Gmer Code:
GMER Logfile:
Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-08-10 17:58:18
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP4T0L0-6 SAMSUNG_HD501LJ rev.CR100-13 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\DPF\AppData\Local\Temp\pxldqpob.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff800031ad000 9 bytes [00, 00, 1D, 02, 4E, 74, 66, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 538 fffff800031ad00a 35 bytes [C0, 03, 80, FA, FF, FF, 0A, ...]
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000772911f5 8 bytes {JMP 0xd}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077291390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 000000007729143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 000000007729158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 000000007729191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077291b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077291bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077291d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077291eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077291edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077291f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077291fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077291fd7 8 bytes {JMP 0xb}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077292272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077292301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077292792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000772927b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000772927d2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007729282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077292890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077292d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077292d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077293023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007729323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000772933c0 16 bytes {JMP 0x4e}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077293a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077293ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077293b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077293d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077294190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00000000772e1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00000000772e1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00000000772e1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000772e1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00000000772e1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000772e1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00000000772e1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000772e27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000074db13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000074db146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000074db16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 0000000074db16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000074db19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000074db19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 0000000074db1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 0000000074db1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074db1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1060] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 0000000074db1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NETGEAR\WG111v3\WG111v3.exe[3444] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000074db13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NETGEAR\WG111v3\WG111v3.exe[3444] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000074db146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\NETGEAR\WG111v3\WG111v3.exe[3444] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000074db16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NETGEAR\WG111v3\WG111v3.exe[3444] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 0000000074db16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NETGEAR\WG111v3\WG111v3.exe[3444] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000074db19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NETGEAR\WG111v3\WG111v3.exe[3444] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000074db19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NETGEAR\WG111v3\WG111v3.exe[3444] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 0000000074db1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NETGEAR\WG111v3\WG111v3.exe[3444] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 0000000074db1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NETGEAR\WG111v3\WG111v3.exe[3444] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074db1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NETGEAR\WG111v3\WG111v3.exe[3444] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 0000000074db1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000772911f5 8 bytes {JMP 0xd}
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077291390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 000000007729143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 000000007729158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 000000007729191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077291b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077291bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077291d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077291eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077291edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077291f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077291fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077291fd7 8 bytes {JMP 0xb}
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077292272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077292301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077292792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000772927b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000772927d2 8 bytes {JMP 0x10}
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007729282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077292890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077292d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077292d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077293023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007729323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000772933c0 16 bytes {JMP 0x4e}
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077293a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077293ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077293b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077293d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077294190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00000000772e1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00000000772e1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00000000772e1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000772e1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00000000772e1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000772e1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00000000772e1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000772e27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000074db13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000074db146b 8 bytes {JMP 0xffffffffffffffb0}
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000074db16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 0000000074db16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000074db19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000074db19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 0000000074db1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 0000000074db1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074db1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text D:\Program Files (x86)\iTunes\iTunesHelper.exe[1908] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 0000000074db1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000772911f5 8 bytes {JMP 0xd}
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077291390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 000000007729143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 000000007729158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 000000007729191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077291b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077291bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077291d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077291eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077291edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077291f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077291fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077291fd7 8 bytes {JMP 0xb}
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077292272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077292301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077292792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000772927b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000772927d2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007729282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077292890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077292d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077292d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077293023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007729323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000772933c0 16 bytes {JMP 0x4e}
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077293a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077293ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077293b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077293d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077294190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00000000772e1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00000000772e1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00000000772e1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000772e1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00000000772e1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000772e1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00000000772e1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000772e27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000074db13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000074db146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000074db16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 0000000074db16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000074db19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000074db19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 0000000074db1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 0000000074db1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074db1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1648] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 0000000074db1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000772911f5 8 bytes {JMP 0xd}
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077291390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 000000007729143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 000000007729158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 000000007729191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077291b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077291bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077291d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077291eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077291edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077291f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077291fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077291fd7 8 bytes {JMP 0xb}
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077292272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077292301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077292792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000772927b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000772927d2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007729282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077292890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077292d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077292d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077293023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007729323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000772933c0 16 bytes {JMP 0x4e}
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077293a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077293ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077293b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077293d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077294190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00000000772e1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00000000772e1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00000000772e1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000772e1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00000000772e1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000772e1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00000000772e1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000772e27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000074db13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000074db146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000074db16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 0000000074db16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000074db19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000074db19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 0000000074db1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 0000000074db1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074db1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe[1572] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 0000000074db1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000772911f5 8 bytes {JMP 0xd}
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077291390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 000000007729143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 000000007729158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 000000007729191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077291b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077291bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077291d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077291eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077291edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077291f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077291fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077291fd7 8 bytes {JMP 0xb}
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077292272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077292301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077292792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000772927b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000772927d2 8 bytes {JMP 0x10}
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007729282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077292890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077292d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077292d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077293023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007729323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000772933c0 16 bytes {JMP 0x4e}
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077293a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077293ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077293b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077293d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077294190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00000000772e1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00000000772e1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00000000772e1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000772e1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00000000772e1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000772e1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00000000772e1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000772e27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000074db13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000074db146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000074db16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 0000000074db16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000074db19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000074db19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 0000000074db1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 0000000074db1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074db1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\DPF\Desktop\Gmer-19357.exe[5772] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 0000000074db1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
---- EOF - GMER 2.1 ----
--- --- ---
|
So funktioniert es:
Malwarebytes Anti-Malware 
AdwCleaner auf deinen Desktop.
SecurityCheck und:
