Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: Back to Desktop + ladender Mauszeiger

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 23.05.2015, 21:33   #1
Kaprisonne
 
Back to Desktop + ladender Mauszeiger - Standard

Back to Desktop + ladender Mauszeiger



Hallo,

Ich werde beim Spielen von Witcher 3 in unregelmäßigen Abständen (~30-60 min) zurück auf zum Desktop geschickt und der Mauszeiger lässt auf das Ausführen eines Programmes schließen(blauer Ladering). Das Spiel wird nicht beendet und ich kann auch sofort wieder reintabben. Weiß nicht ob es am Spiel liegt, aber ich habe noch von keinen ähnlichen Problemen gehört.. Kaspersky findet nichts.

Defogger wurde ohne Probleme ausgeführt.

Hier meine Logs:

FRST.txt:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 22-05-2015 01
Ran by Jannik (administrator) on JANNIK-PC on 23-05-2015 21:12:35
Running from C:\Users\Jannik\Desktop
Loaded Profiles: Jannik (Available Profiles: Jannik)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\avp.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\avpui.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Nota Inc.) C:\Program Files (x86)\Gyazo\GyStation.exe
(Akamai Technologies, Inc.) C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe
(Flux Software LLC) C:\Users\Jannik\AppData\Local\FluxSoftware\Flux\flux.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_YATIKAE.EXE
(Akamai Technologies, Inc.) C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe
(EIZO Corporation) C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe
(Dropbox, Inc.) C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM-x32\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2685072 2015-05-08] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-03-27] (Intel Corporation)
HKU\S-1-5-21-4043579312-2739093779-986575188-1000\...\Run: [Gyazo] => C:\Program Files (x86)\Gyazo\GyStation.exe [3293288 2013-08-02] (Nota Inc.)
HKU\S-1-5-21-4043579312-2739093779-986575188-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2888384 2015-05-15] (Valve Corporation)
HKU\S-1-5-21-4043579312-2739093779-986575188-1000\...\Run: [GarenaPlus] => "C:\Program Files (x86)\Garena Plus\GarenaMessenger.exe" -autolaunch
HKU\S-1-5-21-4043579312-2739093779-986575188-1000\...\Run: [Akamai NetSession Interface] => C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-30] (Akamai Technologies, Inc.)
HKU\S-1-5-21-4043579312-2739093779-986575188-1000\...\Run: [GoogleChromeAutoLaunch_5C32303875095B3A38033A6F03B4CED8] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [813896 2015-05-13] (Google Inc.)
HKU\S-1-5-21-4043579312-2739093779-986575188-1000\...\Run: [f.lux] => C:\Users\Jannik\AppData\Local\FluxSoftware\Flux\flux.exe [1017224 2013-10-24] (Flux Software LLC)
HKU\S-1-5-21-4043579312-2739093779-986575188-1000\...\Run: [GalaxyClient] => C:\Program Files (x86)\GalaxyClient\GalaxyClient.exe [7435320 2015-05-23] (GOG.com)
HKU\S-1-5-21-4043579312-2739093779-986575188-1000\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIKAE.EXE [298560 2013-09-12] (SEIKO EPSON CORPORATION)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2013-08-07] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ScreenManager Pro for LCD (DDCCI) Ver.2.4.0.lnk [2014-08-09]
ShortcutTarget: ScreenManager Pro for LCD (DDCCI) Ver.2.4.0.lnk -> C:\Windows\Installer\{DAB265AD-27B2-4651-B8D8-F4F3A8ECC705}\LcdctrlDdcci.exe1_A2457035AC9A449AAFF91D310EF3707A.exe (Macrovision Corporation)
Startup: C:\Users\Jannik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2014-08-05]
ShortcutTarget: Dropbox.lnk -> C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jannik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jannik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jannik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jannik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jannik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jannik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jannik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jannik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.mysearchdial.com/?f=1&a=MSD2&cd=2XzuyEtN2Y1L1QzuzytDtB0BtAyE0DyE0CtD0Bzz0D0DyDyDtN0D0Tzu0CyBzzzztN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=755617206&ir=
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.mysearchdial.com/?f=1&a=MSD2&cd=2XzuyEtN2Y1L1QzuzytDtB0BtAyE0DyE0CtD0Bzz0D0DyDyDtN0D0Tzu0CyBzzzztN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=755617206&ir=
HKU\S-1-5-21-4043579312-2739093779-986575188-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=MSD2&cd=2XzuyEtN2Y1L1QzuzytDtB0BtAyE0DyE0CtD0Bzz0D0DyDyDtN0D0Tzu0CyBzzzztN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=755617206&ir=
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=MSD2&cd=2XzuyEtN2Y1L1QzuzytDtB0BtAyE0DyE0CtD0Bzz0D0DyDyDtN0D0Tzu0CyBzzzztN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=755617206&ir=
SearchScopes: HKU\S-1-5-21-4043579312-2739093779-986575188-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=MSD2&cd=2XzuyEtN2Y1L1QzuzytDtB0BtAyE0DyE0CtD0Bzz0D0DyDyDtN0D0Tzu0CyBzzzztN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=755617206&ir=
SearchScopes: HKU\S-1-5-21-4043579312-2739093779-986575188-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=MSD2&cd=2XzuyEtN2Y1L1QzuzytDtB0BtAyE0DyE0CtD0Bzz0D0DyDyDtN0D0Tzu0CyBzzzztN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=755617206&ir=
BHO: Virtual Keyboard Plugin -> {4A66AD60-A03D-4D01-86F0-5F0F7C0EF1AD} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\x64\IEExt\ie_plugin.dll [2014-12-23] (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll [2014-11-30] (Oracle Corporation)
BHO: Content Blocker Plugin -> {93BC2EA7-2F17-4729-948A-D2E03FFB2412} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\x64\IEExt\ie_plugin.dll [2014-12-23] (Kaspersky Lab ZAO)
BHO: Safe Money Plugin -> {AB379017-4C03-4E00-8EDF-E6D6AF7CCF82} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\x64\IEExt\ie_plugin.dll [2014-12-23] (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2012-10-01] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-11-30] (Oracle Corporation)
BHO-x32: Virtual Keyboard Plugin -> {4A66AD60-A03D-4D01-86F0-5F0F7C0EF1AD} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\IEExt\ie_plugin.dll [2014-12-23] (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll [2014-10-28] (Oracle Corporation)
BHO-x32: Content Blocker Plugin -> {93BC2EA7-2F17-4729-948A-D2E03FFB2412} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\IEExt\ie_plugin.dll [2014-12-23] (Kaspersky Lab ZAO)
BHO-x32: Safe Money Plugin -> {AB379017-4C03-4E00-8EDF-E6D6AF7CCF82} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\IEExt\ie_plugin.dll [2014-12-23] (Kaspersky Lab ZAO)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2012-10-01] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2012-10-01] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-10-28] (Oracle Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2012-10-01] (Microsoft Corporation)
Tcpip\..\Interfaces\{25B6911B-C9DA-47BF-9AA9-AF5466213304}: [NameServer] 192.168.6.1
Tcpip\..\Interfaces\{F2F8EB4A-CDA3-4ED8-8051-167C065378C4}: [NameServer] 192.168.6.1

FireFox:
========
FF ProfilePath: C:\Users\Jannik\AppData\Roaming\Mozilla\Firefox\Profiles\4k2j71og.default-1415316742647
FF NetworkProxy: "http", "72.159.148.20"
FF NetworkProxy: "http_port", 10000
FF NetworkProxy: "share_proxy_settings", true
FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2014-11-30] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2014-11-30] (Oracle Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.7 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2013-06-11] (VideoLAN)
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2014-10-28] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2014-10-28] (Oracle Corporation)
FF Plugin-x32: @kaspersky.com/content_blocker_663BE84DBCC949E88C7600F63CA7F098 -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\FFExt\content_blocker@kaspersky.com [2015-05-17] ()
FF Plugin-x32: @kaspersky.com/online_banking_08806E753BE44495B44E90AA2513BDC5 -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\FFExt\online_banking@kaspersky.com [2015-05-17] ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard_07402848C2F6470194F131B0F3DE025E -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\FFExt\virtual_keyboard@kaspersky.com [2015-05-17] ()
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-05-12] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-05-12] (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @t.garena.com/garenatalk -> C:\Program Files (x86)\Garena Plus\bbtalk\plugins\npPlugin\npGarenaTalkPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-16] (Google Inc.)
FF user.js: detected! => C:\Users\Jannik\AppData\Roaming\Mozilla\Firefox\Profiles\4k2j71og.default-1415316742647\user.js [2015-05-21]
FF Extension: FoxyProxy Standard - C:\Users\Jannik\AppData\Roaming\Mozilla\Firefox\Profiles\4k2j71og.default-1415316742647\Extensions\foxyproxy@eric.h.jung [2015-04-13]
FF Extension: YouTube Unblocker - C:\Users\Jannik\AppData\Roaming\Mozilla\Firefox\Profiles\4k2j71og.default-1415316742647\Extensions\youtubeunblocker@unblocker.yt [2015-04-13]
FF Extension: Proxy-Listen.de - Proxyswitcher - C:\Users\Jannik\AppData\Roaming\Mozilla\Firefox\Profiles\4k2j71og.default-1415316742647\Extensions\admin@proxy-listen.de.xpi [2015-04-13]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker_663BE84DBCC949E88C7600F63CA7F098@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\FFExt\content_blocker@kaspersky.com
FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\FFExt\content_blocker@kaspersky.com [2015-05-17]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard_07402848C2F6470194F131B0F3DE025E@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\FFExt\virtual_keyboard@kaspersky.com [2015-05-17]
FF HKLM-x32\...\Firefox\Extensions: [online_banking_08806E753BE44495B44E90AA2513BDC5@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\FFExt\online_banking@kaspersky.com [2015-05-17]

Chrome: 
=======
CHR Profile: C:\Users\Jannik\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Jannik\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-03-30]
CHR Extension: (Google Docs) - C:\Users\Jannik\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-03-30]
CHR Extension: (Google Drive) - C:\Users\Jannik\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-03-30]
CHR Extension: (YouTube) - C:\Users\Jannik\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-03-30]
CHR Extension: (FlashBlock) - C:\Users\Jannik\AppData\Local\Google\Chrome\User Data\Default\Extensions\cdngiadmnkhgemkimkhiilgffbjijcie [2015-04-05]
CHR Extension: (Adblock Plus) - C:\Users\Jannik\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2015-04-13]
CHR Extension: (Google Search) - C:\Users\Jannik\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-03-30]
CHR Extension: (Kaspersky Protection) - C:\Users\Jannik\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbhjdbfgekjfcfkkfjjmlmojhbllhbho [2015-05-17]
CHR Extension: (Google Sheets) - C:\Users\Jannik\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-03-30]
CHR Extension: (Bookmark Manager) - C:\Users\Jannik\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-22]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Jannik\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-30]
CHR Extension: (Google Wallet) - C:\Users\Jannik\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-03-30]
CHR Extension: (Gmail) - C:\Users\Jannik\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-30]
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVP15.0.2; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\avp.exe [193400 2014-12-23] (Kaspersky Lab ZAO)
R2 DiagTrack; C:\Windows\system32\diagtrack.dll [1254400 2015-04-27] (Microsoft Corporation)
S3 GalaxyClientService; C:\Program Files (x86)\GalaxyClient\GalaxyClientService.exe [1743928 2015-05-23] (GOG.com)
S3 GalaxyCommunication; C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe [6516792 2015-05-23] (GOG.com)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1152656 2015-05-08] (NVIDIA Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1884304 2015-05-08] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [22997648 2015-05-08] (NVIDIA Corporation)
S3 PAExec; C:\Windows\PAExec.exe [207872 2015-05-12] (Power Admin LLC) []
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-09-30] ()
S3 TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [792016 2015-02-09] (Tunngle.net GmbH)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R0 cm_km_w; C:\Windows\System32\DRIVERS\cm_km_w.sys [238288 2013-01-14] (Kaspersky Lab UK Ltd)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [468576 2014-03-31] (Kaspersky Lab ZAO)
R2 kldisk; C:\Windows\System32\DRIVERS\kldisk.sys [56008 2015-05-17] (Kaspersky Lab ZAO)
R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [151240 2014-11-28] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [245960 2014-10-22] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [842440 2015-05-17] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [30920 2014-10-10] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [30920 2014-10-30] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [57032 2014-10-09] (Kaspersky Lab ZAO)
R1 Klwtp; C:\Windows\System32\DRIVERS\klwtp.sys [77000 2014-11-22] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [181960 2014-11-10] (Kaspersky Lab ZAO)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-05-08] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2015-04-09] (NVIDIA Corporation)
S3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [31232 2009-09-16] (Tunngle.net)
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2014-05-17] (Anchorfree Inc.)
S3 xb1usb; C:\Windows\System32\DRIVERS\xb1usb.sys [34016 2014-05-27] (Microsoft Corporation)
S3 BTCFilterService; system32\DRIVERS\motfilt.sys [X]
S3 GGSAFERDriver; \??\C:\Program Files (x86)\Garena Plus\Room\safedrv.sys [X]
S3 motandroidusb; System32\Drivers\motoandroid.sys [X]
S3 motccgp; system32\DRIVERS\motccgp.sys [X]
S3 motccgpfl; system32\DRIVERS\motccgpfl.sys [X]
S3 MotoSwitchService; system32\DRIVERS\motswch.sys [X]
S3 Motousbnet; system32\DRIVERS\Motousbnet.sys [X]
S3 motusbdevice; system32\DRIVERS\motusbdevice.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-05-23 21:12 - 2015-05-23 21:12 - 00023338 _____ () C:\Users\Jannik\Desktop\FRST.txt
2015-05-23 21:12 - 2015-05-23 21:12 - 00000000 ____D () C:\FRST
2015-05-23 21:11 - 2015-05-23 21:11 - 00000474 _____ () C:\Users\Jannik\Desktop\defogger_disable.log
2015-05-23 21:11 - 2015-05-23 21:11 - 00000112 _____ () C:\Users\Jannik\Desktop\Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten- - Trojaner-Board.url
2015-05-23 21:11 - 2015-05-23 21:11 - 00000000 _____ () C:\Users\Jannik\defogger_reenable
2015-05-23 21:10 - 2015-05-23 21:10 - 02108416 _____ (Farbar) C:\Users\Jannik\Desktop\FRST64.exe
2015-05-23 21:10 - 2015-05-23 21:10 - 00380416 _____ () C:\Users\Jannik\Desktop\Gmer-19357.exe
2015-05-22 16:15 - 2015-05-22 16:15 - 00000220 _____ () C:\Users\Jannik\Desktop\Sid Meier's Civilization V.url
2015-05-21 20:27 - 2015-05-21 20:27 - 00000081 _____ () C:\Users\Jannik\Desktop\My amazing girlfriend gives the best handjob.mp4 - Pornhub.com.url
2015-05-21 07:14 - 2015-05-21 07:14 - 00000072 _____ () C:\Users\Jannik\Desktop\de.spankbang.com-2lqq-video-rachel+fb18.url
2015-05-20 01:43 - 2015-05-20 01:43 - 00000079 _____ () C:\Users\Jannik\Desktop\abiunity - Vorabi- Nationalsozialismus und Krise der Römischen Republik.url
2015-05-20 01:43 - 2015-05-20 01:43 - 00000079 _____ () C:\Users\Jannik\Desktop\abiunity - Geschichte mündlich.url
2015-05-20 01:42 - 2015-05-20 01:42 - 00000079 _____ () C:\Users\Jannik\Desktop\abiunity - Rahmenthema 4 ''Mythen''.url
2015-05-20 01:21 - 2015-05-20 01:21 - 00000069 _____ () C:\Users\Jannik\Desktop\Lil Dicky - Ex-Boyfriend (Official Video) - YouTube.url
2015-05-18 23:59 - 2015-05-23 14:24 - 00000000 ____D () C:\Users\Jannik\Documents\The Witcher 3
2015-05-18 23:59 - 2015-05-18 23:59 - 00000000 ____D () C:\Users\Jannik\AppData\Local\GalaxyCommunicationService
2015-05-18 18:04 - 2015-05-18 18:04 - 00000058 _____ () C:\Users\Jannik\Desktop\MRW I lose my precious but hear a hobbit in the distance - Imgur.url
2015-05-18 17:39 - 2015-05-12 04:34 - 00571024 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2015-05-18 17:38 - 2015-05-13 08:52 - 00195912 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys
2015-05-18 17:38 - 2015-05-13 08:52 - 00031552 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 42718864 _____ () C:\Windows\system32\nvcompiler.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 37741712 _____ () C:\Windows\SysWOW64\nvcompiler.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 30478992 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 22945424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 17540416 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 16145176 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 15858728 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 14455296 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 13263568 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 11790144 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 10972304 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2015-05-18 17:38 - 2015-05-12 08:27 - 02932368 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 02599056 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 01898312 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6435286.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 01557648 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6435286.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 01099808 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 01059984 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 01050256 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 00982672 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 00974480 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 00939080 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 00502896 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 00408208 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 00407296 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 00364176 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 00176064 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 00154256 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 00150832 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2015-05-18 17:38 - 2015-05-12 08:27 - 00128512 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2015-05-17 20:39 - 2015-05-17 20:39 - 00000060 _____ () C:\Users\Jannik\Desktop\RocketBeansTV - Twitch.url
2015-05-17 20:34 - 2015-05-23 13:48 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2015-05-17 20:34 - 2015-05-17 20:40 - 00842440 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2015-05-17 20:34 - 2015-05-17 20:34 - 00002330 _____ () C:\Users\Jannik\Desktop\Sicherer Zahlungsverkehr.lnk
2015-05-17 20:34 - 2015-05-17 20:34 - 00002140 _____ () C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
2015-05-17 20:34 - 2015-05-17 20:34 - 00000000 ____D () C:\Windows\ELAMBKUP
2015-05-17 20:34 - 2015-05-17 20:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security
2015-05-17 20:34 - 2015-05-17 20:34 - 00000000 ____D () C:\Program Files (x86)\Kaspersky Lab
2015-05-17 20:34 - 2014-10-22 21:13 - 00245960 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klhk.sys
2015-05-17 20:34 - 2013-05-06 08:13 - 00110176 _____ (Kaspersky Lab ZAO) C:\Windows\system32\klfphc.dll
2015-05-17 20:31 - 2015-05-17 20:31 - 00097709 _____ () C:\ProgramData\1431887412.bdinstall.bin
2015-05-17 20:30 - 2015-05-17 20:30 - 00037824 _____ () C:\ProgramData\1431887411.bdinstall.bin
2015-05-15 18:01 - 2015-05-23 21:01 - 00000911 _____ () C:\Windows\Tasks\EPSON WF-7620 Series Update {CCDB001A-670E-49E6-A899-CE6982815934}.job
2015-05-15 18:01 - 2015-05-23 21:01 - 00000725 _____ () C:\Windows\Tasks\EPSON WF-7620 Series Invitation {CCDB001A-670E-49E6-A899-CE6982815934}.job
2015-05-15 18:01 - 2015-05-15 19:01 - 00000000 ____D () C:\ProgramData\EPSON
2015-05-15 18:01 - 2015-05-15 18:01 - 00003978 _____ () C:\Windows\System32\Tasks\EPSON WF-7620 Series Update {CCDB001A-670E-49E6-A899-CE6982815934}
2015-05-15 18:01 - 2015-05-15 18:01 - 00003792 _____ () C:\Windows\System32\Tasks\EPSON WF-7620 Series Invitation {CCDB001A-670E-49E6-A899-CE6982815934}
2015-05-15 18:01 - 2015-05-15 18:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON
2015-05-15 18:01 - 2015-05-15 18:01 - 00000000 ____D () C:\Program Files\Common Files\EPSON
2015-05-15 18:01 - 2013-10-22 04:04 - 00179712 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\E_YLMBKAE.DLL
2015-05-15 18:01 - 2011-03-15 03:03 - 00083968 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\E_YD4BKAE.DLL
2015-05-15 18:01 - 2007-04-10 01:06 - 00010752 _____ (SEIKO EPSON CORP.) C:\Windows\system32\E_GCINST.DLL
2015-05-15 00:47 - 2015-05-15 00:47 - 00000086 _____ () C:\Users\Jannik\Desktop\Golden Goal Videobrille Fotball Video Glasses Football - YouTube.url
2015-05-15 00:23 - 2015-05-15 00:23 - 00000994 _____ () C:\Users\Jannik\Desktop\Neues Textdokument.txt
2015-05-14 19:18 - 2015-05-14 19:24 - 00000000 ____D () C:\Users\Jannik\Documents\Mount&Blade Warband Savegames
2015-05-14 19:17 - 2015-05-14 19:22 - 00000000 ____D () C:\Users\Jannik\Documents\Mount&Blade Warband
2015-05-14 19:17 - 2015-05-14 19:17 - 00000000 ____D () C:\Users\Jannik\AppData\Roaming\Mount&Blade Warband
2015-05-14 18:07 - 2015-05-14 18:07 - 00000050 _____ () C:\Users\Jannik\Desktop\isi - ask.fm-isi_isabel.url
2015-05-14 02:42 - 2015-05-01 15:17 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-14 02:42 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 10:49 - 2015-05-05 03:29 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-13 10:49 - 2015-05-05 03:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-05-13 10:49 - 2015-04-22 04:28 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-13 10:49 - 2015-04-22 03:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-05-13 10:49 - 2015-04-21 19:14 - 24971776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-13 10:49 - 2015-04-21 19:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-05-13 10:49 - 2015-04-21 19:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-05-13 10:49 - 2015-04-21 18:51 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-05-13 10:49 - 2015-04-21 18:50 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-13 10:49 - 2015-04-21 18:50 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-13 10:49 - 2015-04-21 18:50 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-05-13 10:49 - 2015-04-21 18:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-13 10:49 - 2015-04-21 18:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-05-13 10:49 - 2015-04-21 18:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-05-13 10:49 - 2015-04-21 18:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-05-13 10:49 - 2015-04-21 18:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-13 10:49 - 2015-04-21 18:35 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-13 10:49 - 2015-04-21 18:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-05-13 10:49 - 2015-04-21 18:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-05-13 10:49 - 2015-04-21 18:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-05-13 10:49 - 2015-04-21 18:31 - 06025728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-13 10:49 - 2015-04-21 18:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-05-13 10:49 - 2015-04-21 18:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-05-13 10:49 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-05-13 10:49 - 2015-04-21 18:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-05-13 10:49 - 2015-04-21 18:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-05-13 10:49 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-05-13 10:49 - 2015-04-21 18:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-05-13 10:49 - 2015-04-21 18:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-05-13 10:49 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-05-13 10:49 - 2015-04-21 18:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-05-13 10:49 - 2015-04-21 18:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-13 10:49 - 2015-04-21 18:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-05-13 10:49 - 2015-04-21 18:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-13 10:49 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-05-13 10:49 - 2015-04-21 18:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-05-13 10:49 - 2015-04-21 18:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-05-13 10:49 - 2015-04-21 18:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-05-13 10:49 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-05-13 10:49 - 2015-04-21 17:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-05-13 10:49 - 2015-04-21 17:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-05-13 10:49 - 2015-04-21 17:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-13 10:49 - 2015-04-21 17:49 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-13 10:49 - 2015-04-21 17:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-05-13 10:49 - 2015-04-21 17:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-05-13 10:49 - 2015-04-21 17:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-13 10:49 - 2015-04-21 17:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-05-13 10:49 - 2015-04-21 17:40 - 14401536 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-13 10:49 - 2015-04-21 17:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-05-13 10:49 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-05-13 10:49 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-05-13 10:49 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-05-13 10:49 - 2015-04-21 17:27 - 02352128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-13 10:49 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-05-13 10:49 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-05-13 10:49 - 2015-04-21 17:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-05-13 10:49 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-05-13 10:49 - 2015-04-21 17:15 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-13 10:49 - 2015-04-21 17:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-13 10:49 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-05-13 10:49 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-05-13 10:49 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-05-13 10:49 - 2015-04-18 05:10 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-13 10:49 - 2015-04-18 04:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-05-13 10:48 - 2015-04-27 21:28 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-05-13 10:48 - 2015-04-27 21:28 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-05-13 10:48 - 2015-04-27 21:28 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-05-13 10:48 - 2015-04-27 21:26 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 01254400 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-05-13 10:48 - 2015-04-27 21:23 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-05-13 10:48 - 2015-04-27 21:22 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-05-13 10:48 - 2015-04-27 21:22 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-05-13 10:48 - 2015-04-27 21:22 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-05-13 10:48 - 2015-04-27 21:22 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-05-13 10:48 - 2015-04-27 21:22 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-05-13 10:48 - 2015-04-27 21:22 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-05-13 10:48 - 2015-04-27 21:22 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-05-13 10:48 - 2015-04-27 21:22 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-05-13 10:48 - 2015-04-27 21:22 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-05-13 10:48 - 2015-04-27 21:21 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-05-13 10:48 - 2015-04-27 21:18 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-05-13 10:48 - 2015-04-27 21:18 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 21:11 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-05-13 10:48 - 2015-04-27 21:11 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-05-13 10:48 - 2015-04-27 21:08 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-05-13 10:48 - 2015-04-27 21:05 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-05-13 10:48 - 2015-04-27 21:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-05-13 10:48 - 2015-04-27 21:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-05-13 10:48 - 2015-04-27 21:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-05-13 10:48 - 2015-04-27 21:05 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2015-05-13 10:48 - 2015-04-27 21:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-05-13 10:48 - 2015-04-27 21:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-05-13 10:48 - 2015-04-27 21:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-05-13 10:48 - 2015-04-27 21:05 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-05-13 10:48 - 2015-04-27 21:04 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-05-13 10:48 - 2015-04-27 21:04 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-05-13 10:48 - 2015-04-27 21:04 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2015-05-13 10:48 - 2015-04-27 21:04 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2015-05-13 10:48 - 2015-04-27 21:04 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe
2015-05-13 10:48 - 2015-04-27 21:04 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2015-05-13 10:48 - 2015-04-27 21:04 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-05-13 10:48 - 2015-04-27 21:04 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-05-13 10:48 - 2015-04-27 21:03 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-05-13 10:48 - 2015-04-27 21:03 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-05-13 10:48 - 2015-04-27 21:03 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-05-13 10:48 - 2015-04-27 21:03 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-05-13 10:48 - 2015-04-27 21:03 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe
2015-05-13 10:48 - 2015-04-27 21:03 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-05-13 10:48 - 2015-04-27 21:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-05-13 10:48 - 2015-04-27 21:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 20:06 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-05-13 10:48 - 2015-04-27 19:57 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-05-13 10:48 - 2015-04-27 19:57 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-05-13 10:48 - 2015-04-27 19:55 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 19:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-05-13 10:48 - 2015-04-27 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-05-13 10:48 - 2015-04-13 05:28 - 00328704 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-13 10:44 - 2015-04-20 05:17 - 01647104 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-13 10:44 - 2015-04-20 05:17 - 01179136 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-13 10:44 - 2015-04-20 04:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-05-13 10:44 - 2015-04-20 04:11 - 03204608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-13 10:44 - 2015-04-08 05:29 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-05-13 10:44 - 2015-04-08 05:29 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-05-13 10:44 - 2015-04-08 05:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-05-13 10:44 - 2015-03-04 06:41 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-05-13 10:44 - 2015-03-04 06:41 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll
2015-05-13 10:44 - 2015-03-04 06:41 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-05-13 10:44 - 2015-03-04 06:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll
2015-05-13 10:44 - 2015-03-04 06:11 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimeng.dll
2015-05-13 10:44 - 2015-03-04 06:10 - 00295936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll
2015-05-13 10:44 - 2015-03-04 06:10 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe
2015-05-13 10:44 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2015-05-13 10:44 - 2015-02-18 09:04 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-05-13 10:44 - 2015-01-29 05:19 - 02543104 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2015-05-13 10:44 - 2015-01-29 05:02 - 02311168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll
2015-05-12 22:10 - 2015-05-13 12:54 - 00000000 ____D () C:\GOG Games
2015-05-12 18:05 - 2015-05-21 17:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com
2015-05-12 18:05 - 2015-05-12 18:12 - 00000000 ____D () C:\Program Files (x86)\GalaxyClient
2015-05-12 18:05 - 2015-05-12 18:05 - 00000000 ____D () C:\ProgramData\GOG.com
2015-05-12 16:15 - 2015-05-14 18:19 - 00000000 ____D () C:\Users\Jannik\AppData\Roaming\NVIDIA
2015-05-12 16:15 - 2015-05-12 16:15 - 01713824 _____ (techPowerUp (www.techpowerup.com)) C:\Users\Jannik\Desktop\GPU-Z.0.8.2.exe
2015-05-12 16:14 - 2015-05-12 16:14 - 00000000 ____D () C:\Users\Jannik\AppData\Local\NVIDIA Corporation
2015-05-12 16:14 - 2015-05-12 16:14 - 00000000 ____D () C:\Users\Jannik\AppData\Local\NVIDIA
2015-05-12 16:13 - 2015-05-18 17:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2015-05-12 16:13 - 2015-05-12 05:30 - 06872392 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2015-05-12 16:13 - 2015-05-12 05:30 - 03490448 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2015-05-12 16:13 - 2015-05-12 05:30 - 02558608 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2015-05-12 16:13 - 2015-05-12 05:30 - 00937288 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2015-05-12 16:13 - 2015-05-12 05:30 - 00385352 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2015-05-12 16:13 - 2015-05-12 05:30 - 00062608 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2015-05-12 16:13 - 2015-05-11 19:01 - 04391871 _____ () C:\Windows\system32\nvcoproc.bin
2015-05-12 16:13 - 2015-05-08 02:35 - 01316184 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2015-05-12 16:13 - 2015-05-08 02:35 - 01316000 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2015-05-12 16:13 - 2015-05-08 02:34 - 01756424 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2015-05-12 16:13 - 2015-05-08 02:34 - 01570672 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2015-05-12 16:12 - 2015-05-18 17:39 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2015-05-12 16:12 - 2015-05-13 08:52 - 01558848 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll
2015-05-12 16:12 - 2015-05-12 16:13 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2015-05-12 16:12 - 2015-05-12 08:27 - 15048816 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2015-05-12 16:12 - 2015-05-12 08:27 - 12849056 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2015-05-12 16:12 - 2015-05-12 08:27 - 03363224 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2015-05-12 16:12 - 2015-05-12 08:27 - 02971776 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2015-05-12 16:12 - 2015-05-12 08:27 - 00112784 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2015-05-12 16:12 - 2015-05-12 08:27 - 00105288 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
2015-05-12 16:12 - 2015-05-12 08:27 - 00031710 _____ () C:\Windows\system32\nvinfo.pb
2015-05-12 16:12 - 2015-04-09 02:58 - 01895568 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6435012.dll
2015-05-12 16:12 - 2015-04-09 02:58 - 01557648 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6435012.dll
2015-05-12 16:12 - 2015-04-09 02:58 - 00038032 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2015-05-12 16:12 - 2015-04-09 02:58 - 00035472 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll
2015-05-12 16:12 - 2015-04-09 02:58 - 00032400 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2015-05-12 15:07 - 2015-05-12 15:08 - 00207872 _____ (Power Admin LLC) C:\Windows\PAExec.exe
2015-05-12 11:01 - 2015-05-21 06:54 - 00000056 _____ () C:\Users\Jannik\Desktop\pr0gramm.com.url
2015-05-12 11:01 - 2015-05-16 19:55 - 00000056 _____ () C:\Users\Jannik\Desktop\gfdgdfgg.url
2015-05-12 11:01 - 2015-05-13 22:59 - 00000056 _____ () C:\Users\Jannik\Desktop\asdasd.url
2015-05-12 11:01 - 2015-05-12 11:01 - 00000056 _____ () C:\Users\Jannik\Desktop\l.url
2015-05-12 10:28 - 2015-05-12 10:28 - 00000000 _____ () C:\Users\Jannik\Desktop\GEp5 22.5 1245.txt
2015-05-12 00:25 - 2015-05-12 00:25 - 03272668 _____ () C:\Users\Jannik\Desktop\VID-20150511-WA0048.mp4
2015-05-11 23:57 - 2015-05-19 01:29 - 00000000 ____D () C:\Users\Jannik\Documents\Witcher 2
2015-05-11 20:44 - 2015-05-11 20:44 - 00000000 ____D () C:\Users\Jannik\AppData\Local\OCCT_-_Ocbase_-_Adrien_Me
2015-05-11 20:43 - 2015-05-12 16:18 - 00000000 ____D () C:\Users\Jannik\Documents\OCCT
2015-05-11 20:39 - 2014-01-24 08:21 - 00000000 ____D () C:\Users\Jannik\Desktop\OCCTPT
2015-05-11 20:38 - 2015-05-11 20:38 - 00000108 _____ () C:\Users\Jannik\Desktop\Overclock3D -- Review -- Gigabyte Z77 Overclocking Guide -- Setup and BIOS.url
2015-05-10 10:54 - 2015-05-10 10:54 - 00000958 _____ () C:\Users\Public\Desktop\CPUID CPU-Z.lnk
2015-05-10 10:54 - 2015-05-10 10:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CPUID
2015-05-10 10:54 - 2015-05-10 10:54 - 00000000 ____D () C:\Program Files (x86)\CPU-Z
2015-05-02 22:10 - 2015-05-02 22:10 - 00000000 ____D () C:\Program Files (x86)\DigitalSimulatorV5.57
2015-05-02 02:07 - 2015-05-02 03:27 - 00000000 ____D () C:\Users\Jannik\Documents\StarCraft II
2015-04-25 12:48 - 2015-04-25 12:48 - 00000000 ____D () C:\Program Files\Microsoft Xbox One Controller for Windows
2015-04-24 21:58 - 2015-04-24 21:58 - 00000000 ____D () C:\Users\Jannik\AppData\Roaming\MK10

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-05-23 21:12 - 2014-12-26 23:21 - 00000000 ____D () C:\Users\Jannik\Desktop\Papierkorb
2015-05-23 21:11 - 2013-08-05 19:17 - 00000000 ____D () C:\Users\Jannik
2015-05-23 21:10 - 2014-08-03 01:00 - 00652883 _____ () C:\Windows\setupact.log
2015-05-23 21:01 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2015-05-23 20:44 - 2013-08-05 19:17 - 01634646 _____ () C:\Windows\WindowsUpdate.log
2015-05-23 20:27 - 2013-08-05 19:33 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-05-23 15:15 - 2009-07-14 06:45 - 00023168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-23 15:15 - 2009-07-14 06:45 - 00023168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-23 13:39 - 2009-07-14 19:58 - 05600070 _____ () C:\Windows\system32\perfh007.dat
2015-05-23 13:39 - 2009-07-14 19:58 - 01672122 _____ () C:\Windows\system32\perfc007.dat
2015-05-23 13:39 - 2009-07-14 07:13 - 00006256 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-23 13:35 - 2013-08-05 20:35 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-05-23 13:34 - 2014-08-05 16:54 - 00000000 ___RD () C:\Users\Jannik\Dropbox
2015-05-23 13:34 - 2014-08-05 16:52 - 00000000 ____D () C:\Users\Jannik\AppData\Roaming\Dropbox
2015-05-23 13:34 - 2013-08-05 19:33 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-05-23 13:33 - 2013-08-05 19:51 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-05-23 13:33 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-22 16:31 - 2015-04-04 20:40 - 00000000 ____D () C:\ProgramData\Tunngle
2015-05-22 16:31 - 2014-07-20 16:04 - 00000000 ____D () C:\Users\Jannik\AppData\Roaming\Tunngle
2015-05-21 17:29 - 2013-08-05 22:01 - 00508890 _____ () C:\Windows\DirectX.log
2015-05-20 21:05 - 2015-04-05 03:00 - 00000000 ___SD () C:\Windows\SysWOW64\GWX
2015-05-20 21:05 - 2015-04-05 03:00 - 00000000 ___SD () C:\Windows\system32\GWX
2015-05-20 01:56 - 2013-08-05 20:28 - 00000000 ____D () C:\Users\Jannik\AppData\Roaming\Skype
2015-05-19 00:44 - 2013-10-16 21:04 - 00000000 ____D () C:\Users\Jannik\AppData\Local\Battle.net
2015-05-18 17:39 - 2013-08-08 20:56 - 00000000 ____D () C:\Temp
2015-05-18 17:38 - 2013-08-05 19:50 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2015-05-17 20:54 - 2015-03-30 17:41 - 00002247 _____ () C:\Users\Jannik\Desktop\Google Chrome.lnk
2015-05-17 20:39 - 2014-08-19 12:31 - 00056008 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kldisk.sys
2015-05-17 20:18 - 2013-08-28 20:38 - 00000000 ____D () C:\Users\Jannik\AppData\Roaming\vlc
2015-05-16 13:22 - 2013-08-05 19:33 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-05-16 13:22 - 2013-08-05 19:33 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-05-15 21:36 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2015-05-15 17:57 - 2013-08-05 19:38 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-05-14 12:37 - 2013-10-16 21:04 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2015-05-14 11:51 - 2009-07-14 20:18 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-14 11:51 - 2009-07-14 06:45 - 00495624 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-05-14 11:51 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\AdvancedInstallers
2015-05-14 02:45 - 2013-08-15 22:27 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-14 02:43 - 2013-08-05 23:04 - 140425016 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-05-13 12:55 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-05-12 16:13 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Help
2015-05-11 20:24 - 2013-08-05 22:09 - 00000000 ___HD () C:\Windows\msdownld.tmp
2015-05-11 20:24 - 2013-08-05 22:09 - 00000000 ____D () C:\Windows\SysWOW64\directx
2015-05-09 12:26 - 2014-08-05 16:53 - 00000000 ____D () C:\Users\Jannik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-05-02 15:12 - 2013-08-05 20:28 - 00000000 ____D () C:\ProgramData\Skype
2015-05-02 12:26 - 2013-08-05 19:46 - 00198760 _____ () C:\Windows\PFRO.log
2015-05-02 02:07 - 2015-04-02 19:16 - 00000000 ____D () C:\Program Files (x86)\Pidgin

==================== Files in the root of some directories =======

2013-11-10 21:43 - 2014-01-18 20:48 - 0045270 _____ () C:\Users\Jannik\AppData\Roaming\room_v3.dat
2014-08-25 18:19 - 2014-08-25 18:29 - 0001407 _____ () C:\Users\Jannik\AppData\Roaming\SpeedRunnersLog.txt
2014-02-26 19:08 - 2014-02-26 19:08 - 0000044 _____ () C:\Users\Jannik\AppData\Roaming\WB.CFG
2008-02-05 14:28 - 2008-02-05 14:28 - 0000051 _____ () C:\Users\Jannik\AppData\Local\setup.txt
2014-09-27 09:05 - 2014-09-27 09:05 - 0170896 _____ () C:\ProgramData\1411801518.bdinstall.bin
2015-05-17 20:30 - 2015-05-17 20:30 - 0037824 _____ () C:\ProgramData\1431887411.bdinstall.bin
2015-05-17 20:31 - 2015-05-17 20:31 - 0097709 _____ () C:\ProgramData\1431887412.bdinstall.bin

Some files in TEMP:
====================
C:\Users\Jannik\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpqmtvai.dll
C:\Users\Jannik\AppData\Local\Temp\FoxitUpdater.exe
C:\Users\Jannik\AppData\Local\Temp\Nv3DVisionIePlugin.dll
C:\Users\Jannik\AppData\Local\Temp\Nv3DVStreaming.dll
C:\Users\Jannik\AppData\Local\Temp\Nv3DVStreaming64.dll
C:\Users\Jannik\AppData\Local\Temp\Nv3DVStreamingIePlugin.dll
C:\Users\Jannik\AppData\Local\Temp\Nv3DVStreamingIePlugin64.dll
C:\Users\Jannik\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\Jannik\AppData\Local\Temp\nvSCPAPI64.dll
C:\Users\Jannik\AppData\Local\Temp\nvStInst.exe
C:\Users\Jannik\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Jannik\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\Jannik\AppData\Local\Temp\tmp3E4D.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-05-15 21:29

==================== End of log ============================
         

Alt 23.05.2015, 21:34   #2
Kaprisonne
 
Back to Desktop + ladender Mauszeiger - Standard

Back to Desktop + ladender Mauszeiger



Addition.txt:
Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-05-2015 01
Ran by Jannik at 2015-05-23 21:12:51
Running from C:\Users\Jannik\Desktop
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-4043579312-2739093779-986575188-500 - Administrator - Disabled)
Gast (S-1-5-21-4043579312-2739093779-986575188-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-4043579312-2739093779-986575188-1002 - Limited - Enabled)
Jannik (S-1-5-21-4043579312-2739093779-986575188-1000 - Administrator - Enabled) => C:\Users\Jannik

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.189 - Adobe Systems Incorporated)
Akamai NetSession Interface (HKU\S-1-5-21-4043579312-2739093779-986575188-1000\...\Akamai) (Version:  - Akamai Technologies, Inc)
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
BlueJ (HKLM-x32\...\{7D66971C-652B-4065-A6B1-B3EE313C254B}) (Version: 3.1.1 - BlueJ Team)
CPUID CPU-Z 1.72 (HKLM\...\CPUID CPU-Z_is1) (Version:  - )
DigitalSimulatorV5.57 (remove only) (HKLM-x32\...\DigitalSimulatorV5.57) (Version:  - )
Dropbox (HKU\S-1-5-21-4043579312-2739093779-986575188-1000\...\Dropbox) (Version: 3.4.6 - Dropbox, Inc.)
Druckerdeinstallation für EPSON WF-7620 Series (HKLM\...\EPSON WF-7620 Series) (Version:  - SEIKO EPSON Corporation)
f.lux (HKU\S-1-5-21-4043579312-2739093779-986575188-1000\...\Flux) (Version:  - )
GOG Galaxy (HKLM-x32\...\{7258BA11-600C-430E-A759-27E2C691A335}_is1) (Version:  - GOG.com)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 43.0.2357.65 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
Gyazo 1.2 (HKLM-x32\...\{6DB8C365-E719-4BA5-9594-10DFC244D3FD}_is1) (Version:  - Nota Inc. & Toshiyuki Masui)
Hex-Editor MX (HKLM-x32\...\{7FC7AD70-1DF3-4B84-9AA2-4FB680F45572}_is1) (Version: 6.0 - NEXT-Soft)
Intel(R) Network Connections 17.2.154.0 (HKLM\...\PROSetDX) (Version: 17.2.154.0 - Intel)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.4.225 - Intel Corporation)
Intel® Chipsatz-Gerätesoftware (x32 Version: 10.0.13 - Intel(R) Corporation) Hidden
IsoBuster 3.3 (HKLM-x32\...\IsoBuster3_is1) (Version: 3.3 - Smart Projects)
Java 8 Update 25 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418025F0}) (Version: 8.0.250 - Oracle Corporation)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
Java SE Development Kit 8 Update 25 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0180250}) (Version: 8.0.250.18 - Oracle Corporation)
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{02FECEE0-16B2-43DB-BC3B-C844477FC142}) (Version: 15.0.2.361 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 15.0.2.361 - Kaspersky Lab) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUSR) (Version: 15.0.4420.1017 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4048 (HKLM\...\{91415F19-4C22-3609-A105-92ED3522D83C}) (Version: 9.0.30729.4048 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4048 (HKLM-x32\...\{5B1F2843-B379-3FF2-B0D3-64DD143ED53A}) (Version: 9.0.30729.4048 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Xbox One Controller for Windows (HKLM\...\{DC2CB48C-FD96-48EB-A36A-7D995BB587EB}) (Version: 1.0.2 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 Refresh (HKLM-x32\...\{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}) (Version: 4.0.30901.0 - Microsoft Corporation)
Mozilla Firefox 33.0.2 (x86 de) (HKLM-x32\...\Mozilla Firefox 33.0.2 (x86 de)) (Version: 33.0.2 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
NVIDIA 3D Vision Controller-Treiber 352.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 352.65 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 352.86 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 352.86 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.4.3.31 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.4.3.31 - NVIDIA Corporation)
NVIDIA Grafiktreiber 352.86 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 352.86 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.34.3 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.34.3 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.15.0428 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.15.0428 - NVIDIA Corporation)
Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Paint.NET v3.5.11 (HKLM\...\{72EF03F5-0507-4861-9A44-D99FD4C41418}) (Version: 3.61.0 - dotPDN LLC)
Pokémon Trading Card Game Online (HKLM-x32\...\{496D7B7E-EBDC-4E2B-B021-4FF03B188B69}) (Version: 1.0.0 - The Pokémon Company International)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.992 - Even Balance, Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6662 - Realtek Semiconductor Corp.)
ScreenManager Pro for LCD (DDC/CI) (HKLM-x32\...\{DAB265AD-27B2-4651-B8D8-F4F3A8ECC705}) (Version: 2.4.0 - EIZO Corporation)
SHIELD Streaming (Version: 4.1.1000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 2.4.3.31 - NVIDIA Corporation) Hidden
Sid Meier's Civilization V (HKLM-x32\...\Steam App 8930) (Version:  - Firaxis Games)
Skype™ 7.4 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.4.102 - Skype Technologies S.A.)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.11 - TeamSpeak Systems GmbH)
The Witcher 3 - Wild Hunt (HKLM-x32\...\1207664643_is1) (Version: 1.0.3.0 - GOG.com)
Tibia (HKLM-x32\...\Tibia_is1) (Version: 10.76 - CipSoft GmbH)
TP-LINK TL-WDN4800 Driver (HKLM-x32\...\{FDA7E907-6539-42C1-9721-0239C281B336}) (Version: 1.3.1 - TP-LINK)
Tunngle (HKLM-x32\...\Tunngle_is1) (Version: 5.2 - Tunngle.net GmbH)
VLC media player 2.0.7 (HKLM\...\VLC media player) (Version: 2.0.7 - VideoLAN)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-4043579312-2739093779-986575188-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4043579312-2739093779-986575188-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Jannik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4043579312-2739093779-986575188-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jannik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4043579312-2739093779-986575188-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jannik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4043579312-2739093779-986575188-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jannik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4043579312-2739093779-986575188-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jannik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4043579312-2739093779-986575188-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jannik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4043579312-2739093779-986575188-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jannik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4043579312-2739093779-986575188-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jannik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4043579312-2739093779-986575188-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jannik\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)

==================== Restore Points =========================


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {26CF4213-B0C7-4D96-B4FA-8848318BFBAF} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-08-05] (Google Inc.)
Task: {277F79DB-B22E-47F0-91BF-80A838500D50} - System32\Tasks\MSIAfterburner => C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe
Task: {2911ACC6-1A5C-48F8-9DD6-64DB9665C26C} - System32\Tasks\EPSON WF-7620 Series Update {CCDB001A-670E-49E6-A899-CE6982815934} => C:\Windows\system32\spool\DRIVERS\x64\3\E_YTSKAE.EXE [2013-02-28] (SEIKO EPSON CORPORATION)
Task: {69681046-EAD0-4426-8428-A92C0799835E} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-07] (Microsoft Corporation)
Task: {6DAC7799-5B2D-4365-A885-240881D9CE01} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation)
Task: {891E5229-1264-42FE-86DE-BBF4118CB9D8} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2012-10-01] (Microsoft Corporation)
Task: {B82EC97B-5A11-4774-9C07-648AC72C3A13} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation)
Task: {D9A6E785-85A9-4810-A2A9-3049EBD49839} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)
Task: {DEC92C4A-A29D-4D16-AA6A-4C4D886A817F} - System32\Tasks\EPSON WF-7620 Series Invitation {CCDB001A-670E-49E6-A899-CE6982815934} => C:\Windows\system32\spool\DRIVERS\x64\3\E_YTSKAE.EXE [2013-02-28] (SEIKO EPSON CORPORATION)
Task: {FE848A78-6E7B-4087-87A1-7D64B73A4049} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-08-05] (Google Inc.)
Task: C:\Windows\Tasks\EPSON WF-7620 Series Invitation {CCDB001A-670E-49E6-A899-CE6982815934}.job => C:\Windows\system32\spool\DRIVERS\x64\3\E_YTSKAE.EXE
Task: C:\Windows\Tasks\EPSON WF-7620 Series Update {CCDB001A-670E-49E6-A899-CE6982815934}.job => C:\Windows\system32\spool\DRIVERS\x64\3\E_YTSKAE.EXE:/EXE:{CCDB001A-670E-49E6-A899-CE6982815934} /F:UpdateSYSTEM
Searches for EPSON software updates, and notifies you when updates are available.If this task is disabled or stopped, your EPSON software will not be automatically kept up to date.Thi
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2015-05-12 16:13 - 2015-05-12 05:30 - 00116368 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2013-09-30 18:51 - 2013-09-30 19:03 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2015-05-12 16:13 - 2015-05-08 02:36 - 00011920 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll
2015-05-23 13:34 - 2015-05-23 13:34 - 00043008 _____ () c:\users\jannik\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpqmtvai.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00750080 _____ () C:\Users\Jannik\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00047616 _____ () C:\Users\Jannik\AppData\Roaming\Dropbox\bin\libEGL.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00865280 _____ () C:\Users\Jannik\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00200704 _____ () C:\Users\Jannik\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
2015-05-21 07:28 - 2015-05-13 18:48 - 01281864 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.65\libglesv2.dll
2015-05-21 07:28 - 2015-05-13 18:48 - 00080712 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.65\libegl.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\Jannik\Desktop\GPU-Z.0.8.2.exe:BDU

==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-4043579312-2739093779-986575188-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Jannik\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.6.1

==================== MSCONFIG/TASK MANAGER Error getting ==

(Currently there is no automatic fix for this section.)


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{30D02F7C-72CD-4D58-99D6-74602393CC73}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{9BF77738-90CA-4E29-9836-B1AAE25F41E0}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{92CAA2A5-758F-4952-8655-FDB833EA0524}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{28954C98-1E54-4285-93C4-4F2331765CD7}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{61D707CA-9BE6-438C-A055-C44B35BDEF92}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{35DA7867-5B9A-40A8-A72F-68A1D202911E}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{351F400E-7B9E-41F3-9FB1-D078C31ED9E5}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{75C0178B-4444-42AF-8F74-94ADBBAC0D3B}] => (Allow) C:\Program Files (x86)\Garena Plus\ggdllhost.exe
FirewallRules: [{526DE124-C4BE-4862-ADB6-C1F8C2E27204}] => (Allow) C:\Program Files (x86)\Garena Plus\Room\garena_room.exe
FirewallRules: [{0259A236-69E2-4241-93C1-733BB92E09FB}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2380\Agent.exe
FirewallRules: [{12379D6A-2AD0-4BA2-8AB0-6B641153F8C3}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2380\Agent.exe
FirewallRules: [TCP Query User{5CDE45AD-39C1-4B03-941B-97DBB73C5245}C:\program files (x86)\hearthstone\hearthstone.exe] => (Allow) C:\program files (x86)\hearthstone\hearthstone.exe
FirewallRules: [UDP Query User{80F6756C-70DD-4419-916E-4E6C1C011970}C:\program files (x86)\hearthstone\hearthstone.exe] => (Allow) C:\program files (x86)\hearthstone\hearthstone.exe
FirewallRules: [{2D7624A1-E0D9-48BA-9057-DD06D6D43303}] => (Allow) C:\Program Files (x86)\Diablo III\Diablo III.exe
FirewallRules: [{CA301678-831F-4DE0-BA16-7C62DD0B8B8A}] => (Allow) C:\Program Files (x86)\Diablo III\Diablo III.exe
FirewallRules: [{F0352C91-4B2A-4287-AE20-912267E361A5}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2391\Agent.exe
FirewallRules: [{92D42491-7D88-40A2-9224-E943BDFA3969}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2391\Agent.exe
FirewallRules: [{346EF31F-58BD-4371-9F1C-0359F71DB575}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2417\Agent.exe
FirewallRules: [{3E99130B-A34A-4394-ABBE-B4240DEEB96A}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2417\Agent.exe
FirewallRules: [{3A86EAF6-CF86-47F7-9B3E-E26DE927BEB8}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2426\Agent.exe
FirewallRules: [{56048861-51AC-4B29-9C64-681B81866CC4}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2426\Agent.exe
FirewallRules: [{EE8EE328-DE2C-4D8B-8162-4EE844750814}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2514\Agent.exe
FirewallRules: [{D0CC9F00-33BA-4E89-BBCD-A8D78D8571BA}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2514\Agent.exe
FirewallRules: [TCP Query User{F5D8BF55-E102-42FA-8D7F-4E49FA125716}C:\program files (x86)\steam\steamapps\common\crusader kings ii\ck2.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\crusader kings ii\ck2.exe
FirewallRules: [UDP Query User{3CAAE14B-A390-4C2E-B687-1C6E707549E2}C:\program files (x86)\steam\steamapps\common\crusader kings ii\ck2.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\crusader kings ii\ck2.exe
FirewallRules: [TCP Query User{9D1C2A57-5B88-436D-ABD3-1A47E7C11186}C:\users\jannik\desktop\sumgames\warcraft iii\war3.exe] => (Allow) C:\users\jannik\desktop\sumgames\warcraft iii\war3.exe
FirewallRules: [UDP Query User{847E8982-839C-48DD-85FD-0E4DED0982A3}C:\users\jannik\desktop\sumgames\warcraft iii\war3.exe] => (Allow) C:\users\jannik\desktop\sumgames\warcraft iii\war3.exe
FirewallRules: [TCP Query User{44D9A510-89ED-499E-9A05-9219A103E0E3}C:\users\jannik\desktop\call of duty 4 - moder warfare (tausch)\call of duty 4 - modern warfare\iw3mp.exe] => (Allow) C:\users\jannik\desktop\call of duty 4 - moder warfare (tausch)\call of duty 4 - modern warfare\iw3mp.exe
FirewallRules: [UDP Query User{D5D18A8B-7572-4517-BFE0-D6FC57405391}C:\users\jannik\desktop\call of duty 4 - moder warfare (tausch)\call of duty 4 - modern warfare\iw3mp.exe] => (Allow) C:\users\jannik\desktop\call of duty 4 - moder warfare (tausch)\call of duty 4 - modern warfare\iw3mp.exe
FirewallRules: [TCP Query User{0375DDF0-2B9A-4E0F-976D-60B0408A3862}C:\program files (x86)\steam\steamapps\common\medieval ii total war\kingdoms.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\medieval ii total war\kingdoms.exe
FirewallRules: [UDP Query User{0873D78C-51CA-4982-B33A-39BF6F2EDC21}C:\program files (x86)\steam\steamapps\common\medieval ii total war\kingdoms.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\medieval ii total war\kingdoms.exe
FirewallRules: [TCP Query User{20B76AAB-D250-459C-B1FF-DD07A3E35334}C:\program files\java\jdk1.7.0_45\bin\javaw.exe] => (Allow) C:\program files\java\jdk1.7.0_45\bin\javaw.exe
FirewallRules: [UDP Query User{4ED9822A-2A19-4483-BAFE-253AA82913B7}C:\program files\java\jdk1.7.0_45\bin\javaw.exe] => (Allow) C:\program files\java\jdk1.7.0_45\bin\javaw.exe
FirewallRules: [TCP Query User{9B775881-CD24-4112-9FE7-C6B40C8E5F2C}C:\program files\java\jdk1.7.0_45\jre\bin\java.exe] => (Allow) C:\program files\java\jdk1.7.0_45\jre\bin\java.exe
FirewallRules: [UDP Query User{27F7D9A2-833C-40A7-A4E2-84E2F22FBEE1}C:\program files\java\jdk1.7.0_45\jre\bin\java.exe] => (Allow) C:\program files\java\jdk1.7.0_45\jre\bin\java.exe
FirewallRules: [{C95208D6-7747-479B-94F7-54C91D8A5AA6}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2581\Agent.exe
FirewallRules: [{65BAAE58-C727-4B4C-856F-05BBB734B2B6}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2581\Agent.exe
FirewallRules: [{24FD674E-FEB3-4924-847A-AC56FA0FBD91}] => (Allow) C:\Program Files (x86)\StarCraft II\StarCraft II.exe
FirewallRules: [{593F5592-9B45-40B8-A0F8-C425E078A93F}] => (Allow) C:\Program Files (x86)\StarCraft II\StarCraft II.exe
FirewallRules: [{1390DFBB-1822-4BA9-8AE3-DD08CFE369ED}] => (Allow) C:\Program Files (x86)\StarCraft II\StarCraft II Public Test.exe
FirewallRules: [{9F2D6974-5CB8-4949-A741-1035FF4670E3}] => (Allow) C:\Program Files (x86)\StarCraft II\StarCraft II Public Test.exe
FirewallRules: [TCP Query User{99634732-B760-439A-A316-45759CF63544}C:\program files (x86)\starcraft ii\versions\base28667\sc2.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base28667\sc2.exe
FirewallRules: [UDP Query User{C1784830-AA4F-41A0-9BC0-5CA5430E0868}C:\program files (x86)\starcraft ii\versions\base28667\sc2.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base28667\sc2.exe
FirewallRules: [{530829BB-28CF-4D82-8FAB-AF7F3E8B613D}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2680\Agent.exe
FirewallRules: [{5D6A11C1-19E8-4DCB-956D-6F5A731AF572}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2680\Agent.exe
FirewallRules: [{6A2C12D0-0313-4F7D-8E1D-E4FC1C9D5A5E}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{D50CC1BC-FA1D-4787-AE14-B5BEB034D8E8}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{E26C1FC7-7E30-4054-AABB-41B1E9345BAB}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{1FB1B81C-0BBD-4DC2-9AFB-4695CE49DA5E}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{17A9CD60-989C-48FB-92C9-9A8336B156E0}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2689\Agent.exe
FirewallRules: [{4FC8E182-A263-4A9D-84A5-8F6D25B0F493}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2689\Agent.exe
FirewallRules: [TCP Query User{F9EA0945-6711-4958-882B-80C16AD4365C}C:\users\jannik\appdata\local\akamai\netsession_win.exe] => (Block) C:\users\jannik\appdata\local\akamai\netsession_win.exe
FirewallRules: [UDP Query User{530EB872-B7CF-4302-BE07-95760F0B12B4}C:\users\jannik\appdata\local\akamai\netsession_win.exe] => (Block) C:\users\jannik\appdata\local\akamai\netsession_win.exe
FirewallRules: [{9F7BF35A-EF6F-48DF-8B2E-16B4C183615D}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3023\Agent.exe
FirewallRules: [{D7308A75-9F58-4F56-8C62-971F0714659D}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3023\Agent.exe
FirewallRules: [{FD6A409F-FB36-4721-B0FC-7EB509C536BF}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Total War Rome II\launcher\launcher.exe
FirewallRules: [{6B07D6A6-3791-4FBD-B73D-7F2C1560FA51}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Total War Rome II\launcher\launcher.exe
FirewallRules: [{97B56603-5544-4A48-8E7E-A0F6139F63B5}] => (Allow) C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{C856F146-544F-48AA-B249-B827D3288481}] => (Allow) C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{D959B845-1F38-4EE3-9C7E-90F697BC401A}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3182\Agent.exe
FirewallRules: [{352FD50A-D2E2-4B47-A192-7FA32E12B460}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3182\Agent.exe
FirewallRules: [TCP Query User{811878B7-98E5-4AF7-B4F2-0048849D255B}C:\users\jannik\desktop\warcraft iii\war3.exe] => (Allow) C:\users\jannik\desktop\warcraft iii\war3.exe
FirewallRules: [UDP Query User{19A9C13B-AC5B-42FB-AB29-30D9F78E2A26}C:\users\jannik\desktop\warcraft iii\war3.exe] => (Allow) C:\users\jannik\desktop\warcraft iii\war3.exe
FirewallRules: [{D742AFFD-E8FD-47D1-AF08-6A6A32461F7A}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3235\Agent.exe
FirewallRules: [{CF0070BA-3A95-408F-A56C-D19CEF014F47}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3235\Agent.exe
FirewallRules: [{4D1FC643-640B-4003-AA7E-D66A00C96F28}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Risen 3\system\Risen3.exe
FirewallRules: [{8B93DAA0-3269-4214-BE47-15B2C013D75E}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Risen 3\system\Risen3.exe
FirewallRules: [{63CF7E70-DE89-4C65-AA16-02D1C4259497}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{051388E1-A8DD-4CC9-9139-DB933659A3C5}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [TCP Query User{696CE46C-99AB-47FE-B7AA-3AF5628E2B1C}C:\users\jannik\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\jannik\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{FE7389A1-E4DE-4259-84CF-6F1BA0F2A7EE}C:\users\jannik\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\jannik\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{039794A4-BDAB-4157-B4BB-6FA939068E4C}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3286\Agent.exe
FirewallRules: [{3812F235-48BF-473B-A13C-7077E831910E}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3286\Agent.exe
FirewallRules: [TCP Query User{DE237B8D-68CE-48E1-BAB3-8C7BD3613F3B}C:\users\jannik\desktop\retroshare\retroshare.exe] => (Allow) C:\users\jannik\desktop\retroshare\retroshare.exe
FirewallRules: [UDP Query User{EB2CCB8D-9CE9-4226-8D77-52A95E0FF25A}C:\users\jannik\desktop\retroshare\retroshare.exe] => (Allow) C:\users\jannik\desktop\retroshare\retroshare.exe
FirewallRules: [TCP Query User{3AE129BA-0D1A-47D2-BA8D-9DE11E546D71}C:\program files (x86)\steam\steamapps\common\war thunder\aces.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\war thunder\aces.exe
FirewallRules: [UDP Query User{B1955574-C52E-416E-AE4D-C509C5B24CDC}C:\program files (x86)\steam\steamapps\common\war thunder\aces.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\war thunder\aces.exe
FirewallRules: [{B014D17A-060B-42AB-8C66-567BF984AD3E}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3322\Agent.exe
FirewallRules: [{9BD35473-65E6-442B-AAA4-32CCB077AAAD}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3322\Agent.exe
FirewallRules: [{18D67C4A-19DC-446F-872C-953D55DCA69A}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3323\Agent.exe
FirewallRules: [{52487619-FA96-4B36-A19C-694A5795101D}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3323\Agent.exe
FirewallRules: [TCP Query User{040155F1-AE02-4523-866A-287A69948BC7}C:\programdata\battle.net\agent\agent.3332\agent.exe] => (Block) C:\programdata\battle.net\agent\agent.3332\agent.exe
FirewallRules: [UDP Query User{F9B360C5-3153-4E00-910C-BB87606DB2E0}C:\programdata\battle.net\agent\agent.3332\agent.exe] => (Block) C:\programdata\battle.net\agent\agent.3332\agent.exe
FirewallRules: [{B27B177D-3D60-44A4-8B29-F7B226F3AB44}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3334\Agent.exe
FirewallRules: [{8AABDB2E-3F36-40C6-92FB-00CD47A87AFF}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3334\Agent.exe
FirewallRules: [{A21895EC-3BF5-42C1-B7BC-E9CF70DBE4B1}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3346\Agent.exe
FirewallRules: [{5FB7D7DB-9D71-4550-8097-791653A10D97}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3346\Agent.exe
FirewallRules: [TCP Query User{75D96F8E-B7A3-40FA-A77E-53A761DEBD47}C:\programdata\battle.net\agent\agent.3372\agent.exe] => (Allow) C:\programdata\battle.net\agent\agent.3372\agent.exe
FirewallRules: [UDP Query User{F333FA29-2942-4650-8A7C-1B11B9867A6D}C:\programdata\battle.net\agent\agent.3372\agent.exe] => (Allow) C:\programdata\battle.net\agent\agent.3372\agent.exe
FirewallRules: [{CDE9442A-9A13-4D2F-AE90-AE92F07BB1DA}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3427\Agent.exe
FirewallRules: [{550C6459-1EC6-47BC-9916-012FBDBE7170}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3427\Agent.exe
FirewallRules: [{E69195A5-9E9C-4FBB-83A2-1CC69537487D}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3454\Agent.exe
FirewallRules: [{AE2EFD52-1BE0-4928-9F09-AE4F98A04BDC}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3454\Agent.exe
FirewallRules: [{1224C385-090D-433E-8753-7B7D79A6FD5F}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3478\Agent.exe
FirewallRules: [{CC398CD5-F54C-4AF7-9940-80B46346E2DB}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3478\Agent.exe
FirewallRules: [TCP Query User{CF2DCBD6-07C3-4BF9-B34A-AACB636F651E}C:\programdata\battle.net\agent\agent.3507\agent.exe] => (Allow) C:\programdata\battle.net\agent\agent.3507\agent.exe
FirewallRules: [UDP Query User{9F35EBD6-48FC-4298-A0B7-0F266D08580E}C:\programdata\battle.net\agent\agent.3507\agent.exe] => (Allow) C:\programdata\battle.net\agent\agent.3507\agent.exe
FirewallRules: [TCP Query User{3F9C519C-917D-4B55-8CFC-1719485953EC}C:\users\jannik\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\jannik\appdata\local\akamai\netsession_win.exe
FirewallRules: [UDP Query User{825DF382-0145-49BB-91A2-5CBD3F6AEE9B}C:\users\jannik\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\jannik\appdata\local\akamai\netsession_win.exe
FirewallRules: [{CDBABCF5-3810-4F8B-A4EC-3D258836D23C}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3526\Agent.exe
FirewallRules: [{5FEA1D45-C116-46DD-8C4F-11F1DA37293D}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3526\Agent.exe
FirewallRules: [TCP Query User{F3E8BF83-66A1-436D-95B1-1C844A0A8075}C:\program files\java\jdk1.8.0_25\bin\jmc.exe] => (Allow) C:\program files\java\jdk1.8.0_25\bin\jmc.exe
FirewallRules: [UDP Query User{5E68E40A-D375-4078-AE53-B2472B22C167}C:\program files\java\jdk1.8.0_25\bin\jmc.exe] => (Allow) C:\program files\java\jdk1.8.0_25\bin\jmc.exe
FirewallRules: [{57BE7777-909B-49A3-813A-6EAD8E357D19}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3634\Agent.exe
FirewallRules: [{1B884CF8-9229-4DD1-A68C-2962C838DCB0}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3634\Agent.exe
FirewallRules: [{479A5314-36E8-4F84-A04E-F2192C21C807}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Don't Starve Together Beta\bin\dontstarve_steam.exe
FirewallRules: [{34C2F363-F116-448D-989E-807C072E7BA4}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Don't Starve Together Beta\bin\dontstarve_steam.exe
FirewallRules: [TCP Query User{2C23000C-0FF8-4DB9-AA36-73A684EA8E66}E:\call of duty 4 - moder warfare (tausch)\call of duty 4 - modern warfare\iw3mp.exe] => (Allow) E:\call of duty 4 - moder warfare (tausch)\call of duty 4 - modern warfare\iw3mp.exe
FirewallRules: [UDP Query User{B92A9E50-E2F4-47F5-90AE-0878EE30A078}E:\call of duty 4 - moder warfare (tausch)\call of duty 4 - modern warfare\iw3mp.exe] => (Allow) E:\call of duty 4 - moder warfare (tausch)\call of duty 4 - modern warfare\iw3mp.exe
FirewallRules: [TCP Query User{6C08079F-1A58-4E59-BCCA-D733B12E5F2B}C:\users\jannik\desktop\papierkorb\desktop\call of duty 4 - moder warfare (tausch)\call of duty 4 - modern warfare\iw3mp.exe] => (Allow) C:\users\jannik\desktop\papierkorb\desktop\call of duty 4 - moder warfare (tausch)\call of duty 4 - modern warfare\iw3mp.exe
FirewallRules: [UDP Query User{0AEEF2EF-09AC-4CE1-B22C-C50EC9AFD607}C:\users\jannik\desktop\papierkorb\desktop\call of duty 4 - moder warfare (tausch)\call of duty 4 - modern warfare\iw3mp.exe] => (Allow) C:\users\jannik\desktop\papierkorb\desktop\call of duty 4 - moder warfare (tausch)\call of duty 4 - modern warfare\iw3mp.exe
FirewallRules: [{15B866BA-866A-45DE-9EF0-2DE7EDE95DF4}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3669\Agent.exe
FirewallRules: [{577FC633-FBCF-47BD-870C-81CF45AB295F}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3669\Agent.exe
FirewallRules: [{71771A92-44C3-4602-9CE7-95217EF4B69E}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3688\Agent.exe
FirewallRules: [{9013473E-CCC2-4860-9CFA-620F37B796AD}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3688\Agent.exe
FirewallRules: [{9F9C58A4-2D90-4C69-8CFE-BDA7C2558922}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3689\Agent.exe
FirewallRules: [{AB8D099D-B5AE-4074-A1F4-03CA48F84A5D}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3689\Agent.exe
FirewallRules: [{BC8B9342-F477-44F0-BA2A-FF0FF28231E7}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3715\Agent.exe
FirewallRules: [{F72BE471-51C8-4A76-B910-91A6B4CA97DD}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3715\Agent.exe
FirewallRules: [TCP Query User{ECE407D3-3684-45C0-A471-3A5F64191068}C:\program files (x86)\myphoneexplorer\myphoneexplorer.exe] => (Allow) C:\program files (x86)\myphoneexplorer\myphoneexplorer.exe
FirewallRules: [UDP Query User{3068B0A0-0A3A-4D87-B5FD-2DF9D0B76F4B}C:\program files (x86)\myphoneexplorer\myphoneexplorer.exe] => (Allow) C:\program files (x86)\myphoneexplorer\myphoneexplorer.exe
FirewallRules: [TCP Query User{7DAE47E9-ADA7-4A4F-A332-8AC8C3B6F550}C:\program files (x86)\heroes of the storm\versions\base34190\heroesofthestorm_x64.exe] => (Allow) C:\program files (x86)\heroes of the storm\versions\base34190\heroesofthestorm_x64.exe
FirewallRules: [UDP Query User{D5B36EAD-5EAE-421A-BE38-7D1621E57F8E}C:\program files (x86)\heroes of the storm\versions\base34190\heroesofthestorm_x64.exe] => (Allow) C:\program files (x86)\heroes of the storm\versions\base34190\heroesofthestorm_x64.exe
FirewallRules: [{D12C260B-2779-4123-A8C0-A35528E1AF8F}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\ShadowOfMordor\x64\ShadowOfMordor.exe
FirewallRules: [{531EC746-8636-4E4A-94F3-77A1591624FD}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\ShadowOfMordor\x64\ShadowOfMordor.exe
FirewallRules: [{9B0073F4-1B7E-40DF-BDF5-DE90E3CC2FDE}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Divinity - Original Sin\Shipping\EoCApp.exe
FirewallRules: [{047E9E12-B1FC-4E58-AB77-6E48FEA8CAAF}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Divinity - Original Sin\Shipping\EoCApp.exe
FirewallRules: [TCP Query User{C5AB1F96-14B4-409C-A0DC-79222A8E7796}C:\program files (x86)\heroes of the storm\versions\base34659\heroesofthestorm_x64.exe] => (Allow) C:\program files (x86)\heroes of the storm\versions\base34659\heroesofthestorm_x64.exe
FirewallRules: [UDP Query User{C4BA9DAE-FD5C-4DE0-BB11-E3AC8EC5D9F2}C:\program files (x86)\heroes of the storm\versions\base34659\heroesofthestorm_x64.exe] => (Allow) C:\program files (x86)\heroes of the storm\versions\base34659\heroesofthestorm_x64.exe
FirewallRules: [TCP Query User{BAC9939A-5D7E-40FC-AAB1-84E3BA268EEE}C:\program files\starcitizen\citizenclient\bin64\starcitizen.exe] => (Allow) C:\program files\starcitizen\citizenclient\bin64\starcitizen.exe
FirewallRules: [UDP Query User{FF85A0B7-0D16-4122-A245-8BE4CA43FB07}C:\program files\starcitizen\citizenclient\bin64\starcitizen.exe] => (Allow) C:\program files\starcitizen\citizenclient\bin64\starcitizen.exe
FirewallRules: [TCP Query User{A3FD71C2-D49A-47AB-84E8-43BA7BD999C0}C:\program files (x86)\ccp\eve\bin\exefile.exe] => (Allow) C:\program files (x86)\ccp\eve\bin\exefile.exe
FirewallRules: [UDP Query User{698C8148-D3F0-4989-8710-054E61C1EE35}C:\program files (x86)\ccp\eve\bin\exefile.exe] => (Allow) C:\program files (x86)\ccp\eve\bin\exefile.exe
FirewallRules: [{942B3847-825B-48C0-A99F-DDB13081FBF9}] => (Allow) C:\Program Files (x86)\Tunngle\TnglCtrl.exe
FirewallRules: [{2B5A38E5-0B52-42A3-BED7-1BEB89D36034}] => (Allow) C:\Program Files (x86)\Tunngle\TnglCtrl.exe
FirewallRules: [{ADDA9D15-6CCC-4F23-985E-D6AA6286A9E2}] => (Allow) C:\Program Files (x86)\Tunngle\Tunngle.exe
FirewallRules: [{C2373056-8BB6-4D67-9D1E-5CCD98A547FE}] => (Allow) C:\Program Files (x86)\Tunngle\Tunngle.exe
FirewallRules: [{AE746600-9477-47B3-A3BE-EEA2265EE2FE}] => (Allow) C:\Program Files (x86)\Fiddler2\Fiddler.exe
FirewallRules: [TCP Query User{60FC49CD-98BD-415F-B454-E8EB878B4EC8}C:\program files (x86)\heroes of the storm\versions\base34846\heroesofthestorm_x64.exe] => (Allow) C:\program files (x86)\heroes of the storm\versions\base34846\heroesofthestorm_x64.exe
FirewallRules: [UDP Query User{7BBE69DF-1814-4F66-83CC-438C1A46C4A8}C:\program files (x86)\heroes of the storm\versions\base34846\heroesofthestorm_x64.exe] => (Allow) C:\program files (x86)\heroes of the storm\versions\base34846\heroesofthestorm_x64.exe
FirewallRules: [TCP Query User{1479CCAC-22F1-4D01-8C64-CEBEE826847F}C:\users\jannik\desktop\adhocserver\adhocsever.exe] => (Allow) C:\users\jannik\desktop\adhocserver\adhocsever.exe
FirewallRules: [UDP Query User{2EA309E7-59D7-470B-A9E8-2A94F3B69EA7}C:\users\jannik\desktop\adhocserver\adhocsever.exe] => (Allow) C:\users\jannik\desktop\adhocserver\adhocsever.exe
FirewallRules: [TCP Query User{A4F90A4E-13B4-4762-AAB2-BC654755CDC9}C:\users\jannik\desktop\ppsspp\ppssppwindows64.exe] => (Allow) C:\users\jannik\desktop\ppsspp\ppssppwindows64.exe
FirewallRules: [UDP Query User{F9CD5FEC-C7FE-458F-A5CD-162A2DB4CD1D}C:\users\jannik\desktop\ppsspp\ppssppwindows64.exe] => (Allow) C:\users\jannik\desktop\ppsspp\ppssppwindows64.exe
FirewallRules: [TCP Query User{B6FA7CDD-D64B-4000-B27B-ACA9A0047DDE}C:\program files (x86)\starcraft ii\versions\base32283\sc2.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base32283\sc2.exe
FirewallRules: [UDP Query User{571D0508-F856-4B70-97B7-B90E1B351254}C:\program files (x86)\starcraft ii\versions\base32283\sc2.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base32283\sc2.exe
FirewallRules: [TCP Query User{7FEF8C7A-83A6-4CC3-9F3F-FC24167EB3F8}C:\users\jannik\desktop\papierkorb\desktop\warcraft iii\war3.exe] => (Allow) C:\users\jannik\desktop\papierkorb\desktop\warcraft iii\war3.exe
FirewallRules: [UDP Query User{44AF77BA-ECD7-4D0D-A758-3FF59F689EFA}C:\users\jannik\desktop\papierkorb\desktop\warcraft iii\war3.exe] => (Allow) C:\users\jannik\desktop\papierkorb\desktop\warcraft iii\war3.exe
FirewallRules: [TCP Query User{382BCAA9-6E4C-4046-AEDD-8E40BC26C23C}C:\program files (x86)\steam\steamapps\common\the witcher 2\bin\witcher2.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\the witcher 2\bin\witcher2.exe
FirewallRules: [UDP Query User{6D3512A7-CA8F-40A7-B4C4-84F0203E25DA}C:\program files (x86)\steam\steamapps\common\the witcher 2\bin\witcher2.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\the witcher 2\bin\witcher2.exe
FirewallRules: [{54584A45-071D-4A2C-8D52-ED90FB526234}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{30F68D47-6E4B-45A9-AA7D-8062BF134F71}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{83CFA5BF-2F19-46BA-B385-EB505E2627C0}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{76EF55EC-ED34-4178-8B0F-39D80C951416}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{BB2CB526-4E43-4330-AD8E-C7AFF185B802}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{CE7D83CA-BCB9-4B5D-8A9F-46B2AB298BB1}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [TCP Query User{20DE9092-1DFD-4D85-A526-FFAAE903FEC6}C:\program files (x86)\starcitizen\citizenclient\bin64\starcitizen.exe] => (Allow) C:\program files (x86)\starcitizen\citizenclient\bin64\starcitizen.exe
FirewallRules: [UDP Query User{0D92FF15-F1B2-462A-BEC6-F0B2F1019151}C:\program files (x86)\starcitizen\citizenclient\bin64\starcitizen.exe] => (Allow) C:\program files (x86)\starcitizen\citizenclient\bin64\starcitizen.exe
FirewallRules: [{E2E9FB37-6C04-433C-8AE3-6CBFC5ED51EE}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Hammerwatch\editor\HammerEditor.exe
FirewallRules: [{CB7D8D99-4A68-44F9-8FBD-C4F00DF7D81D}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Hammerwatch\editor\HammerEditor.exe
FirewallRules: [{352B90CA-5C4A-4B99-8AD3-4413D410E8D6}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{AF82F08C-C3D3-4B39-B64E-0B6085C03AD4}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sid Meier's Civilization V\Launcher.exe
FirewallRules: [{05B13642-571D-47DD-86FC-47934AC44AE5}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sid Meier's Civilization V\Launcher.exe

==================== Faulty Device Manager Devices =============

Name: TP-LINK 450Mbps Wireless N Adapter
Description: TP-LINK 450Mbps Wireless N Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: TP-LINK
Service: athr
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: TAP-Win32 Adapter V9 (Tunngle)
Description: TAP-Win32 Adapter V9 (Tunngle)
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: TAP-Win32 Provider V9 (Tunngle)
Service: tap0901t
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (05/23/2015 01:39:47 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (05/23/2015 01:39:47 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (05/23/2015 01:39:47 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (05/23/2015 01:05:23 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073418231

Error: (05/22/2015 02:31:00 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073418231

Error: (05/22/2015 02:26:53 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (05/22/2015 02:26:53 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (05/22/2015 02:26:53 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (05/21/2015 08:48:16 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (05/21/2015 08:48:16 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.


System errors:
=============
Error: (05/23/2015 01:35:33 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (05/23/2015 01:33:51 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
cdrom

Error: (05/22/2015 05:51:57 PM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error: (05/22/2015 02:22:19 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (05/22/2015 02:21:00 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
cdrom

Error: (05/21/2015 08:43:24 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (05/21/2015 08:42:22 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
cdrom

Error: (05/21/2015 00:29:12 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (05/21/2015 00:27:57 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
cdrom

Error: (05/21/2015 06:35:42 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)


Microsoft Office:
=========================
Error: (05/23/2015 01:39:47 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (05/23/2015 01:39:47 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (05/23/2015 01:39:47 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (05/23/2015 01:05:23 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073418231

Error: (05/22/2015 02:31:00 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073418231

Error: (05/22/2015 02:26:53 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (05/22/2015 02:26:53 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (05/22/2015 02:26:53 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (05/21/2015 08:48:16 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (05/21/2015 08:48:16 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000


CodeIntegrity Errors:
===================================
  Date: 2014-09-16 19:44:20.613
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-16 19:44:20.613
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-16 19:44:20.611
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-16 19:44:20.609
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-16 19:44:20.607
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-16 19:44:20.605
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-11 13:43:22.775
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-11 13:43:22.774
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-11 13:43:22.771
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-11 13:43:22.770
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-3570K CPU @ 3.40GHz
Percentage of memory in use: 25%
Total physical RAM: 8152.67 MB
Available physical RAM: 6107.62 MB
Total Pagefile: 16303.54 MB
Available Pagefile: 13874.18 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:119.14 GB) (Free:22.17 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 119.2 GB) (Disk ID: F5DADA83)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=119.1 GB) - (Type=07 NTFS)

==================== End of log ============================
         
__________________


Alt 23.05.2015, 21:36   #3
Kaprisonne
 
Back to Desktop + ladender Mauszeiger - Standard

Back to Desktop + ladender Mauszeiger



Gmer.txt: (Teil 1)
Code:
ATTFilter
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-05-23 21:18:49
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2 Samsung_SSD_840_PRO_Series rev.DXM04B0Q 119,24GB
Running: Gmer-19357.exe; Driver: C:\Users\Jannik\AppData\Local\Temp\pfdiqpog.sys


---- User code sections - GMER 2.1 ----

.text    C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\SysWOW64\WSOCK32.dll!recv + 82                                                                                                                                                                            00000000715f17fa 2 bytes CALL 767111a9 C:\Windows\syswow64\kernel32.dll
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\SysWOW64\WSOCK32.dll!recvfrom + 88                                                                                                                                                                        00000000715f1860 2 bytes CALL 767111a9 C:\Windows\syswow64\kernel32.dll
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 98                                                                                                                                                                      00000000715f1942 2 bytes JMP 74ef7089 C:\Windows\syswow64\WS2_32.dll
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 109                                                                                                                                                                     00000000715f194d 2 bytes JMP 74efcba6 C:\Windows\syswow64\WS2_32.dll
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                                                                              0000000076351401 2 bytes JMP 7673b21b C:\Windows\syswow64\kernel32.dll
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                                                                                0000000076351419 2 bytes JMP 7673b346 C:\Windows\syswow64\kernel32.dll
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                                                                              0000000076351431 2 bytes JMP 767b8f29 C:\Windows\syswow64\kernel32.dll
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                                                                              000000007635144a 2 bytes CALL 7671489d C:\Windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                                                                                         * 9
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                                                                                 00000000763514dd 2 bytes JMP 767b8822 C:\Windows\syswow64\kernel32.dll
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                                                                                          00000000763514f5 2 bytes JMP 767b89f8 C:\Windows\syswow64\kernel32.dll
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                                                                                 000000007635150d 2 bytes JMP 767b8718 C:\Windows\syswow64\kernel32.dll
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                                                                                          0000000076351525 2 bytes JMP 767b8ae2 C:\Windows\syswow64\kernel32.dll
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                                                                                000000007635153d 2 bytes JMP 7672fca8 C:\Windows\syswow64\kernel32.dll
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                                                                                     0000000076351555 2 bytes JMP 767368ef C:\Windows\syswow64\kernel32.dll
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                                                                              000000007635156d 2 bytes JMP 767b8fe3 C:\Windows\syswow64\kernel32.dll
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                                                                                0000000076351585 2 bytes JMP 767b8b42 C:\Windows\syswow64\kernel32.dll
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                                                                                   000000007635159d 2 bytes JMP 767b86dc C:\Windows\syswow64\kernel32.dll
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                                                                                00000000763515b5 2 bytes JMP 7672fd41 C:\Windows\syswow64\kernel32.dll
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                                                                              00000000763515cd 2 bytes JMP 7673b2dc C:\Windows\syswow64\kernel32.dll
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                                                                                          00000000763516b2 2 bytes JMP 767b8ea4 C:\Windows\syswow64\kernel32.dll
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1284] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                                                                                          00000000763516bd 2 bytes JMP 767b8671 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                                                                          00000000772413ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500                                                                                                                          0000000077241544 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                                                                                  00000000772418ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212                                                                                                                                 0000000077241ba8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                                                                                    0000000077241d25 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                                                                                        0000000077241e8f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89                                                                                                                                      0000000077241f75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680                                                                                                                          0000000077242238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 531                                                                                                               0000000077242683 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                                                                                      00000000772426a0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                                                                                    00000000772426c2 8 bytes {JMP 0x10}
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                                                                                     000000007724271f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184                                                                                                    0000000077242788 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                         * 4
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                                                                            0000000077242b4b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375                                                                                                            0000000077242b97 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                         * 2
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                                                                                        000000007724306b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920                                                                                                                        00000000772431f8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                                                                                       000000007724388e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                                                                                       00000000772438e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                                                                                           00000000772439b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                                                                                    0000000077243f50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161                                                                                                                   0000000077244001 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277                                                                                                                   0000000077244075 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                         * 3
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214                                                                                                                       00000000772441b6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276                                                                                                                       00000000772441f4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 609                                                                                                                                 0000000077244461 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284                                                                                                                    000000007724464c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483                                                                                                                    0000000077244713 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231                                                                                                                                 0000000077244807 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518                                                                                                                                 0000000077244926 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                         * 2
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256                                                                                                                0000000077244a50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67                                                                                                                   0000000077244aa3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501                                                                                                                0000000077244ca5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256                                                                                                                           0000000077244ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247                                                                                                                     0000000077244fa7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 483                                                                                                                       0000000077245193 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438                                                                                                                       0000000077245f46 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!EtwEventProviderEnabled + 198                                                                                                                       0000000077246016 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!atol + 194                                                                                                                                          000000007724610e 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76                                                                                                                                          00000000772462fc 8 bytes [50, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45                                                                                                            000000007724633d 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4                                                                                                                0000000077246354 8 bytes [30, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92                                                                                                               00000000772463ac 8 bytes [20, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790                                                                                                                         0000000077246b76 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                                                                              000000007728dc80 8 bytes {JMP QWORD [RIP-0x47949]}
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                                                                            000000007728de00 8 bytes {JMP QWORD [RIP-0x47ab2]}
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                                                  000000007728de30 8 bytes {JMP QWORD [RIP-0x47e20]}
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                                                                000000007728df50 8 bytes {JMP QWORD [RIP-0x47c5a]}
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                                                                    000000007728e000 8 bytes {JMP QWORD [RIP-0x47ef8]}
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                                                                    000000007728e630 8 bytes {JMP QWORD [RIP-0x47102]}
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                                                                  000000007728e880 8 bytes {JMP QWORD [RIP-0x47d10]}
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                                                  000000007728f0e0 8 bytes {JMP QWORD [RIP-0x48d3a]}
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                                                                                0000000074cd13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                                                                                0000000074cd146b 8 bytes {JMP 0xffffffffffffffb0}
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                                                                             0000000074cd16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                                                                          0000000074cd19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                                                                          0000000074cd19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                                                                                    0000000074cd1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1588] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                                                                                                 0000000075f02ab1 5 bytes JMP 00000001002c2dcc
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                                                                                                   00000000772413ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500                                                                                                                                                   0000000077241544 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                                                                                                           00000000772418ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212                                                                                                                                                          0000000077241ba8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                                                                                                             0000000077241d25 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                                                                                                                 0000000077241e8f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89                                                                                                                                                               0000000077241f75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680                                                                                                                                                   0000000077242238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 531                                                                                                                                        0000000077242683 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                                                                                                               00000000772426a0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                                                                                                             00000000772426c2 8 bytes {JMP 0x10}
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                                                                                                              000000007724271f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184                                                                                                                             0000000077242788 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                         * 4
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                                                                                                     0000000077242b4b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375                                                                                                                                     0000000077242b97 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                         * 2
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                                                                                                                 000000007724306b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920                                                                                                                                                 00000000772431f8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                                                                                                                000000007724388e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                                                                                                                00000000772438e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                                                                                                                    00000000772439b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                                                                                                             0000000077243f50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161                                                                                                                                            0000000077244001 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277                                                                                                                                            0000000077244075 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                         * 3
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214                                                                                                                                                00000000772441b6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276                                                                                                                                                00000000772441f4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 609                                                                                                                                                          0000000077244461 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284                                                                                                                                             000000007724464c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483                                                                                                                                             0000000077244713 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231                                                                                                                                                          0000000077244807 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518                                                                                                                                                          0000000077244926 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                         * 2
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256                                                                                                                                         0000000077244a50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67                                                                                                                                            0000000077244aa3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501                                                                                                                                         0000000077244ca5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256                                                                                                                                                    0000000077244ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247                                                                                                                                              0000000077244fa7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 483                                                                                                                                                0000000077245193 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438                                                                                                                                                0000000077245f46 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!EtwEventProviderEnabled + 198                                                                                                                                                0000000077246016 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!atol + 194                                                                                                                                                                   000000007724610e 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76                                                                                                                                                                   00000000772462fc 8 bytes [50, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45                                                                                                                                     000000007724633d 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4                                                                                                                                         0000000077246354 8 bytes [30, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92                                                                                                                                        00000000772463ac 8 bytes [20, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790                                                                                                                                                  0000000077246b76 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                                                                                                       000000007728dc80 8 bytes {JMP QWORD [RIP-0x47949]}
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                                                                                                     000000007728de00 8 bytes {JMP QWORD [RIP-0x47ab2]}
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                                                                           000000007728de30 8 bytes {JMP QWORD [RIP-0x47e20]}
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                                                                                         000000007728df50 8 bytes {JMP QWORD [RIP-0x47c5a]}
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                                                                                             000000007728e000 8 bytes {JMP QWORD [RIP-0x47ef8]}
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                                                                                             000000007728e630 8 bytes {JMP QWORD [RIP-0x47102]}
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                                                                                           000000007728e880 8 bytes {JMP QWORD [RIP-0x47d10]}
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                                                                           000000007728f0e0 8 bytes {JMP QWORD [RIP-0x48d3a]}
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                                                                                                         0000000074cd13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                                                                                                         0000000074cd146b 8 bytes {JMP 0xffffffffffffffb0}
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                                                                                                      0000000074cd16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                                                                                                   0000000074cd19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                                                                                                   0000000074cd19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Gyazo\GyStation.exe[1296] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                                                                                                             0000000074cd1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                                                                                      00000000772413ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500                                                                                                                                      0000000077241544 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                                                                                              00000000772418ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212                                                                                                                                             0000000077241ba8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                                                                                                0000000077241d25 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                                                                                                    0000000077241e8f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89                                                                                                                                                  0000000077241f75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680                                                                                                                                      0000000077242238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 531                                                                                                                           0000000077242683 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                                                                                                  00000000772426a0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                                                                                                00000000772426c2 8 bytes {JMP 0x10}
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                                                                                                 000000007724271f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184                                                                                                                0000000077242788 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                         * 4
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                                                                                        0000000077242b4b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375                                                                                                                        0000000077242b97 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                         * 2
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                                                                                                    000000007724306b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920                                                                                                                                    00000000772431f8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                                                                                                   000000007724388e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                                                                                                   00000000772438e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                                                                                                       00000000772439b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                                                                                                0000000077243f50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161                                                                                                                               0000000077244001 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277                                                                                                                               0000000077244075 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                         * 3
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214                                                                                                                                   00000000772441b6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276                                                                                                                                   00000000772441f4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 609                                                                                                                                             0000000077244461 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284                                                                                                                                000000007724464c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483                                                                                                                                0000000077244713 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231                                                                                                                                             0000000077244807 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518                                                                                                                                             0000000077244926 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                         * 2
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256                                                                                                                            0000000077244a50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67                                                                                                                               0000000077244aa3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501                                                                                                                            0000000077244ca5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256                                                                                                                                       0000000077244ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247                                                                                                                                 0000000077244fa7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 483                                                                                                                                   0000000077245193 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438                                                                                                                                   0000000077245f46 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!EtwEventProviderEnabled + 198                                                                                                                                   0000000077246016 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!atol + 194                                                                                                                                                      000000007724610e 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76                                                                                                                                                      00000000772462fc 8 bytes [50, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45                                                                                                                        000000007724633d 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4                                                                                                                            0000000077246354 8 bytes [30, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92                                                                                                                           00000000772463ac 8 bytes [20, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790                                                                                                                                     0000000077246b76 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                                                                                          000000007728dc80 8 bytes {JMP QWORD [RIP-0x47949]}
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                                                                                        000000007728de00 8 bytes {JMP QWORD [RIP-0x47ab2]}
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                                                              000000007728de30 8 bytes {JMP QWORD [RIP-0x47e20]}
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                                                                            000000007728df50 8 bytes {JMP QWORD [RIP-0x47c5a]}
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                                                                                000000007728e000 8 bytes {JMP QWORD [RIP-0x47ef8]}
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                                                                                000000007728e630 8 bytes {JMP QWORD [RIP-0x47102]}
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                                                                              000000007728e880 8 bytes {JMP QWORD [RIP-0x47d10]}
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                                                              000000007728f0e0 8 bytes {JMP QWORD [RIP-0x48d3a]}
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                                                                                            0000000074cd13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                                                                                            0000000074cd146b 8 bytes {JMP 0xffffffffffffffb0}
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                                                                                         0000000074cd16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                                                                                      0000000074cd19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                                                                                      0000000074cd19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                                                                                                0000000074cd1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                                                       0000000076351401 2 bytes JMP 7673b21b C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                                                         0000000076351419 2 bytes JMP 7673b346 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                                                       0000000076351431 2 bytes JMP 767b8f29 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                                                       000000007635144a 2 bytes CALL 7671489d C:\Windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                                                                                         * 9
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                                                          00000000763514dd 2 bytes JMP 767b8822 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                                                                   00000000763514f5 2 bytes JMP 767b89f8 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                                                          000000007635150d 2 bytes JMP 767b8718 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                                                                   0000000076351525 2 bytes JMP 767b8ae2 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                                                         000000007635153d 2 bytes JMP 7672fca8 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                                                              0000000076351555 2 bytes JMP 767368ef C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                                                       000000007635156d 2 bytes JMP 767b8fe3 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                                                         0000000076351585 2 bytes JMP 767b8b42 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                                                            000000007635159d 2 bytes JMP 767b86dc C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                                                         00000000763515b5 2 bytes JMP 7672fd41 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                                                       00000000763515cd 2 bytes JMP 7673b2dc C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                                                                   00000000763516b2 2 bytes JMP 767b8ea4 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[3380] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                                                                   00000000763516bd 2 bytes JMP 767b8671 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                                                                                      00000000772413ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500                                                                                                                                      0000000077241544 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                                                                                              00000000772418ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212                                                                                                                                             0000000077241ba8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                                                                                                0000000077241d25 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                                                                                                    0000000077241e8f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89                                                                                                                                                  0000000077241f75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680                                                                                                                                      0000000077242238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 531                                                                                                                           0000000077242683 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                                                                                                  00000000772426a0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                                                                                                00000000772426c2 8 bytes {JMP 0x10}
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                                                                                                 000000007724271f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184                                                                                                                0000000077242788 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                         * 4
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                                                                                        0000000077242b4b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375                                                                                                                        0000000077242b97 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...
         
__________________

Alt 24.05.2015, 01:48   #4
Kaprisonne
 
Back to Desktop + ladender Mauszeiger - Standard

Back to Desktop + ladender Mauszeiger



Gmer.txt: (Teil 2)
Code:
ATTFilter
                                                                                                                                                                                                                                                        * 2
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                                                                                                    000000007724306b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920                                                                                                                                    00000000772431f8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                                                                                                   000000007724388e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                                                                                                   00000000772438e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                                                                                                       00000000772439b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                                                                                                0000000077243f50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161                                                                                                                               0000000077244001 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277                                                                                                                               0000000077244075 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                         * 3
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214                                                                                                                                   00000000772441b6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276                                                                                                                                   00000000772441f4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 609                                                                                                                                             0000000077244461 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284                                                                                                                                000000007724464c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483                                                                                                                                0000000077244713 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231                                                                                                                                             0000000077244807 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518                                                                                                                                             0000000077244926 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                         * 2
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256                                                                                                                            0000000077244a50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67                                                                                                                               0000000077244aa3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501                                                                                                                            0000000077244ca5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256                                                                                                                                       0000000077244ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247                                                                                                                                 0000000077244fa7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 483                                                                                                                                   0000000077245193 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438                                                                                                                                   0000000077245f46 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!EtwEventProviderEnabled + 198                                                                                                                                   0000000077246016 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!atol + 194                                                                                                                                                      000000007724610e 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76                                                                                                                                                      00000000772462fc 8 bytes [50, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45                                                                                                                        000000007724633d 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4                                                                                                                            0000000077246354 8 bytes [30, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92                                                                                                                           00000000772463ac 8 bytes [20, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790                                                                                                                                     0000000077246b76 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                                                                                          000000007728dc80 8 bytes {JMP QWORD [RIP-0x47949]}
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                                                                                        000000007728de00 8 bytes {JMP QWORD [RIP-0x47ab2]}
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                                                              000000007728de30 8 bytes {JMP QWORD [RIP-0x47e20]}
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                                                                            000000007728df50 8 bytes {JMP QWORD [RIP-0x47c5a]}
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                                                                                000000007728e000 8 bytes {JMP QWORD [RIP-0x47ef8]}
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                                                                                000000007728e630 8 bytes {JMP QWORD [RIP-0x47102]}
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                                                                              000000007728e880 8 bytes {JMP QWORD [RIP-0x47d10]}
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                                                              000000007728f0e0 8 bytes {JMP QWORD [RIP-0x48d3a]}
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                                                                                            0000000074cd13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                                                                                            0000000074cd146b 8 bytes {JMP 0xffffffffffffffb0}
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                                                                                         0000000074cd16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                                                                                      0000000074cd19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                                                                                      0000000074cd19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                                                                                                0000000074cd1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                                                       0000000076351401 2 bytes JMP 7673b21b C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                                                         0000000076351419 2 bytes JMP 7673b346 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                                                       0000000076351431 2 bytes JMP 767b8f29 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                                                       000000007635144a 2 bytes CALL 7671489d C:\Windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                                                                                         * 9
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                                                          00000000763514dd 2 bytes JMP 767b8822 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                                                                   00000000763514f5 2 bytes JMP 767b89f8 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                                                          000000007635150d 2 bytes JMP 767b8718 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                                                                   0000000076351525 2 bytes JMP 767b8ae2 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                                                         000000007635153d 2 bytes JMP 7672fca8 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                                                              0000000076351555 2 bytes JMP 767368ef C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                                                       000000007635156d 2 bytes JMP 767b8fe3 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                                                         0000000076351585 2 bytes JMP 767b8b42 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                                                            000000007635159d 2 bytes JMP 767b86dc C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                                                         00000000763515b5 2 bytes JMP 7672fd41 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                                                       00000000763515cd 2 bytes JMP 7673b2dc C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                                                                   00000000763516b2 2 bytes JMP 767b8ea4 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Local\Akamai\netsession_win.exe[4036] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                                                                   00000000763516bd 2 bytes JMP 767b8671 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                                                               00000000772413ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500                                                                                                               0000000077241544 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                                                                       00000000772418ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212                                                                                                                      0000000077241ba8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                                                                         0000000077241d25 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                                                                             0000000077241e8f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89                                                                                                                           0000000077241f75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680                                                                                                               0000000077242238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 531                                                                                                    0000000077242683 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                                                                           00000000772426a0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                                                                         00000000772426c2 8 bytes {JMP 0x10}
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                                                                          000000007724271f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184                                                                                         0000000077242788 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                         * 4
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                                                                 0000000077242b4b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375                                                                                                 0000000077242b97 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                         * 2
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                                                                             000000007724306b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920                                                                                                             00000000772431f8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                                                                            000000007724388e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                                                                            00000000772438e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                                                                                00000000772439b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                                                                         0000000077243f50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161                                                                                                        0000000077244001 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277                                                                                                        0000000077244075 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                         * 3
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214                                                                                                            00000000772441b6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276                                                                                                            00000000772441f4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 609                                                                                                                      0000000077244461 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284                                                                                                         000000007724464c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483                                                                                                         0000000077244713 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231                                                                                                                      0000000077244807 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518                                                                                                                      0000000077244926 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                         * 2
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256                                                                                                     0000000077244a50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67                                                                                                        0000000077244aa3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501                                                                                                     0000000077244ca5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256                                                                                                                0000000077244ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247                                                                                                          0000000077244fa7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 483                                                                                                            0000000077245193 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438                                                                                                            0000000077245f46 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!EtwEventProviderEnabled + 198                                                                                                            0000000077246016 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!atol + 194                                                                                                                               000000007724610e 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76                                                                                                                               00000000772462fc 8 bytes [50, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45                                                                                                 000000007724633d 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4                                                                                                     0000000077246354 8 bytes [30, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92                                                                                                    00000000772463ac 8 bytes [20, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790                                                                                                              0000000077246b76 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                                                                   000000007728dc80 8 bytes {JMP QWORD [RIP-0x47949]}
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                                                                 000000007728de00 8 bytes {JMP QWORD [RIP-0x47ab2]}
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                                       000000007728de30 8 bytes {JMP QWORD [RIP-0x47e20]}
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                                                     000000007728df50 8 bytes {JMP QWORD [RIP-0x47c5a]}
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                                                         000000007728e000 8 bytes {JMP QWORD [RIP-0x47ef8]}
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                                                         000000007728e630 8 bytes {JMP QWORD [RIP-0x47102]}
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                                                       000000007728e880 8 bytes {JMP QWORD [RIP-0x47d10]}
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                                       000000007728f0e0 8 bytes {JMP QWORD [RIP-0x48d3a]}
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                                                                     0000000074cd13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                                                                     0000000074cd146b 8 bytes {JMP 0xffffffffffffffb0}
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                                                                  0000000074cd16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                                                               0000000074cd19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                                                               0000000074cd19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe[3140] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                                                                         0000000074cd1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                                                                                      00000000772413ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500                                                                                                                                      0000000077241544 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                                                                                              00000000772418ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212                                                                                                                                             0000000077241ba8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                                                                                                0000000077241d25 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                                                                                                    0000000077241e8f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89                                                                                                                                                  0000000077241f75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680                                                                                                                                      0000000077242238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 531                                                                                                                           0000000077242683 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                                                                                                  00000000772426a0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                                                                                                00000000772426c2 8 bytes {JMP 0x10}
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                                                                                                 000000007724271f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184                                                                                                                0000000077242788 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                         * 4
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                                                                                        0000000077242b4b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375                                                                                                                        0000000077242b97 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                         * 2
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                                                                                                    000000007724306b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920                                                                                                                                    00000000772431f8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                                                                                                   000000007724388e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                                                                                                   00000000772438e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                                                                                                       00000000772439b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                                                                                                0000000077243f50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161                                                                                                                               0000000077244001 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277                                                                                                                               0000000077244075 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                         * 3
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214                                                                                                                                   00000000772441b6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276                                                                                                                                   00000000772441f4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 609                                                                                                                                             0000000077244461 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284                                                                                                                                000000007724464c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483                                                                                                                                0000000077244713 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231                                                                                                                                             0000000077244807 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518                                                                                                                                             0000000077244926 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                         * 2
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256                                                                                                                            0000000077244a50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67                                                                                                                               0000000077244aa3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501                                                                                                                            0000000077244ca5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256                                                                                                                                       0000000077244ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247                                                                                                                                 0000000077244fa7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 483                                                                                                                                   0000000077245193 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438                                                                                                                                   0000000077245f46 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!EtwEventProviderEnabled + 198                                                                                                                                   0000000077246016 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!atol + 194                                                                                                                                                      000000007724610e 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76                                                                                                                                                      00000000772462fc 8 bytes [50, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45                                                                                                                        000000007724633d 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4                                                                                                                            0000000077246354 8 bytes [30, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92                                                                                                                           00000000772463ac 8 bytes [20, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790                                                                                                                                     0000000077246b76 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                                                                                          000000007728dc80 8 bytes {JMP QWORD [RIP-0x47949]}
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                                                                                        000000007728de00 8 bytes {JMP QWORD [RIP-0x47ab2]}
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                                                              000000007728de30 8 bytes {JMP QWORD [RIP-0x47e20]}
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                                                                            000000007728df50 8 bytes {JMP QWORD [RIP-0x47c5a]}
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                                                                                000000007728e000 8 bytes {JMP QWORD [RIP-0x47ef8]}
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                                                                                000000007728e630 8 bytes {JMP QWORD [RIP-0x47102]}
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                                                                              000000007728e880 8 bytes {JMP QWORD [RIP-0x47d10]}
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                                                              000000007728f0e0 8 bytes {JMP QWORD [RIP-0x48d3a]}
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                                                                                            0000000074cd13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                                                                                            0000000074cd146b 8 bytes {JMP 0xffffffffffffffb0}
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                                                                                         0000000074cd16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                                                                                      0000000074cd19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                                                                                      0000000074cd19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                                                                                                0000000074cd1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\syswow64\Psapi.dll!GetModuleFileNameExW + 17                                                                                                                                       0000000076351401 2 bytes JMP 7673b21b C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\syswow64\Psapi.dll!EnumProcessModules + 17                                                                                                                                         0000000076351419 2 bytes JMP 7673b346 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 17                                                                                                                                       0000000076351431 2 bytes JMP 767b8f29 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 42                                                                                                                                       000000007635144a 2 bytes CALL 7671489d C:\Windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                                                                                         * 9
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\syswow64\Psapi.dll!EnumDeviceDrivers + 17                                                                                                                                          00000000763514dd 2 bytes JMP 767b8822 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\syswow64\Psapi.dll!GetDeviceDriverBaseNameA + 17                                                                                                                                   00000000763514f5 2 bytes JMP 767b89f8 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\syswow64\Psapi.dll!QueryWorkingSetEx + 17                                                                                                                                          000000007635150d 2 bytes JMP 767b8718 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\syswow64\Psapi.dll!GetDeviceDriverBaseNameW + 17                                                                                                                                   0000000076351525 2 bytes JMP 767b8ae2 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\syswow64\Psapi.dll!GetModuleBaseNameW + 17                                                                                                                                         000000007635153d 2 bytes JMP 7672fca8 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\syswow64\Psapi.dll!EnumProcesses + 17                                                                                                                                              0000000076351555 2 bytes JMP 767368ef C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\syswow64\Psapi.dll!GetProcessMemoryInfo + 17                                                                                                                                       000000007635156d 2 bytes JMP 767b8fe3 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\syswow64\Psapi.dll!GetPerformanceInfo + 17                                                                                                                                         0000000076351585 2 bytes JMP 767b8b42 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\syswow64\Psapi.dll!QueryWorkingSet + 17                                                                                                                                            000000007635159d 2 bytes JMP 767b86dc C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\syswow64\Psapi.dll!GetModuleBaseNameA + 17                                                                                                                                         00000000763515b5 2 bytes JMP 7672fd41 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\syswow64\Psapi.dll!GetModuleFileNameExA + 17                                                                                                                                       00000000763515cd 2 bytes JMP 7673b2dc C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\syswow64\Psapi.dll!GetProcessImageFileNameW + 20                                                                                                                                   00000000763516b2 2 bytes JMP 767b8ea4 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe[2204] C:\Windows\syswow64\Psapi.dll!GetProcessImageFileNameW + 31                                                                                                                                   00000000763516bd 2 bytes JMP 767b8671 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                                     00000000772413ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500                                                                                     0000000077241544 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                                             00000000772418ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212                                                                                            0000000077241ba8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                                               0000000077241d25 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                                                   0000000077241e8f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89                                                                                                 0000000077241f75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680                                                                                     0000000077242238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 531                                                                          0000000077242683 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                                                 00000000772426a0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                                               00000000772426c2 8 bytes {JMP 0x10}
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                                                000000007724271f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184                                                               0000000077242788 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                         * 4
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                                       0000000077242b4b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375                                                                       0000000077242b97 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                         * 2
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                                                   000000007724306b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920                                                                                   00000000772431f8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                                                  000000007724388e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                                                  00000000772438e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                                                      00000000772439b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                                               0000000077243f50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161                                                                              0000000077244001 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277                                                                              0000000077244075 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                         * 3
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214                                                                                  00000000772441b6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276                                                                                  00000000772441f4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 609                                                                                            0000000077244461 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284                                                                               000000007724464c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483                                                                               0000000077244713 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231                                                                                            0000000077244807 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518                                                                                            0000000077244926 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                         * 2
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256                                                                           0000000077244a50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67                                                                              0000000077244aa3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501                                                                           0000000077244ca5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256                                                                                      0000000077244ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247                                                                                0000000077244fa7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 483                                                                                  0000000077245193 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438                                                                                  0000000077245f46 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!EtwEventProviderEnabled + 198                                                                                  0000000077246016 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!atol + 194                                                                                                     000000007724610e 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76                                                                                                     00000000772462fc 8 bytes [50, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45                                                                       000000007724633d 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4                                                                           0000000077246354 8 bytes [30, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92                                                                          00000000772463ac 8 bytes [20, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790                                                                                    0000000077246b76 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                                         000000007728dc80 8 bytes {JMP QWORD [RIP-0x47949]}
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                                       000000007728de00 8 bytes {JMP QWORD [RIP-0x47ab2]}
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                             000000007728de30 8 bytes {JMP QWORD [RIP-0x47e20]}
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                           000000007728df50 8 bytes {JMP QWORD [RIP-0x47c5a]}
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                               000000007728e000 8 bytes {JMP QWORD [RIP-0x47ef8]}
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                               000000007728e630 8 bytes {JMP QWORD [RIP-0x47102]}
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                             000000007728e880 8 bytes {JMP QWORD [RIP-0x47d10]}
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                             000000007728f0e0 8 bytes {JMP QWORD [RIP-0x48d3a]}
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                                           0000000074cd13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                                           0000000074cd146b 8 bytes {JMP 0xffffffffffffffb0}
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                                        0000000074cd16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                                     0000000074cd19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                                     0000000074cd19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4172] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                                               0000000074cd1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                                                                                                       00000000772413ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500                                                                                                                                                       0000000077241544 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                                                                                                               00000000772418ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212                                                                                                                                                              0000000077241ba8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                                                                                                                 0000000077241d25 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                                                                                                                     0000000077241e8f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89                                                                                                                                                                   0000000077241f75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680                                                                                                                                                       0000000077242238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 531                                                                                                                                            0000000077242683 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                                                                                                                   00000000772426a0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                                                                                                                 00000000772426c2 8 bytes {JMP 0x10}
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                                                                                                                  000000007724271f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184                                                                                                                                 0000000077242788 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                         * 4
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                                                                                                         0000000077242b4b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375                                                                                                                                         0000000077242b97 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                         * 2
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                                                                                                                     000000007724306b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920                                                                                                                                                     00000000772431f8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                                                                                                                    000000007724388e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                                                                                                                    00000000772438e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                                                                                                                        00000000772439b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                                                                                                                 0000000077243f50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161                                                                                                                                                0000000077244001 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277                                                                                                                                                0000000077244075 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                         * 3
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214                                                                                                                                                    00000000772441b6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276                                                                                                                                                    00000000772441f4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 609                                                                                                                                                              0000000077244461 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284                                                                                                                                                 000000007724464c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483                                                                                                                                                 0000000077244713 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231                                                                                                                                                              0000000077244807 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518                                                                                                                                                              0000000077244926 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                         * 2
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256                                                                                                                                             0000000077244a50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67                                                                                                                                                0000000077244aa3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501                                                                                                                                             0000000077244ca5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256                                                                                                                                                        0000000077244ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247                                                                                                                                                  0000000077244fa7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 483                                                                                                                                                    0000000077245193 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438                                                                                                                                                    0000000077245f46 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!EtwEventProviderEnabled + 198                                                                                                                                                    0000000077246016 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!atol + 194                                                                                                                                                                       000000007724610e 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76                                                                                                                                                                       00000000772462fc 8 bytes [50, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45                                                                                                                                         000000007724633d 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4                                                                                                                                             0000000077246354 8 bytes [30, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92                                                                                                                                            00000000772463ac 8 bytes [20, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790                                                                                                                                                      0000000077246b76 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                                                                                                           000000007728dc80 8 bytes {JMP QWORD [RIP-0x47949]}
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                                                                                                         000000007728de00 8 bytes {JMP QWORD [RIP-0x47ab2]}
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                                                                               000000007728de30 8 bytes {JMP QWORD [RIP-0x47e20]}
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                                                                                             000000007728df50 8 bytes {JMP QWORD [RIP-0x47c5a]}
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                                                                                                 000000007728e000 8 bytes {JMP QWORD [RIP-0x47ef8]}
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                                                                                                 000000007728e630 8 bytes {JMP QWORD [RIP-0x47102]}
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                                                                                               000000007728e880 8 bytes {JMP QWORD [RIP-0x47d10]}
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                                                                               000000007728f0e0 8 bytes {JMP QWORD [RIP-0x48d3a]}
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                                                                                                             0000000074cd13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                                                                                                             0000000074cd146b 8 bytes {JMP 0xffffffffffffffb0}
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                                                                                                          0000000074cd16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                                                                                                       0000000074cd19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                                                                                                       0000000074cd19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Jannik\Desktop\Gmer-19357.exe[4340] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                                                                                                                 0000000074cd1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

---- Threads - GMER 2.1 ----

Thread   C:\Windows\System32\svchost.exe [3428:6484]                                                                                                                                                                                                                 000007feef729688
---- Processes - GMER 2.1 ----

Library  c:\users\jannik\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpqmtvai.dll (*** suspicious ***) @ C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe [2204](2015-05-23 11:34:36)                                       0000000003e60000
Library  C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Qt5Core.dll (*** suspicious ***) @ C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe [2204] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:24)           0000000069b30000
Library  C:\Users\Jannik\AppData\Roaming\Dropbox\bin\icuin52.dll (*** suspicious ***) @ C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe [2204] (ICU I18N DLL/The ICU Project)(2015-03-04 21:45:30)                                                           000000004a900000
Library  C:\Users\Jannik\AppData\Roaming\Dropbox\bin\icuuc52.dll (*** suspicious ***) @ C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe [2204] (ICU Common DLL/The ICU Project)(2015-03-04 21:45:30)                                                         0000000005e10000
Library  C:\Users\Jannik\AppData\Roaming\Dropbox\bin\icudt52.dll (*** suspicious ***) @ C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe [2204] (ICU Data DLL/The ICU Project)(2015-03-04 21:45:30)                                                           000000004ad00000
Library  C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Qt5Widgets.dll (*** suspicious ***) @ C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe [2204] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:28)        00000000626e0000
Library  C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Qt5Gui.dll (*** suspicious ***) @ C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe [2204] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26)            00000000623f0000
Library  C:\Users\Jannik\AppData\Roaming\Dropbox\bin\libGLESv2.dll (*** suspicious ***) @ C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe [2204](2015-03-04 21:45:30)                                                                                        0000000069430000
Library  C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Qt5Network.dll (*** suspicious ***) @ C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe [2204] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26)        0000000062210000
Library  C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Qt5WebKit.dll (*** suspicious ***) @ C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe [2204] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26)         0000000060330000
Library  C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Qt5Quick.dll (*** suspicious ***) @ C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe [2204] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26)          0000000060110000
Library  C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Qt5Qml.dll (*** suspicious ***) @ C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe [2204] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26)            000000005feb0000
Library  C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Qt5Sql.dll (*** suspicious ***) @ C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe [2204] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26)            00000000696e0000
Library  C:\Users\Jannik\AppData\Roaming\Dropbox\bin\libEGL.dll (*** suspicious ***) @ C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe [2204](2015-03-04 21:45:30)                                                                                           0000000069a70000
Library  C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Qt5WebKitWidgets.dll (*** suspicious ***) @ C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe [2204] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:28)  0000000069010000
Library  C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Qt5OpenGL.dll (*** suspicious ***) @ C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe [2204] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26)         0000000068fd0000
Library  C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Qt5PrintSupport.dll (*** suspicious ***) @ C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe [2204] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26)   0000000068f80000
Library  C:\Users\Jannik\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll (*** suspicious ***) @ C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe [2204](2015-03-04 21:45:30)                                                                       0000000068c60000
Library  C:\Users\Jannik\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll (*** suspicious ***) @ C:\Users\Jannik\AppData\Roaming\Dropbox\bin\Dropbox.exe [2204](2015-03-04 21:45:30)                                                                       0000000068c20000

---- EOF - GMER 2.1 ----
         
Vielleicht findet ihr ja was.

Grüße und ,
Kaprisonne

Edit:
Es liegt übrigens nicht am Spiel. Auch wenn ich nur am rumsurfen bin kommt der ladene Mauszeiger ab und zu.

Alt 26.05.2015, 12:56   #5
schrauber
/// the machine
/// TB-Ausbilder
 

Back to Desktop + ladender Mauszeiger - Standard

Back to Desktop + ladender Mauszeiger



hi,

Downloade dir bitte Malwarebytes Anti-Rootkit Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
  • Starte bitte die mbar.exe.
  • Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
  • Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
  • Klicke auf den CleanUp Button und erlaube den Neustart.
  • Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
  • Nach dem Neustart starte die mbar.exe erneut.
  • Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.
Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Downloade dir bitte TDSSKiller TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
    TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
    Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt
Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 26.05.2015, 13:57   #6
Kaprisonne
 
Back to Desktop + ladender Mauszeiger - Standard

Back to Desktop + ladender Mauszeiger



Hab bereits meinen PC formatiert, wurde sowieso mal wieder Zeit, kann also geclosed werden.

Trotzdem danke

Alt 27.05.2015, 07:50   #7
schrauber
/// the machine
/// TB-Ausbilder
 

Back to Desktop + ladender Mauszeiger - Standard

Back to Desktop + ladender Mauszeiger



ok
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Antwort

Themen zu Back to Desktop + ladender Mauszeiger
abständen, ausführen, beendet, beim spielen, blauer, desktop, geschickt, kaspersky, mauszeiger, min, probleme, problemen, programmes, regelmäßigen, schließe, schließen, sofort, spiele, unregelmäßige



Ähnliche Themen: Back to Desktop + ladender Mauszeiger


  1. Back again
    Plagegeister aller Art und deren Bekämpfung - 02.06.2015 (19)
  2. Windows 8: MyPC Back up pop up
    Log-Analyse und Auswertung - 03.02.2014 (5)
  3. GVU Trojaner auf Win 7 ohne Back Up, Wie Daten retten?
    Plagegeister aller Art und deren Bekämpfung - 26.03.2013 (18)
  4. Jamez is back... Partitionstabelle wiederherstellen
    Netzwerk und Hardware - 17.08.2011 (17)
  5. Phrack is back: 25 Jahre digitales Hackermagazin
    Nachrichten - 18.11.2010 (0)
  6. Back'Up auf DOS ebene
    Überwachung, Datenschutz und Spam - 03.06.2009 (3)
  7. Hilfe Trojaner, kein Back Up!
    Plagegeister aller Art und deren Bekämpfung - 06.02.2009 (0)
  8. Mauszeiger fährt unkontrolliert über den Desktop
    Plagegeister aller Art und deren Bekämpfung - 26.02.2006 (4)
  9. sygate firewall, back trace, whois?
    Antiviren-, Firewall- und andere Schutzprogramme - 01.01.2006 (2)
  10. Back door Programm
    Log-Analyse und Auswertung - 23.10.2005 (3)
  11. I'm back!
    Mülltonne - 05.09.2005 (17)
  12. Back Web Lite
    Plagegeister aller Art und deren Bekämpfung - 04.06.2005 (4)
  13. Cash Back Hund und andere Werbedinger
    Plagegeister aller Art und deren Bekämpfung - 22.02.2005 (8)
  14. Hiiiillllfffeeee...bitte! back door sub7
    Antiviren-, Firewall- und andere Schutzprogramme - 03.11.2004 (74)
  15. Cash Back Hund
    Plagegeister aller Art und deren Bekämpfung - 23.08.2004 (28)

Zum Thema Back to Desktop + ladender Mauszeiger - Hallo, Ich werde beim Spielen von Witcher 3 in unregelmäßigen Abständen (~30-60 min) zurück auf zum Desktop geschickt und der Mauszeiger lässt auf das Ausführen eines Programmes schließen(blauer Ladering). Das - Back to Desktop + ladender Mauszeiger...
Archiv
Du betrachtest: Back to Desktop + ladender Mauszeiger auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.