| sibelius84 | 15.04.2015 16:26 |
Windows 8 - Prävention nach kurzzeitigem Schädlingsbefall
Hallo zusammen,
vor 1-2 Jahren habt ihr mir schon mal sehr geholfen und nun habe ich mir kurzzeitig neuen Schlamassel eingebrockt:
Auf meinem neuen Win8-Notebook wollte ich die neueste Version meines Lieblingsspiels zocken und es fehlte die d3dx9_25.dll, die ich dann gesucht und runtergeladen habe - wie ich zu meiner Schande eingestehen muss, nicht von einer besonders vertrauenswürdigen Seite. Extra noch die Datenbanken meiner Kaspersky Internet Security (KIS) aktualisiert und das Teil geprüft, war scheinbar ok. Kaum angeklickt, gab die KIS mehrere Fehlermeldungen auf einmal aus: Adware - Malware. Unter anderem sagte es mir, ich solle den Rechner neu starten.
Das habe ich gemacht und es dauerte unheimlich lange. Wieder hochgefahren, hatte ich erstmal einen (Win8-)Bluescreen, weil Windows sich konfigurieren musste, auch das dauerte unheimlich lange, wobei die meiste Zeit schon ein Fortschritt von "100%" angezeigt wurde. Danach war die Tastenbelegung meiner Tastatur plötzlich die englische und nicht mehr die deutsche, das habe ich von Hand umgestellt, ansonsten schien alles ok zu sein. Im Bericht von KIS steht auch, dass drei Bedrohungen erfolgreich eliminiert wurden.
Nun möchte ich sichergehen, dass da nicht noch versteckte Gefahren im Hintergrund lauern und bitte euch dafür noch einmal um Hilfe.
Hier sind die LOGS:
1.) FRST.txt
(mein Post wird zu lang, muss ich evtl als Anhang schicken)
2.) Addition.txt Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-04-2015 02
Ran by sibelius84 at 2015-04-15 16:23:10
Running from C:\Users\sibelius84\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.007.20033 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
ASUS Live Update (HKLM-x32\...\{FA540E67-095C-4A1B-97BA-4D547DEC9AF4}) (Version: 3.2.8 - ASUS)
ASUS Screen Saver (HKLM-x32\...\{0FBEEDF8-30FA-4FA3-B31F-C9C7E7E8DFA2}) (Version: 1.0.3 - ASUS)
ASUS Smart Gesture (HKLM-x32\...\{4D3286A6-F6AB-498A-82A4-E4F040529F3D}) (Version: 3.0.8 - ASUS)
ASUS Splendid Video Enhancement Technology (HKLM-x32\...\{0969AF05-4FF6-4C00-9406-43599238DE0D}) (Version: 3.01.0003 - ASUS)
ASUS USB Charger Plus (HKLM-x32\...\{A859E3E5-C62F-4BFA-AF1D-2B95E03166AF}) (Version: 3.1.9 - ASUS)
ATK Package (HKLM-x32\...\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}) (Version: 1.0.0034 - ASUS)
Device Setup (HKLM-x32\...\{1F07F2C7-596F-4F34-B805-2C61A3E50E5A}) (Version: 1.0.18 - ASUSTek Computer Inc.)
Foxit PhantomPDF (HKLM-x32\...\{FC76E6BB-7CBB-4CD6-8178-3BCADC0526C3}) (Version: 6.0.62.801 - Foxit Corporation)
Heroes of Might & Magic V: Hammers of Fate (HKLM-x32\...\{66FF4C48-0083-4E60-8556-B883AB200091}) (Version: - )
Heroes of Might and Magic V (HKLM-x32\...\{20071984-5EB1-4881-8EDB-082532ACEC6D}) (Version: - )
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3496 - Intel Corporation)
Intel(R) Sideband Fabric Device Driver (HKLM-x32\...\C5A8BC6E-723A-4C0F-96E1-C426D1A4BCA9) (Version: 1.0.0.1002 - Intel Corporation)
Intel(R) Trusted Execution Engine (HKLM\...\{176E2755-0A17-42C6-88E2-192AB2131278}) (Version: 1.0.0.1064 - Intel Corporation)
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{02FECEE0-16B2-43DB-BC3B-C844477FC142}) (Version: 15.0.2.361 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 15.0.2.361 - Kaspersky Lab) Hidden
Microsoft Mouse and Keyboard Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.3.188.0 - Microsoft Corporation)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4641.3004 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
MiKTeX 2.8 (HKLM-x32\...\MiKTeX 2.8) (Version: 2.8 - MiKTeX.org)
Mozilla Firefox 37.0.1 (x86 en-GB) (HKLM-x32\...\Mozilla Firefox 37.0.1 (x86 en-GB)) (Version: 37.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 31.6.0 - Mozilla)
Mozilla Thunderbird 31.6.0 (x86 en-GB) (HKLM-x32\...\Mozilla Thunderbird 31.6.0 (x86 en-GB)) (Version: 31.6.0 - Mozilla)
MyPCBU version 2.25 (HKLM-x32\...\{7D7D6742-5B49-4454-9E9B-748E731E741A}_is1) (Version: 2.25 - )
OpenOffice 4.1.1 (HKLM-x32\...\{86F2B095-3998-41D5-833D-1C5075300950}) (Version: 4.11.9775 - Apache Software Foundation)
Qualcomm Atheros Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 10.0 - Qualcomm Atheros)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9600.21243 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.29.314.2014 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7231 - Realtek Semiconductor Corp.)
Skype™ 6.18 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.105 - Skype Technologies S.A.)
TeXnicCenter Version 1.0 Stable RC1 (HKLM-x32\...\TeXnicCenter_is1) (Version: Version 1.0 Stable RC1 - TeXnicCenter.org)
Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.0 - VideoLAN)
WebStorage (HKLM-x32\...\WebStorage) (Version: 2.2.0.496 - ASUS Cloud Corporation)
WildTangent Games App (HKLM-x32\...\{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-asus) (Version: 4.0.11.14 - WildTangent)
Windows Driver Package - ASUS (ATP) Mouse (07/02/2014 1.0.0.228) (HKLM\...\7504488B89E0121B0737D63957491C9CD2633065) (Version: 07/02/2014 1.0.0.228 - ASUS)
WinFlash (HKLM-x32\...\{8F21291E-0444-4B1D-B9F9-4370A73E346D}) (Version: 2.42.0 - ASUS)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-3825016726-1200000350-241092879-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)
==================== Restore Points =========================
11-04-2015 20:56:13 Installed Heroes of Might and Magic V
13-04-2015 16:25:49 Installed Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {08AF166D-568D-4263-9344-D4ED1C7C17D9} - System32\Tasks\ASUS USB Charger Plus => C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe [2014-03-27] (ASUSTek Computer Inc.)
Task: {168C3C2E-43D3-4914-A0C9-25DB602F000E} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-03-07] (Adobe Systems Incorporated)
Task: {36E27157-D0DB-4D2D-A708-3BCE4417161E} - System32\Tasks\ASUS\ASUS Product Register Service => C:\Program Files (x86)\ASUS\APRP\aprp.exe [2014-09-02] (ASUSTek Computer Inc.)
Task: {38961278-A870-4098-8236-7792CAFE396B} - System32\Tasks\ASUS Live Update2 => C:\Program Files (x86) [2015-04-14] ()
Task: {5CF11E7E-BC9C-4EE0-A660-D654FDEDF807} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {641C9E39-B1E5-44F5-A733-426A0F0C5EA6} - System32\Tasks\Update Checker => C:\Program Files (x86)\ASUS\ASUS Live Update\UpdateChecker.exe [2014-03-11] ()
Task: {6977D3D0-D14F-47D3-BA9E-A3EF431EA309} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-14] (Adobe Systems Incorporated)
Task: {6ABAE3E2-6162-4278-8CCE-48ABDC5D7161} - System32\Tasks\RtHDVBg => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2014-04-15] (Realtek Semiconductor)
Task: {73A3406A-3F24-43C7-9DAF-10C8EDB97E16} - System32\Tasks\ASUS Splendid ACMON => C:\Program Files (x86)\ASUS\Splendid\ACMON.exe [2014-04-02] (ASUS)
Task: {88E1DE14-AE9C-4E9F-B082-9B4581E34420} - System32\Tasks\Microsoft\Office\Microsoft Office Touchless Attach Notification => C:\Program Files (x86)\Microsoft Office\Office15\FirstRun.exe [2014-08-20] (Microsoft Corporation)
Task: {8A7B85C1-4437-4A55-9EDE-8A015A1F5D86} - System32\Tasks\ATK Package 36D18D69AFC3 => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\SimAppExec.exe [2014-01-14] (ASUSTek Computer Inc.)
Task: {9089F897-7D62-40D3-97E9-7DCAE540D6CC} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2014-03-19] (Microsoft)
Task: {91DDF1CF-E1C3-4CA6-8335-1137B8A4D0DD} - System32\Tasks\RTKCPL => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2014-04-10] (Realtek Semiconductor)
Task: {A135453C-F8BB-4C58-88E2-42E354A9A00A} - System32\Tasks\ASUS Smart Gesture Launcher => C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLauncher.exe [2014-09-19] (AsusTek)
Task: {A77E6BED-A725-4E7D-A833-2DF0427045E1} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {CF344C1A-0C07-40A6-A6B5-6E921394EA02} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {DBEE27E4-DD1D-4643-9752-C928BE1A30B7} - System32\Tasks\ASUS Live Update1 => C:\Program Files (x86) [2015-04-14] ()
Task: {EBF578C9-DDB3-4294-89C3-F58EAFAECE20} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {F2A61883-5BE7-4941-8C01-D95DAB93B463} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-04-15] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) ==============
2015-02-13 05:56 - 2015-02-13 05:56 - 01374504 _____ () C:\Program Files (x86)\ASUS\WebStorage\2.2.0.496\AsusWSService.exe
2014-12-23 16:54 - 2014-12-23 16:54 - 01272616 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\kpcengine.2.3.dll
2014-04-02 16:46 - 2014-04-02 16:46 - 00117248 _____ () C:\Program Files (x86)\ASUS\Splendid\CCTAdjust.dll
2014-04-02 16:46 - 2014-04-02 16:46 - 00037936 _____ () C:\Program Files (x86)\ASUS\Splendid\DetectDisplayDC.dll
2014-04-02 16:46 - 2014-04-02 16:46 - 00018992 _____ () C:\Program Files (x86)\ASUS\Splendid\AMDColorEnhance.dll
2014-04-02 16:46 - 2014-04-02 16:46 - 00020528 _____ () C:\Program Files (x86)\ASUS\Splendid\AMDRegammaAndGamut.dll
2014-12-23 16:54 - 2014-12-23 16:54 - 00502056 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\FFExt\content_blocker@kaspersky.com\npcontentblocker.dll
2014-12-23 16:54 - 2014-12-23 16:54 - 00608040 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\FFExt\virtual_keyboard@kaspersky.com\npvkplugin.dll
2014-12-23 16:54 - 2014-12-23 16:54 - 00338216 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\FFExt\online_banking@kaspersky.com\nponlinebanking.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-3825016726-1200000350-241092879-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\asus\wallpapers\asus.jpg
DNS Servers: 192.168.178.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== Accounts: =============================
Administrator (S-1-5-21-3825016726-1200000350-241092879-500 - Administrator - Disabled)
Guest (S-1-5-21-3825016726-1200000350-241092879-501 - Limited - Disabled)
sibelius84 (S-1-5-21-3825016726-1200000350-241092879-1001 - Administrator - Enabled) => C:\Users\sibelius84
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (04/15/2015 11:36:18 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program FirstRun.exe version 15.0.4641.1000 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
Process ID: 13e0
Start Time: 01d076f85108ec90
Termination Time: 5750
Application Path: C:\Program Files (x86)\Microsoft Office\Office15\FirstRun.exe
Report Id: 88ab1580-e352-11e4-8264-f0795982e664
Faulting package full name:
Faulting package-relative application ID:
Error: (04/14/2015 11:14:02 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: 013053~1.EXE, version: 8.6.146.0, time stamp: 0x5331bbeb
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x495c2936
Faulting process ID: 0x620
Faulting application start time: 0x013053~1.EXE0
Faulting application path: 013053~1.EXE1
Faulting module path: 013053~1.EXE2
Report ID: 013053~1.EXE3
Faulting package full name: 013053~1.EXE4
Faulting package-relative application ID: 013053~1.EXE5
Error: (04/14/2015 10:49:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: 013053~1.EXE, version: 8.6.146.0, time stamp: 0x5331bbeb
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x495c2936
Faulting process ID: 0x618
Faulting application start time: 0x013053~1.EXE0
Faulting application path: 013053~1.EXE1
Faulting module path: 013053~1.EXE2
Report ID: 013053~1.EXE3
Faulting package full name: 013053~1.EXE4
Faulting package-relative application ID: 013053~1.EXE5
Error: (04/14/2015 10:40:00 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: 013053~1.EXE, version: 8.6.146.0, time stamp: 0x5331bbeb
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x495c2936
Faulting process ID: 0x664
Faulting application start time: 0x013053~1.EXE0
Faulting application path: 013053~1.EXE1
Faulting module path: 013053~1.EXE2
Report ID: 013053~1.EXE3
Faulting package full name: 013053~1.EXE4
Faulting package-relative application ID: 013053~1.EXE5
Error: (04/14/2015 10:27:31 PM) (Source: Microsoft-Windows-WMI) (EventID: 4) (User: NT AUTHORITY)
Description: Error 0x8004401e encountered when trying to load MOF C:\WINDOWS\SYSTEM32\WBEM\NL-NL\MSDTCWMI.MFL while recovering .MOF file marked with autorecover.
Error: (04/14/2015 10:27:31 PM) (Source: Microsoft-Windows-WMI) (EventID: 4) (User: NT AUTHORITY)
Description: Error 0x8004401e encountered when trying to load MOF C:\WINDOWS\SYSTEM32\NL-NL\PSMODULEDISCOVERYPROVIDER.MFL while recovering .MOF file marked with autorecover.
Error: (04/14/2015 10:27:31 PM) (Source: Microsoft-Windows-WMI) (EventID: 4) (User: NT AUTHORITY)
Description: Error 0x8004401e encountered when trying to load MOF C:\WINDOWS\SYSTEM32\WBEM\NL-NL\NETEVENTPACKETCAPTURE.MFL while recovering .MOF file marked with autorecover.
Error: (04/14/2015 10:27:31 PM) (Source: Microsoft-Windows-WMI) (EventID: 4) (User: NT AUTHORITY)
Description: Error 0x8004401e encountered when trying to load MOF C:\WINDOWS\SYSTEM32\WBEM\NL-NL\SCHEDPROV.MFL while recovering .MOF file marked with autorecover.
Error: (04/14/2015 10:27:31 PM) (Source: Microsoft-Windows-WMI) (EventID: 4) (User: NT AUTHORITY)
Description: Error 0x8004401e encountered when trying to load MOF C:\WINDOWS\SYSTEM32\WBEM\NL-NL\WDACWMIPROV.MFL while recovering .MOF file marked with autorecover.
Error: (04/14/2015 10:27:31 PM) (Source: Microsoft-Windows-WMI) (EventID: 4) (User: NT AUTHORITY)
Description: Error 0x8004401e encountered when trying to load MOF C:\WINDOWS\SYSTEM32\WBEM\NL-NL\WFASCIM.MFL while recovering .MOF file marked with autorecover.
System errors:
=============
Error: (04/15/2015 11:58:45 AM) (Source: DCOM) (EventID: 10010) (User: Asus2015)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
Error: (04/15/2015 11:47:21 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)UnavailableUnavailable
Error: (04/15/2015 11:16:35 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x800f0841: Security Update for Windows 8.1 for x64-based Systems (KB3033889).
Error: (04/14/2015 11:14:02 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The McAfee Application Installer Cleanup (0130531428766510) service terminated unexpectedly. It has done this 1 time(s).
Error: (04/14/2015 11:11:22 PM) (Source: DCOM) (EventID: 10010) (User: NT AUTHORITY)
Description: {752073A1-23F2-4396-85F0-8FDB879ED0ED}
Error: (04/14/2015 11:09:22 PM) (Source: DCOM) (EventID: 10010) (User: NT AUTHORITY)
Description: {752073A1-23F2-4396-85F0-8FDB879ED0ED}
Error: (04/14/2015 11:07:22 PM) (Source: DCOM) (EventID: 10010) (User: NT AUTHORITY)
Description: {752073A1-23F2-4396-85F0-8FDB879ED0ED}
Error: (04/14/2015 11:05:22 PM) (Source: DCOM) (EventID: 10010) (User: NT AUTHORITY)
Description: {752073A1-23F2-4396-85F0-8FDB879ED0ED}
Error: (04/14/2015 11:03:22 PM) (Source: DCOM) (EventID: 10010) (User: NT AUTHORITY)
Description: {752073A1-23F2-4396-85F0-8FDB879ED0ED}
Error: (04/14/2015 11:01:22 PM) (Source: DCOM) (EventID: 10010) (User: NT AUTHORITY)
Description: {752073A1-23F2-4396-85F0-8FDB879ED0ED}
Microsoft Office Sessions:
=========================
Error: (04/15/2015 11:36:18 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: FirstRun.exe15.0.4641.100013e001d076f85108ec905750C:\Program Files (x86)\Microsoft Office\Office15\FirstRun.exe88ab1580-e352-11e4-8264-f0795982e664
Error: (04/14/2015 11:14:02 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: 013053~1.EXE8.6.146.05331bbebunknown0.0.0.000000000c0000005495c293662001d076f7e5e8aba4C:\Users\SIBELI~1\AppData\Local\Temp\013053~1.EXEunknown2c05652c-e2eb-11e4-8264-f0795982e664
Error: (04/14/2015 10:49:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: 013053~1.EXE8.6.146.05331bbebunknown0.0.0.000000000c0000005495c293661801d076f4817f7a21C:\Users\SIBELI~1\AppData\Local\Temp\013053~1.EXEunknowncb9d727a-e2e7-11e4-8263-f0795982e664
Error: (04/14/2015 10:40:00 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: 013053~1.EXE8.6.146.05331bbebunknown0.0.0.000000000c0000005495c293666401d076f3204fcc19C:\Users\SIBELI~1\AppData\Local\Temp\013053~1.EXEunknown6b360ca3-e2e6-11e4-8262-f0795982e664
Error: (04/14/2015 10:27:31 PM) (Source: Microsoft-Windows-WMI) (EventID: 4) (User: NT AUTHORITY)
Description: 0x8004401eC:\WINDOWS\SYSTEM32\WBEM\NL-NL\MSDTCWMI.MFL
Error: (04/14/2015 10:27:31 PM) (Source: Microsoft-Windows-WMI) (EventID: 4) (User: NT AUTHORITY)
Description: 0x8004401eC:\WINDOWS\SYSTEM32\NL-NL\PSMODULEDISCOVERYPROVIDER.MFL
Error: (04/14/2015 10:27:31 PM) (Source: Microsoft-Windows-WMI) (EventID: 4) (User: NT AUTHORITY)
Description: 0x8004401eC:\WINDOWS\SYSTEM32\WBEM\NL-NL\NETEVENTPACKETCAPTURE.MFL
Error: (04/14/2015 10:27:31 PM) (Source: Microsoft-Windows-WMI) (EventID: 4) (User: NT AUTHORITY)
Description: 0x8004401eC:\WINDOWS\SYSTEM32\WBEM\NL-NL\SCHEDPROV.MFL
Error: (04/14/2015 10:27:31 PM) (Source: Microsoft-Windows-WMI) (EventID: 4) (User: NT AUTHORITY)
Description: 0x8004401eC:\WINDOWS\SYSTEM32\WBEM\NL-NL\WDACWMIPROV.MFL
Error: (04/14/2015 10:27:31 PM) (Source: Microsoft-Windows-WMI) (EventID: 4) (User: NT AUTHORITY)
Description: 0x8004401eC:\WINDOWS\SYSTEM32\WBEM\NL-NL\WFASCIM.MFL
==================== Memory info ===========================
Processor: Intel(R) Celeron(R) CPU N2940 @ 1.83GHz
Percentage of memory in use: 25%
Total physical RAM: 8078.54 MB
Available physical RAM: 5980.14 MB
Total Pagefile: 9998.54 MB
Available Pagefile: 8019 MB
Total Virtual: 131072 MB
Available Virtual: 131071.8 MB
==================== Drives ================================
Drive c: (OS) (Fixed) (Total:372.6 GB) (Free:328.49 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Data) (Fixed) (Total:537.8 GB) (Free:533.1 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 7FCA99AF)
Partition: GPT Partition Type.
==================== End Of Log ============================
3.) GMER.txt Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-04-15 16:53:36
Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\00000023 TOSHIBA_MQ01ABD100 rev.AX0R2J 931.51GB
Running: Gmer-19357.exe; Driver: C:\Users\SIBELI~1\AppData\Local\Temp\kxdyrpoc.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 132 00007ffbd48f4b04 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 316 00007ffbd48f4f2c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!TpAllocIoCompletion + 710 00007ffbd48f5206 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitForWnfMetaNotification + 479 00007ffbd48f53ff 8 bytes {JMP 0xffffffffffffffee}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!RtlUserThreadStart + 911 00007ffbd48f579f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWork + 420 00007ffbd48f5954 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitOnAddress + 657 00007ffbd48f5ef1 8 bytes {JMP 0xffffffffffffff9e}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfNotificationWaitForCompletion + 78 00007ffbd48f5f4e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!RtlWakeAddressAll + 399 00007ffbd48f60ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfStateChangeNotification + 977 00007ffbd48f64d1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 310 00007ffbd48f6616 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 491 00007ffbd48f66cb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!RtlReportSilentProcessExit + 359 00007ffbd48f8397 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 67 00007ffbd48f8a13 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 864 00007ffbd48f8d30 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllHandleByName + 143 00007ffbd48f8e9f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 510 00007ffbd48f90ae 8 bytes {JMP 0xffffffffffffff96}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 715 00007ffbd48f917b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!RtlQueueWorkItem + 772 00007ffbd48f9d14 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!LdrAddRefDll + 685 00007ffbd48f9fcd 8 bytes {JMP 0xffffffffffffffaf}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 352 00007ffbd48faae0 8 bytes {JMP 0xffffffffffffffcd}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 488 00007ffbd48fab68 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!RtlGetVersion + 565 00007ffbd48fb2e5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!RtlGetNtProductType + 78 00007ffbd48fb33e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 311 00007ffbd48fc4d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 528 00007ffbd48fc5b0 8 bytes {JMP 0xffffffffffffffc7}
.text ... * 2
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!RtlAllocateActivationContextStack + 579 00007ffbd48fd0d3 8 bytes {JMP 0xffffffffffffffef}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!RtlFreeThreadActivationContextStack + 47 00007ffbd48fd10f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!RtlProcessFlsData + 495 00007ffbd48fd57f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 43 00007ffbd48fd6eb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 456 00007ffbd48fd888 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseWait + 180 00007ffbd48fd944 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!RtlRegisterWait + 596 00007ffbd48fdba4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWait + 424 00007ffbd48fdd58 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 771 00007ffbd48fe073 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 948 00007ffbd48fe124 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsA + 48 00007ffbd48fe160 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!RtlRandomEx + 756 00007ffbd48feb74 8 bytes {JMP 0xffffffffffffffd0}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteFunctionTable + 371 00007ffbd48ffe63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!RtlAddFunctionTable + 556 00007ffbd490009c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!RtlProtectHeap + 171 00007ffbd490015b 8 bytes [70, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 744 00007ffbd4901438 8 bytes [40, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsW + 214 00007ffbd49015e6 8 bytes [30, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!EtwNotificationRegister + 567 00007ffbd4901877 8 bytes [20, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 429 00007ffbd4901a2d 8 bytes [10, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceExecuteOnce + 213 00007ffbd4901c35 8 bytes [00, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00007ffbd4971290 8 bytes {JMP QWORD [RIP-0x6fe5e]}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00007ffbd4971410 8 bytes {JMP QWORD [RIP-0x6fe30]}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00007ffbd4971440 8 bytes {JMP QWORD [RIP-0x712eb]}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffbd4971560 8 bytes {JMP QWORD [RIP-0x70c1e]}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00007ffbd4971610 8 bytes {JMP QWORD [RIP-0x71122]}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007ffbd4971cd0 8 bytes {JMP QWORD [RIP-0x700a1]}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00007ffbd4971fd0 8 bytes {JMP QWORD [RIP-0x705a9]}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007ffbd4972850 8 bytes {JMP QWORD [RIP-0x70fdf]}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 438 0000000077bb13f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 387 0000000077bb1583 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49 0000000077bb1621 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68 0000000077bb1674 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23 0000000077bb16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 9 0000000077bb16e9 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 71 0000000077bb1727 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 7
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16 0000000077bb25d0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308 0000000077bb2714 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 529 0000000077bb2961 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[2488] C:\Windows\system32\wow64cpu.dll!CpuProcessTerm + 595 0000000077bb2bd3 8 bytes [DC, 6A, F8, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 132 00007ffbd48f4b04 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 316 00007ffbd48f4f2c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!TpAllocIoCompletion + 710 00007ffbd48f5206 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitForWnfMetaNotification + 479 00007ffbd48f53ff 8 bytes {JMP 0xffffffffffffffee}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!RtlUserThreadStart + 911 00007ffbd48f579f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWork + 420 00007ffbd48f5954 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitOnAddress + 657 00007ffbd48f5ef1 8 bytes {JMP 0xffffffffffffff9e}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfNotificationWaitForCompletion + 78 00007ffbd48f5f4e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!RtlWakeAddressAll + 399 00007ffbd48f60ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfStateChangeNotification + 977 00007ffbd48f64d1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 310 00007ffbd48f6616 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 491 00007ffbd48f66cb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!RtlReportSilentProcessExit + 359 00007ffbd48f8397 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 67 00007ffbd48f8a13 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 864 00007ffbd48f8d30 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllHandleByName + 143 00007ffbd48f8e9f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 510 00007ffbd48f90ae 8 bytes {JMP 0xffffffffffffff96}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 715 00007ffbd48f917b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!RtlQueueWorkItem + 772 00007ffbd48f9d14 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!LdrAddRefDll + 685 00007ffbd48f9fcd 8 bytes {JMP 0xffffffffffffffaf}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 352 00007ffbd48faae0 8 bytes {JMP 0xffffffffffffffcd}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 488 00007ffbd48fab68 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!RtlGetVersion + 565 00007ffbd48fb2e5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!RtlGetNtProductType + 78 00007ffbd48fb33e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 311 00007ffbd48fc4d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 528 00007ffbd48fc5b0 8 bytes {JMP 0xffffffffffffffc7}
.text ... * 2
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!RtlAllocateActivationContextStack + 579 00007ffbd48fd0d3 8 bytes {JMP 0xffffffffffffffef}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!RtlFreeThreadActivationContextStack + 47 00007ffbd48fd10f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!RtlProcessFlsData + 495 00007ffbd48fd57f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 43 00007ffbd48fd6eb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 456 00007ffbd48fd888 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseWait + 180 00007ffbd48fd944 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!RtlRegisterWait + 596 00007ffbd48fdba4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWait + 424 00007ffbd48fdd58 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 771 00007ffbd48fe073 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 948 00007ffbd48fe124 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsA + 48 00007ffbd48fe160 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!RtlRandomEx + 756 00007ffbd48feb74 8 bytes {JMP 0xffffffffffffffd0}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteFunctionTable + 371 00007ffbd48ffe63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!RtlAddFunctionTable + 556 00007ffbd490009c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!RtlProtectHeap + 171 00007ffbd490015b 8 bytes [70, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 744 00007ffbd4901438 8 bytes [40, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsW + 214 00007ffbd49015e6 8 bytes [30, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!EtwNotificationRegister + 567 00007ffbd4901877 8 bytes [20, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 429 00007ffbd4901a2d 8 bytes [10, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceExecuteOnce + 213 00007ffbd4901c35 8 bytes [00, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00007ffbd4971290 8 bytes {JMP QWORD [RIP-0x6fe5e]}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00007ffbd4971410 8 bytes {JMP QWORD [RIP-0x6fe30]}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00007ffbd4971440 8 bytes {JMP QWORD [RIP-0x712eb]}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffbd4971560 8 bytes {JMP QWORD [RIP-0x70c1e]}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00007ffbd4971610 8 bytes {JMP QWORD [RIP-0x71122]}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007ffbd4971cd0 8 bytes {JMP QWORD [RIP-0x700a1]}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00007ffbd4971fd0 8 bytes {JMP QWORD [RIP-0x705a9]}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007ffbd4972850 8 bytes {JMP QWORD [RIP-0x70fdf]}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 438 0000000077bb13f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 387 0000000077bb1583 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49 0000000077bb1621 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68 0000000077bb1674 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23 0000000077bb16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 9 0000000077bb16e9 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 71 0000000077bb1727 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 7
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16 0000000077bb25d0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308 0000000077bb2714 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 529 0000000077bb2961 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[2400] C:\Windows\system32\wow64cpu.dll!CpuProcessTerm + 595 0000000077bb2bd3 8 bytes [DC, 6A, F8, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 132 00007ffbd48f4b04 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 316 00007ffbd48f4f2c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!TpAllocIoCompletion + 710 00007ffbd48f5206 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitForWnfMetaNotification + 479 00007ffbd48f53ff 8 bytes {JMP 0xffffffffffffffee}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!RtlUserThreadStart + 911 00007ffbd48f579f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWork + 420 00007ffbd48f5954 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitOnAddress + 657 00007ffbd48f5ef1 8 bytes {JMP 0xffffffffffffff9e}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfNotificationWaitForCompletion + 78 00007ffbd48f5f4e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!RtlWakeAddressAll + 399 00007ffbd48f60ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfStateChangeNotification + 977 00007ffbd48f64d1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 310 00007ffbd48f6616 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 491 00007ffbd48f66cb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!RtlReportSilentProcessExit + 359 00007ffbd48f8397 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 67 00007ffbd48f8a13 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 864 00007ffbd48f8d30 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllHandleByName + 143 00007ffbd48f8e9f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 510 00007ffbd48f90ae 8 bytes {JMP 0xffffffffffffff96}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 715 00007ffbd48f917b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!RtlQueueWorkItem + 772 00007ffbd48f9d14 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!LdrAddRefDll + 685 00007ffbd48f9fcd 8 bytes {JMP 0xffffffffffffffaf}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 352 00007ffbd48faae0 8 bytes {JMP 0xffffffffffffffcd}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 488 00007ffbd48fab68 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!RtlGetVersion + 565 00007ffbd48fb2e5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!RtlGetNtProductType + 78 00007ffbd48fb33e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 311 00007ffbd48fc4d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 528 00007ffbd48fc5b0 8 bytes {JMP 0xffffffffffffffc7}
.text ... * 2
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!RtlAllocateActivationContextStack + 579 00007ffbd48fd0d3 8 bytes {JMP 0xffffffffffffffef}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!RtlFreeThreadActivationContextStack + 47 00007ffbd48fd10f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!RtlProcessFlsData + 495 00007ffbd48fd57f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 43 00007ffbd48fd6eb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 456 00007ffbd48fd888 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseWait + 180 00007ffbd48fd944 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!RtlRegisterWait + 596 00007ffbd48fdba4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWait + 424 00007ffbd48fdd58 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 771 00007ffbd48fe073 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 948 00007ffbd48fe124 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsA + 48 00007ffbd48fe160 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!RtlRandomEx + 756 00007ffbd48feb74 8 bytes {JMP 0xffffffffffffffd0}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteFunctionTable + 371 00007ffbd48ffe63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!RtlAddFunctionTable + 556 00007ffbd490009c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!RtlProtectHeap + 171 00007ffbd490015b 8 bytes [70, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 744 00007ffbd4901438 8 bytes [40, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsW + 214 00007ffbd49015e6 8 bytes [30, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!EtwNotificationRegister + 567 00007ffbd4901877 8 bytes [20, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 429 00007ffbd4901a2d 8 bytes [10, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceExecuteOnce + 213 00007ffbd4901c35 8 bytes [00, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00007ffbd4971290 8 bytes {JMP QWORD [RIP-0x6fe5e]}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00007ffbd4971410 8 bytes {JMP QWORD [RIP-0x6fe30]}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00007ffbd4971440 8 bytes {JMP QWORD [RIP-0x712eb]}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffbd4971560 8 bytes {JMP QWORD [RIP-0x70c1e]}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00007ffbd4971610 8 bytes {JMP QWORD [RIP-0x71122]}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007ffbd4971cd0 8 bytes {JMP QWORD [RIP-0x700a1]}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00007ffbd4971fd0 8 bytes {JMP QWORD [RIP-0x705a9]}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007ffbd4972850 8 bytes {JMP QWORD [RIP-0x70fdf]}
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 438 0000000077bb13f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 387 0000000077bb1583 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49 0000000077bb1621 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68 0000000077bb1674 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23 0000000077bb16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 9 0000000077bb16e9 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 71 0000000077bb1727 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 7
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16 0000000077bb25d0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308 0000000077bb2714 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 529 0000000077bb2961 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[3564] C:\Windows\system32\wow64cpu.dll!CpuProcessTerm + 595 0000000077bb2bd3 8 bytes [DC, 6A, F8, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 132 00007ffbd48f4b04 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 316 00007ffbd48f4f2c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!TpAllocIoCompletion + 710 00007ffbd48f5206 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitForWnfMetaNotification + 479 00007ffbd48f53ff 8 bytes {JMP 0xffffffffffffffee}
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!RtlUserThreadStart + 911 00007ffbd48f579f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWork + 420 00007ffbd48f5954 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitOnAddress + 657 00007ffbd48f5ef1 8 bytes {JMP 0xffffffffffffff9e}
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfNotificationWaitForCompletion + 78 00007ffbd48f5f4e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!RtlWakeAddressAll + 399 00007ffbd48f60ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfStateChangeNotification + 977 00007ffbd48f64d1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 310 00007ffbd48f6616 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 491 00007ffbd48f66cb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!RtlReportSilentProcessExit + 359 00007ffbd48f8397 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 67 00007ffbd48f8a13 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 864 00007ffbd48f8d30 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllHandleByName + 143 00007ffbd48f8e9f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 510 00007ffbd48f90ae 8 bytes {JMP 0xffffffffffffff96}
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 715 00007ffbd48f917b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!RtlQueueWorkItem + 772 00007ffbd48f9d14 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!LdrAddRefDll + 685 00007ffbd48f9fcd 8 bytes {JMP 0xffffffffffffffaf}
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 352 00007ffbd48faae0 8 bytes {JMP 0xffffffffffffffcd}
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 488 00007ffbd48fab68 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!RtlGetVersion + 565 00007ffbd48fb2e5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!RtlGetNtProductType + 78 00007ffbd48fb33e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 311 00007ffbd48fc4d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 528 00007ffbd48fc5b0 8 bytes {JMP 0xffffffffffffffc7}
.text ... * 2
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!RtlAllocateActivationContextStack + 579 00007ffbd48fd0d3 8 bytes {JMP 0xffffffffffffffef}
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!RtlFreeThreadActivationContextStack + 47 00007ffbd48fd10f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!RtlProcessFlsData + 495 00007ffbd48fd57f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 43 00007ffbd48fd6eb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 456 00007ffbd48fd888 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseWait + 180 00007ffbd48fd944 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!RtlRegisterWait + 596 00007ffbd48fdba4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWait + 424 00007ffbd48fdd58 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 771 00007ffbd48fe073 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 948 00007ffbd48fe124 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsA + 48 00007ffbd48fe160 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!RtlRandomEx + 756 00007ffbd48feb74 8 bytes {JMP 0xffffffffffffffd0}
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteFunctionTable + 371 00007ffbd48ffe63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!RtlAddFunctionTable + 556 00007ffbd490009c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!RtlProtectHeap + 171 00007ffbd490015b 8 bytes [70, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 744 00007ffbd4901438 8 bytes [40, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsW + 214 00007ffbd49015e6 8 bytes [30, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!EtwNotificationRegister + 567 00007ffbd4901877 8 bytes [20, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 429 00007ffbd4901a2d 8 bytes [10, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceExecuteOnce + 213 00007ffbd4901c35 8 bytes [00, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00007ffbd4971290 8 bytes {JMP QWORD [RIP-0x6fe5e]}
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00007ffbd4971410 8 bytes {JMP QWORD [RIP-0x6fe30]}
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00007ffbd4971440 8 bytes {JMP QWORD [RIP-0x712eb]}
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffbd4971560 8 bytes {JMP QWORD [RIP-0x70c1e]}
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00007ffbd4971610 8 bytes {JMP QWORD [RIP-0x71122]}
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007ffbd4971cd0 8 bytes {JMP QWORD [RIP-0x700a1]}
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00007ffbd4971fd0 8 bytes {JMP QWORD [RIP-0x705a9]}
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007ffbd4972850 8 bytes {JMP QWORD [RIP-0x70fdf]}
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 438 0000000077bb13f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 387 0000000077bb1583 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49 0000000077bb1621 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68 0000000077bb1674 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23 0000000077bb16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 9 0000000077bb16e9 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 71 0000000077bb1727 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 7
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16 0000000077bb25d0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308 0000000077bb2714 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 529 0000000077bb2961 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe[3572] C:\Windows\system32\wow64cpu.dll!CpuProcessTerm + 595 0000000077bb2bd3 8 bytes [DC, 6A, F8, 7F, 00, 00, 00, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 132 00007ffbd48f4b04 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 316 00007ffbd48f4f2c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!TpAllocIoCompletion + 710 00007ffbd48f5206 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitForWnfMetaNotification + 479 00007ffbd48f53ff 8 bytes {JMP 0xffffffffffffffee}
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!RtlUserThreadStart + 911 00007ffbd48f579f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWork + 420 00007ffbd48f5954 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitOnAddress + 657 00007ffbd48f5ef1 8 bytes {JMP 0xffffffffffffff9e}
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfNotificationWaitForCompletion + 78 00007ffbd48f5f4e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!RtlWakeAddressAll + 399 00007ffbd48f60ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfStateChangeNotification + 977 00007ffbd48f64d1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 310 00007ffbd48f6616 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 491 00007ffbd48f66cb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!RtlReportSilentProcessExit + 359 00007ffbd48f8397 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 67 00007ffbd48f8a13 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 864 00007ffbd48f8d30 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllHandleByName + 143 00007ffbd48f8e9f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 510 00007ffbd48f90ae 8 bytes {JMP 0xffffffffffffff96}
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 715 00007ffbd48f917b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!RtlQueueWorkItem + 772 00007ffbd48f9d14 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!LdrAddRefDll + 685 00007ffbd48f9fcd 8 bytes {JMP 0xffffffffffffffaf}
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 352 00007ffbd48faae0 8 bytes {JMP 0xffffffffffffffcd}
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 488 00007ffbd48fab68 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!RtlGetVersion + 565 00007ffbd48fb2e5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!RtlGetNtProductType + 78 00007ffbd48fb33e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 311 00007ffbd48fc4d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 528 00007ffbd48fc5b0 8 bytes {JMP 0xffffffffffffffc7}
.text ... * 2
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!RtlAllocateActivationContextStack + 579 00007ffbd48fd0d3 8 bytes {JMP 0xffffffffffffffef}
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!RtlFreeThreadActivationContextStack + 47 00007ffbd48fd10f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!RtlProcessFlsData + 495 00007ffbd48fd57f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 43 00007ffbd48fd6eb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 456 00007ffbd48fd888 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseWait + 180 00007ffbd48fd944 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!RtlRegisterWait + 596 00007ffbd48fdba4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWait + 424 00007ffbd48fdd58 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 771 00007ffbd48fe073 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 948 00007ffbd48fe124 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsA + 48 00007ffbd48fe160 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!RtlRandomEx + 756 00007ffbd48feb74 8 bytes {JMP 0xffffffffffffffd0}
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteFunctionTable + 371 00007ffbd48ffe63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!RtlAddFunctionTable + 556 00007ffbd490009c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!RtlProtectHeap + 171 00007ffbd490015b 8 bytes [70, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 744 00007ffbd4901438 8 bytes [40, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsW + 214 00007ffbd49015e6 8 bytes [30, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!EtwNotificationRegister + 567 00007ffbd4901877 8 bytes [20, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 429 00007ffbd4901a2d 8 bytes [10, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceExecuteOnce + 213 00007ffbd4901c35 8 bytes [00, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00007ffbd4971290 8 bytes {JMP QWORD [RIP-0x6fe5e]}
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00007ffbd4971410 8 bytes {JMP QWORD [RIP-0x6fe30]}
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00007ffbd4971440 8 bytes {JMP QWORD [RIP-0x712eb]}
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffbd4971560 8 bytes {JMP QWORD [RIP-0x70c1e]}
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00007ffbd4971610 8 bytes {JMP QWORD [RIP-0x71122]}
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007ffbd4971cd0 8 bytes {JMP QWORD [RIP-0x700a1]}
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00007ffbd4971fd0 8 bytes {JMP QWORD [RIP-0x705a9]}
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007ffbd4972850 8 bytes {JMP QWORD [RIP-0x70fdf]}
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 438 0000000077bb13f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 387 0000000077bb1583 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49 0000000077bb1621 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68 0000000077bb1674 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23 0000000077bb16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 9 0000000077bb16e9 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 71 0000000077bb1727 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 7
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16 0000000077bb25d0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308 0000000077bb2714 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 529 0000000077bb2961 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\sibelius84\Desktop\Gmer-19357.exe[2420] C:\Windows\system32\wow64cpu.dll!CpuProcessTerm + 595 0000000077bb2bd3 8 bytes [DC, 6A, F8, 7F, 00, 00, 00, ...]
---- Threads - GMER 2.1 ----
Thread C:\Windows\system32\csrss.exe [664:688] fffff9600097bb90
Thread C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2784:1528] 00007ffbb6aff5f8
Thread C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2784:3404] 00007ffbb699bc60
Thread C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [1568:3484] 00007ffbb699bc60
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
4.) Löschbericht der KIS Code:
15.04.2015 16.48.27 Gefundenes Objekt (Prozessspeicher) ist nicht aktiv. c:\users\sibelius84\desktop\gmer-19357.exe Prozessspeicher: c:\users\sibelius84\desktop\gmer-19357.exe Objektname:: PDM:Suspicious.Driver.Installation.a Objekttyp:: Legales Programm, das von einem Angreifer benutzt werden kann, um den Computer oder die Benutzerdaten zu beschädigen Zeitpunkt:: 15/04/2015, 16:48
14.04.2015 22.06.48 Gefundenes Objekt (Datei) wurde gelöscht. C:\Users\sibelius84\AppData\Local\Temp\awh7BD8.tmp Datei: C:\Users\sibelius84\AppData\Local\Temp\awh7BD8.tmp Objektname:: not-a-virus:AdWare.Win32.Agent.hjwf Objekttyp:: Adware Zeitpunkt:: 14/04/2015, 22:06
14.04.2015 22.06.27 Gefundenes Objekt (Datei) wurde gelöscht. C:\Users\sibelius84\AppData\Local\Temp\is-HDHS8.tmp\components1//data0002 Datei: C:\Users\sibelius84\AppData\Local\Temp\is-HDHS8.tmp\components1//data0002 Objektname:: not-a-virus:AdWare.Win32.MultiPlug.oaul Objekttyp:: Adware Zeitpunkt:: 14/04/2015, 22:06
14.04.2015 22.06.27 Gefundenes Objekt (Datei) wurde gelöscht. C:\Users\sibelius84\AppData\Local\Temp\is-HDHS8.tmp\components1 Datei: C:\Users\sibelius84\AppData\Local\Temp\is-HDHS8.tmp\components1 Objektname:: Objekttyp:: Unbekannte Bedrohung Zeitpunkt:: 14/04/2015, 22:06
Hoffentlich ist alles ok...
Danke schonmal & Grüße
Felix |
