GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-01-04 02:00:02 Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\00000032 ST3320620AS rev.3.AAK 298,09GB Running: ug9whz37.exe; Driver: C:\Users\Adam\AppData\Local\Temp\kxldrpoc.sys ---- User code sections - GMER 2.1 ---- .text C:\Windows\System32\dwm.exe[1584] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff8898f169a 4 bytes [8F, 89, F8, 7F] .text C:\Windows\System32\dwm.exe[1584] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff8898f16a2 4 bytes [8F, 89, F8, 7F] .text C:\Windows\System32\dwm.exe[1584] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff8898f181a 4 bytes [8F, 89, F8, 7F] .text C:\Windows\System32\dwm.exe[1584] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff8898f1832 4 bytes [8F, 89, F8, 7F] .text C:\Windows\system32\nvvsvc.exe[5028] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff8898f169a 4 bytes [8F, 89, F8, 7F] .text C:\Windows\system32\nvvsvc.exe[5028] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff8898f16a2 4 bytes [8F, 89, F8, 7F] .text C:\Windows\system32\nvvsvc.exe[5028] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff8898f181a 4 bytes [8F, 89, F8, 7F] .text C:\Windows\system32\nvvsvc.exe[5028] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff8898f1832 4 bytes [8F, 89, F8, 7F] .text C:\Windows\Explorer.EXE[6308] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff8898f169a 4 bytes [8F, 89, F8, 7F] .text C:\Windows\Explorer.EXE[6308] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff8898f16a2 4 bytes [8F, 89, F8, 7F] .text C:\Windows\Explorer.EXE[6308] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff8898f181a 4 bytes [8F, 89, F8, 7F] .text C:\Windows\Explorer.EXE[6308] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff8898f1832 4 bytes [8F, 89, F8, 7F] .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 112 00007ff88a1e2bd4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 432 00007ff88a1e2d14 8 bytes {JMP 0xffffffffffffffd8} .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 428 00007ff88a1e2ee8 16 bytes {JMP 0xffffffffffffffb8} .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllPath + 415 00007ff88a1e3757 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllPath + 704 00007ff88a1e3878 8 bytes {JMP 0xffffffffffffffd3} .text ... * 2 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll + 280 00007ff88a1e425c 8 bytes {JMP 0xffffffffffffffbb} .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!RtlReleasePath + 91 00007ff88a1e4a2b 8 bytes {JMP 0xffffffffffffffde} .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!RtlReleasePath + 132 00007ff88a1e4a54 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateTagHeap + 312 00007ff88a1e4cfc 8 bytes {JMP 0xffffffffffffffb1} .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!RtlTryEnterCriticalSection + 52 00007ff88a1e5030 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!RtlTryEnterCriticalSection + 291 00007ff88a1e511f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!CsrCaptureMessageBuffer + 75 00007ff88a1e6693 8 bytes {JMP 0xffffffffffffffde} .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsA + 48 00007ff88a1e6964 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!CsrClientConnectToServer + 412 00007ff88a1e6b08 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryResourcePolicy + 199 00007ff88a1e740f 8 bytes {JMP 0xffffffffffffffe8} .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!EtwEventRegister + 67 00007ff88a1e75c7 8 bytes {JMP 0xffffffffffffffe5} .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!EtwNotificationRegister + 559 00007ff88a1ea8b3 8 bytes {JMP 0xffffffffffffff9e} .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 12 00007ff88a1ea8c8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 264 00007ff88a1ea9c4 8 bytes {JMP 0xffffffffffffffe1} .text ... * 3 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!RtlRandomEx + 160 00007ff88a1ead90 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceComplete + 543 00007ff88a1eb157 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceComplete + 736 00007ff88a1eb218 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeResource + 244 00007ff88a1eb57c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeResource + 448 00007ff88a1eb648 8 bytes [10, 6A, B3, 7E, 00, 00, 00, ...] .text ... * 2 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 448 00007ff88a1eb88c 8 bytes [F0, 69, B3, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 704 00007ff88a1eb98c 8 bytes [E0, 69, B3, 7E, 00, 00, 00, ...] .text ... * 2 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!RtlAllocateActivationContextStack + 288 00007ff88a1ebc38 8 bytes [B0, 69, B3, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!RtlRegisterWait + 596 00007ff88a1ebe94 8 bytes [A0, 69, B3, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00007ff88a261740 8 bytes {JMP QWORD [RIP-0x75dba]} .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00007ff88a2618c0 8 bytes {JMP QWORD [RIP-0x75eda]} .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00007ff88a2618f0 8 bytes {JMP QWORD [RIP-0x762ae]} .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ff88a261a10 8 bytes {JMP QWORD [RIP-0x7618a]} .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00007ff88a261ac0 8 bytes {JMP QWORD [RIP-0x76403]} .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007ff88a262180 8 bytes {JMP QWORD [RIP-0x762f2]} .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00007ff88a262480 8 bytes {JMP QWORD [RIP-0x7684e]} .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007ff88a262d00 8 bytes {JMP QWORD [RIP-0x771f6]} .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 381 00000000778d137d 16 bytes {JMP 0xffffffffffffffd3} .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 386 00000000778d1512 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49 00000000778d1551 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\system32\wow64cpu.dll!CpuSetStackPointer + 23 00000000778d1577 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 516 00000000778d1784 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\system32\wow64cpu.dll!CpuThreadInit + 50 00000000778d17c2 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23 00000000778d17e7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68 00000000778d1834 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 1 00000000778d1841 24 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 513 00000000778d1a41 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16 00000000778d2ae0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308 00000000778d2c1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2500] C:\Windows\system32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000778d2c43 8 bytes [7C, 68, B3, 7E, 00, 00, 00, ...] .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 112 00007ff88a1e2bd4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 432 00007ff88a1e2d14 8 bytes {JMP 0xffffffffffffffd8} .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 428 00007ff88a1e2ee8 16 bytes {JMP 0xffffffffffffffb8} .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllPath + 415 00007ff88a1e3757 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllPath + 704 00007ff88a1e3878 8 bytes {JMP 0xffffffffffffffd3} .text ... * 2 .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll + 280 00007ff88a1e425c 8 bytes {JMP 0xffffffffffffffbb} .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\SYSTEM32\ntdll.dll!RtlReleasePath + 91 00007ff88a1e4a2b 8 bytes {JMP 0xffffffffffffffde} .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\SYSTEM32\ntdll.dll!RtlReleasePath + 132 00007ff88a1e4a54 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateTagHeap + 312 00007ff88a1e4cfc 8 bytes {JMP 0xffffffffffffffb1} .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\SYSTEM32\ntdll.dll!RtlTryEnterCriticalSection + 52 00007ff88a1e5030 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\SYSTEM32\ntdll.dll!RtlTryEnterCriticalSection + 291 00007ff88a1e511f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\SYSTEM32\ntdll.dll!CsrCaptureMessageBuffer + 75 00007ff88a1e6693 8 bytes {JMP 0xffffffffffffffde} .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsA + 48 00007ff88a1e6964 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\SYSTEM32\ntdll.dll!CsrClientConnectToServer + 412 00007ff88a1e6b08 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryResourcePolicy + 199 00007ff88a1e740f 8 bytes {JMP 0xffffffffffffffe8} .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\SYSTEM32\ntdll.dll!EtwEventRegister + 67 00007ff88a1e75c7 8 bytes {JMP 0xffffffffffffffe5} .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\SYSTEM32\ntdll.dll!EtwNotificationRegister + 559 00007ff88a1ea8b3 8 bytes {JMP 0xffffffffffffff9e} .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 12 00007ff88a1ea8c8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 264 00007ff88a1ea9c4 8 bytes {JMP 0xffffffffffffffe1} .text ... * 3 .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\SYSTEM32\ntdll.dll!RtlRandomEx + 160 00007ff88a1ead90 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceComplete + 543 00007ff88a1eb157 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceComplete + 736 00007ff88a1eb218 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeResource + 244 00007ff88a1eb57c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeResource + 448 00007ff88a1eb648 8 bytes [10, 6A, F8, 7F, 00, 00, 00, ...] .text ... * 2 .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 448 00007ff88a1eb88c 8 bytes [F0, 69, F8, 7F, 00, 00, 00, ...] .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 704 00007ff88a1eb98c 8 bytes [E0, 69, F8, 7F, 00, 00, 00, ...] .text ... * 2 .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\SYSTEM32\ntdll.dll!RtlAllocateActivationContextStack + 288 00007ff88a1ebc38 8 bytes [B0, 69, F8, 7F, 00, 00, 00, ...] .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\SYSTEM32\ntdll.dll!RtlRegisterWait + 596 00007ff88a1ebe94 8 bytes [A0, 69, F8, 7F, 00, 00, 00, ...] .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00007ff88a261740 8 bytes {JMP QWORD [RIP-0x75dba]} .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00007ff88a2618c0 8 bytes {JMP QWORD [RIP-0x75eda]} .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00007ff88a2618f0 8 bytes {JMP QWORD [RIP-0x762ae]} .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ff88a261a10 8 bytes {JMP QWORD [RIP-0x7618a]} .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00007ff88a261ac0 8 bytes {JMP QWORD [RIP-0x76403]} .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007ff88a262180 8 bytes {JMP QWORD [RIP-0x762f2]} .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00007ff88a262480 8 bytes {JMP QWORD [RIP-0x7684e]} .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007ff88a262d00 8 bytes {JMP QWORD [RIP-0x771f6]} .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 381 00000000778d137d 16 bytes {JMP 0xffffffffffffffd3} .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 386 00000000778d1512 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49 00000000778d1551 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\system32\wow64cpu.dll!CpuSetStackPointer + 23 00000000778d1577 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 516 00000000778d1784 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\system32\wow64cpu.dll!CpuThreadInit + 50 00000000778d17c2 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23 00000000778d17e7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68 00000000778d1834 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 1 00000000778d1841 24 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 513 00000000778d1a41 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16 00000000778d2ae0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308 00000000778d2c1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Adam\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[5956] C:\Windows\system32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000778d2c43 8 bytes [7C, 68, F8, 7F, 00, 00, 00, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 112 00007ff88a1e2bd4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 432 00007ff88a1e2d14 8 bytes {JMP 0xffffffffffffffd8} .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 428 00007ff88a1e2ee8 16 bytes {JMP 0xffffffffffffffb8} .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllPath + 415 00007ff88a1e3757 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllPath + 704 00007ff88a1e3878 8 bytes {JMP 0xffffffffffffffd3} .text ... * 2 .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll + 280 00007ff88a1e425c 8 bytes {JMP 0xffffffffffffffbb} .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\SYSTEM32\ntdll.dll!RtlReleasePath + 91 00007ff88a1e4a2b 8 bytes {JMP 0xffffffffffffffde} .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\SYSTEM32\ntdll.dll!RtlReleasePath + 132 00007ff88a1e4a54 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateTagHeap + 312 00007ff88a1e4cfc 8 bytes {JMP 0xffffffffffffffb1} .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\SYSTEM32\ntdll.dll!RtlTryEnterCriticalSection + 52 00007ff88a1e5030 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\SYSTEM32\ntdll.dll!RtlTryEnterCriticalSection + 291 00007ff88a1e511f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\SYSTEM32\ntdll.dll!CsrCaptureMessageBuffer + 75 00007ff88a1e6693 8 bytes {JMP 0xffffffffffffffde} .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsA + 48 00007ff88a1e6964 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\SYSTEM32\ntdll.dll!CsrClientConnectToServer + 412 00007ff88a1e6b08 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryResourcePolicy + 199 00007ff88a1e740f 8 bytes {JMP 0xffffffffffffffe8} .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\SYSTEM32\ntdll.dll!EtwEventRegister + 67 00007ff88a1e75c7 8 bytes {JMP 0xffffffffffffffe5} .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\SYSTEM32\ntdll.dll!EtwNotificationRegister + 559 00007ff88a1ea8b3 8 bytes {JMP 0xffffffffffffff9e} .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 12 00007ff88a1ea8c8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 264 00007ff88a1ea9c4 8 bytes {JMP 0xffffffffffffffe1} .text ... * 3 .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\SYSTEM32\ntdll.dll!RtlRandomEx + 160 00007ff88a1ead90 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceComplete + 543 00007ff88a1eb157 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceComplete + 736 00007ff88a1eb218 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeResource + 244 00007ff88a1eb57c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeResource + 448 00007ff88a1eb648 8 bytes [10, 6A, 08, 7E, 00, 00, 00, ...] .text ... * 2 .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 448 00007ff88a1eb88c 8 bytes [F0, 69, 08, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 704 00007ff88a1eb98c 8 bytes [E0, 69, 08, 7E, 00, 00, 00, ...] .text ... * 2 .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\SYSTEM32\ntdll.dll!RtlAllocateActivationContextStack + 288 00007ff88a1ebc38 8 bytes [B0, 69, 08, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\SYSTEM32\ntdll.dll!RtlRegisterWait + 596 00007ff88a1ebe94 8 bytes [A0, 69, 08, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00007ff88a261740 8 bytes {JMP QWORD [RIP-0x75dba]} .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00007ff88a2618c0 8 bytes {JMP QWORD [RIP-0x75eda]} .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00007ff88a2618f0 8 bytes {JMP QWORD [RIP-0x762ae]} .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ff88a261a10 8 bytes {JMP QWORD [RIP-0x7618a]} .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00007ff88a261ac0 8 bytes {JMP QWORD [RIP-0x76403]} .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007ff88a262180 8 bytes {JMP QWORD [RIP-0x762f2]} .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00007ff88a262480 8 bytes {JMP QWORD [RIP-0x7684e]} .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007ff88a262d00 8 bytes {JMP QWORD [RIP-0x771f6]} .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 381 00000000778d137d 16 bytes {JMP 0xffffffffffffffd3} .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 386 00000000778d1512 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49 00000000778d1551 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\system32\wow64cpu.dll!CpuSetStackPointer + 23 00000000778d1577 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 516 00000000778d1784 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\system32\wow64cpu.dll!CpuThreadInit + 50 00000000778d17c2 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23 00000000778d17e7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68 00000000778d1834 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 1 00000000778d1841 24 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 513 00000000778d1a41 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16 00000000778d2ae0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308 00000000778d2c1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3452] C:\Windows\system32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000778d2c43 8 bytes [7C, 68, 08, 7E, 00, 00, 00, ...] .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 112 00007ff88a1e2bd4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 432 00007ff88a1e2d14 8 bytes {JMP 0xffffffffffffffd8} .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 428 00007ff88a1e2ee8 16 bytes {JMP 0xffffffffffffffb8} .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllPath + 415 00007ff88a1e3757 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllPath + 704 00007ff88a1e3878 8 bytes {JMP 0xffffffffffffffd3} .text ... * 2 .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll + 280 00007ff88a1e425c 8 bytes {JMP 0xffffffffffffffbb} .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\SYSTEM32\ntdll.dll!RtlReleasePath + 91 00007ff88a1e4a2b 8 bytes {JMP 0xffffffffffffffde} .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\SYSTEM32\ntdll.dll!RtlReleasePath + 132 00007ff88a1e4a54 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateTagHeap + 312 00007ff88a1e4cfc 8 bytes {JMP 0xffffffffffffffb1} .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\SYSTEM32\ntdll.dll!RtlTryEnterCriticalSection + 52 00007ff88a1e5030 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\SYSTEM32\ntdll.dll!RtlTryEnterCriticalSection + 291 00007ff88a1e511f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\SYSTEM32\ntdll.dll!CsrCaptureMessageBuffer + 75 00007ff88a1e6693 8 bytes {JMP 0xffffffffffffffde} .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsA + 48 00007ff88a1e6964 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\SYSTEM32\ntdll.dll!CsrClientConnectToServer + 412 00007ff88a1e6b08 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryResourcePolicy + 199 00007ff88a1e740f 8 bytes {JMP 0xffffffffffffffe8} .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\SYSTEM32\ntdll.dll!EtwEventRegister + 67 00007ff88a1e75c7 8 bytes {JMP 0xffffffffffffffe5} .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\SYSTEM32\ntdll.dll!EtwNotificationRegister + 559 00007ff88a1ea8b3 8 bytes {JMP 0xffffffffffffff9e} .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 12 00007ff88a1ea8c8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 264 00007ff88a1ea9c4 8 bytes {JMP 0xffffffffffffffe1} .text ... * 3 .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\SYSTEM32\ntdll.dll!RtlRandomEx + 160 00007ff88a1ead90 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceComplete + 543 00007ff88a1eb157 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceComplete + 736 00007ff88a1eb218 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeResource + 244 00007ff88a1eb57c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeResource + 448 00007ff88a1eb648 8 bytes [10, 6A, A0, 7F, 00, 00, 00, ...] .text ... * 2 .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 448 00007ff88a1eb88c 8 bytes [F0, 69, A0, 7F, 00, 00, 00, ...] .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 704 00007ff88a1eb98c 8 bytes [E0, 69, A0, 7F, 00, 00, 00, ...] .text ... * 2 .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\SYSTEM32\ntdll.dll!RtlAllocateActivationContextStack + 288 00007ff88a1ebc38 8 bytes [B0, 69, A0, 7F, 00, 00, 00, ...] .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\SYSTEM32\ntdll.dll!RtlRegisterWait + 596 00007ff88a1ebe94 8 bytes [A0, 69, A0, 7F, 00, 00, 00, ...] .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00007ff88a261740 8 bytes {JMP QWORD [RIP-0x75dba]} .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00007ff88a2618c0 8 bytes {JMP QWORD [RIP-0x75eda]} .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00007ff88a2618f0 8 bytes {JMP QWORD [RIP-0x762ae]} .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ff88a261a10 8 bytes {JMP QWORD [RIP-0x7618a]} .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00007ff88a261ac0 8 bytes {JMP QWORD [RIP-0x76403]} .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007ff88a262180 8 bytes {JMP QWORD [RIP-0x762f2]} .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00007ff88a262480 8 bytes {JMP QWORD [RIP-0x7684e]} .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007ff88a262d00 8 bytes {JMP QWORD [RIP-0x771f6]} .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 381 00000000778d137d 16 bytes {JMP 0xffffffffffffffd3} .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 386 00000000778d1512 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49 00000000778d1551 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\system32\wow64cpu.dll!CpuSetStackPointer + 23 00000000778d1577 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 516 00000000778d1784 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\system32\wow64cpu.dll!CpuThreadInit + 50 00000000778d17c2 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23 00000000778d17e7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68 00000000778d1834 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 1 00000000778d1841 24 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 513 00000000778d1a41 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16 00000000778d2ae0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308 00000000778d2c1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe[440] C:\Windows\system32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000778d2c43 8 bytes [7C, 68, A0, 7F, 00, 00, 00, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 112 00007ff88a1e2bd4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 432 00007ff88a1e2d14 8 bytes {JMP 0xffffffffffffffd8} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 428 00007ff88a1e2ee8 16 bytes {JMP 0xffffffffffffffb8} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllPath + 415 00007ff88a1e3757 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllPath + 704 00007ff88a1e3878 8 bytes {JMP 0xffffffffffffffd3} .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll + 280 00007ff88a1e425c 8 bytes {JMP 0xffffffffffffffbb} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\SYSTEM32\ntdll.dll!RtlReleasePath + 91 00007ff88a1e4a2b 8 bytes {JMP 0xffffffffffffffde} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\SYSTEM32\ntdll.dll!RtlReleasePath + 132 00007ff88a1e4a54 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateTagHeap + 312 00007ff88a1e4cfc 8 bytes {JMP 0xffffffffffffffb1} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\SYSTEM32\ntdll.dll!RtlTryEnterCriticalSection + 52 00007ff88a1e5030 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\SYSTEM32\ntdll.dll!RtlTryEnterCriticalSection + 291 00007ff88a1e511f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\SYSTEM32\ntdll.dll!CsrCaptureMessageBuffer + 75 00007ff88a1e6693 8 bytes {JMP 0xffffffffffffffde} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsA + 48 00007ff88a1e6964 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\SYSTEM32\ntdll.dll!CsrClientConnectToServer + 412 00007ff88a1e6b08 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryResourcePolicy + 199 00007ff88a1e740f 8 bytes {JMP 0xffffffffffffffe8} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\SYSTEM32\ntdll.dll!EtwEventRegister + 67 00007ff88a1e75c7 8 bytes {JMP 0xffffffffffffffe5} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\SYSTEM32\ntdll.dll!EtwNotificationRegister + 559 00007ff88a1ea8b3 8 bytes {JMP 0xffffffffffffff9e} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 12 00007ff88a1ea8c8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 264 00007ff88a1ea9c4 8 bytes {JMP 0xffffffffffffffe1} .text ... * 3 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\SYSTEM32\ntdll.dll!RtlRandomEx + 160 00007ff88a1ead90 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceComplete + 543 00007ff88a1eb157 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceComplete + 736 00007ff88a1eb218 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeResource + 244 00007ff88a1eb57c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeResource + 448 00007ff88a1eb648 8 bytes [10, 6A, 4B, FF, 00, 00, 00, ...] .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 448 00007ff88a1eb88c 8 bytes [F0, 69, 4B, FF, 00, 00, 00, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 704 00007ff88a1eb98c 8 bytes [E0, 69, 4B, FF, 00, 00, 00, ...] .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\SYSTEM32\ntdll.dll!RtlAllocateActivationContextStack + 288 00007ff88a1ebc38 8 bytes [B0, 69, 4B, FF, 00, 00, 00, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\SYSTEM32\ntdll.dll!RtlRegisterWait + 596 00007ff88a1ebe94 8 bytes [A0, 69, 4B, FF, 00, 00, 00, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00007ff88a261740 8 bytes {JMP QWORD [RIP-0x75dba]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00007ff88a2618c0 8 bytes {JMP QWORD [RIP-0x75eda]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00007ff88a2618f0 8 bytes {JMP QWORD [RIP-0x762ae]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ff88a261a10 8 bytes {JMP QWORD [RIP-0x7618a]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00007ff88a261ac0 8 bytes {JMP QWORD [RIP-0x76403]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007ff88a262180 8 bytes {JMP QWORD [RIP-0x762f2]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00007ff88a262480 8 bytes {JMP QWORD [RIP-0x7684e]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007ff88a262d00 8 bytes {JMP QWORD [RIP-0x771f6]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 381 00000000778d137d 16 bytes {JMP 0xffffffffffffffd3} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 386 00000000778d1512 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49 00000000778d1551 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\system32\wow64cpu.dll!CpuSetStackPointer + 23 00000000778d1577 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 516 00000000778d1784 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\system32\wow64cpu.dll!CpuThreadInit + 50 00000000778d17c2 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23 00000000778d17e7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68 00000000778d1834 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 1 00000000778d1841 24 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 513 00000000778d1a41 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16 00000000778d2ae0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308 00000000778d2c1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5332] C:\Windows\system32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000778d2c43 8 bytes [7C, 68, 4B, FF, 00, 00, 00, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 112 00007ff88a1e2bd4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 432 00007ff88a1e2d14 8 bytes {JMP 0xffffffffffffffd8} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 428 00007ff88a1e2ee8 16 bytes {JMP 0xffffffffffffffb8} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllPath + 415 00007ff88a1e3757 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllPath + 704 00007ff88a1e3878 8 bytes {JMP 0xffffffffffffffd3} .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll + 280 00007ff88a1e425c 8 bytes {JMP 0xffffffffffffffbb} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\SYSTEM32\ntdll.dll!RtlReleasePath + 91 00007ff88a1e4a2b 8 bytes {JMP 0xffffffffffffffde} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\SYSTEM32\ntdll.dll!RtlReleasePath + 132 00007ff88a1e4a54 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateTagHeap + 312 00007ff88a1e4cfc 8 bytes {JMP 0xffffffffffffffb1} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\SYSTEM32\ntdll.dll!RtlTryEnterCriticalSection + 52 00007ff88a1e5030 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\SYSTEM32\ntdll.dll!RtlTryEnterCriticalSection + 291 00007ff88a1e511f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\SYSTEM32\ntdll.dll!CsrCaptureMessageBuffer + 75 00007ff88a1e6693 8 bytes {JMP 0xffffffffffffffde} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsA + 48 00007ff88a1e6964 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\SYSTEM32\ntdll.dll!CsrClientConnectToServer + 412 00007ff88a1e6b08 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryResourcePolicy + 199 00007ff88a1e740f 8 bytes {JMP 0xffffffffffffffe8} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\SYSTEM32\ntdll.dll!EtwEventRegister + 67 00007ff88a1e75c7 8 bytes {JMP 0xffffffffffffffe5} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\SYSTEM32\ntdll.dll!EtwNotificationRegister + 559 00007ff88a1ea8b3 8 bytes {JMP 0xffffffffffffff9e} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 12 00007ff88a1ea8c8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 264 00007ff88a1ea9c4 8 bytes {JMP 0xffffffffffffffe1} .text ... * 3 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\SYSTEM32\ntdll.dll!RtlRandomEx + 160 00007ff88a1ead90 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceComplete + 543 00007ff88a1eb157 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceComplete + 736 00007ff88a1eb218 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeResource + 244 00007ff88a1eb57c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeResource + 448 00007ff88a1eb648 8 bytes [10, 6A, 83, FE, 00, 00, 00, ...] .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 448 00007ff88a1eb88c 8 bytes [F0, 69, 83, FE, 00, 00, 00, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 704 00007ff88a1eb98c 8 bytes [E0, 69, 83, FE, 00, 00, 00, ...] .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\SYSTEM32\ntdll.dll!RtlAllocateActivationContextStack + 288 00007ff88a1ebc38 8 bytes [B0, 69, 83, FE, 00, 00, 00, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\SYSTEM32\ntdll.dll!RtlRegisterWait + 596 00007ff88a1ebe94 8 bytes [A0, 69, 83, FE, 00, 00, 00, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00007ff88a261740 8 bytes {JMP QWORD [RIP-0x75dba]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00007ff88a2618c0 8 bytes {JMP QWORD [RIP-0x75eda]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00007ff88a2618f0 8 bytes {JMP QWORD [RIP-0x762ae]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ff88a261a10 8 bytes {JMP QWORD [RIP-0x7618a]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00007ff88a261ac0 8 bytes {JMP QWORD [RIP-0x76403]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007ff88a262180 8 bytes {JMP QWORD [RIP-0x762f2]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00007ff88a262480 8 bytes {JMP QWORD [RIP-0x7684e]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007ff88a262d00 8 bytes {JMP QWORD [RIP-0x771f6]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 381 00000000778d137d 16 bytes {JMP 0xffffffffffffffd3} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 386 00000000778d1512 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49 00000000778d1551 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\system32\wow64cpu.dll!CpuSetStackPointer + 23 00000000778d1577 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 516 00000000778d1784 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\system32\wow64cpu.dll!CpuThreadInit + 50 00000000778d17c2 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23 00000000778d17e7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68 00000000778d1834 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 1 00000000778d1841 24 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 513 00000000778d1a41 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16 00000000778d2ae0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308 00000000778d2c1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe[6116] C:\Windows\system32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000778d2c43 8 bytes [7C, 68, 83, FE, 00, 00, 00, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 112 00007ff88a1e2bd4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 432 00007ff88a1e2d14 8 bytes {JMP 0xffffffffffffffd8} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 428 00007ff88a1e2ee8 16 bytes {JMP 0xffffffffffffffb8} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllPath + 415 00007ff88a1e3757 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllPath + 704 00007ff88a1e3878 8 bytes {JMP 0xffffffffffffffd3} .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll + 280 00007ff88a1e425c 8 bytes {JMP 0xffffffffffffffbb} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\SYSTEM32\ntdll.dll!RtlReleasePath + 91 00007ff88a1e4a2b 8 bytes {JMP 0xffffffffffffffde} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\SYSTEM32\ntdll.dll!RtlReleasePath + 132 00007ff88a1e4a54 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateTagHeap + 312 00007ff88a1e4cfc 8 bytes {JMP 0xffffffffffffffb1} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\SYSTEM32\ntdll.dll!RtlTryEnterCriticalSection + 52 00007ff88a1e5030 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\SYSTEM32\ntdll.dll!RtlTryEnterCriticalSection + 291 00007ff88a1e511f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\SYSTEM32\ntdll.dll!CsrCaptureMessageBuffer + 75 00007ff88a1e6693 8 bytes {JMP 0xffffffffffffffde} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsA + 48 00007ff88a1e6964 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\SYSTEM32\ntdll.dll!CsrClientConnectToServer + 412 00007ff88a1e6b08 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryResourcePolicy + 199 00007ff88a1e740f 8 bytes {JMP 0xffffffffffffffe8} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\SYSTEM32\ntdll.dll!EtwEventRegister + 67 00007ff88a1e75c7 8 bytes {JMP 0xffffffffffffffe5} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\SYSTEM32\ntdll.dll!EtwNotificationRegister + 559 00007ff88a1ea8b3 8 bytes {JMP 0xffffffffffffff9e} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 12 00007ff88a1ea8c8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 264 00007ff88a1ea9c4 8 bytes {JMP 0xffffffffffffffe1} .text ... * 3 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\SYSTEM32\ntdll.dll!RtlRandomEx + 160 00007ff88a1ead90 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceComplete + 543 00007ff88a1eb157 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceComplete + 736 00007ff88a1eb218 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeResource + 244 00007ff88a1eb57c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeResource + 448 00007ff88a1eb648 8 bytes [10, 6A, 1B, FF, 00, 00, 00, ...] .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 448 00007ff88a1eb88c 8 bytes [F0, 69, 1B, FF, 00, 00, 00, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 704 00007ff88a1eb98c 8 bytes [E0, 69, 1B, FF, 00, 00, 00, ...] .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\SYSTEM32\ntdll.dll!RtlAllocateActivationContextStack + 288 00007ff88a1ebc38 8 bytes [B0, 69, 1B, FF, 00, 00, 00, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\SYSTEM32\ntdll.dll!RtlRegisterWait + 596 00007ff88a1ebe94 8 bytes [A0, 69, 1B, FF, 00, 00, 00, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00007ff88a261740 8 bytes {JMP QWORD [RIP-0x75dba]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00007ff88a2618c0 8 bytes {JMP QWORD [RIP-0x75eda]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00007ff88a2618f0 8 bytes {JMP QWORD [RIP-0x762ae]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ff88a261a10 8 bytes {JMP QWORD [RIP-0x7618a]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00007ff88a261ac0 8 bytes {JMP QWORD [RIP-0x76403]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007ff88a262180 8 bytes {JMP QWORD [RIP-0x762f2]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00007ff88a262480 8 bytes {JMP QWORD [RIP-0x7684e]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007ff88a262d00 8 bytes {JMP QWORD [RIP-0x771f6]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 381 00000000778d137d 16 bytes {JMP 0xffffffffffffffd3} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 386 00000000778d1512 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49 00000000778d1551 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\system32\wow64cpu.dll!CpuSetStackPointer + 23 00000000778d1577 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 516 00000000778d1784 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\system32\wow64cpu.dll!CpuThreadInit + 50 00000000778d17c2 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23 00000000778d17e7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68 00000000778d1834 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 1 00000000778d1841 24 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 513 00000000778d1a41 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16 00000000778d2ae0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308 00000000778d2c1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[5088] C:\Windows\system32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000778d2c43 8 bytes [7C, 68, 1B, FF, 00, 00, 00, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 112 00007ff88a1e2bd4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 432 00007ff88a1e2d14 8 bytes {JMP 0xffffffffffffffd8} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 428 00007ff88a1e2ee8 16 bytes {JMP 0xffffffffffffffb8} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllPath + 415 00007ff88a1e3757 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllPath + 704 00007ff88a1e3878 8 bytes {JMP 0xffffffffffffffd3} .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll + 280 00007ff88a1e425c 8 bytes {JMP 0xffffffffffffffbb} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\SYSTEM32\ntdll.dll!RtlReleasePath + 91 00007ff88a1e4a2b 8 bytes {JMP 0xffffffffffffffde} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\SYSTEM32\ntdll.dll!RtlReleasePath + 132 00007ff88a1e4a54 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateTagHeap + 312 00007ff88a1e4cfc 8 bytes {JMP 0xffffffffffffffb1} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\SYSTEM32\ntdll.dll!RtlTryEnterCriticalSection + 52 00007ff88a1e5030 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\SYSTEM32\ntdll.dll!RtlTryEnterCriticalSection + 291 00007ff88a1e511f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\SYSTEM32\ntdll.dll!CsrCaptureMessageBuffer + 75 00007ff88a1e6693 8 bytes {JMP 0xffffffffffffffde} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsA + 48 00007ff88a1e6964 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\SYSTEM32\ntdll.dll!CsrClientConnectToServer + 412 00007ff88a1e6b08 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryResourcePolicy + 199 00007ff88a1e740f 8 bytes {JMP 0xffffffffffffffe8} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\SYSTEM32\ntdll.dll!EtwEventRegister + 67 00007ff88a1e75c7 8 bytes {JMP 0xffffffffffffffe5} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\SYSTEM32\ntdll.dll!EtwNotificationRegister + 559 00007ff88a1ea8b3 8 bytes {JMP 0xffffffffffffff9e} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 12 00007ff88a1ea8c8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 264 00007ff88a1ea9c4 8 bytes {JMP 0xffffffffffffffe1} .text ... * 3 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\SYSTEM32\ntdll.dll!RtlRandomEx + 160 00007ff88a1ead90 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceComplete + 543 00007ff88a1eb157 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceComplete + 736 00007ff88a1eb218 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeResource + 244 00007ff88a1eb57c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeResource + 448 00007ff88a1eb648 8 bytes [10, 6A, E2, FE, 00, 00, 00, ...] .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 448 00007ff88a1eb88c 8 bytes [F0, 69, E2, FE, 00, 00, 00, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 704 00007ff88a1eb98c 8 bytes [E0, 69, E2, FE, 00, 00, 00, ...] .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\SYSTEM32\ntdll.dll!RtlAllocateActivationContextStack + 288 00007ff88a1ebc38 8 bytes [B0, 69, E2, FE, 00, 00, 00, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\SYSTEM32\ntdll.dll!RtlRegisterWait + 596 00007ff88a1ebe94 8 bytes [A0, 69, E2, FE, 00, 00, 00, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00007ff88a261740 8 bytes {JMP QWORD [RIP-0x75dba]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00007ff88a2618c0 8 bytes {JMP QWORD [RIP-0x75eda]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00007ff88a2618f0 8 bytes {JMP QWORD [RIP-0x762ae]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ff88a261a10 8 bytes {JMP QWORD [RIP-0x7618a]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00007ff88a261ac0 8 bytes {JMP QWORD [RIP-0x76403]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007ff88a262180 8 bytes {JMP QWORD [RIP-0x762f2]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00007ff88a262480 8 bytes {JMP QWORD [RIP-0x7684e]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007ff88a262d00 8 bytes {JMP QWORD [RIP-0x771f6]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 381 00000000778d137d 16 bytes {JMP 0xffffffffffffffd3} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 386 00000000778d1512 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49 00000000778d1551 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\system32\wow64cpu.dll!CpuSetStackPointer + 23 00000000778d1577 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 516 00000000778d1784 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\system32\wow64cpu.dll!CpuThreadInit + 50 00000000778d17c2 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23 00000000778d17e7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68 00000000778d1834 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 1 00000000778d1841 24 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 513 00000000778d1a41 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16 00000000778d2ae0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308 00000000778d2c1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[4828] C:\Windows\system32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000778d2c43 8 bytes [7C, 68, E2, FE, 00, 00, 00, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 112 00007ff88a1e2bd4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 432 00007ff88a1e2d14 8 bytes {JMP 0xffffffffffffffd8} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 428 00007ff88a1e2ee8 16 bytes {JMP 0xffffffffffffffb8} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllPath + 415 00007ff88a1e3757 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllPath + 704 00007ff88a1e3878 8 bytes {JMP 0xffffffffffffffd3} .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll + 280 00007ff88a1e425c 8 bytes {JMP 0xffffffffffffffbb} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\SYSTEM32\ntdll.dll!RtlReleasePath + 91 00007ff88a1e4a2b 8 bytes {JMP 0xffffffffffffffde} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\SYSTEM32\ntdll.dll!RtlReleasePath + 132 00007ff88a1e4a54 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateTagHeap + 312 00007ff88a1e4cfc 8 bytes {JMP 0xffffffffffffffb1} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\SYSTEM32\ntdll.dll!RtlTryEnterCriticalSection + 52 00007ff88a1e5030 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\SYSTEM32\ntdll.dll!RtlTryEnterCriticalSection + 291 00007ff88a1e511f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\SYSTEM32\ntdll.dll!CsrCaptureMessageBuffer + 75 00007ff88a1e6693 8 bytes {JMP 0xffffffffffffffde} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsA + 48 00007ff88a1e6964 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\SYSTEM32\ntdll.dll!CsrClientConnectToServer + 412 00007ff88a1e6b08 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryResourcePolicy + 199 00007ff88a1e740f 8 bytes {JMP 0xffffffffffffffe8} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\SYSTEM32\ntdll.dll!EtwEventRegister + 67 00007ff88a1e75c7 8 bytes {JMP 0xffffffffffffffe5} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\SYSTEM32\ntdll.dll!EtwNotificationRegister + 559 00007ff88a1ea8b3 8 bytes {JMP 0xffffffffffffff9e} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 12 00007ff88a1ea8c8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 264 00007ff88a1ea9c4 8 bytes {JMP 0xffffffffffffffe1} .text ... * 3 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\SYSTEM32\ntdll.dll!RtlRandomEx + 160 00007ff88a1ead90 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceComplete + 543 00007ff88a1eb157 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceComplete + 736 00007ff88a1eb218 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeResource + 244 00007ff88a1eb57c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeResource + 448 00007ff88a1eb648 8 bytes [10, 6A, BD, FE, 00, 00, 00, ...] .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 448 00007ff88a1eb88c 8 bytes [F0, 69, BD, FE, 00, 00, 00, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 704 00007ff88a1eb98c 8 bytes [E0, 69, BD, FE, 00, 00, 00, ...] .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\SYSTEM32\ntdll.dll!RtlAllocateActivationContextStack + 288 00007ff88a1ebc38 8 bytes [B0, 69, BD, FE, 00, 00, 00, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\SYSTEM32\ntdll.dll!RtlRegisterWait + 596 00007ff88a1ebe94 8 bytes [A0, 69, BD, FE, 00, 00, 00, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00007ff88a261740 8 bytes {JMP QWORD [RIP-0x75dba]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00007ff88a2618c0 8 bytes {JMP QWORD [RIP-0x75eda]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00007ff88a2618f0 8 bytes {JMP QWORD [RIP-0x762ae]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ff88a261a10 8 bytes {JMP QWORD [RIP-0x7618a]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00007ff88a261ac0 8 bytes {JMP QWORD [RIP-0x76403]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007ff88a262180 8 bytes {JMP QWORD [RIP-0x762f2]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00007ff88a262480 8 bytes {JMP QWORD [RIP-0x7684e]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007ff88a262d00 8 bytes {JMP QWORD [RIP-0x771f6]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 381 00000000778d137d 16 bytes {JMP 0xffffffffffffffd3} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 386 00000000778d1512 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49 00000000778d1551 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\system32\wow64cpu.dll!CpuSetStackPointer + 23 00000000778d1577 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 516 00000000778d1784 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\system32\wow64cpu.dll!CpuThreadInit + 50 00000000778d17c2 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23 00000000778d17e7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68 00000000778d1834 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 1 00000000778d1841 24 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 513 00000000778d1a41 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16 00000000778d2ae0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308 00000000778d2c1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[3888] C:\Windows\system32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000778d2c43 8 bytes [7C, 68, BD, FE, 00, 00, 00, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 112 00007ff88a1e2bd4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 432 00007ff88a1e2d14 8 bytes {JMP 0xffffffffffffffd8} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 428 00007ff88a1e2ee8 16 bytes {JMP 0xffffffffffffffb8} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllPath + 415 00007ff88a1e3757 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllPath + 704 00007ff88a1e3878 8 bytes {JMP 0xffffffffffffffd3} .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll + 280 00007ff88a1e425c 8 bytes {JMP 0xffffffffffffffbb} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\SYSTEM32\ntdll.dll!RtlReleasePath + 91 00007ff88a1e4a2b 8 bytes {JMP 0xffffffffffffffde} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\SYSTEM32\ntdll.dll!RtlReleasePath + 132 00007ff88a1e4a54 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateTagHeap + 312 00007ff88a1e4cfc 8 bytes {JMP 0xffffffffffffffb1} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\SYSTEM32\ntdll.dll!RtlTryEnterCriticalSection + 52 00007ff88a1e5030 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\SYSTEM32\ntdll.dll!RtlTryEnterCriticalSection + 291 00007ff88a1e511f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\SYSTEM32\ntdll.dll!CsrCaptureMessageBuffer + 75 00007ff88a1e6693 8 bytes {JMP 0xffffffffffffffde} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsA + 48 00007ff88a1e6964 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\SYSTEM32\ntdll.dll!CsrClientConnectToServer + 412 00007ff88a1e6b08 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryResourcePolicy + 199 00007ff88a1e740f 8 bytes {JMP 0xffffffffffffffe8} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\SYSTEM32\ntdll.dll!EtwEventRegister + 67 00007ff88a1e75c7 8 bytes {JMP 0xffffffffffffffe5} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\SYSTEM32\ntdll.dll!EtwNotificationRegister + 559 00007ff88a1ea8b3 8 bytes {JMP 0xffffffffffffff9e} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 12 00007ff88a1ea8c8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 264 00007ff88a1ea9c4 8 bytes {JMP 0xffffffffffffffe1} .text ... * 3 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\SYSTEM32\ntdll.dll!RtlRandomEx + 160 00007ff88a1ead90 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceComplete + 543 00007ff88a1eb157 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceComplete + 736 00007ff88a1eb218 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeResource + 244 00007ff88a1eb57c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeResource + 448 00007ff88a1eb648 8 bytes [10, 6A, FD, FE, 00, 00, 00, ...] .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 448 00007ff88a1eb88c 8 bytes [F0, 69, FD, FE, 00, 00, 00, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 704 00007ff88a1eb98c 8 bytes [E0, 69, FD, FE, 00, 00, 00, ...] .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\SYSTEM32\ntdll.dll!RtlAllocateActivationContextStack + 288 00007ff88a1ebc38 8 bytes [B0, 69, FD, FE, 00, 00, 00, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\SYSTEM32\ntdll.dll!RtlRegisterWait + 596 00007ff88a1ebe94 8 bytes [A0, 69, FD, FE, 00, 00, 00, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00007ff88a261740 8 bytes {JMP QWORD [RIP-0x75dba]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00007ff88a2618c0 8 bytes {JMP QWORD [RIP-0x75eda]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00007ff88a2618f0 8 bytes {JMP QWORD [RIP-0x762ae]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ff88a261a10 8 bytes {JMP QWORD [RIP-0x7618a]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00007ff88a261ac0 8 bytes {JMP QWORD [RIP-0x76403]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007ff88a262180 8 bytes {JMP QWORD [RIP-0x762f2]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00007ff88a262480 8 bytes {JMP QWORD [RIP-0x7684e]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007ff88a262d00 8 bytes {JMP QWORD [RIP-0x771f6]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 381 00000000778d137d 16 bytes {JMP 0xffffffffffffffd3} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 386 00000000778d1512 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49 00000000778d1551 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\system32\wow64cpu.dll!CpuSetStackPointer + 23 00000000778d1577 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 516 00000000778d1784 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\system32\wow64cpu.dll!CpuThreadInit + 50 00000000778d17c2 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23 00000000778d17e7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68 00000000778d1834 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 1 00000000778d1841 24 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 513 00000000778d1a41 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16 00000000778d2ae0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308 00000000778d2c1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[7012] C:\Windows\system32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000778d2c43 8 bytes [7C, 68, FD, FE, 00, 00, 00, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 112 00007ff88a1e2bd4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 432 00007ff88a1e2d14 8 bytes {JMP 0xffffffffffffffd8} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 428 00007ff88a1e2ee8 16 bytes {JMP 0xffffffffffffffb8} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllPath + 415 00007ff88a1e3757 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllPath + 704 00007ff88a1e3878 8 bytes {JMP 0xffffffffffffffd3} .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll + 280 00007ff88a1e425c 8 bytes {JMP 0xffffffffffffffbb} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlReleasePath + 91 00007ff88a1e4a2b 8 bytes {JMP 0xffffffffffffffde} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlReleasePath + 132 00007ff88a1e4a54 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateTagHeap + 312 00007ff88a1e4cfc 8 bytes {JMP 0xffffffffffffffb1} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlTryEnterCriticalSection + 52 00007ff88a1e5030 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlTryEnterCriticalSection + 291 00007ff88a1e511f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!CsrCaptureMessageBuffer + 75 00007ff88a1e6693 8 bytes {JMP 0xffffffffffffffde} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsA + 48 00007ff88a1e6964 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!CsrClientConnectToServer + 412 00007ff88a1e6b08 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryResourcePolicy + 199 00007ff88a1e740f 8 bytes {JMP 0xffffffffffffffe8} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!EtwEventRegister + 67 00007ff88a1e75c7 8 bytes {JMP 0xffffffffffffffe5} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!EtwNotificationRegister + 559 00007ff88a1ea8b3 8 bytes {JMP 0xffffffffffffff9e} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 12 00007ff88a1ea8c8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 264 00007ff88a1ea9c4 8 bytes {JMP 0xffffffffffffffe1} .text ... * 3 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlRandomEx + 160 00007ff88a1ead90 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceComplete + 543 00007ff88a1eb157 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceComplete + 736 00007ff88a1eb218 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeResource + 244 00007ff88a1eb57c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeResource + 448 00007ff88a1eb648 8 bytes [10, 6A, 0B, FE, 00, 00, 00, ...] .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 448 00007ff88a1eb88c 8 bytes [F0, 69, 0B, FE, 00, 00, 00, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 704 00007ff88a1eb98c 8 bytes [E0, 69, 0B, FE, 00, 00, 00, ...] .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlAllocateActivationContextStack + 288 00007ff88a1ebc38 8 bytes [B0, 69, 0B, FE, 00, 00, 00, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlRegisterWait + 596 00007ff88a1ebe94 8 bytes [A0, 69, 0B, FE, 00, 00, 00, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00007ff88a261740 8 bytes {JMP QWORD [RIP-0x75dba]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00007ff88a2618c0 8 bytes {JMP QWORD [RIP-0x75eda]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00007ff88a2618f0 8 bytes {JMP QWORD [RIP-0x762ae]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ff88a261a10 8 bytes {JMP QWORD [RIP-0x7618a]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00007ff88a261ac0 8 bytes {JMP QWORD [RIP-0x76403]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007ff88a262180 8 bytes {JMP QWORD [RIP-0x762f2]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00007ff88a262480 8 bytes {JMP QWORD [RIP-0x7684e]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007ff88a262d00 8 bytes {JMP QWORD [RIP-0x771f6]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 381 00000000778d137d 16 bytes {JMP 0xffffffffffffffd3} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 386 00000000778d1512 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49 00000000778d1551 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\system32\wow64cpu.dll!CpuSetStackPointer + 23 00000000778d1577 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 516 00000000778d1784 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\system32\wow64cpu.dll!CpuThreadInit + 50 00000000778d17c2 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23 00000000778d17e7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68 00000000778d1834 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 1 00000000778d1841 24 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 513 00000000778d1a41 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16 00000000778d2ae0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308 00000000778d2c1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[1928] C:\Windows\system32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000778d2c43 8 bytes [7C, 68, 0B, FE, 00, 00, 00, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 112 00007ff88a1e2bd4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 432 00007ff88a1e2d14 8 bytes {JMP 0xffffffffffffffd8} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 428 00007ff88a1e2ee8 16 bytes {JMP 0xffffffffffffffb8} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllPath + 415 00007ff88a1e3757 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllPath + 704 00007ff88a1e3878 8 bytes {JMP 0xffffffffffffffd3} .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll + 280 00007ff88a1e425c 8 bytes {JMP 0xffffffffffffffbb} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\SYSTEM32\ntdll.dll!RtlReleasePath + 91 00007ff88a1e4a2b 8 bytes {JMP 0xffffffffffffffde} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\SYSTEM32\ntdll.dll!RtlReleasePath + 132 00007ff88a1e4a54 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateTagHeap + 312 00007ff88a1e4cfc 8 bytes {JMP 0xffffffffffffffb1} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\SYSTEM32\ntdll.dll!RtlTryEnterCriticalSection + 52 00007ff88a1e5030 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\SYSTEM32\ntdll.dll!RtlTryEnterCriticalSection + 291 00007ff88a1e511f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\SYSTEM32\ntdll.dll!CsrCaptureMessageBuffer + 75 00007ff88a1e6693 8 bytes {JMP 0xffffffffffffffde} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsA + 48 00007ff88a1e6964 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\SYSTEM32\ntdll.dll!CsrClientConnectToServer + 412 00007ff88a1e6b08 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryResourcePolicy + 199 00007ff88a1e740f 8 bytes {JMP 0xffffffffffffffe8} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\SYSTEM32\ntdll.dll!EtwEventRegister + 67 00007ff88a1e75c7 8 bytes {JMP 0xffffffffffffffe5} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\SYSTEM32\ntdll.dll!EtwNotificationRegister + 559 00007ff88a1ea8b3 8 bytes {JMP 0xffffffffffffff9e} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 12 00007ff88a1ea8c8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 264 00007ff88a1ea9c4 8 bytes {JMP 0xffffffffffffffe1} .text ... * 3 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\SYSTEM32\ntdll.dll!RtlRandomEx + 160 00007ff88a1ead90 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceComplete + 543 00007ff88a1eb157 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceComplete + 736 00007ff88a1eb218 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeResource + 244 00007ff88a1eb57c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeResource + 448 00007ff88a1eb648 8 bytes [10, 6A, 9C, FE, 00, 00, 00, ...] .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 448 00007ff88a1eb88c 8 bytes [F0, 69, 9C, FE, 00, 00, 00, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 704 00007ff88a1eb98c 8 bytes [E0, 69, 9C, FE, 00, 00, 00, ...] .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\SYSTEM32\ntdll.dll!RtlAllocateActivationContextStack + 288 00007ff88a1ebc38 8 bytes [B0, 69, 9C, FE, 00, 00, 00, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\SYSTEM32\ntdll.dll!RtlRegisterWait + 596 00007ff88a1ebe94 8 bytes [A0, 69, 9C, FE, 00, 00, 00, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00007ff88a261740 8 bytes {JMP QWORD [RIP-0x75dba]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00007ff88a2618c0 8 bytes {JMP QWORD [RIP-0x75eda]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00007ff88a2618f0 8 bytes {JMP QWORD [RIP-0x762ae]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ff88a261a10 8 bytes {JMP QWORD [RIP-0x7618a]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00007ff88a261ac0 8 bytes {JMP QWORD [RIP-0x76403]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007ff88a262180 8 bytes {JMP QWORD [RIP-0x762f2]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00007ff88a262480 8 bytes {JMP QWORD [RIP-0x7684e]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007ff88a262d00 8 bytes {JMP QWORD [RIP-0x771f6]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 381 00000000778d137d 16 bytes {JMP 0xffffffffffffffd3} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 386 00000000778d1512 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49 00000000778d1551 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\system32\wow64cpu.dll!CpuSetStackPointer + 23 00000000778d1577 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 516 00000000778d1784 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\system32\wow64cpu.dll!CpuThreadInit + 50 00000000778d17c2 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23 00000000778d17e7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68 00000000778d1834 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 1 00000000778d1841 24 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 513 00000000778d1a41 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16 00000000778d2ae0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308 00000000778d2c1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6372] C:\Windows\system32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000778d2c43 8 bytes [7C, 68, 9C, FE, 00, 00, 00, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 112 00007ff88a1e2bd4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 432 00007ff88a1e2d14 8 bytes {JMP 0xffffffffffffffd8} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 428 00007ff88a1e2ee8 16 bytes {JMP 0xffffffffffffffb8} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllPath + 415 00007ff88a1e3757 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllPath + 704 00007ff88a1e3878 8 bytes {JMP 0xffffffffffffffd3} .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll + 280 00007ff88a1e425c 8 bytes {JMP 0xffffffffffffffbb} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\SYSTEM32\ntdll.dll!RtlReleasePath + 91 00007ff88a1e4a2b 8 bytes {JMP 0xffffffffffffffde} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\SYSTEM32\ntdll.dll!RtlReleasePath + 132 00007ff88a1e4a54 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateTagHeap + 312 00007ff88a1e4cfc 8 bytes {JMP 0xffffffffffffffb1} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\SYSTEM32\ntdll.dll!RtlTryEnterCriticalSection + 52 00007ff88a1e5030 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\SYSTEM32\ntdll.dll!RtlTryEnterCriticalSection + 291 00007ff88a1e511f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\SYSTEM32\ntdll.dll!CsrCaptureMessageBuffer + 75 00007ff88a1e6693 8 bytes {JMP 0xffffffffffffffde} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsA + 48 00007ff88a1e6964 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\SYSTEM32\ntdll.dll!CsrClientConnectToServer + 412 00007ff88a1e6b08 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryResourcePolicy + 199 00007ff88a1e740f 8 bytes {JMP 0xffffffffffffffe8} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\SYSTEM32\ntdll.dll!EtwEventRegister + 67 00007ff88a1e75c7 8 bytes {JMP 0xffffffffffffffe5} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\SYSTEM32\ntdll.dll!EtwNotificationRegister + 559 00007ff88a1ea8b3 8 bytes {JMP 0xffffffffffffff9e} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 12 00007ff88a1ea8c8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 264 00007ff88a1ea9c4 8 bytes {JMP 0xffffffffffffffe1} .text ... * 3 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\SYSTEM32\ntdll.dll!RtlRandomEx + 160 00007ff88a1ead90 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceComplete + 543 00007ff88a1eb157 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceComplete + 736 00007ff88a1eb218 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeResource + 244 00007ff88a1eb57c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeResource + 448 00007ff88a1eb648 8 bytes [10, 6A, 22, FF, 00, 00, 00, ...] .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 448 00007ff88a1eb88c 8 bytes [F0, 69, 22, FF, 00, 00, 00, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 704 00007ff88a1eb98c 8 bytes [E0, 69, 22, FF, 00, 00, 00, ...] .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\SYSTEM32\ntdll.dll!RtlAllocateActivationContextStack + 288 00007ff88a1ebc38 8 bytes [B0, 69, 22, FF, 00, 00, 00, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\SYSTEM32\ntdll.dll!RtlRegisterWait + 596 00007ff88a1ebe94 8 bytes [A0, 69, 22, FF, 00, 00, 00, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00007ff88a261740 8 bytes {JMP QWORD [RIP-0x75dba]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00007ff88a2618c0 8 bytes {JMP QWORD [RIP-0x75eda]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00007ff88a2618f0 8 bytes {JMP QWORD [RIP-0x762ae]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ff88a261a10 8 bytes {JMP QWORD [RIP-0x7618a]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00007ff88a261ac0 8 bytes {JMP QWORD [RIP-0x76403]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007ff88a262180 8 bytes {JMP QWORD [RIP-0x762f2]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00007ff88a262480 8 bytes {JMP QWORD [RIP-0x7684e]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007ff88a262d00 8 bytes {JMP QWORD [RIP-0x771f6]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 381 00000000778d137d 16 bytes {JMP 0xffffffffffffffd3} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 386 00000000778d1512 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49 00000000778d1551 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\system32\wow64cpu.dll!CpuSetStackPointer + 23 00000000778d1577 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 516 00000000778d1784 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\system32\wow64cpu.dll!CpuThreadInit + 50 00000000778d17c2 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23 00000000778d17e7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68 00000000778d1834 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 1 00000000778d1841 24 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 513 00000000778d1a41 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16 00000000778d2ae0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308 00000000778d2c1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6192] C:\Windows\system32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000778d2c43 8 bytes [7C, 68, 22, FF, 00, 00, 00, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 112 00007ff88a1e2bd4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 432 00007ff88a1e2d14 8 bytes {JMP 0xffffffffffffffd8} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 428 00007ff88a1e2ee8 16 bytes {JMP 0xffffffffffffffb8} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllPath + 415 00007ff88a1e3757 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllPath + 704 00007ff88a1e3878 8 bytes {JMP 0xffffffffffffffd3} .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll + 280 00007ff88a1e425c 8 bytes {JMP 0xffffffffffffffbb} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\SYSTEM32\ntdll.dll!RtlReleasePath + 91 00007ff88a1e4a2b 8 bytes {JMP 0xffffffffffffffde} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\SYSTEM32\ntdll.dll!RtlReleasePath + 132 00007ff88a1e4a54 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateTagHeap + 312 00007ff88a1e4cfc 8 bytes {JMP 0xffffffffffffffb1} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\SYSTEM32\ntdll.dll!RtlTryEnterCriticalSection + 52 00007ff88a1e5030 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\SYSTEM32\ntdll.dll!RtlTryEnterCriticalSection + 291 00007ff88a1e511f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\SYSTEM32\ntdll.dll!CsrCaptureMessageBuffer + 75 00007ff88a1e6693 8 bytes {JMP 0xffffffffffffffde} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsA + 48 00007ff88a1e6964 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\SYSTEM32\ntdll.dll!CsrClientConnectToServer + 412 00007ff88a1e6b08 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryResourcePolicy + 199 00007ff88a1e740f 8 bytes {JMP 0xffffffffffffffe8} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\SYSTEM32\ntdll.dll!EtwEventRegister + 67 00007ff88a1e75c7 8 bytes {JMP 0xffffffffffffffe5} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\SYSTEM32\ntdll.dll!EtwNotificationRegister + 559 00007ff88a1ea8b3 8 bytes {JMP 0xffffffffffffff9e} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 12 00007ff88a1ea8c8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 264 00007ff88a1ea9c4 8 bytes {JMP 0xffffffffffffffe1} .text ... * 3 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\SYSTEM32\ntdll.dll!RtlRandomEx + 160 00007ff88a1ead90 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceComplete + 543 00007ff88a1eb157 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceComplete + 736 00007ff88a1eb218 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeResource + 244 00007ff88a1eb57c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeResource + 448 00007ff88a1eb648 8 bytes [10, 6A, FB, FE, 00, 00, 00, ...] .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 448 00007ff88a1eb88c 8 bytes [F0, 69, FB, FE, 00, 00, 00, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 704 00007ff88a1eb98c 8 bytes [E0, 69, FB, FE, 00, 00, 00, ...] .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\SYSTEM32\ntdll.dll!RtlAllocateActivationContextStack + 288 00007ff88a1ebc38 8 bytes [B0, 69, FB, FE, 00, 00, 00, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\SYSTEM32\ntdll.dll!RtlRegisterWait + 596 00007ff88a1ebe94 8 bytes [A0, 69, FB, FE, 00, 00, 00, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00007ff88a261740 8 bytes {JMP QWORD [RIP-0x75dba]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00007ff88a2618c0 8 bytes {JMP QWORD [RIP-0x75eda]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00007ff88a2618f0 8 bytes {JMP QWORD [RIP-0x762ae]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ff88a261a10 8 bytes {JMP QWORD [RIP-0x7618a]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00007ff88a261ac0 8 bytes {JMP QWORD [RIP-0x76403]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007ff88a262180 8 bytes {JMP QWORD [RIP-0x762f2]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00007ff88a262480 8 bytes {JMP QWORD [RIP-0x7684e]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007ff88a262d00 8 bytes {JMP QWORD [RIP-0x771f6]} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 381 00000000778d137d 16 bytes {JMP 0xffffffffffffffd3} .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 386 00000000778d1512 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49 00000000778d1551 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\system32\wow64cpu.dll!CpuSetStackPointer + 23 00000000778d1577 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 516 00000000778d1784 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\system32\wow64cpu.dll!CpuThreadInit + 50 00000000778d17c2 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23 00000000778d17e7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68 00000000778d1834 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 1 00000000778d1841 24 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 513 00000000778d1a41 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16 00000000778d2ae0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308 00000000778d2c1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe[6020] C:\Windows\system32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000778d2c43 8 bytes [7C, 68, FB, FE, 00, 00, 00, ...] .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 112 00007ff88a1e2bd4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 432 00007ff88a1e2d14 8 bytes {JMP 0xffffffffffffffd8} .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 428 00007ff88a1e2ee8 16 bytes {JMP 0xffffffffffffffb8} .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllPath + 415 00007ff88a1e3757 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllPath + 704 00007ff88a1e3878 8 bytes {JMP 0xffffffffffffffd3} .text ... * 2 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll + 280 00007ff88a1e425c 8 bytes {JMP 0xffffffffffffffbb} .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\SYSTEM32\ntdll.dll!RtlReleasePath + 91 00007ff88a1e4a2b 8 bytes {JMP 0xffffffffffffffde} .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\SYSTEM32\ntdll.dll!RtlReleasePath + 132 00007ff88a1e4a54 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateTagHeap + 312 00007ff88a1e4cfc 8 bytes {JMP 0xffffffffffffffb1} .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\SYSTEM32\ntdll.dll!RtlTryEnterCriticalSection + 52 00007ff88a1e5030 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\SYSTEM32\ntdll.dll!RtlTryEnterCriticalSection + 291 00007ff88a1e511f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\SYSTEM32\ntdll.dll!CsrCaptureMessageBuffer + 75 00007ff88a1e6693 8 bytes {JMP 0xffffffffffffffde} .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsA + 48 00007ff88a1e6964 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\SYSTEM32\ntdll.dll!CsrClientConnectToServer + 412 00007ff88a1e6b08 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryResourcePolicy + 199 00007ff88a1e740f 8 bytes {JMP 0xffffffffffffffe8} .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\SYSTEM32\ntdll.dll!EtwEventRegister + 67 00007ff88a1e75c7 8 bytes {JMP 0xffffffffffffffe5} .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\SYSTEM32\ntdll.dll!EtwNotificationRegister + 559 00007ff88a1ea8b3 8 bytes {JMP 0xffffffffffffff9e} .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 12 00007ff88a1ea8c8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 264 00007ff88a1ea9c4 8 bytes {JMP 0xffffffffffffffe1} .text ... * 3 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\SYSTEM32\ntdll.dll!RtlRandomEx + 160 00007ff88a1ead90 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceComplete + 543 00007ff88a1eb157 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceComplete + 736 00007ff88a1eb218 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeResource + 244 00007ff88a1eb57c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeResource + 448 00007ff88a1eb648 8 bytes [10, 6A, F4, 7E, 00, 00, 00, ...] .text ... * 2 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 448 00007ff88a1eb88c 8 bytes [F0, 69, F4, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 704 00007ff88a1eb98c 8 bytes [E0, 69, F4, 7E, 00, 00, 00, ...] .text ... * 2 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\SYSTEM32\ntdll.dll!RtlAllocateActivationContextStack + 288 00007ff88a1ebc38 8 bytes [B0, 69, F4, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\SYSTEM32\ntdll.dll!RtlRegisterWait + 596 00007ff88a1ebe94 8 bytes [A0, 69, F4, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00007ff88a261740 8 bytes {JMP QWORD [RIP-0x75dba]} .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00007ff88a2618c0 8 bytes {JMP QWORD [RIP-0x75eda]} .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00007ff88a2618f0 8 bytes {JMP QWORD [RIP-0x762ae]} .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ff88a261a10 8 bytes {JMP QWORD [RIP-0x7618a]} .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00007ff88a261ac0 8 bytes {JMP QWORD [RIP-0x76403]} .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007ff88a262180 8 bytes {JMP QWORD [RIP-0x762f2]} .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00007ff88a262480 8 bytes {JMP QWORD [RIP-0x7684e]} .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007ff88a262d00 8 bytes {JMP QWORD [RIP-0x771f6]} .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 381 00000000778d137d 16 bytes {JMP 0xffffffffffffffd3} .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 386 00000000778d1512 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49 00000000778d1551 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\system32\wow64cpu.dll!CpuSetStackPointer + 23 00000000778d1577 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 516 00000000778d1784 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\system32\wow64cpu.dll!CpuThreadInit + 50 00000000778d17c2 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23 00000000778d17e7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68 00000000778d1834 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 1 00000000778d1841 24 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 513 00000000778d1a41 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16 00000000778d2ae0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308 00000000778d2c1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5828] C:\Windows\system32\wow64cpu.dll!CpuProcessDebugEvent + 3 00000000778d2c43 8 bytes [7C, 68, F4, 7E, 00, 00, 00, ...] ---- User IAT/EAT - GMER 2.1 ---- IAT C:\Windows\Explorer.EXE[6308] @ C:\Windows\system32\RPCRT4.dll[ntdll.dll!NtAlpcConnectPortEx] [744344b0] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\x64\prremote.dll ---- Threads - GMER 2.1 ---- Thread C:\Windows\System32\svchost.exe [568:1116] 00007ff882921420 Thread C:\Windows\System32\svchost.exe [568:1168] 00007ff881f4e840 Thread C:\Windows\System32\svchost.exe [568:1172] 00007ff881e6e160 Thread C:\Windows\System32\svchost.exe [568:2296] 00007ff87e646dd0 Thread C:\Windows\System32\svchost.exe [568:2752] 00007ff87e644f30 Thread C:\Windows\System32\svchost.exe [568:2740] 00007ff882001ed0 Thread C:\Windows\System32\svchost.exe [568:6776] 00007ff87f2712f8 Thread C:\Windows\system32\csrss.exe [2472:3624] fffff96000907b90 ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Configuration\MAX089D744AD01401507_2C_07D7_FC^5AE30EDA05360FF92E23DC8468D125A1@Timestamp 0xCE 0x0F 0xC6 0xE4 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel\RNG@RNGAuxiliarySeed 779208582 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@POSTTime 13262 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@FwPOSTTime 12334 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@TotalResumeTime 60944 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@ResumeBootMgrTime 521 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@ResumeAppTime 1392 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@ResumeAppStartTimestamp 13784 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@ResumeInitTime 109 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@ResumeHiberFileTime 1169 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@ResumeRestoreImageStartTimestamp 14006 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@ResumeIoTime 1007 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@ResumeDecompressTime 169 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@ResumeKernelSwitchTimestamp 15176 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@KernelReturnFromHandlerTimestamp 15194 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@SleeperThreadEndTimestamp 59344 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@TimeStampCounterAtSwitchTime 15192 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@KernelReturnSystemPowerState 59713 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@HiberHiberFileTime 42278 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@HiberInitTime 199 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@HiberSharedBufferTime 27 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@TotalHibernateTime 71018 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@KernelResumeHiberFileTime 44143 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@KernelResumeSharedBufferTime 43 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@DeviceResumeTime 361 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@KernelAnimationTime 71 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@KernelPagesProcessed 2549955 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@KernelPagesWritten 0xE0 0xA7 0x0C 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@BootPagesProcessed 46137 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@BootPagesWritten 0x16 0x46 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@ResumeDecompressRate 150 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@KernelResumeIoCpuTime 3870 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@HiberIoCpuTime 1376 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@HybridBootAnimationTime 44157 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@ResumeCompleteTimestamp 0xFE 0x69 0x1E 0x15 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server@GlassSessionId 2 Reg HKLM\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\Isatap\{3E8AA4FB-DDFC-4B28-AB5A-8E8D06D4F685}@DefunctTimestamp 0x3D 0x53 0xA8 0x54 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch@Epoch 3088 Reg HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch2@Epoch 825 Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{D3264BD9-AC2F-49F9-9ABB-4DC09272C3DB}@LeaseObtainedTime 1420317503 Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{D3264BD9-AC2F-49F9-9ABB-4DC09272C3DB}@T1 1420360703 Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{D3264BD9-AC2F-49F9-9ABB-4DC09272C3DB}@T2 1420393103 Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{D3264BD9-AC2F-49F9-9ABB-4DC09272C3DB}@LeaseTerminatesTime 1420403903 Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Applets\Paint\View@BMPWidth 794 Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Applets\Paint\View@BMPHeight 1123 ---- EOF - GMER 2.1 ----