12.570
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-11-20 18:17:12.491
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-11-20 18:17:08.944
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-11-20 18:17:08.859
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-11-20 18:09:39.538
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-11-20 18:09:39.470
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-11-20 18:09:35.995
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-11-20 18:09:35.939
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-11-20 18:09:31.407
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-11-20 18:09:31.342
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\dsound.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i7-3610QM CPU @ 2.30GHz
Percentage of memory in use: 33%
Total physical RAM: 8094.36 MB
Available physical RAM: 5396.7 MB
Total Pagefile: 16186.89 MB
Available Pagefile: 13204.54 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:195.21 GB) (Free:137.34 GB) NTFS
Drive d: () (Fixed) (Total:736.2 GB) (Free:416.23 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: FAFCD1C1)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=195.2 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=736.2 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

Hi,

wo wurde das gefunden? Logfile?Screenshot?

Oh Entschuldigung, das habe ich ganz vergessen, danke für den Hinweis.
Hier ist der Log. Er wurde erst abgebrochen, da ich Detekt ohne Administrator Rechte ausgeführt hatte.

2014-11-20 21:19:04,362 - detector - INFO - Starting with process ID 7128
2014-11-20 21:19:04,365 - detector - ERROR - The user is not an Administrator, aborting
2014-11-20 21:19:52,423 - detector - INFO - Starting with process ID 6608
2014-11-20 21:19:52,427 - detector - INFO - Selected Profile Name: Win7SP1x64
2014-11-20 21:19:52,427 - detector - INFO - Selected Driver: C:\Users\FREDER~1\AppData\Local\Temp\_MEI34322\drivers\winpmem64.sys
2014-11-20 21:19:52,427 - detector.service - INFO - Launching service destroyer...
2014-11-20 21:19:52,427 - detector.service - DEBUG - Unable to OpenService: (1060, 'OpenService', 'Der angegebene Dienst ist kein installierter Dienst.')
2014-11-20 21:19:52,428 - detector.service - INFO - Trying to stop the winpmem service...
2014-11-20 21:19:52,428 - detector.service - INFO - Trying to delete the winpmem service...
2014-11-20 21:19:52,428 - detector.service - DEBUG - Unable to delete the service: (6, 'DeleteService', 'Das Handle ist ung\xfcltig.')
2014-11-20 21:19:52,467 - detector.service - INFO - Trying to start the winpmem service...
2014-11-20 21:19:52,792 - detector - INFO - Service started
2014-11-20 21:19:52,792 - detector - INFO - Selected Yara signature file at C:\Users\FREDER~1\AppData\Local\Temp\_MEI34322\rules\signatures.yar
2014-11-20 21:19:52,792 - detector - INFO - Obtaining address space and generating config for volatility
2014-11-20 21:19:53,835 - detector - INFO - Address space: <volatility.plugins.addrspaces.amd64.AMD64PagedMemory object at 0x08D692F0>, Base: <volatility.plugins.addrspaces.win32pmem.Win32FileAddressSpace object at 0x08044C70>
2014-11-20 21:19:53,835 - detector - INFO - Profile: <volatility.plugins.overlays.windows.win7.Win7SP1x64 object at 0x08044A30>, DTB: 0x187000
2014-11-20 21:19:53,836 - detector - INFO - Starting yara scanner...
2014-11-20 21:34:54,299 - detector - WARNING - Process avp.exe (pid: 2172) matched: Xtreme at address: 0x2BDD66C6, Value:

58 74 72 65 6d 65 52 41 54 20 75 6e 64 20 6e 6a XtremeRAT.und.nj
52 41 54 2e 20 44 69 65 20 45 6e 74 77 69 63 6b RAT..Die.Entwick
6c 65 72 20 77 65 69 73 65 6e 20 61 75 73 64 72 ler.weisen.ausdr
26 75 75 6d 6c 3b 63 6b 6c 69 63 68 20 64 61 72 &uuml;cklich.dar
61 75 66 20 68 69 6e 2c 20 64 61 73 73 20 65 69 auf.hin,.dass.ei
6e 20 6e 65 67 61 74 69 76 65 73 20 53 63 61 6e n.negatives.Scan
2d 45 72 67 65 62 6e 69 73 2c 20 62 65 69 20 64 -Ergebnis,.bei.d
65 6d 20 6b 65 69 6e 65 20 53 63 68 61 64 73 6f em.keine.Schadso
66 74 77 61 72 65 20 67 65 66 75 6e 64 65 6e 20 ftware.gefunden.
77 69 72 64 2c 20 6e 69 63 68 74 20 61 75 74 6f wird,.nicht.auto
6d 61 74 69 73 63 68 20 62 65 64 65 75 74 65 74 matisch.bedeutet
2c 20 64 61 73 73 20 65 69 6e 20 53 79 73 74 65 ,.dass.ein.Syste
6d 20 6e 69 63 68 74 20 26 75 75 6d 6c 3b 62 65 m.nicht.&uuml;be
72 77 61 63 68 74 20 77 69 72 64 2e 3c 2f 73 70 rwacht.wird.</sp
61 6e 3e 0a 0a 09 0a 09 0a 09 20 20 20 0a 09 20 an>.............
20 20 20 20 20 0a 09 20 20 20 20 20 20 20 20 20 ................

2014-11-20 22:15:21,352 - detector - INFO - Scanning finished
2014-11-20 22:15:21,352 - detector.service - INFO - Trying to stop the winpmem service...
2014-11-20 22:15:21,352 - detector.service - INFO - Trying to delete the winpmem service...
2014-11-20 22:15:21,352 - detector - INFO - Service stopped
2014-11-20 22:15:21,352 - detector - INFO - Analysis finished
2014-11-20 23:06:36,381 - detector - INFO - Starting with process ID 5892
2014-11-20 23:06:36,381 - detector - ERROR - The user is not an Administrator, aborting
2014-11-20 23:07:03,930 - detector - INFO - Starting with process ID 5660
2014-11-20 23:07:03,933 - detector - INFO - Selected Profile Name: Win7SP1x64
2014-11-20 23:07:03,934 - detector - INFO - Selected Driver: C:\Users\FREDER~1\AppData\Local\Temp\_MEI58722\drivers\winpmem64.sys
2014-11-20 23:07:03,934 - detector.service - INFO - Launching service destroyer...
2014-11-20 23:07:03,934 - detector.service - DEBUG - Unable to OpenService: (1060, 'OpenService', 'Der angegebene Dienst ist kein installierter Dienst.')
2014-11-20 23:07:03,934 - detector.service - INFO - Trying to stop the winpmem service...
2014-11-20 23:07:03,934 - detector.service - INFO - Trying to delete the winpmem service...
2014-11-20 23:07:03,936 - detector.service - DEBUG - Unable to delete the service: (6, 'DeleteService', 'Das Handle ist ung\xfcltig.')
2014-11-20 23:07:04,253 - detector.service - INFO - Trying to start the winpmem service...
2014-11-20 23:07:04,423 - detector - INFO - Service started
2014-11-20 23:07:04,424 - detector - INFO - Selected Yara signature file at C:\Users\FREDER~1\AppData\Local\Temp\_MEI58722\rules\signatures.yar
2014-11-20 23:07:04,424 - detector - INFO - Obtaining address space and generating config for volatility
2014-11-20 23:07:05,428 - detector - INFO - Address space: <volatility.plugins.addrspaces.amd64.AMD64PagedMemory object at 0x08D5B2F0>, Base: <volatility.plugins.addrspaces.win32pmem.Win32FileAddressSpace object at 0x02AB9C70>
2014-11-20 23:07:05,428 - detector - INFO - Profile: <volatility.plugins.overlays.windows.win7.Win7SP1x64 object at 0x02AB93D0>, DTB: 0x187000
2014-11-20 23:07:05,430 - detector - INFO - Starting yara scanner...
2014-11-20 23:52:11,739 - detector - WARNING - Process notepad.exe (pid: 7876) matched: Xtreme at address: 0x354016, Value:

58 00 74 00 72 00 65 00 6d 00 65 00 52 00 41 00 X.t.r.e.m.e.R.A.
54 00 2e 00 75 00 6e 00 64 00 2e 00 6e 00 6a 00 T...u.n.d...n.j.
0d 00 0a 00 35 00 32 00 20 00 34 00 31 00 20 00 ....5.2...4.1...
35 00 34 00 20 00 32 00 65 00 20 00 32 00 30 00 5.4...2.e...2.0.
20 00 34 00 34 00 20 00 36 00 39 00 20 00 36 00 ..4.4...6.9...6.
35 00 20 00 32 00 30 00 20 00 34 00 35 00 20 00 5...2.0...4.5...
36 00 65 00 20 00 37 00 34 00 20 00 37 00 37 00 6.e...7.4...7.7.
20 00 36 00 39 00 20 00 36 00 33 00 20 00 36 00 ..6.9...6.3...6.
62 00 20 00 52 00 41 00 54 00 2e 00 2e 00 44 00 b...R.A.T.....D.
69 00 65 00 2e 00 45 00 6e 00 74 00 77 00 69 00 i.e...E.n.t.w.i.
63 00 6b 00 0d 00 0a 00 36 00 63 00 20 00 36 00 c.k.....6.c...6.
35 00 20 00 37 00 32 00 20 00 32 00 30 00 20 00 5...7.2...2.0...
37 00 37 00 20 00 36 00 35 00 20 00 36 00 39 00 7.7...6.5...6.9.
20 00 37 00 33 00 20 00 36 00 35 00 20 00 36 00 ..7.3...6.5...6.
65 00 20 00 32 00 30 00 20 00 36 00 31 00 20 00 e...2.0...6.1...
37 00 35 00 20 00 37 00 33 00 20 00 36 00 34 00 7.5...7.3...6.4.

2014-11-20 23:52:37,088 - detector - INFO - Scanning finished
2014-11-20 23:52:37,088 - detector.service - INFO - Trying to stop the winpmem service...
2014-11-20 23:52:37,088 - detector.service - INFO - Trying to delete the winpmem service...
2014-11-20 23:52:37,088 - detector - INFO - Service stopped
2014-11-20 23:52:37,088 - detector - INFO - Analysis finished
         

Achja und was ich noch vergessen habe zu posten ist der log von GERM.
Ich hoffe es hilft das Problem zu finden, und danke jedem, der mir helfen will.

GMER Logfile:

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-11-21 13:06:14
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST1000LM rev.2BA3 931,51GB
Running: Gmer-19357.exe; Driver: C:\Users\FREDER~1\AppData\Local\Temp\ufloiuog.sys


---- User code sections - GMER 2.1 ----

.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                   00000000771211f5 8 bytes {JMP 0xd}
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                 0000000077121390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                        000000007712143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                        000000007712158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                000000007712191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                0000000077121b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                               0000000077121bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                  0000000077121d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                  0000000077121eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                      0000000077121edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                     0000000077121f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                    0000000077121fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                            0000000077121fd7 8 bytes {JMP 0xb}
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                        0000000077122272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                        0000000077122301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578             0000000077122792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                    00000000771227b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                  00000000771227d2 8 bytes {JMP 0x10}
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79   000000007712282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176  0000000077122890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                                                            * 2
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299          0000000077122d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367          0000000077122d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                                                            * 3
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                  0000000077123023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                      000000007712323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                      00000000771233c0 16 bytes {JMP 0x4e}
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                     0000000077123a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                     0000000077123ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197         0000000077123b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611         0000000077123d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                  0000000077124190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                            0000000077171380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                          0000000077171500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                0000000077171530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                              0000000077171650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                  0000000077171700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                  0000000077171d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                0000000077171f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                00000000771727e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312              00000000738913cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471              000000007389146b 8 bytes {JMP 0xffffffffffffffb0}
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                           00000000738916d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                             00000000738916e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                        00000000738919db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                        00000000738919fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                  0000000073891a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                    0000000073891a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                  0000000073891a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4672] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                       0000000073891a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2760] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                             0000000077171530 16 bytes [50, 48, B8, 18, 35, B4, EF, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5416] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                         0000000077171380 16 bytes [50, 48, B8, CC, E4, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken                                                                              00000000771714f0 16 bytes [50, 48, B8, 24, E4, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                  0000000077171510 48 bytes [50, 48, B8, A0, E3, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5416] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection                                                                           0000000077171550 16 bytes [50, 48, B8, F0, E4, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx                                                                            00000000771715a0 32 bytes [50, 48, B8, 48, E4, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                     00000000771715e0 16 bytes [50, 48, B8, 30, E3, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5416] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile                                                                          0000000077171680 16 bytes [50, 48, B8, 78, E4, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                   0000000077171800 16 bytes [50, 48, B8, F4, E1, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken                                                                             0000000077172270 16 bytes [50, 48, B8, C4, E3, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                                   00000000771722c0 16 bytes [50, 48, B8, 00, E4, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5416] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile                                                                      0000000077172410 16 bytes [50, 48, B8, 8C, E4, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5972] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                         0000000077171380 16 bytes [50, 48, B8, CC, E4, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken                                                                              00000000771714f0 16 bytes [50, 48, B8, 24, E4, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                  0000000077171510 48 bytes [50, 48, B8, A0, E3, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5972] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection                                                                           0000000077171550 16 bytes [50, 48, B8, F0, E4, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx                                                                            00000000771715a0 32 bytes [50, 48, B8, 48, E4, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                     00000000771715e0 16 bytes [50, 48, B8, 30, E3, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5972] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile                                                                          0000000077171680 16 bytes [50, 48, B8, 78, E4, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                   0000000077171800 16 bytes [50, 48, B8, F4, E1, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken                                                                             0000000077172270 16 bytes [50, 48, B8, C4, E3, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                                   00000000771722c0 16 bytes [50, 48, B8, 00, E4, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5972] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile                                                                      0000000077172410 16 bytes [50, 48, B8, 8C, E4, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5992] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                         0000000077171380 16 bytes [50, 48, B8, CC, E4, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5992] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken                                                                              00000000771714f0 16 bytes [50, 48, B8, 24, E4, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5992] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                  0000000077171510 48 bytes [50, 48, B8, A0, E3, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5992] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection                                                                           0000000077171550 16 bytes [50, 48, B8, F0, E4, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5992] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx                                                                            00000000771715a0 32 bytes [50, 48, B8, 48, E4, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5992] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                     00000000771715e0 16 bytes [50, 48, B8, 30, E3, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5992] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile                                                                          0000000077171680 16 bytes [50, 48, B8, 78, E4, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5992] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                   0000000077171800 16 bytes [50, 48, B8, F4, E1, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5992] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken                                                                             0000000077172270 16 bytes [50, 48, B8, C4, E3, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5992] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                                   00000000771722c0 16 bytes [50, 48, B8, 00, E4, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5992] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile                                                                      0000000077172410 16 bytes [50, 48, B8, 8C, E4, 4B, 3F, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                                        00000000771211f5 8 bytes {JMP 0xd}
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                                      0000000077121390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                             000000007712143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                             000000007712158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                     000000007712191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                                     0000000077121b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                                    0000000077121bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                       0000000077121d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                                       0000000077121eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                           0000000077121edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                          0000000077121f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                         0000000077121fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                                 0000000077121fd7 8 bytes {JMP 0xb}
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                             0000000077122272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                             0000000077122301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                                  0000000077122792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                         00000000771227b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                       00000000771227d2 8 bytes {JMP 0x10}
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                        000000007712282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176                       0000000077122890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                                                            * 2
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                               0000000077122d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                               0000000077122d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                                                            * 3
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                                       0000000077123023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                           000000007712323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                           00000000771233c0 16 bytes {JMP 0x4e}
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                          0000000077123a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                          0000000077123ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                              0000000077123b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                              0000000077123d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                       0000000077124190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                 0000000077171380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                               0000000077171500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                     0000000077171530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                   0000000077171650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                       0000000077171700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                       0000000077171d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                     0000000077171f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                     00000000771727e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                   00000000738913cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                   000000007389146b 8 bytes {JMP 0xffffffffffffffb0}
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                00000000738916d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                  00000000738916e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                             00000000738919db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                             00000000738919fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                       0000000073891a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                         0000000073891a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                       0000000073891a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6244] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                            0000000073891a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                               00000000771211f5 8 bytes {JMP 0xd}
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                             0000000077121390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                    000000007712143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                    000000007712158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                            000000007712191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                            0000000077121b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                           0000000077121bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                              0000000077121d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                              0000000077121eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                  0000000077121edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                 0000000077121f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                0000000077121fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                        0000000077121fd7 8 bytes {JMP 0xb}
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                    0000000077122272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                    0000000077122301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                         0000000077122792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                00000000771227b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                              00000000771227d2 8 bytes {JMP 0x10}
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79               000000007712282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176              0000000077122890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                                                            * 2
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                      0000000077122d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                      0000000077122d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                                                            * 3
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                              0000000077123023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                  000000007712323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                  00000000771233c0 16 bytes {JMP 0x4e}
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                 0000000077123a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                 0000000077123ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                     0000000077123b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                     0000000077123d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                              0000000077124190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                        0000000077171380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                      0000000077171500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                            0000000077171530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                          0000000077171650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                              0000000077171700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                              0000000077171d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                            0000000077171f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                            00000000771727e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                          00000000738913cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                          000000007389146b 8 bytes {JMP 0xffffffffffffffb0}
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                       00000000738916d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                         00000000738916e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                    00000000738919db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                    00000000738919fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                              0000000073891a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                0000000073891a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                              0000000073891a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe[6560] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                   0000000073891a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                                             00000000771211f5 8 bytes {JMP 0xd}
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                                           0000000077121390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                  000000007712143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                                  000000007712158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                          000000007712191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                                          0000000077121b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                                         0000000077121bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                            0000000077121d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                                            0000000077121eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                0000000077121edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                               0000000077121f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                              0000000077121fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                                      0000000077121fd7 8 bytes {JMP 0xb}
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                                  0000000077122272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                                  0000000077122301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                                       0000000077122792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                              00000000771227b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                            00000000771227d2 8 bytes {JMP 0x10}
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                             000000007712282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176                            0000000077122890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                                                            * 2
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                    0000000077122d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                                    0000000077122d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                                                            * 3
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                                            0000000077123023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                000000007712323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                                00000000771233c0 16 bytes {JMP 0x4e}
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                               0000000077123a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                               0000000077123ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                   0000000077123b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                                   0000000077123d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                            0000000077124190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                      0000000077171380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                    0000000077171500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                          0000000077171530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                        0000000077171650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                            0000000077171700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                            0000000077171d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                          0000000077171f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                          00000000771727e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                        00000000738913cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                        000000007389146b 8 bytes {JMP 0xffffffffffffffb0}
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                     00000000738916d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                       00000000738916e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                  00000000738919db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                  00000000738919fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                            0000000073891a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                              0000000073891a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                            0000000073891a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6644] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                                 0000000073891a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                                       00000000771211f5 8 bytes {JMP 0xd}
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                                     0000000077121390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                            000000007712143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                            000000007712158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                    000000007712191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                                    0000000077121b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                                   0000000077121bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                      0000000077121d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                                      0000000077121eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                          0000000077121edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                         0000000077121f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                        0000000077121fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                                0000000077121fd7 8 bytes {JMP 0xb}
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                            0000000077122272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                            0000000077122301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                                 0000000077122792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                        00000000771227b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                      00000000771227d2 8 bytes {JMP 0x10}
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                       000000007712282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176                      0000000077122890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                                                            * 2
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                              0000000077122d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                              0000000077122d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                                                            * 3
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                                      0000000077123023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                          000000007712323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                          00000000771233c0 16 bytes {JMP 0x4e}
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                         0000000077123a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                         0000000077123ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                             0000000077123b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                             0000000077123d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                      0000000077124190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                0000000077171380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                              0000000077171500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                    0000000077171530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                  0000000077171650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                      0000000077171700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                      0000000077171d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                    0000000077171f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                    00000000771727e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                  00000000738913cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                  000000007389146b 8 bytes {JMP 0xffffffffffffffb0}
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                               00000000738916d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                 00000000738916e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                            00000000738919db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                            00000000738919fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                      0000000073891a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                        0000000073891a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                      0000000073891a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe[6712] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                           0000000073891a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                                                   00000000771211f5 8 bytes {JMP 0xd}
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                                                 0000000077121390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                        000000007712143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                                        000000007712158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                000000007712191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                                                0000000077121b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                                               0000000077121bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                  0000000077121d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                                                  0000000077121eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                      0000000077121edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                                     0000000077121f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                                    0000000077121fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                                            0000000077121fd7 8 bytes {JMP 0xb}
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                                        0000000077122272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                                        0000000077122301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                                             0000000077122792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                    00000000771227b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                  00000000771227d2 8 bytes {JMP 0x10}
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                   000000007712282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176                                  0000000077122890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                                                            * 2
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                          0000000077122d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                                          0000000077122d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                                                            * 3
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                                                  0000000077123023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                      000000007712323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                                      00000000771233c0 16 bytes {JMP 0x4e}
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                     0000000077123a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                     0000000077123ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                         0000000077123b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                                         0000000077123d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                  0000000077124190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                            0000000077171380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                          0000000077171500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                0000000077171530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                              0000000077171650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                  0000000077171700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                  0000000077171d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                0000000077171f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                00000000771727e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                              00000000738913cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                              000000007389146b 8 bytes {JMP 0xffffffffffffffb0}
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                           00000000738916d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                             00000000738916e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                        00000000738919db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                        00000000738919fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                                  0000000073891a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                                    0000000073891a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                  0000000073891a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                                       0000000073891a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                         0000000075d61401 2 bytes JMP 7510b21b C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                           0000000075d61419 2 bytes JMP 7510b346 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                         0000000075d61431 2 bytes JMP 75188ea9 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                         0000000075d6144a 2 bytes CALL 750e48ad C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                                                                            * 9
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                            0000000075d614dd 2 bytes JMP 751887a2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                     0000000075d614f5 2 bytes JMP 75188978 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                            0000000075d6150d 2 bytes JMP 75188698 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                     0000000075d61525 2 bytes JMP 75188a62 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                           0000000075d6153d 2 bytes JMP 750ffca8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                0000000075d61555 2 bytes JMP 751068ef C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                         0000000075d6156d 2 bytes JMP 75188f61 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                           0000000075d61585 2 bytes JMP 75188ac2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                              0000000075d6159d 2 bytes JMP 7518865c C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                           0000000075d615b5 2 bytes JMP 750ffd41 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                         0000000075d615cd 2 bytes JMP 7510b2dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                     0000000075d616b2 2 bytes JMP 75188e24 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[6780] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                     0000000075d616bd 2 bytes JMP 751885f1 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                                             00000000771211f5 8 bytes {JMP 0xd}
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                                           0000000077121390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                  000000007712143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                                  000000007712158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                          000000007712191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                                          0000000077121b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                                         0000000077121bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                            0000000077121d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                                            0000000077121eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                0000000077121edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                               0000000077121f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                              0000000077121fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                                      0000000077121fd7 8 bytes {JMP 0xb}
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                                  0000000077122272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                                  0000000077122301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                                       0000000077122792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                              00000000771227b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                            00000000771227d2 8 bytes {JMP 0x10}
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                             000000007712282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176                            0000000077122890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                                                            * 2
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                    0000000077122d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                                    0000000077122d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                                                            * 3
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                                            0000000077123023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                000000007712323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                                00000000771233c0 16 bytes {JMP 0x4e}
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                               0000000077123a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                               0000000077123ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                   0000000077123b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                                   0000000077123d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                            0000000077124190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                      0000000077171380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                    0000000077171500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                          0000000077171530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                        0000000077171650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                            0000000077171700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                            0000000077171d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                          0000000077171f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                          00000000771727e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                        00000000738913cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                        000000007389146b 8 bytes {JMP 0xffffffffffffffb0}
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                     00000000738916d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                       00000000738916e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                  00000000738919db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                  00000000738919fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                            0000000073891a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                              0000000073891a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                            0000000073891a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[7000] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                                 0000000073891a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3228] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                         0000000077171380 16 bytes [50, 48, B8, CC, E4, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3228] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken                                                                              00000000771714f0 16 bytes [50, 48, B8, 24, E4, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3228] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                  0000000077171510 48 bytes [50, 48, B8, A0, E3, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3228] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection                                                                           0000000077171550 16 bytes [50, 48, B8, F0, E4, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3228] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx                                                                            00000000771715a0 32 bytes [50, 48, B8, 48, E4, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3228] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                     00000000771715e0 16 bytes [50, 48, B8, 30, E3, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3228] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile                                                                          0000000077171680 16 bytes [50, 48, B8, 78, E4, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3228] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                   0000000077171800 16 bytes [50, 48, B8, F4, E1, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3228] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken                                                                             0000000077172270 16 bytes [50, 48, B8, C4, E3, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3228] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                                   00000000771722c0 16 bytes [50, 48, B8, 00, E4, 4B, 3F, ...]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3228] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile                                                                      0000000077172410 16 bytes [50, 48, B8, 8C, E4, 4B, 3F, ...]
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                                                                                  00000000771211f5 8 bytes {JMP 0xd}
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                                                                                0000000077121390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                                       000000007712143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                                                                       000000007712158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                                               000000007712191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                                                                               0000000077121b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                                                                              0000000077121bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                                                 0000000077121d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                                                                                 0000000077121eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                                                     0000000077121edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                                                                    0000000077121f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                                                                   0000000077121fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                                                                           0000000077121fd7 8 bytes {JMP 0xb}
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                                                                       0000000077122272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                                                                       0000000077122301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                                                                            0000000077122792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                                                   00000000771227b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                                                 00000000771227d2 8 bytes {JMP 0x10}
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                                                  000000007712282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176                                                                 0000000077122890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                                                            * 2
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                                         0000000077122d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                                                                         0000000077122d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                                                            * 3
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                                                                                 0000000077123023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                                                     000000007712323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                                                                     00000000771233c0 16 bytes {JMP 0x4e}
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                                                    0000000077123a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                                                    0000000077123ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                                                        0000000077123b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                                                                        0000000077123d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                                                 0000000077124190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                                           0000000077171380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                                         0000000077171500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                               0000000077171530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                             0000000077171650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                                 0000000077171700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                                 0000000077171d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                               0000000077171f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                               00000000771727e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                                             00000000738913cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                                             000000007389146b 8 bytes {JMP 0xffffffffffffffb0}
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                                          00000000738916d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                                                            00000000738916e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                                       00000000738919db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                                       00000000738919fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                                                                 0000000073891a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                                                                   0000000073891a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                                                 0000000073891a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Frederick\Desktop\Gmer-19357.exe[4504] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                                                                      0000000073891a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

---- Registry - GMER 2.1 ----

Reg    HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\20689d7aec72                                                                                                                    
Reg    HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\20689d7aec72 (not active ControlSet)                                                                                                

---- EOF - GMER 2.1 ----
         

--- --- ---

Rechner ist sauber

Puhh da bin ich ja erleichtert
super herzlichsten Dank von meiner Seite.
Aber warum gibt dann Detekt solche Auskünfte wenn es garnicht stimmt?
Ist das mal wieder nur Panikmache?

genau das ist es, gepaart mit Unfähigkeit.

Super ich danke dir wirklich von ganzen Herzen für deinen super Support
Lg
Angel

Gern Geschehen