GMER 2.2.19882 - http://www.gmer.net Rootkit scan 2016-10-24 14:30:12 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP1T0L0-1 INTENSO_SSD_128GB rev.O0213E 119,24GB Running: wfjdcgwn.exe; Driver: C:\Users\Damian\AppData\Local\Temp\uxdirpod.sys ---- User code sections - GMER 2.2 ---- .text C:\Windows\system32\PnkBstrA.exe[3752] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076f41401 2 bytes JMP 75fdb263 C:\Windows\syswow64\kernel32.dll .text C:\Windows\system32\PnkBstrA.exe[3752] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076f41419 2 bytes JMP 75fdb38e C:\Windows\syswow64\kernel32.dll .text C:\Windows\system32\PnkBstrA.exe[3752] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076f41431 2 bytes JMP 760590f1 C:\Windows\syswow64\kernel32.dll .text C:\Windows\system32\PnkBstrA.exe[3752] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000076f4144a 2 bytes CALL 75fb48ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Windows\system32\PnkBstrA.exe[3752] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000076f414dd 2 bytes JMP 760589ea C:\Windows\syswow64\kernel32.dll .text C:\Windows\system32\PnkBstrA.exe[3752] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000076f414f5 2 bytes JMP 76058bc0 C:\Windows\syswow64\kernel32.dll .text C:\Windows\system32\PnkBstrA.exe[3752] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000076f4150d 2 bytes JMP 760588e0 C:\Windows\syswow64\kernel32.dll .text C:\Windows\system32\PnkBstrA.exe[3752] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076f41525 2 bytes JMP 76058caa C:\Windows\syswow64\kernel32.dll .text C:\Windows\system32\PnkBstrA.exe[3752] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000076f4153d 2 bytes JMP 75fcfce8 C:\Windows\syswow64\kernel32.dll .text C:\Windows\system32\PnkBstrA.exe[3752] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076f41555 2 bytes JMP 75fd6937 C:\Windows\syswow64\kernel32.dll .text C:\Windows\system32\PnkBstrA.exe[3752] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000076f4156d 2 bytes JMP 760591a9 C:\Windows\syswow64\kernel32.dll .text C:\Windows\system32\PnkBstrA.exe[3752] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076f41585 2 bytes JMP 76058d0a C:\Windows\syswow64\kernel32.dll .text C:\Windows\system32\PnkBstrA.exe[3752] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000076f4159d 2 bytes JMP 760588a4 C:\Windows\syswow64\kernel32.dll .text C:\Windows\system32\PnkBstrA.exe[3752] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000076f415b5 2 bytes JMP 75fcfd81 C:\Windows\syswow64\kernel32.dll .text C:\Windows\system32\PnkBstrA.exe[3752] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000076f415cd 2 bytes JMP 75fdb324 C:\Windows\syswow64\kernel32.dll .text C:\Windows\system32\PnkBstrA.exe[3752] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000076f416b2 2 bytes JMP 7605906c C:\Windows\syswow64\kernel32.dll .text C:\Windows\system32\PnkBstrA.exe[3752] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000076f416bd 2 bytes JMP 76058839 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1996] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00000000777bbdb0 14 bytes {MOV RAX, 0x7feef4d8d54; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00000000777bbc00 7 bytes [48, B8, FC, 0E, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8 00000000777bbc08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 00000000777bbd70 7 bytes [48, B8, 70, 0F, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8 00000000777bbd78 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000777bbd90 7 bytes [48, B8, 1C, 13, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 00000000777bbd98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 00000000777bbda0 7 bytes [48, B8, 20, 11, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8 00000000777bbda8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00000000777bbdb0 7 bytes [48, B8, E0, 0D, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 00000000777bbdb8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 00000000777bbdd0 7 bytes [48, B8, 4C, 0E, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 00000000777bbdd8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 00000000777bbe20 7 bytes [48, B8, E0, 0F, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8 00000000777bbe28 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 00000000777bbe30 7 bytes [48, B8, 58, 13, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8 00000000777bbe38 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00000000777bbe60 7 bytes [48, B8, C4, 10, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8 00000000777bbe68 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 00000000777bbf00 7 bytes [48, B8, F8, 10, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8 00000000777bbf08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00000000777bc080 7 bytes [48, B8, 50, 10, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 00000000777bc088 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 00000000777bcaf0 7 bytes [48, B8, 40, 13, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8 00000000777bcaf8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000777bcb40 7 bytes [48, B8, F8, 12, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8 00000000777bcb48 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 00000000777bcc90 7 bytes [48, B8, 0C, 11, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3284] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8 00000000777bcc98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4968] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00000000777bbc00 7 bytes [48, B8, FC, 0E, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4968] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8 00000000777bbc08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 00000000777bbd70 7 bytes [48, B8, 70, 0F, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8 00000000777bbd78 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000777bbd90 7 bytes [48, B8, 1C, 13, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 00000000777bbd98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4968] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 00000000777bbda0 7 bytes [48, B8, 20, 11, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4968] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8 00000000777bbda8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4968] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00000000777bbdb0 7 bytes [48, B8, E0, 0D, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4968] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 00000000777bbdb8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4968] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 00000000777bbdd0 7 bytes [48, B8, 4C, 0E, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4968] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 00000000777bbdd8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 00000000777bbe20 7 bytes [48, B8, E0, 0F, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8 00000000777bbe28 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 00000000777bbe30 7 bytes [48, B8, 58, 13, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8 00000000777bbe38 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00000000777bbe60 7 bytes [48, B8, C4, 10, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8 00000000777bbe68 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4968] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 00000000777bbf00 7 bytes [48, B8, F8, 10, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4968] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8 00000000777bbf08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4968] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00000000777bc080 7 bytes [48, B8, 50, 10, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4968] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 00000000777bc088 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 00000000777bcaf0 7 bytes [48, B8, 40, 13, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8 00000000777bcaf8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000777bcb40 7 bytes [48, B8, F8, 12, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8 00000000777bcb48 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4968] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 00000000777bcc90 7 bytes [48, B8, 0C, 11, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4968] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8 00000000777bcc98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4148] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00000000777bbc00 7 bytes [48, B8, FC, 0E, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4148] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8 00000000777bbc08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 00000000777bbd70 7 bytes [48, B8, 70, 0F, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8 00000000777bbd78 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000777bbd90 7 bytes [48, B8, 1C, 13, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 00000000777bbd98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4148] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 00000000777bbda0 7 bytes [48, B8, 20, 11, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4148] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8 00000000777bbda8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4148] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00000000777bbdb0 7 bytes [48, B8, E0, 0D, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4148] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 00000000777bbdb8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4148] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 00000000777bbdd0 7 bytes [48, B8, 4C, 0E, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4148] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 00000000777bbdd8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 00000000777bbe20 7 bytes [48, B8, E0, 0F, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8 00000000777bbe28 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 00000000777bbe30 7 bytes [48, B8, 58, 13, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8 00000000777bbe38 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00000000777bbe60 7 bytes [48, B8, C4, 10, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8 00000000777bbe68 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4148] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 00000000777bbf00 7 bytes [48, B8, F8, 10, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4148] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8 00000000777bbf08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4148] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00000000777bc080 7 bytes [48, B8, 50, 10, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4148] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 00000000777bc088 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 00000000777bcaf0 7 bytes [48, B8, 40, 13, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8 00000000777bcaf8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000777bcb40 7 bytes [48, B8, F8, 12, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8 00000000777bcb48 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4148] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 00000000777bcc90 7 bytes [48, B8, 0C, 11, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4148] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8 00000000777bcc98 6 bytes {ADD [RAX], AL; JMP RAX} .text D:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[4100] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076f41401 2 bytes JMP 75fdb263 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[4100] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076f41419 2 bytes JMP 75fdb38e C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[4100] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076f41431 2 bytes JMP 760590f1 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[4100] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000076f4144a 2 bytes CALL 75fb48ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text D:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[4100] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000076f414dd 2 bytes JMP 760589ea C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[4100] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000076f414f5 2 bytes JMP 76058bc0 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[4100] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000076f4150d 2 bytes JMP 760588e0 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[4100] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076f41525 2 bytes JMP 76058caa C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[4100] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000076f4153d 2 bytes JMP 75fcfce8 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[4100] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076f41555 2 bytes JMP 75fd6937 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[4100] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000076f4156d 2 bytes JMP 760591a9 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[4100] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076f41585 2 bytes JMP 76058d0a C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[4100] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000076f4159d 2 bytes JMP 760588a4 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[4100] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000076f415b5 2 bytes JMP 75fcfd81 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[4100] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000076f415cd 2 bytes JMP 75fdb324 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[4100] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000076f416b2 2 bytes JMP 7605906c C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[4100] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000076f416bd 2 bytes JMP 76058839 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.1.30\deploy\LoLLauncher.exe[4520] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076f41401 2 bytes JMP 75fdb263 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.1.30\deploy\LoLLauncher.exe[4520] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076f41419 2 bytes JMP 75fdb38e C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.1.30\deploy\LoLLauncher.exe[4520] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076f41431 2 bytes JMP 760590f1 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.1.30\deploy\LoLLauncher.exe[4520] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000076f4144a 2 bytes CALL 75fb48ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text D:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.1.30\deploy\LoLLauncher.exe[4520] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000076f414dd 2 bytes JMP 760589ea C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.1.30\deploy\LoLLauncher.exe[4520] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000076f414f5 2 bytes JMP 76058bc0 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.1.30\deploy\LoLLauncher.exe[4520] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000076f4150d 2 bytes JMP 760588e0 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.1.30\deploy\LoLLauncher.exe[4520] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076f41525 2 bytes JMP 76058caa C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.1.30\deploy\LoLLauncher.exe[4520] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000076f4153d 2 bytes JMP 75fcfce8 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.1.30\deploy\LoLLauncher.exe[4520] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076f41555 2 bytes JMP 75fd6937 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.1.30\deploy\LoLLauncher.exe[4520] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000076f4156d 2 bytes JMP 760591a9 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.1.30\deploy\LoLLauncher.exe[4520] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076f41585 2 bytes JMP 76058d0a C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.1.30\deploy\LoLLauncher.exe[4520] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000076f4159d 2 bytes JMP 760588a4 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.1.30\deploy\LoLLauncher.exe[4520] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000076f415b5 2 bytes JMP 75fcfd81 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.1.30\deploy\LoLLauncher.exe[4520] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000076f415cd 2 bytes JMP 75fdb324 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.1.30\deploy\LoLLauncher.exe[4520] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000076f416b2 2 bytes JMP 7605906c C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.1.30\deploy\LoLLauncher.exe[4520] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000076f416bd 2 bytes JMP 76058839 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.70\deploy\LoLPatcher.exe[4428] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000075fb8791 5 bytes [33, C0, C2, 04, 00] .text D:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.70\deploy\LoLPatcher.exe[4428] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076f41401 2 bytes JMP 75fdb263 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.70\deploy\LoLPatcher.exe[4428] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076f41419 2 bytes JMP 75fdb38e C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.70\deploy\LoLPatcher.exe[4428] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076f41431 2 bytes JMP 760590f1 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.70\deploy\LoLPatcher.exe[4428] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000076f4144a 2 bytes CALL 75fb48ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text D:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.70\deploy\LoLPatcher.exe[4428] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000076f414dd 2 bytes JMP 760589ea C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.70\deploy\LoLPatcher.exe[4428] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000076f414f5 2 bytes JMP 76058bc0 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.70\deploy\LoLPatcher.exe[4428] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000076f4150d 2 bytes JMP 760588e0 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.70\deploy\LoLPatcher.exe[4428] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076f41525 2 bytes JMP 76058caa C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.70\deploy\LoLPatcher.exe[4428] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000076f4153d 2 bytes JMP 75fcfce8 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.70\deploy\LoLPatcher.exe[4428] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076f41555 2 bytes JMP 75fd6937 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.70\deploy\LoLPatcher.exe[4428] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000076f4156d 2 bytes JMP 760591a9 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.70\deploy\LoLPatcher.exe[4428] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076f41585 2 bytes JMP 76058d0a C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.70\deploy\LoLPatcher.exe[4428] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000076f4159d 2 bytes JMP 760588a4 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.70\deploy\LoLPatcher.exe[4428] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000076f415b5 2 bytes JMP 75fcfd81 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.70\deploy\LoLPatcher.exe[4428] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000076f415cd 2 bytes JMP 75fdb324 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.70\deploy\LoLPatcher.exe[4428] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000076f416b2 2 bytes JMP 7605906c C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.70\deploy\LoLPatcher.exe[4428] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000076f416bd 2 bytes JMP 76058839 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.226\deploy\LolClient.exe[4300] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076f41401 2 bytes JMP 75fdb263 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.226\deploy\LolClient.exe[4300] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076f41419 2 bytes JMP 75fdb38e C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.226\deploy\LolClient.exe[4300] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076f41431 2 bytes JMP 760590f1 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.226\deploy\LolClient.exe[4300] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000076f4144a 2 bytes CALL 75fb48ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text D:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.226\deploy\LolClient.exe[4300] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000076f414dd 2 bytes JMP 760589ea C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.226\deploy\LolClient.exe[4300] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000076f414f5 2 bytes JMP 76058bc0 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.226\deploy\LolClient.exe[4300] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000076f4150d 2 bytes JMP 760588e0 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.226\deploy\LolClient.exe[4300] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076f41525 2 bytes JMP 76058caa C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.226\deploy\LolClient.exe[4300] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000076f4153d 2 bytes JMP 75fcfce8 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.226\deploy\LolClient.exe[4300] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076f41555 2 bytes JMP 75fd6937 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.226\deploy\LolClient.exe[4300] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000076f4156d 2 bytes JMP 760591a9 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.226\deploy\LolClient.exe[4300] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076f41585 2 bytes JMP 76058d0a C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.226\deploy\LolClient.exe[4300] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000076f4159d 2 bytes JMP 760588a4 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.226\deploy\LolClient.exe[4300] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000076f415b5 2 bytes JMP 75fcfd81 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.226\deploy\LolClient.exe[4300] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000076f415cd 2 bytes JMP 75fdb324 C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.226\deploy\LolClient.exe[4300] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000076f416b2 2 bytes JMP 7605906c C:\Windows\syswow64\kernel32.dll .text D:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.226\deploy\LolClient.exe[4300] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000076f416bd 2 bytes JMP 76058839 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4108] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00000000777bbc00 7 bytes [48, B8, FC, 0E, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4108] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8 00000000777bbc08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4108] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 00000000777bbd70 7 bytes [48, B8, 70, 0F, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4108] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8 00000000777bbd78 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4108] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000777bbd90 7 bytes [48, B8, 1C, 13, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4108] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 00000000777bbd98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4108] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 00000000777bbda0 7 bytes [48, B8, 20, 11, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4108] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8 00000000777bbda8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4108] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00000000777bbdb0 7 bytes [48, B8, E0, 0D, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4108] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 00000000777bbdb8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4108] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 00000000777bbdd0 7 bytes [48, B8, 4C, 0E, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4108] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 00000000777bbdd8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4108] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 00000000777bbe20 7 bytes [48, B8, E0, 0F, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4108] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8 00000000777bbe28 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4108] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 00000000777bbe30 7 bytes [48, B8, 58, 13, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4108] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8 00000000777bbe38 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4108] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00000000777bbe60 7 bytes [48, B8, C4, 10, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4108] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8 00000000777bbe68 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4108] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 00000000777bbf00 7 bytes [48, B8, F8, 10, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4108] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8 00000000777bbf08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4108] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00000000777bc080 7 bytes [48, B8, 50, 10, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4108] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 00000000777bc088 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4108] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 00000000777bcaf0 7 bytes [48, B8, 40, 13, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4108] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8 00000000777bcaf8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4108] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000777bcb40 7 bytes [48, B8, F8, 12, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4108] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8 00000000777bcb48 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4108] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 00000000777bcc90 7 bytes [48, B8, 0C, 11, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4108] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8 00000000777bcc98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00000000777bbc00 7 bytes [48, B8, FC, 0E, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8 00000000777bbc08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 00000000777bbd70 7 bytes [48, B8, 70, 0F, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8 00000000777bbd78 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000777bbd90 7 bytes [48, B8, 1C, 13, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 00000000777bbd98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 00000000777bbda0 7 bytes [48, B8, 20, 11, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8 00000000777bbda8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00000000777bbdb0 7 bytes [48, B8, E0, 0D, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 00000000777bbdb8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 00000000777bbdd0 7 bytes [48, B8, 4C, 0E, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 00000000777bbdd8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 00000000777bbe20 7 bytes [48, B8, E0, 0F, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8 00000000777bbe28 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 00000000777bbe30 7 bytes [48, B8, 58, 13, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8 00000000777bbe38 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00000000777bbe60 7 bytes [48, B8, C4, 10, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8 00000000777bbe68 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 00000000777bbf00 7 bytes [48, B8, F8, 10, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8 00000000777bbf08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00000000777bc080 7 bytes [48, B8, 50, 10, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 00000000777bc088 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 00000000777bcaf0 7 bytes [48, B8, 40, 13, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8 00000000777bcaf8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000777bcb40 7 bytes [48, B8, F8, 12, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8 00000000777bcb48 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 00000000777bcc90 7 bytes [48, B8, 0C, 11, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8 00000000777bcc98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00000000777bbc00 7 bytes [48, B8, FC, 0E, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8 00000000777bbc08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 00000000777bbd70 7 bytes [48, B8, 70, 0F, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8 00000000777bbd78 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000777bbd90 7 bytes [48, B8, 1C, 13, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 00000000777bbd98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 00000000777bbda0 7 bytes [48, B8, 20, 11, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8 00000000777bbda8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00000000777bbdb0 7 bytes [48, B8, E0, 0D, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 00000000777bbdb8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 00000000777bbdd0 7 bytes [48, B8, 4C, 0E, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 00000000777bbdd8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 00000000777bbe20 7 bytes [48, B8, E0, 0F, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8 00000000777bbe28 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 00000000777bbe30 7 bytes [48, B8, 58, 13, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8 00000000777bbe38 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00000000777bbe60 7 bytes [48, B8, C4, 10, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8 00000000777bbe68 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 00000000777bbf00 7 bytes [48, B8, F8, 10, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8 00000000777bbf08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00000000777bc080 7 bytes [48, B8, 50, 10, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 00000000777bc088 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 00000000777bcaf0 7 bytes [48, B8, 40, 13, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8 00000000777bcaf8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000777bcb40 7 bytes [48, B8, F8, 12, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8 00000000777bcb48 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 00000000777bcc90 7 bytes [48, B8, 0C, 11, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8 00000000777bcc98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3720] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00000000777bbc00 7 bytes [48, B8, FC, 0E, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3720] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8 00000000777bbc08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3720] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 00000000777bbd70 7 bytes [48, B8, 70, 0F, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3720] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8 00000000777bbd78 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3720] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000777bbd90 7 bytes [48, B8, 1C, 13, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3720] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 00000000777bbd98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3720] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 00000000777bbda0 7 bytes [48, B8, 20, 11, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3720] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8 00000000777bbda8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3720] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00000000777bbdb0 7 bytes [48, B8, E0, 0D, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3720] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 00000000777bbdb8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3720] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 00000000777bbdd0 7 bytes [48, B8, 4C, 0E, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3720] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 00000000777bbdd8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3720] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 00000000777bbe20 7 bytes [48, B8, E0, 0F, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3720] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8 00000000777bbe28 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3720] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 00000000777bbe30 7 bytes [48, B8, 58, 13, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3720] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8 00000000777bbe38 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3720] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00000000777bbe60 7 bytes [48, B8, C4, 10, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3720] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8 00000000777bbe68 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3720] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 00000000777bbf00 7 bytes [48, B8, F8, 10, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3720] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8 00000000777bbf08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3720] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00000000777bc080 7 bytes [48, B8, 50, 10, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3720] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 00000000777bc088 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3720] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 00000000777bcaf0 7 bytes [48, B8, 40, 13, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3720] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8 00000000777bcaf8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3720] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000777bcb40 7 bytes [48, B8, F8, 12, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3720] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8 00000000777bcb48 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3720] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 00000000777bcc90 7 bytes [48, B8, 0C, 11, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3720] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8 00000000777bcc98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2468] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00000000777bbc00 7 bytes [48, B8, FC, 0E, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2468] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8 00000000777bbc08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 00000000777bbd70 7 bytes [48, B8, 70, 0F, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8 00000000777bbd78 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000777bbd90 7 bytes [48, B8, 1C, 13, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 00000000777bbd98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2468] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 00000000777bbda0 7 bytes [48, B8, 20, 11, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2468] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8 00000000777bbda8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2468] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00000000777bbdb0 7 bytes [48, B8, E0, 0D, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2468] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 00000000777bbdb8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2468] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 00000000777bbdd0 7 bytes [48, B8, 4C, 0E, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2468] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 00000000777bbdd8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 00000000777bbe20 7 bytes [48, B8, E0, 0F, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8 00000000777bbe28 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 00000000777bbe30 7 bytes [48, B8, 58, 13, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8 00000000777bbe38 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00000000777bbe60 7 bytes [48, B8, C4, 10, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8 00000000777bbe68 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2468] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 00000000777bbf00 7 bytes [48, B8, F8, 10, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2468] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8 00000000777bbf08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2468] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00000000777bc080 7 bytes [48, B8, 50, 10, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2468] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 00000000777bc088 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 00000000777bcaf0 7 bytes [48, B8, 40, 13, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8 00000000777bcaf8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000777bcb40 7 bytes [48, B8, F8, 12, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8 00000000777bcb48 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2468] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 00000000777bcc90 7 bytes [48, B8, 0C, 11, BC, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2468] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8 00000000777bcc98 6 bytes {ADD [RAX], AL; JMP RAX} ---- User IAT/EAT - GMER 2.2 ---- IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4968] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenServiceW] [7fee4206778] C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.59\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4968] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!CloseServiceHandle] [7fee4206000] C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.59\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4968] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenSCManagerW] [7fee4206760] C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.59\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4968] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!StartServiceW] [7fee42069b4] C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.59\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4968] @ C:\Windows\system32\DWrite.dll[ntdll.dll!NtAlpcConnectPort] [7fee33b9354] C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.59\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4148] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenServiceW] [7fee4206778] C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.59\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4148] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!CloseServiceHandle] [7fee4206000] C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.59\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4148] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenSCManagerW] [7fee4206760] C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.59\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4148] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!StartServiceW] [7fee42069b4] C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.59\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4148] @ C:\Windows\system32\DWrite.dll[ntdll.dll!NtAlpcConnectPort] [7fee33b9354] C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.59\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4108] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenServiceW] [7fee4206778] C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.59\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4108] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!CloseServiceHandle] [7fee4206000] C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.59\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4108] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenSCManagerW] [7fee4206760] C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.59\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4108] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!StartServiceW] [7fee42069b4] C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.59\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4108] @ C:\Windows\system32\DWrite.dll[ntdll.dll!NtAlpcConnectPort] [7fee33b9354] C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.59\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1416] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenServiceW] [7fee4206778] C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.59\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1416] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!CloseServiceHandle] [7fee4206000] C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.59\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1416] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenSCManagerW] [7fee4206760] C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.59\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1416] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!StartServiceW] [7fee42069b4] C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.59\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1416] @ C:\Windows\system32\DWrite.dll[ntdll.dll!NtAlpcConnectPort] [7fee33b9354] C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.59\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenServiceW] [7fee4206778] C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.59\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!CloseServiceHandle] [7fee4206000] C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.59\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenSCManagerW] [7fee4206760] C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.59\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!StartServiceW] [7fee42069b4] C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.59\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] @ C:\Windows\system32\DWrite.dll[ntdll.dll!NtAlpcConnectPort] [7fee33b9354] C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.59\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3720] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenServiceW] [7fee4206778] C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.59\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3720] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!CloseServiceHandle] [7fee4206000] C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.59\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3720] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenSCManagerW] [7fee4206760] C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.59\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3720] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!StartServiceW] [7fee42069b4] C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.59\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3720] @ C:\Windows\system32\DWrite.dll[ntdll.dll!NtAlpcConnectPort] [7fee33b9354] C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.59\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2468] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenServiceW] [7fee4206778] C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.59\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2468] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!CloseServiceHandle] [7fee4206000] C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.59\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2468] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenSCManagerW] [7fee4206760] C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.59\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2468] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!StartServiceW] [7fee42069b4] C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.59\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2468] @ C:\Windows\system32\DWrite.dll[ntdll.dll!NtAlpcConnectPort] [7fee33b9354] C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.59\chrome_child.dll ---- Processes - GMER 2.2 ---- Library C:\Users\Damian\Downloads\FRST64.exe (*** suspicious ***) @ C:\Users\Damian\Downloads\FRST64.exe [3112] 000000013fad0000 ---- Registry - GMER 2.2 ---- Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts@C:\Users\Damian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GOG.com\WiedŸmin 3\xae - Dziki Gon\WiedŸmin 3\xae - Dziki Gon.lnk 1 Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts@C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com\WiedŸmin 3\xae - Dziki Gon\WiedŸmin 3\xae - Dziki Gon.lnk 1 Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts@C:\Users\Damian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GOG.com\WiedŸmin 3\xae - Dziki Gon\Usuñ WiedŸmin 3\xae - Dziki Gon.lnk 1 Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts@C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com\WiedŸmin 3\xae - Dziki Gon\Usuñ WiedŸmin 3\xae - Dziki Gon.lnk 1 ---- Files - GMER 2.2 ---- File C:\Users\Damian\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Cache\f_0028f9 0 bytes ---- EOF - GMER 2.2 ----