Und GMER 4. und damit letzter Teil: Code:
.text ... * 4
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000076d32b4b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375 0000000076d32b97 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000076d3306b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920 0000000076d331f8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000076d3388e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000076d338e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000076d339b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000076d33f50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161 0000000076d34001 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277 0000000076d34075 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214 0000000076d341b6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276 0000000076d341f4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 609 0000000076d34461 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284 0000000076d3464c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483 0000000076d34713 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231 0000000076d34807 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518 0000000076d34926 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256 0000000076d34a50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67 0000000076d34aa3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501 0000000076d34ca5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256 0000000076d34ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247 0000000076d34fa7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 483 0000000076d35193 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438 0000000076d35f46 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!EtwEventProviderEnabled + 198 0000000076d36016 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!atol + 194 0000000076d3610e 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76 0000000076d362fc 8 bytes [50, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45 0000000076d3633d 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4 0000000076d36354 8 bytes [30, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92 0000000076d363ac 8 bytes [20, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790 0000000076d36b76 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000076d7dc80 8 bytes {JMP QWORD [RIP-0x47949]}
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000076d7de00 8 bytes {JMP QWORD [RIP-0x47ab2]}
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000076d7de30 8 bytes {JMP QWORD [RIP-0x47e20]}
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076d7df50 8 bytes {JMP QWORD [RIP-0x47c5a]}
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076d7e000 8 bytes {JMP QWORD [RIP-0x47ef8]}
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076d7e630 8 bytes {JMP QWORD [RIP-0x47102]}
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076d7e880 8 bytes {JMP QWORD [RIP-0x47d10]}
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076d7f0e0 8 bytes {JMP QWORD [RIP-0x48d3a]}
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000747b13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000747b146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000747b16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000747b19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000747b19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\listener.exe[1884] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000747b1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000076d313ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000076d31544 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000076d318ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000076d31ba8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000076d31d25 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000076d31e8f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000076d31f75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000076d32238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 531 0000000076d32683 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000076d326a0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000076d326c2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000076d3271f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184 0000000076d32788 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 4
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000076d32b4b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375 0000000076d32b97 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000076d3306b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920 0000000076d331f8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000076d3388e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000076d338e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000076d339b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000076d33f50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161 0000000076d34001 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277 0000000076d34075 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214 0000000076d341b6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276 0000000076d341f4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 609 0000000076d34461 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284 0000000076d3464c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483 0000000076d34713 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231 0000000076d34807 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518 0000000076d34926 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256 0000000076d34a50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67 0000000076d34aa3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501 0000000076d34ca5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256 0000000076d34ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247 0000000076d34fa7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 483 0000000076d35193 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438 0000000076d35f46 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!EtwEventProviderEnabled + 198 0000000076d36016 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!atol + 194 0000000076d3610e 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76 0000000076d362fc 8 bytes [50, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45 0000000076d3633d 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4 0000000076d36354 8 bytes [30, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92 0000000076d363ac 8 bytes [20, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790 0000000076d36b76 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000076d7dc80 8 bytes {JMP QWORD [RIP-0x47949]}
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000076d7de00 8 bytes {JMP QWORD [RIP-0x47ab2]}
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000076d7de30 8 bytes {JMP QWORD [RIP-0x47e20]}
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076d7df50 8 bytes {JMP QWORD [RIP-0x47c5a]}
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076d7e000 8 bytes {JMP QWORD [RIP-0x47ef8]}
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076d7e630 8 bytes {JMP QWORD [RIP-0x47102]}
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076d7e880 8 bytes {JMP QWORD [RIP-0x47d10]}
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076d7f0e0 8 bytes {JMP QWORD [RIP-0x48d3a]}
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000747b13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000747b146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000747b16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000747b19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000747b19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000747b1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075481401 2 bytes JMP 7539b21b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075481419 2 bytes JMP 7539b346 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075481431 2 bytes JMP 75418f29 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007548144a 2 bytes CALL 7537489d C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000754814dd 2 bytes JMP 75418822 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000754814f5 2 bytes JMP 754189f8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007548150d 2 bytes JMP 75418718 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075481525 2 bytes JMP 75418ae2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007548153d 2 bytes JMP 7538fca8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075481555 2 bytes JMP 753968ef C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007548156d 2 bytes JMP 75418fe3 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075481585 2 bytes JMP 75418b42 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007548159d 2 bytes JMP 754186dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000754815b5 2 bytes JMP 7538fd41 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000754815cd 2 bytes JMP 7539b2dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000754816b2 2 bytes JMP 75418ea4 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5636] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000754816bd 2 bytes JMP 75418671 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000076d313ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000076d31544 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000076d318ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000076d31ba8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000076d31d25 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000076d31e8f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000076d31f75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000076d32238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 531 0000000076d32683 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000076d326a0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000076d326c2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000076d3271f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184 0000000076d32788 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 4
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000076d32b4b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375 0000000076d32b97 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000076d3306b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920 0000000076d331f8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000076d3388e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000076d338e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000076d339b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000076d33f50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161 0000000076d34001 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277 0000000076d34075 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214 0000000076d341b6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276 0000000076d341f4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 609 0000000076d34461 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284 0000000076d3464c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483 0000000076d34713 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231 0000000076d34807 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518 0000000076d34926 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256 0000000076d34a50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67 0000000076d34aa3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501 0000000076d34ca5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256 0000000076d34ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247 0000000076d34fa7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 483 0000000076d35193 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438 0000000076d35f46 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!EtwEventProviderEnabled + 198 0000000076d36016 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!atol + 194 0000000076d3610e 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76 0000000076d362fc 8 bytes [50, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45 0000000076d3633d 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4 0000000076d36354 8 bytes [30, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92 0000000076d363ac 8 bytes [20, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790 0000000076d36b76 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000076d7dc80 8 bytes {JMP QWORD [RIP-0x47949]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000076d7de00 8 bytes {JMP QWORD [RIP-0x47ab2]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000076d7de30 8 bytes {JMP QWORD [RIP-0x47e20]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076d7df50 8 bytes {JMP QWORD [RIP-0x47c5a]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076d7e000 8 bytes {JMP QWORD [RIP-0x47ef8]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076d7e630 8 bytes {JMP QWORD [RIP-0x47102]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076d7e880 8 bytes {JMP QWORD [RIP-0x47d10]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076d7f0e0 8 bytes {JMP QWORD [RIP-0x48d3a]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000747b13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000747b146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000747b16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000747b19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000747b19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[9204] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000747b1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000076d313ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000076d31544 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000076d318ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000076d31ba8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000076d31d25 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000076d31e8f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000076d31f75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000076d32238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 531 0000000076d32683 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000076d326a0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000076d326c2 8 bytes {JMP 0x10}
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000076d3271f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184 0000000076d32788 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 4
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000076d32b4b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375 0000000076d32b97 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000076d3306b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920 0000000076d331f8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000076d3388e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000076d338e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000076d339b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000076d33f50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161 0000000076d34001 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277 0000000076d34075 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214 0000000076d341b6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276 0000000076d341f4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 609 0000000076d34461 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284 0000000076d3464c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483 0000000076d34713 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231 0000000076d34807 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518 0000000076d34926 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256 0000000076d34a50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67 0000000076d34aa3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501 0000000076d34ca5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256 0000000076d34ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247 0000000076d34fa7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 483 0000000076d35193 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438 0000000076d35f46 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!EtwEventProviderEnabled + 198 0000000076d36016 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!atol + 194 0000000076d3610e 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76 0000000076d362fc 8 bytes [50, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45 0000000076d3633d 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4 0000000076d36354 8 bytes [30, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92 0000000076d363ac 8 bytes [20, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790 0000000076d36b76 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000076d7dc80 8 bytes {JMP QWORD [RIP-0x47949]}
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000076d7de00 8 bytes {JMP QWORD [RIP-0x47ab2]}
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000076d7de30 8 bytes {JMP QWORD [RIP-0x47e20]}
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076d7df50 8 bytes {JMP QWORD [RIP-0x47c5a]}
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076d7e000 8 bytes {JMP QWORD [RIP-0x47ef8]}
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076d7e630 8 bytes {JMP QWORD [RIP-0x47102]}
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076d7e880 8 bytes {JMP QWORD [RIP-0x47d10]}
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076d7f0e0 8 bytes {JMP QWORD [RIP-0x48d3a]}
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000747b13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000747b146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000747b16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000747b19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000747b19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Sony\VAIO Care\VCService.exe[6880] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000747b1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000076d313ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000076d31544 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000076d318ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000076d31ba8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000076d31d25 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000076d31e8f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000076d31f75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000076d32238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 531 0000000076d32683 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000076d326a0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000076d326c2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000076d3271f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184 0000000076d32788 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 4
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000076d32b4b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375 0000000076d32b97 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000076d3306b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920 0000000076d331f8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000076d3388e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000076d338e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000076d339b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000076d33f50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161 0000000076d34001 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277 0000000076d34075 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214 0000000076d341b6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276 0000000076d341f4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 609 0000000076d34461 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284 0000000076d3464c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483 0000000076d34713 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231 0000000076d34807 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518 0000000076d34926 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256 0000000076d34a50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67 0000000076d34aa3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501 0000000076d34ca5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256 0000000076d34ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247 0000000076d34fa7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 483 0000000076d35193 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438 0000000076d35f46 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!EtwEventProviderEnabled + 198 0000000076d36016 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!atol + 194 0000000076d3610e 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76 0000000076d362fc 8 bytes [50, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45 0000000076d3633d 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4 0000000076d36354 8 bytes [30, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92 0000000076d363ac 8 bytes [20, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790 0000000076d36b76 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000076d7dc80 8 bytes {JMP QWORD [RIP-0x47949]}
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000076d7de00 8 bytes {JMP QWORD [RIP-0x47ab2]}
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000076d7de30 8 bytes {JMP QWORD [RIP-0x47e20]}
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076d7df50 8 bytes {JMP QWORD [RIP-0x47c5a]}
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076d7e000 8 bytes {JMP QWORD [RIP-0x47ef8]}
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076d7e630 8 bytes {JMP QWORD [RIP-0x47102]}
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076d7e880 8 bytes {JMP QWORD [RIP-0x47d10]}
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076d7f0e0 8 bytes {JMP QWORD [RIP-0x48d3a]}
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000747b13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000747b146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000747b16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000747b19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000747b19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE[9120] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000747b1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000076d313ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000076d31544 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000076d318ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000076d31ba8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000076d31d25 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000076d31e8f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000076d31f75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000076d32238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 531 0000000076d32683 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000076d326a0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000076d326c2 8 bytes {JMP 0x10}
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000076d3271f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184 0000000076d32788 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 4
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000076d32b4b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375 0000000076d32b97 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000076d3306b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920 0000000076d331f8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000076d3388e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000076d338e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000076d339b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000076d33f50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161 0000000076d34001 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277 0000000076d34075 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214 0000000076d341b6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276 0000000076d341f4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 609 0000000076d34461 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284 0000000076d3464c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483 0000000076d34713 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231 0000000076d34807 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518 0000000076d34926 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256 0000000076d34a50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67 0000000076d34aa3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501 0000000076d34ca5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256 0000000076d34ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247 0000000076d34fa7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 483 0000000076d35193 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438 0000000076d35f46 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!EtwEventProviderEnabled + 198 0000000076d36016 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!atol + 194 0000000076d3610e 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76 0000000076d362fc 8 bytes [50, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45 0000000076d3633d 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4 0000000076d36354 8 bytes [30, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92 0000000076d363ac 8 bytes [20, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790 0000000076d36b76 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000076d7dc80 8 bytes {JMP QWORD [RIP-0x47949]}
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000076d7de00 8 bytes {JMP QWORD [RIP-0x47ab2]}
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000076d7de30 8 bytes {JMP QWORD [RIP-0x47e20]}
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076d7df50 8 bytes {JMP QWORD [RIP-0x47c5a]}
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076d7e000 8 bytes {JMP QWORD [RIP-0x47ef8]}
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076d7e630 8 bytes {JMP QWORD [RIP-0x47102]}
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076d7e880 8 bytes {JMP QWORD [RIP-0x47d10]}
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076d7f0e0 8 bytes {JMP QWORD [RIP-0x48d3a]}
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000747b13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000747b146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000747b16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000747b19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000747b19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\chberghoff\Desktop\Gmer-19357.exe[9684] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000747b1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\642737adbe4e
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\642737adbe4e (not active ControlSet)
---- EOF - GMER 2.1 ----
|
So funktioniert es:
Malwarebytes Anti-Malware 
AdwCleaner auf deinen Desktop.
SecurityCheck und:
