GMER 2.2.19882 - http://www.gmer.net Rootkit scan 2016-08-17 16:00:12 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST1000LM rev.2AR1 931,51GB Running: eyerm083.exe; Driver: C:\Users\Szymon\AppData\Local\Temp\kxdirkod.sys ---- User code sections - GMER 2.2 ---- .text D:\Programy\Steam\steam.exe[2996] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000771c1401 2 bytes JMP 75d3b263 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\steam.exe[2996] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000771c1419 2 bytes JMP 75d3b38e C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\steam.exe[2996] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000771c1431 2 bytes JMP 75db90f1 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\steam.exe[2996] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000771c144a 2 bytes CALL 75d148ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text D:\Programy\Steam\steam.exe[2996] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000771c14dd 2 bytes JMP 75db89ea C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\steam.exe[2996] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000771c14f5 2 bytes JMP 75db8bc0 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\steam.exe[2996] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000771c150d 2 bytes JMP 75db88e0 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\steam.exe[2996] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000771c1525 2 bytes JMP 75db8caa C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\steam.exe[2996] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000771c153d 2 bytes JMP 75d2fce8 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\steam.exe[2996] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000771c1555 2 bytes JMP 75d36937 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\steam.exe[2996] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000771c156d 2 bytes JMP 75db91a9 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\steam.exe[2996] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000771c1585 2 bytes JMP 75db8d0a C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\steam.exe[2996] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000771c159d 2 bytes JMP 75db88a4 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\steam.exe[2996] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000771c15b5 2 bytes JMP 75d2fd81 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\steam.exe[2996] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000771c15cd 2 bytes JMP 75d3b324 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\steam.exe[2996] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000771c16b2 2 bytes JMP 75db906c C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\steam.exe[2996] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000771c16bd 2 bytes JMP 75db8839 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[2504] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000771c1401 2 bytes JMP 75d3b263 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[2504] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000771c1419 2 bytes JMP 75d3b38e C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[2504] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000771c1431 2 bytes JMP 75db90f1 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[2504] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000771c144a 2 bytes CALL 75d148ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text D:\Programy\Steam\bin\steamwebhelper.exe[2504] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000771c14dd 2 bytes JMP 75db89ea C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[2504] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000771c14f5 2 bytes JMP 75db8bc0 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[2504] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000771c150d 2 bytes JMP 75db88e0 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[2504] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000771c1525 2 bytes JMP 75db8caa C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[2504] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000771c153d 2 bytes JMP 75d2fce8 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[2504] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000771c1555 2 bytes JMP 75d36937 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[2504] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000771c156d 2 bytes JMP 75db91a9 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[2504] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000771c1585 2 bytes JMP 75db8d0a C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[2504] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000771c159d 2 bytes JMP 75db88a4 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[2504] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000771c15b5 2 bytes JMP 75d2fd81 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[2504] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000771c15cd 2 bytes JMP 75d3b324 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[2504] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000771c16b2 2 bytes JMP 75db906c C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[2504] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000771c16bd 2 bytes JMP 75db8839 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[5480] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000771c1401 2 bytes JMP 75d3b263 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[5480] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000771c1419 2 bytes JMP 75d3b38e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[5480] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000771c1431 2 bytes JMP 75db90f1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[5480] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000771c144a 2 bytes CALL 75d148ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[5480] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000771c14dd 2 bytes JMP 75db89ea C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[5480] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000771c14f5 2 bytes JMP 75db8bc0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[5480] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000771c150d 2 bytes JMP 75db88e0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[5480] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000771c1525 2 bytes JMP 75db8caa C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[5480] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000771c153d 2 bytes JMP 75d2fce8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[5480] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000771c1555 2 bytes JMP 75d36937 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[5480] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000771c156d 2 bytes JMP 75db91a9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[5480] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000771c1585 2 bytes JMP 75db8d0a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[5480] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000771c159d 2 bytes JMP 75db88a4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[5480] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000771c15b5 2 bytes JMP 75d2fd81 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[5480] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000771c15cd 2 bytes JMP 75d3b324 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[5480] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000771c16b2 2 bytes JMP 75db906c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[5480] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000771c16bd 2 bytes JMP 75db8839 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5528] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationThread + 5 00000000775e0309 7 bytes {MOV EDX, 0x5ac2e8; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5528] C:\Windows\SysWOW64\ntdll.dll!NtOpenKey + 5 00000000775e0385 7 bytes {MOV EDX, 0x5ac1a8; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5528] C:\Windows\SysWOW64\ntdll.dll!NtCreateKey + 5 00000000775e049d 7 bytes {MOV EDX, 0x5ac168; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5528] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadToken + 5 00000000775e054d 7 bytes {MOV EDX, 0x5ac328; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5528] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 5 00000000775e057d 7 bytes {MOV EDX, 0x5ac268; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5528] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 5 00000000775e0595 7 bytes {MOV EDX, 0x5ac128; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5528] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection + 5 00000000775e05ad 7 bytes {MOV EDX, 0x5ac3e8; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5528] C:\Windows\SysWOW64\ntdll.dll!NtUnmapViewOfSection + 5 00000000775e05dd 7 bytes {MOV EDX, 0x5ac428; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5528] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadTokenEx + 5 00000000775e065d 7 bytes {MOV EDX, 0x5ac3a8; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5528] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessTokenEx + 5 00000000775e0675 7 bytes {MOV EDX, 0x5ac368; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5528] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 5 00000000775e06c1 7 bytes {MOV EDX, 0x5ac068; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5528] C:\Windows\SysWOW64\ntdll.dll!NtQueryAttributesFile + 5 00000000775e07b9 7 bytes {MOV EDX, 0x5ac0a8; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5528] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 5 00000000775e0a11 7 bytes {MOV EDX, 0x5ac028; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5528] C:\Windows\SysWOW64\ntdll.dll!NtOpenKeyEx + 5 00000000775e1975 7 bytes {MOV EDX, 0x5ac1e8; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5528] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessToken + 5 00000000775e1a1d 7 bytes {MOV EDX, 0x5ac2a8; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5528] C:\Windows\SysWOW64\ntdll.dll!NtOpenThread + 5 00000000775e1a95 7 bytes {MOV EDX, 0x5ac228; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5528] C:\Windows\SysWOW64\ntdll.dll!NtQueryFullAttributesFile + 5 00000000775e1c99 7 bytes {MOV EDX, 0x5ac0e8; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5528] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000771c1401 2 bytes JMP 75d3b263 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5528] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000771c1419 2 bytes JMP 75d3b38e C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5528] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000771c1431 2 bytes JMP 75db90f1 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5528] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000771c144a 2 bytes CALL 75d148ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text D:\Programy\Steam\bin\steamwebhelper.exe[5528] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000771c14dd 2 bytes JMP 75db89ea C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5528] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000771c14f5 2 bytes JMP 75db8bc0 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5528] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000771c150d 2 bytes JMP 75db88e0 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5528] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000771c1525 2 bytes JMP 75db8caa C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5528] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000771c153d 2 bytes JMP 75d2fce8 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5528] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000771c1555 2 bytes JMP 75d36937 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5528] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000771c156d 2 bytes JMP 75db91a9 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5528] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000771c1585 2 bytes JMP 75db8d0a C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5528] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000771c159d 2 bytes JMP 75db88a4 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5528] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000771c15b5 2 bytes JMP 75d2fd81 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5528] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000771c15cd 2 bytes JMP 75d3b324 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5528] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000771c16b2 2 bytes JMP 75db906c C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5528] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000771c16bd 2 bytes JMP 75db8839 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[4028] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationThread + 5 00000000775e0309 7 bytes {MOV EDX, 0x2022e8; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[4028] C:\Windows\SysWOW64\ntdll.dll!NtOpenKey + 5 00000000775e0385 7 bytes {MOV EDX, 0x2021a8; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[4028] C:\Windows\SysWOW64\ntdll.dll!NtCreateKey + 5 00000000775e049d 7 bytes {MOV EDX, 0x202168; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[4028] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadToken + 5 00000000775e054d 7 bytes {MOV EDX, 0x202328; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[4028] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 5 00000000775e057d 7 bytes {MOV EDX, 0x202268; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[4028] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 5 00000000775e0595 7 bytes {MOV EDX, 0x202128; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[4028] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection + 5 00000000775e05ad 7 bytes {MOV EDX, 0x2023e8; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[4028] C:\Windows\SysWOW64\ntdll.dll!NtUnmapViewOfSection + 5 00000000775e05dd 7 bytes {MOV EDX, 0x202428; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[4028] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadTokenEx + 5 00000000775e065d 7 bytes {MOV EDX, 0x2023a8; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[4028] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessTokenEx + 5 00000000775e0675 7 bytes {MOV EDX, 0x202368; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[4028] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 5 00000000775e06c1 7 bytes {MOV EDX, 0x202068; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[4028] C:\Windows\SysWOW64\ntdll.dll!NtQueryAttributesFile + 5 00000000775e07b9 7 bytes {MOV EDX, 0x2020a8; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[4028] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 5 00000000775e0a11 7 bytes {MOV EDX, 0x202028; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[4028] C:\Windows\SysWOW64\ntdll.dll!NtOpenKeyEx + 5 00000000775e1975 7 bytes {MOV EDX, 0x2021e8; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[4028] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessToken + 5 00000000775e1a1d 7 bytes {MOV EDX, 0x2022a8; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[4028] C:\Windows\SysWOW64\ntdll.dll!NtOpenThread + 5 00000000775e1a95 7 bytes {MOV EDX, 0x202228; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[4028] C:\Windows\SysWOW64\ntdll.dll!NtQueryFullAttributesFile + 5 00000000775e1c99 7 bytes {MOV EDX, 0x2020e8; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[4028] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000771c1401 2 bytes JMP 75d3b263 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[4028] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000771c1419 2 bytes JMP 75d3b38e C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[4028] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000771c1431 2 bytes JMP 75db90f1 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[4028] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000771c144a 2 bytes CALL 75d148ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text D:\Programy\Steam\bin\steamwebhelper.exe[4028] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000771c14dd 2 bytes JMP 75db89ea C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[4028] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000771c14f5 2 bytes JMP 75db8bc0 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[4028] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000771c150d 2 bytes JMP 75db88e0 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[4028] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000771c1525 2 bytes JMP 75db8caa C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[4028] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000771c153d 2 bytes JMP 75d2fce8 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[4028] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000771c1555 2 bytes JMP 75d36937 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[4028] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000771c156d 2 bytes JMP 75db91a9 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[4028] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000771c1585 2 bytes JMP 75db8d0a C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[4028] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000771c159d 2 bytes JMP 75db88a4 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[4028] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000771c15b5 2 bytes JMP 75d2fd81 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[4028] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000771c15cd 2 bytes JMP 75d3b324 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[4028] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000771c16b2 2 bytes JMP 75db906c C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[4028] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000771c16bd 2 bytes JMP 75db8839 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5584] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationThread + 5 00000000775e0309 7 bytes {MOV EDX, 0xd9d2e8; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5584] C:\Windows\SysWOW64\ntdll.dll!NtOpenKey + 5 00000000775e0385 7 bytes {MOV EDX, 0xd9d1a8; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5584] C:\Windows\SysWOW64\ntdll.dll!NtCreateKey + 5 00000000775e049d 7 bytes {MOV EDX, 0xd9d168; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5584] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadToken + 5 00000000775e054d 7 bytes {MOV EDX, 0xd9d328; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5584] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 5 00000000775e057d 7 bytes {MOV EDX, 0xd9d268; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5584] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 5 00000000775e0595 7 bytes {MOV EDX, 0xd9d128; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5584] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection + 5 00000000775e05ad 7 bytes {MOV EDX, 0xd9d3e8; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5584] C:\Windows\SysWOW64\ntdll.dll!NtUnmapViewOfSection + 5 00000000775e05dd 7 bytes {MOV EDX, 0xd9d428; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5584] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadTokenEx + 5 00000000775e065d 7 bytes {MOV EDX, 0xd9d3a8; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5584] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessTokenEx + 5 00000000775e0675 7 bytes {MOV EDX, 0xd9d368; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5584] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 5 00000000775e06c1 7 bytes {MOV EDX, 0xd9d068; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5584] C:\Windows\SysWOW64\ntdll.dll!NtQueryAttributesFile + 5 00000000775e07b9 7 bytes {MOV EDX, 0xd9d0a8; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5584] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 5 00000000775e0a11 7 bytes {MOV EDX, 0xd9d028; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5584] C:\Windows\SysWOW64\ntdll.dll!NtOpenKeyEx + 5 00000000775e1975 7 bytes {MOV EDX, 0xd9d1e8; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5584] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessToken + 5 00000000775e1a1d 7 bytes {MOV EDX, 0xd9d2a8; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5584] C:\Windows\SysWOW64\ntdll.dll!NtOpenThread + 5 00000000775e1a95 7 bytes {MOV EDX, 0xd9d228; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5584] C:\Windows\SysWOW64\ntdll.dll!NtQueryFullAttributesFile + 5 00000000775e1c99 7 bytes {MOV EDX, 0xd9d0e8; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5584] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000771c1401 2 bytes JMP 75d3b263 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5584] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000771c1419 2 bytes JMP 75d3b38e C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5584] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000771c1431 2 bytes JMP 75db90f1 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5584] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000771c144a 2 bytes CALL 75d148ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text D:\Programy\Steam\bin\steamwebhelper.exe[5584] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000771c14dd 2 bytes JMP 75db89ea C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5584] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000771c14f5 2 bytes JMP 75db8bc0 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5584] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000771c150d 2 bytes JMP 75db88e0 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5584] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000771c1525 2 bytes JMP 75db8caa C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5584] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000771c153d 2 bytes JMP 75d2fce8 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5584] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000771c1555 2 bytes JMP 75d36937 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5584] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000771c156d 2 bytes JMP 75db91a9 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5584] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000771c1585 2 bytes JMP 75db8d0a C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5584] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000771c159d 2 bytes JMP 75db88a4 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5584] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000771c15b5 2 bytes JMP 75d2fd81 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5584] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000771c15cd 2 bytes JMP 75d3b324 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5584] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000771c16b2 2 bytes JMP 75db906c C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5584] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000771c16bd 2 bytes JMP 75db8839 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5856] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationThread + 5 00000000775e0309 7 bytes {MOV EDX, 0xbf6ae8; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5856] C:\Windows\SysWOW64\ntdll.dll!NtOpenKey + 5 00000000775e0385 7 bytes {MOV EDX, 0xbf69a8; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5856] C:\Windows\SysWOW64\ntdll.dll!NtCreateKey + 5 00000000775e049d 7 bytes {MOV EDX, 0xbf6968; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5856] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadToken + 5 00000000775e054d 7 bytes {MOV EDX, 0xbf6b28; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5856] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 5 00000000775e057d 7 bytes {MOV EDX, 0xbf6a68; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5856] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 5 00000000775e0595 7 bytes {MOV EDX, 0xbf6928; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5856] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection + 5 00000000775e05ad 7 bytes {MOV EDX, 0xbf6be8; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5856] C:\Windows\SysWOW64\ntdll.dll!NtUnmapViewOfSection + 5 00000000775e05dd 7 bytes {MOV EDX, 0xbf6c28; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5856] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadTokenEx + 5 00000000775e065d 7 bytes {MOV EDX, 0xbf6ba8; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5856] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessTokenEx + 5 00000000775e0675 7 bytes {MOV EDX, 0xbf6b68; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5856] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 5 00000000775e06c1 7 bytes {MOV EDX, 0xbf6868; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5856] C:\Windows\SysWOW64\ntdll.dll!NtQueryAttributesFile + 5 00000000775e07b9 7 bytes {MOV EDX, 0xbf68a8; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5856] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 5 00000000775e0a11 7 bytes {MOV EDX, 0xbf6828; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5856] C:\Windows\SysWOW64\ntdll.dll!NtOpenKeyEx + 5 00000000775e1975 7 bytes {MOV EDX, 0xbf69e8; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5856] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessToken + 5 00000000775e1a1d 7 bytes {MOV EDX, 0xbf6aa8; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5856] C:\Windows\SysWOW64\ntdll.dll!NtOpenThread + 5 00000000775e1a95 7 bytes {MOV EDX, 0xbf6a28; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5856] C:\Windows\SysWOW64\ntdll.dll!NtQueryFullAttributesFile + 5 00000000775e1c99 7 bytes {MOV EDX, 0xbf68e8; JMP RDX} .text D:\Programy\Steam\bin\steamwebhelper.exe[5856] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000771c1401 2 bytes JMP 75d3b263 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5856] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000771c1419 2 bytes JMP 75d3b38e C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5856] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000771c1431 2 bytes JMP 75db90f1 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5856] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000771c144a 2 bytes CALL 75d148ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text D:\Programy\Steam\bin\steamwebhelper.exe[5856] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000771c14dd 2 bytes JMP 75db89ea C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5856] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000771c14f5 2 bytes JMP 75db8bc0 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5856] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000771c150d 2 bytes JMP 75db88e0 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5856] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000771c1525 2 bytes JMP 75db8caa C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5856] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000771c153d 2 bytes JMP 75d2fce8 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5856] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000771c1555 2 bytes JMP 75d36937 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5856] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000771c156d 2 bytes JMP 75db91a9 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5856] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000771c1585 2 bytes JMP 75db8d0a C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5856] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000771c159d 2 bytes JMP 75db88a4 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5856] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000771c15b5 2 bytes JMP 75d2fd81 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5856] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000771c15cd 2 bytes JMP 75d3b324 C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5856] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000771c16b2 2 bytes JMP 75db906c C:\Windows\syswow64\kernel32.dll .text D:\Programy\Steam\bin\steamwebhelper.exe[5856] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000771c16bd 2 bytes JMP 75db8839 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Mail.Ru\Update Service\mrupdsrv.exe[3184] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000771c1401 2 bytes JMP 75d3b263 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Mail.Ru\Update Service\mrupdsrv.exe[3184] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000771c1419 2 bytes JMP 75d3b38e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Mail.Ru\Update Service\mrupdsrv.exe[3184] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000771c1431 2 bytes JMP 75db90f1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Mail.Ru\Update Service\mrupdsrv.exe[3184] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000771c144a 2 bytes CALL 75d148ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Mail.Ru\Update Service\mrupdsrv.exe[3184] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000771c14dd 2 bytes JMP 75db89ea C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Mail.Ru\Update Service\mrupdsrv.exe[3184] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000771c14f5 2 bytes JMP 75db8bc0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Mail.Ru\Update Service\mrupdsrv.exe[3184] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000771c150d 2 bytes JMP 75db88e0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Mail.Ru\Update Service\mrupdsrv.exe[3184] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000771c1525 2 bytes JMP 75db8caa C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Mail.Ru\Update Service\mrupdsrv.exe[3184] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000771c153d 2 bytes JMP 75d2fce8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Mail.Ru\Update Service\mrupdsrv.exe[3184] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000771c1555 2 bytes JMP 75d36937 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Mail.Ru\Update Service\mrupdsrv.exe[3184] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000771c156d 2 bytes JMP 75db91a9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Mail.Ru\Update Service\mrupdsrv.exe[3184] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000771c1585 2 bytes JMP 75db8d0a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Mail.Ru\Update Service\mrupdsrv.exe[3184] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000771c159d 2 bytes JMP 75db88a4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Mail.Ru\Update Service\mrupdsrv.exe[3184] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000771c15b5 2 bytes JMP 75d2fd81 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Mail.Ru\Update Service\mrupdsrv.exe[3184] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000771c15cd 2 bytes JMP 75d3b324 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Mail.Ru\Update Service\mrupdsrv.exe[3184] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000771c16b2 2 bytes JMP 75db906c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Mail.Ru\Update Service\mrupdsrv.exe[3184] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000771c16bd 2 bytes JMP 75db8839 C:\Windows\syswow64\kernel32.dll .text C:\Users\Szymon\AppData\Local\Mail.Ru\MailRuUpdater.exe[6760] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000771c1401 2 bytes JMP 75d3b263 C:\Windows\syswow64\kernel32.dll .text C:\Users\Szymon\AppData\Local\Mail.Ru\MailRuUpdater.exe[6760] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000771c1419 2 bytes JMP 75d3b38e C:\Windows\syswow64\kernel32.dll .text C:\Users\Szymon\AppData\Local\Mail.Ru\MailRuUpdater.exe[6760] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000771c1431 2 bytes JMP 75db90f1 C:\Windows\syswow64\kernel32.dll .text C:\Users\Szymon\AppData\Local\Mail.Ru\MailRuUpdater.exe[6760] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000771c144a 2 bytes CALL 75d148ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Users\Szymon\AppData\Local\Mail.Ru\MailRuUpdater.exe[6760] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000771c14dd 2 bytes JMP 75db89ea C:\Windows\syswow64\kernel32.dll .text C:\Users\Szymon\AppData\Local\Mail.Ru\MailRuUpdater.exe[6760] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000771c14f5 2 bytes JMP 75db8bc0 C:\Windows\syswow64\kernel32.dll .text C:\Users\Szymon\AppData\Local\Mail.Ru\MailRuUpdater.exe[6760] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000771c150d 2 bytes JMP 75db88e0 C:\Windows\syswow64\kernel32.dll .text C:\Users\Szymon\AppData\Local\Mail.Ru\MailRuUpdater.exe[6760] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000771c1525 2 bytes JMP 75db8caa C:\Windows\syswow64\kernel32.dll .text C:\Users\Szymon\AppData\Local\Mail.Ru\MailRuUpdater.exe[6760] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000771c153d 2 bytes JMP 75d2fce8 C:\Windows\syswow64\kernel32.dll .text C:\Users\Szymon\AppData\Local\Mail.Ru\MailRuUpdater.exe[6760] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000771c1555 2 bytes JMP 75d36937 C:\Windows\syswow64\kernel32.dll .text C:\Users\Szymon\AppData\Local\Mail.Ru\MailRuUpdater.exe[6760] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000771c156d 2 bytes JMP 75db91a9 C:\Windows\syswow64\kernel32.dll .text C:\Users\Szymon\AppData\Local\Mail.Ru\MailRuUpdater.exe[6760] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000771c1585 2 bytes JMP 75db8d0a C:\Windows\syswow64\kernel32.dll .text C:\Users\Szymon\AppData\Local\Mail.Ru\MailRuUpdater.exe[6760] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000771c159d 2 bytes JMP 75db88a4 C:\Windows\syswow64\kernel32.dll .text C:\Users\Szymon\AppData\Local\Mail.Ru\MailRuUpdater.exe[6760] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000771c15b5 2 bytes JMP 75d2fd81 C:\Windows\syswow64\kernel32.dll .text C:\Users\Szymon\AppData\Local\Mail.Ru\MailRuUpdater.exe[6760] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000771c15cd 2 bytes JMP 75d3b324 C:\Windows\syswow64\kernel32.dll .text C:\Users\Szymon\AppData\Local\Mail.Ru\MailRuUpdater.exe[6760] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000771c16b2 2 bytes JMP 75db906c C:\Windows\syswow64\kernel32.dll .text C:\Users\Szymon\AppData\Local\Mail.Ru\MailRuUpdater.exe[6760] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000771c16bd 2 bytes JMP 75db8839 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Mail.Ru\MailRuUpdater\MailRuUpdater.exe[4980] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000771c1401 2 bytes JMP 75d3b263 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Mail.Ru\MailRuUpdater\MailRuUpdater.exe[4980] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000771c1419 2 bytes JMP 75d3b38e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Mail.Ru\MailRuUpdater\MailRuUpdater.exe[4980] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000771c1431 2 bytes JMP 75db90f1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Mail.Ru\MailRuUpdater\MailRuUpdater.exe[4980] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000771c144a 2 bytes CALL 75d148ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Mail.Ru\MailRuUpdater\MailRuUpdater.exe[4980] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000771c14dd 2 bytes JMP 75db89ea C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Mail.Ru\MailRuUpdater\MailRuUpdater.exe[4980] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000771c14f5 2 bytes JMP 75db8bc0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Mail.Ru\MailRuUpdater\MailRuUpdater.exe[4980] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000771c150d 2 bytes JMP 75db88e0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Mail.Ru\MailRuUpdater\MailRuUpdater.exe[4980] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000771c1525 2 bytes JMP 75db8caa C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Mail.Ru\MailRuUpdater\MailRuUpdater.exe[4980] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000771c153d 2 bytes JMP 75d2fce8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Mail.Ru\MailRuUpdater\MailRuUpdater.exe[4980] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000771c1555 2 bytes JMP 75d36937 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Mail.Ru\MailRuUpdater\MailRuUpdater.exe[4980] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000771c156d 2 bytes JMP 75db91a9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Mail.Ru\MailRuUpdater\MailRuUpdater.exe[4980] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000771c1585 2 bytes JMP 75db8d0a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Mail.Ru\MailRuUpdater\MailRuUpdater.exe[4980] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000771c159d 2 bytes JMP 75db88a4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Mail.Ru\MailRuUpdater\MailRuUpdater.exe[4980] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000771c15b5 2 bytes JMP 75d2fd81 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Mail.Ru\MailRuUpdater\MailRuUpdater.exe[4980] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000771c15cd 2 bytes JMP 75d3b324 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Mail.Ru\MailRuUpdater\MailRuUpdater.exe[4980] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000771c16b2 2 bytes JMP 75db906c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Mail.Ru\MailRuUpdater\MailRuUpdater.exe[4980] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000771c16bd 2 bytes JMP 75db8839 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5696] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007743bdb0 14 bytes {MOV RAX, 0x7fef4f930f0; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6604] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007743bc00 7 bytes [48, B8, 68, F4, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6604] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8 000000007743bc08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6604] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 000000007743bd70 7 bytes [48, B8, C0, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6604] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8 000000007743bd78 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6604] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 000000007743bd90 7 bytes [48, B8, 3C, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6604] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 000000007743bd98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6604] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 000000007743bda0 7 bytes [48, B8, 3C, F4, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6604] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8 000000007743bda8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6604] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007743bdb0 7 bytes [48, B8, 48, F2, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6604] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 000000007743bdb8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6604] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 000000007743bdd0 7 bytes [48, B8, 8C, F4, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6604] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 000000007743bdd8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6604] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 000000007743be20 7 bytes [48, B8, E4, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6604] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8 000000007743be28 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6604] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 000000007743be30 7 bytes [48, B8, 78, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6604] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8 000000007743be38 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6604] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 000000007743be60 7 bytes [48, B8, CC, F2, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6604] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8 000000007743be68 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6604] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 000000007743bf00 7 bytes [48, B8, 14, F4, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6604] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8 000000007743bf08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6604] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 000000007743c080 7 bytes [48, B8, 90, F1, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6604] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 000000007743c088 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6604] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 000000007743caf0 7 bytes [48, B8, 60, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6604] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8 000000007743caf8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6604] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 000000007743cb40 7 bytes [48, B8, 9C, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6604] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8 000000007743cb48 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6604] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 000000007743cc90 7 bytes [48, B8, 28, F4, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6604] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8 000000007743cc98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8128] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007743bc00 7 bytes [48, B8, 68, F4, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8128] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8 000000007743bc08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8128] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 000000007743bd70 7 bytes [48, B8, C0, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8128] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8 000000007743bd78 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8128] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 000000007743bd90 7 bytes [48, B8, 3C, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8128] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 000000007743bd98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8128] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 000000007743bda0 7 bytes [48, B8, 3C, F4, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8128] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8 000000007743bda8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8128] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007743bdb0 7 bytes [48, B8, 48, F2, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8128] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 000000007743bdb8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8128] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 000000007743bdd0 7 bytes [48, B8, 8C, F4, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8128] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 000000007743bdd8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8128] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 000000007743be20 7 bytes [48, B8, E4, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8128] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8 000000007743be28 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8128] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 000000007743be30 7 bytes [48, B8, 78, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8128] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8 000000007743be38 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8128] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 000000007743be60 7 bytes [48, B8, CC, F2, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8128] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8 000000007743be68 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8128] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 000000007743bf00 7 bytes [48, B8, 14, F4, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8128] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8 000000007743bf08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8128] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 000000007743c080 7 bytes [48, B8, 90, F1, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8128] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 000000007743c088 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8128] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 000000007743caf0 7 bytes [48, B8, 60, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8128] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8 000000007743caf8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8128] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 000000007743cb40 7 bytes [48, B8, 9C, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8128] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8 000000007743cb48 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8128] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 000000007743cc90 7 bytes [48, B8, 28, F4, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8128] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8 000000007743cc98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007743bc00 7 bytes [48, B8, 68, F4, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8 000000007743bc08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 000000007743bd70 7 bytes [48, B8, C0, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8 000000007743bd78 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 000000007743bd90 7 bytes [48, B8, 3C, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 000000007743bd98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 000000007743bda0 7 bytes [48, B8, 3C, F4, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8 000000007743bda8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007743bdb0 7 bytes [48, B8, 48, F2, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 000000007743bdb8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 000000007743bdd0 7 bytes [48, B8, 8C, F4, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 000000007743bdd8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 000000007743be20 7 bytes [48, B8, E4, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8 000000007743be28 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 000000007743be30 7 bytes [48, B8, 78, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8 000000007743be38 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 000000007743be60 7 bytes [48, B8, CC, F2, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8 000000007743be68 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 000000007743bf00 7 bytes [48, B8, 14, F4, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8 000000007743bf08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 000000007743c080 7 bytes [48, B8, 90, F1, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 000000007743c088 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 000000007743caf0 7 bytes [48, B8, 60, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8 000000007743caf8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 000000007743cb40 7 bytes [48, B8, 9C, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8 000000007743cb48 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 000000007743cc90 7 bytes [48, B8, 28, F4, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7280] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8 000000007743cc98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3172] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007743bc00 7 bytes [48, B8, 68, F4, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3172] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8 000000007743bc08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3172] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 000000007743bd70 7 bytes [48, B8, C0, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3172] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8 000000007743bd78 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3172] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 000000007743bd90 7 bytes [48, B8, 3C, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3172] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 000000007743bd98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3172] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 000000007743bda0 7 bytes [48, B8, 3C, F4, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3172] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8 000000007743bda8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3172] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007743bdb0 7 bytes [48, B8, 48, F2, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3172] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 000000007743bdb8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3172] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 000000007743bdd0 7 bytes [48, B8, 8C, F4, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3172] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 000000007743bdd8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3172] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 000000007743be20 7 bytes [48, B8, E4, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3172] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8 000000007743be28 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3172] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 000000007743be30 7 bytes [48, B8, 78, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3172] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8 000000007743be38 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3172] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 000000007743be60 7 bytes [48, B8, CC, F2, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3172] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8 000000007743be68 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3172] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 000000007743bf00 7 bytes [48, B8, 14, F4, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3172] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8 000000007743bf08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3172] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 000000007743c080 7 bytes [48, B8, 90, F1, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3172] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 000000007743c088 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3172] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 000000007743caf0 7 bytes [48, B8, 60, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3172] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8 000000007743caf8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3172] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 000000007743cb40 7 bytes [48, B8, 9C, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3172] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8 000000007743cb48 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3172] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 000000007743cc90 7 bytes [48, B8, 28, F4, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3172] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8 000000007743cc98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007743bc00 7 bytes [48, B8, 68, F4, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8 000000007743bc08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 000000007743bd70 7 bytes [48, B8, C0, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8 000000007743bd78 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 000000007743bd90 7 bytes [48, B8, 3C, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 000000007743bd98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 000000007743bda0 7 bytes [48, B8, 3C, F4, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8 000000007743bda8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007743bdb0 7 bytes [48, B8, 48, F2, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 000000007743bdb8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 000000007743bdd0 7 bytes [48, B8, 8C, F4, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 000000007743bdd8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 000000007743be20 7 bytes [48, B8, E4, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8 000000007743be28 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 000000007743be30 7 bytes [48, B8, 78, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8 000000007743be38 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 000000007743be60 7 bytes [48, B8, CC, F2, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8 000000007743be68 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 000000007743bf00 7 bytes [48, B8, 14, F4, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8 000000007743bf08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 000000007743c080 7 bytes [48, B8, 90, F1, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 000000007743c088 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 000000007743caf0 7 bytes [48, B8, 60, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8 000000007743caf8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 000000007743cb40 7 bytes [48, B8, 9C, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8 000000007743cb48 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 000000007743cc90 7 bytes [48, B8, 28, F4, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8 000000007743cc98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7284] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007743bc00 7 bytes [48, B8, 68, F4, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7284] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8 000000007743bc08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 000000007743bd70 7 bytes [48, B8, C0, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8 000000007743bd78 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 000000007743bd90 7 bytes [48, B8, 3C, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 000000007743bd98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7284] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 000000007743bda0 7 bytes [48, B8, 3C, F4, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7284] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8 000000007743bda8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7284] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007743bdb0 7 bytes [48, B8, 48, F2, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7284] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 000000007743bdb8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7284] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 000000007743bdd0 7 bytes [48, B8, 8C, F4, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7284] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 000000007743bdd8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 000000007743be20 7 bytes [48, B8, E4, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8 000000007743be28 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 000000007743be30 7 bytes [48, B8, 78, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8 000000007743be38 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 000000007743be60 7 bytes [48, B8, CC, F2, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8 000000007743be68 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7284] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 000000007743bf00 7 bytes [48, B8, 14, F4, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7284] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8 000000007743bf08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7284] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 000000007743c080 7 bytes [48, B8, 90, F1, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7284] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 000000007743c088 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 000000007743caf0 7 bytes [48, B8, 60, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8 000000007743caf8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 000000007743cb40 7 bytes [48, B8, 9C, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8 000000007743cb48 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7284] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 000000007743cc90 7 bytes [48, B8, 28, F4, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7284] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8 000000007743cc98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8164] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007743bc00 7 bytes [48, B8, 68, F4, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8164] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8 000000007743bc08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 000000007743bd70 7 bytes [48, B8, C0, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8 000000007743bd78 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 000000007743bd90 7 bytes [48, B8, 3C, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 000000007743bd98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8164] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 000000007743bda0 7 bytes [48, B8, 3C, F4, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8164] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8 000000007743bda8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8164] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007743bdb0 7 bytes [48, B8, 48, F2, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8164] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 000000007743bdb8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8164] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 000000007743bdd0 7 bytes [48, B8, 8C, F4, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8164] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 000000007743bdd8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 000000007743be20 7 bytes [48, B8, E4, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8 000000007743be28 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 000000007743be30 7 bytes [48, B8, 78, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8 000000007743be38 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 000000007743be60 7 bytes [48, B8, CC, F2, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8 000000007743be68 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8164] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 000000007743bf00 7 bytes [48, B8, 14, F4, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8164] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8 000000007743bf08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8164] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 000000007743c080 7 bytes [48, B8, 90, F1, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8164] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 000000007743c088 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 000000007743caf0 7 bytes [48, B8, 60, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8 000000007743caf8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 000000007743cb40 7 bytes [48, B8, 9C, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8 000000007743cb48 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8164] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 000000007743cc90 7 bytes [48, B8, 28, F4, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8164] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8 000000007743cc98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6436] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007743bc00 7 bytes [48, B8, 68, F4, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6436] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8 000000007743bc08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6436] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 000000007743bd70 7 bytes [48, B8, C0, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6436] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8 000000007743bd78 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6436] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 000000007743bd90 7 bytes [48, B8, 3C, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6436] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 000000007743bd98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6436] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 000000007743bda0 7 bytes [48, B8, 3C, F4, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6436] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8 000000007743bda8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6436] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007743bdb0 7 bytes [48, B8, 48, F2, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6436] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 000000007743bdb8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6436] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 000000007743bdd0 7 bytes [48, B8, 8C, F4, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6436] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 000000007743bdd8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6436] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 000000007743be20 7 bytes [48, B8, E4, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6436] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8 000000007743be28 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6436] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 000000007743be30 7 bytes [48, B8, 78, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6436] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8 000000007743be38 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6436] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 000000007743be60 7 bytes [48, B8, CC, F2, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6436] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8 000000007743be68 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6436] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 000000007743bf00 7 bytes [48, B8, 14, F4, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6436] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8 000000007743bf08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6436] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 000000007743c080 7 bytes [48, B8, 90, F1, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6436] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 000000007743c088 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6436] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 000000007743caf0 7 bytes [48, B8, 60, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6436] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8 000000007743caf8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6436] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 000000007743cb40 7 bytes [48, B8, 9C, F3, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6436] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8 000000007743cb48 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6436] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 000000007743cc90 7 bytes [48, B8, 28, F4, 80, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6436] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8 000000007743cc98 6 bytes {ADD [RAX], AL; JMP RAX} ---- User IAT/EAT - GMER 2.2 ---- IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8128] @ C:\Windows\system32\dwrite.dll[ADVAPI32.dll!OpenServiceW] [7fed8fd6880] C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8128] @ C:\Windows\system32\dwrite.dll[ADVAPI32.dll!CloseServiceHandle] [7fed8fd5fc4] C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8128] @ C:\Windows\system32\dwrite.dll[ADVAPI32.dll!OpenSCManagerW] [7fed8fd6868] C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8128] @ C:\Windows\system32\dwrite.dll[ADVAPI32.dll!StartServiceW] [7fed8fd6ca4] C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8128] @ C:\Windows\system32\dwrite.dll[ntdll.dll!NtAlpcConnectPort] [7fed8fd6860] C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7280] @ C:\Windows\system32\dwrite.dll[ADVAPI32.dll!OpenServiceW] [7fed8fd6880] C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7280] @ C:\Windows\system32\dwrite.dll[ADVAPI32.dll!CloseServiceHandle] [7fed8fd5fc4] C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7280] @ C:\Windows\system32\dwrite.dll[ADVAPI32.dll!OpenSCManagerW] [7fed8fd6868] C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7280] @ C:\Windows\system32\dwrite.dll[ADVAPI32.dll!StartServiceW] [7fed8fd6ca4] C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7280] @ C:\Windows\system32\dwrite.dll[ntdll.dll!NtAlpcConnectPort] [7fed8fd6860] C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3172] @ C:\Windows\system32\dwrite.dll[ADVAPI32.dll!OpenServiceW] [7fed8fd6880] C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3172] @ C:\Windows\system32\dwrite.dll[ADVAPI32.dll!CloseServiceHandle] [7fed8fd5fc4] C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3172] @ C:\Windows\system32\dwrite.dll[ADVAPI32.dll!OpenSCManagerW] [7fed8fd6868] C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3172] @ C:\Windows\system32\dwrite.dll[ADVAPI32.dll!StartServiceW] [7fed8fd6ca4] C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3172] @ C:\Windows\system32\dwrite.dll[ntdll.dll!NtAlpcConnectPort] [7fed8fd6860] C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7808] @ C:\Windows\system32\dwrite.dll[ADVAPI32.dll!OpenServiceW] [7fed8fd6880] C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7808] @ C:\Windows\system32\dwrite.dll[ADVAPI32.dll!CloseServiceHandle] [7fed8fd5fc4] C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7808] @ C:\Windows\system32\dwrite.dll[ADVAPI32.dll!OpenSCManagerW] [7fed8fd6868] C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7808] @ C:\Windows\system32\dwrite.dll[ADVAPI32.dll!StartServiceW] [7fed8fd6ca4] C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7808] @ C:\Windows\system32\dwrite.dll[ntdll.dll!NtAlpcConnectPort] [7fed8fd6860] C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7284] @ C:\Windows\system32\dwrite.dll[ADVAPI32.dll!OpenServiceW] [7fed8fd6880] C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7284] @ C:\Windows\system32\dwrite.dll[ADVAPI32.dll!CloseServiceHandle] [7fed8fd5fc4] C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7284] @ C:\Windows\system32\dwrite.dll[ADVAPI32.dll!OpenSCManagerW] [7fed8fd6868] C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7284] @ C:\Windows\system32\dwrite.dll[ADVAPI32.dll!StartServiceW] [7fed8fd6ca4] C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7284] @ C:\Windows\system32\dwrite.dll[ntdll.dll!NtAlpcConnectPort] [7fed8fd6860] C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8164] @ C:\Windows\system32\dwrite.dll[ADVAPI32.dll!OpenServiceW] [7fed8fd6880] C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8164] @ C:\Windows\system32\dwrite.dll[ADVAPI32.dll!CloseServiceHandle] [7fed8fd5fc4] C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8164] @ C:\Windows\system32\dwrite.dll[ADVAPI32.dll!OpenSCManagerW] [7fed8fd6868] C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8164] @ C:\Windows\system32\dwrite.dll[ADVAPI32.dll!StartServiceW] [7fed8fd6ca4] C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8164] @ C:\Windows\system32\dwrite.dll[ntdll.dll!NtAlpcConnectPort] [7fed8fd6860] C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6436] @ C:\Windows\system32\dwrite.dll[ADVAPI32.dll!OpenServiceW] [7fed8fd6880] C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6436] @ C:\Windows\system32\dwrite.dll[ADVAPI32.dll!CloseServiceHandle] [7fed8fd5fc4] C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6436] @ C:\Windows\system32\dwrite.dll[ADVAPI32.dll!OpenSCManagerW] [7fed8fd6868] C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6436] @ C:\Windows\system32\dwrite.dll[ADVAPI32.dll!StartServiceW] [7fed8fd6ca4] C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[6436] @ C:\Windows\system32\dwrite.dll[ntdll.dll!NtAlpcConnectPort] [7fed8fd6860] C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\chrome_child.dll ---- Registry - GMER 2.2 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\50b7c3bc8e22 Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\50b7c3bc8e22 (not active ControlSet) ---- Files - GMER 2.2 ---- File C:\Users\Szymon\AppData\Local\Google\Chrome\User Data\Default\Cache\f_0000e1 16948 bytes ---- EOF - GMER 2.2 ----