GMER 2.2.19882 - http://www.gmer.net Rootkit scan 2018-01-29 18:47:22 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 WDC_WD1600AAJS-75M0A0 rev.02.03E02 149,01GB Running: gmer.exe; Driver: C:\Users\Admin\AppData\Local\Temp\uwrdakob.sys ---- User code sections - GMER 2.2 ---- .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[2532] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075011401 2 bytes JMP 7530b233 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[2532] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075011419 2 bytes JMP 7530b35e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[2532] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075011431 2 bytes JMP 75389149 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[2532] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007501144a 2 bytes CALL 752e4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[2532] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000750114dd 2 bytes JMP 75388a42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[2532] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000750114f5 2 bytes JMP 75388c18 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[2532] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007501150d 2 bytes JMP 75388938 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[2532] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075011525 2 bytes JMP 75388d02 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[2532] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007501153d 2 bytes JMP 752ffcc0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[2532] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075011555 2 bytes JMP 75306907 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[2532] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007501156d 2 bytes JMP 75389201 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[2532] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075011585 2 bytes JMP 75388d62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[2532] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007501159d 2 bytes JMP 753888fc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[2532] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000750115b5 2 bytes JMP 752ffd59 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[2532] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000750115cd 2 bytes JMP 7530b2f4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[2532] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000750116b2 2 bytes JMP 753890c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[2532] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000750116bd 2 bytes JMP 75388891 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TeamSpeak 3 Client\ts3client_win32.exe[3852] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075011401 2 bytes JMP 7530b233 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TeamSpeak 3 Client\ts3client_win32.exe[3852] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075011419 2 bytes JMP 7530b35e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TeamSpeak 3 Client\ts3client_win32.exe[3852] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075011431 2 bytes JMP 75389149 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TeamSpeak 3 Client\ts3client_win32.exe[3852] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007501144a 2 bytes CALL 752e4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\TeamSpeak 3 Client\ts3client_win32.exe[3852] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000750114dd 2 bytes JMP 75388a42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TeamSpeak 3 Client\ts3client_win32.exe[3852] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000750114f5 2 bytes JMP 75388c18 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TeamSpeak 3 Client\ts3client_win32.exe[3852] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007501150d 2 bytes JMP 75388938 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TeamSpeak 3 Client\ts3client_win32.exe[3852] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075011525 2 bytes JMP 75388d02 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TeamSpeak 3 Client\ts3client_win32.exe[3852] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007501153d 2 bytes JMP 752ffcc0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TeamSpeak 3 Client\ts3client_win32.exe[3852] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075011555 2 bytes JMP 75306907 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TeamSpeak 3 Client\ts3client_win32.exe[3852] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007501156d 2 bytes JMP 75389201 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TeamSpeak 3 Client\ts3client_win32.exe[3852] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075011585 2 bytes JMP 75388d62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TeamSpeak 3 Client\ts3client_win32.exe[3852] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007501159d 2 bytes JMP 753888fc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TeamSpeak 3 Client\ts3client_win32.exe[3852] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000750115b5 2 bytes JMP 752ffd59 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TeamSpeak 3 Client\ts3client_win32.exe[3852] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000750115cd 2 bytes JMP 7530b2f4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TeamSpeak 3 Client\ts3client_win32.exe[3852] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000750116b2 2 bytes JMP 753890c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TeamSpeak 3 Client\ts3client_win32.exe[3852] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000750116bd 2 bytes JMP 75388891 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[428] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075011401 2 bytes JMP 7530b233 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[428] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075011419 2 bytes JMP 7530b35e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[428] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075011431 2 bytes JMP 75389149 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[428] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007501144a 2 bytes CALL 752e4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[428] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000750114dd 2 bytes JMP 75388a42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[428] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000750114f5 2 bytes JMP 75388c18 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[428] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007501150d 2 bytes JMP 75388938 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[428] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075011525 2 bytes JMP 75388d02 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[428] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007501153d 2 bytes JMP 752ffcc0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[428] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075011555 2 bytes JMP 75306907 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[428] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007501156d 2 bytes JMP 75389201 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[428] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075011585 2 bytes JMP 75388d62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[428] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007501159d 2 bytes JMP 753888fc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[428] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000750115b5 2 bytes JMP 752ffd59 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[428] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000750115cd 2 bytes JMP 7530b2f4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[428] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000750116b2 2 bytes JMP 753890c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[428] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000750116bd 2 bytes JMP 75388891 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[372] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075011401 2 bytes JMP 7530b233 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[372] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075011419 2 bytes JMP 7530b35e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[372] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075011431 2 bytes JMP 75389149 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[372] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007501144a 2 bytes CALL 752e4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[372] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000750114dd 2 bytes JMP 75388a42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[372] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000750114f5 2 bytes JMP 75388c18 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[372] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007501150d 2 bytes JMP 75388938 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[372] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075011525 2 bytes JMP 75388d02 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[372] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007501153d 2 bytes JMP 752ffcc0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[372] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075011555 2 bytes JMP 75306907 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[372] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007501156d 2 bytes JMP 75389201 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[372] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075011585 2 bytes JMP 75388d62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[372] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007501159d 2 bytes JMP 753888fc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[372] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000750115b5 2 bytes JMP 752ffd59 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[372] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000750115cd 2 bytes JMP 7530b2f4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[372] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000750116b2 2 bytes JMP 753890c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[372] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000750116bd 2 bytes JMP 75388891 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[4952] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationThread + 5 0000000076eef9c1 7 bytes {MOV EDX, 0xab4ae8; JMP RDX} .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[4952] C:\Windows\SysWOW64\ntdll.dll!NtOpenKey + 5 0000000076eefa3d 7 bytes {MOV EDX, 0xab49a8; JMP RDX} .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[4952] C:\Windows\SysWOW64\ntdll.dll!NtCreateKey + 5 0000000076eefb55 7 bytes {MOV EDX, 0xab4968; JMP RDX} .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[4952] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadToken + 5 0000000076eefc05 7 bytes {MOV EDX, 0xab4b28; JMP RDX} .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[4952] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 5 0000000076eefc35 7 bytes {MOV EDX, 0xab4a68; JMP RDX} .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[4952] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 5 0000000076eefc4d 7 bytes {MOV EDX, 0xab4928; JMP RDX} .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[4952] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection + 5 0000000076eefc65 7 bytes {MOV EDX, 0xab4be8; JMP RDX} .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[4952] C:\Windows\SysWOW64\ntdll.dll!NtUnmapViewOfSection + 5 0000000076eefc95 7 bytes {MOV EDX, 0xab4c28; JMP RDX} .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[4952] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadTokenEx + 5 0000000076eefd15 7 bytes {MOV EDX, 0xab4ba8; JMP RDX} .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[4952] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessTokenEx + 5 0000000076eefd2d 7 bytes {MOV EDX, 0xab4b68; JMP RDX} .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[4952] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 5 0000000076eefd79 7 bytes {MOV EDX, 0xab4868; JMP RDX} .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[4952] C:\Windows\SysWOW64\ntdll.dll!NtQueryAttributesFile + 5 0000000076eefe71 7 bytes {MOV EDX, 0xab48a8; JMP RDX} .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[4952] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 5 0000000076ef00c9 7 bytes {MOV EDX, 0xab4828; JMP RDX} .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[4952] C:\Windows\SysWOW64\ntdll.dll!NtOpenKeyEx + 5 0000000076ef102d 7 bytes {MOV EDX, 0xab49e8; JMP RDX} .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[4952] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessToken + 5 0000000076ef10d5 7 bytes {MOV EDX, 0xab4aa8; JMP RDX} .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[4952] C:\Windows\SysWOW64\ntdll.dll!NtOpenThread + 5 0000000076ef114d 7 bytes {MOV EDX, 0xab4a28; JMP RDX} .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[4952] C:\Windows\SysWOW64\ntdll.dll!NtQueryFullAttributesFile + 5 0000000076ef1351 7 bytes {MOV EDX, 0xab48e8; JMP RDX} .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[4952] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075011401 2 bytes JMP 7530b233 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[4952] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075011419 2 bytes JMP 7530b35e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[4952] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075011431 2 bytes JMP 75389149 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[4952] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007501144a 2 bytes CALL 752e4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[4952] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000750114dd 2 bytes JMP 75388a42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[4952] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000750114f5 2 bytes JMP 75388c18 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[4952] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007501150d 2 bytes JMP 75388938 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[4952] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075011525 2 bytes JMP 75388d02 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[4952] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007501153d 2 bytes JMP 752ffcc0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[4952] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075011555 2 bytes JMP 75306907 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[4952] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007501156d 2 bytes JMP 75389201 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[4952] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075011585 2 bytes JMP 75388d62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[4952] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007501159d 2 bytes JMP 753888fc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[4952] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000750115b5 2 bytes JMP 752ffd59 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[4952] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000750115cd 2 bytes JMP 7530b2f4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[4952] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000750116b2 2 bytes JMP 753890c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[4952] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000750116bd 2 bytes JMP 75388891 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[2848] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075011401 2 bytes JMP 7530b233 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[2848] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075011419 2 bytes JMP 7530b35e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[2848] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075011431 2 bytes JMP 75389149 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[2848] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007501144a 2 bytes CALL 752e4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[2848] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000750114dd 2 bytes JMP 75388a42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[2848] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000750114f5 2 bytes JMP 75388c18 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[2848] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007501150d 2 bytes JMP 75388938 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[2848] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075011525 2 bytes JMP 75388d02 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[2848] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007501153d 2 bytes JMP 752ffcc0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[2848] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075011555 2 bytes JMP 75306907 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[2848] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007501156d 2 bytes JMP 75389201 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[2848] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075011585 2 bytes JMP 75388d62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[2848] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007501159d 2 bytes JMP 753888fc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[2848] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000750115b5 2 bytes JMP 752ffd59 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[2848] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000750115cd 2 bytes JMP 7530b2f4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[2848] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000750116b2 2 bytes JMP 753890c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[2848] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000750116bd 2 bytes JMP 75388891 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3400] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000076d3be00 7 bytes [48, B8, A0, 20, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3400] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8 0000000076d3be08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 0000000076d3bf70 7 bytes [48, B8, 20, 21, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8 0000000076d3bf78 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076d3bf90 7 bytes [48, B8, 10, 25, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 0000000076d3bf98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3400] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 0000000076d3bfa0 7 bytes [48, B8, 00, 23, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3400] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8 0000000076d3bfa8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3400] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000076d3bfb0 7 bytes [48, B8, 80, 1F, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3400] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 0000000076d3bfb8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3400] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 0000000076d3bfd0 7 bytes [48, B8, F0, 1F, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3400] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 0000000076d3bfd8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 0000000076d3c020 7 bytes [48, B8, 90, 21, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8 0000000076d3c028 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 0000000076d3c030 7 bytes [48, B8, 60, 25, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8 0000000076d3c038 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 0000000076d3c060 7 bytes [48, B8, 80, 22, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8 0000000076d3c068 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3400] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 0000000076d3c100 7 bytes [48, B8, C0, 22, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3400] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8 0000000076d3c108 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000076d3c280 7 bytes [48, B8, 00, 22, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 0000000076d3c288 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 0000000076d3ccf0 7 bytes [48, B8, 40, 25, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8 0000000076d3ccf8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076d3cd40 7 bytes [48, B8, E0, 24, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8 0000000076d3cd48 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3400] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 0000000076d3ce90 7 bytes [48, B8, E0, 22, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3400] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8 0000000076d3ce98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4852] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000076d3be00 7 bytes [48, B8, A0, 20, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4852] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8 0000000076d3be08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4852] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 0000000076d3bf70 7 bytes [48, B8, 20, 21, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4852] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8 0000000076d3bf78 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4852] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076d3bf90 7 bytes [48, B8, 10, 25, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4852] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 0000000076d3bf98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4852] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 0000000076d3bfa0 7 bytes [48, B8, 00, 23, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4852] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8 0000000076d3bfa8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4852] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000076d3bfb0 7 bytes [48, B8, 80, 1F, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4852] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 0000000076d3bfb8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4852] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 0000000076d3bfd0 7 bytes [48, B8, F0, 1F, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4852] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 0000000076d3bfd8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4852] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 0000000076d3c020 7 bytes [48, B8, 90, 21, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4852] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8 0000000076d3c028 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4852] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 0000000076d3c030 7 bytes [48, B8, 60, 25, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4852] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8 0000000076d3c038 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4852] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 0000000076d3c060 7 bytes [48, B8, 80, 22, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4852] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8 0000000076d3c068 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4852] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 0000000076d3c100 7 bytes [48, B8, C0, 22, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4852] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8 0000000076d3c108 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4852] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000076d3c280 7 bytes [48, B8, 00, 22, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4852] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 0000000076d3c288 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4852] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 0000000076d3ccf0 7 bytes [48, B8, 40, 25, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4852] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8 0000000076d3ccf8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4852] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076d3cd40 7 bytes [48, B8, E0, 24, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4852] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8 0000000076d3cd48 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4852] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 0000000076d3ce90 7 bytes [48, B8, E0, 22, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4852] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8 0000000076d3ce98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3748] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000076d3be00 7 bytes [48, B8, A0, 20, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3748] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8 0000000076d3be08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 0000000076d3bf70 7 bytes [48, B8, 20, 21, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8 0000000076d3bf78 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076d3bf90 7 bytes [48, B8, 10, 25, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 0000000076d3bf98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3748] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 0000000076d3bfa0 7 bytes [48, B8, 00, 23, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3748] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8 0000000076d3bfa8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3748] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000076d3bfb0 7 bytes [48, B8, 80, 1F, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3748] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 0000000076d3bfb8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3748] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 0000000076d3bfd0 7 bytes [48, B8, F0, 1F, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3748] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 0000000076d3bfd8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 0000000076d3c020 7 bytes [48, B8, 90, 21, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8 0000000076d3c028 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 0000000076d3c030 7 bytes [48, B8, 60, 25, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8 0000000076d3c038 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 0000000076d3c060 7 bytes [48, B8, 80, 22, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8 0000000076d3c068 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3748] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 0000000076d3c100 7 bytes [48, B8, C0, 22, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3748] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8 0000000076d3c108 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000076d3c280 7 bytes [48, B8, 00, 22, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 0000000076d3c288 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 0000000076d3ccf0 7 bytes [48, B8, 40, 25, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8 0000000076d3ccf8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076d3cd40 7 bytes [48, B8, E0, 24, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8 0000000076d3cd48 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3748] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 0000000076d3ce90 7 bytes [48, B8, E0, 22, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3748] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8 0000000076d3ce98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000076d3be00 7 bytes [48, B8, A0, 20, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8 0000000076d3be08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 0000000076d3bf70 7 bytes [48, B8, 20, 21, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8 0000000076d3bf78 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076d3bf90 7 bytes [48, B8, 10, 25, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 0000000076d3bf98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 0000000076d3bfa0 7 bytes [48, B8, 00, 23, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8 0000000076d3bfa8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000076d3bfb0 7 bytes [48, B8, 80, 1F, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 0000000076d3bfb8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 0000000076d3bfd0 7 bytes [48, B8, F0, 1F, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 0000000076d3bfd8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 0000000076d3c020 7 bytes [48, B8, 90, 21, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8 0000000076d3c028 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 0000000076d3c030 7 bytes [48, B8, 60, 25, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8 0000000076d3c038 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 0000000076d3c060 7 bytes [48, B8, 80, 22, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8 0000000076d3c068 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 0000000076d3c100 7 bytes [48, B8, C0, 22, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8 0000000076d3c108 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000076d3c280 7 bytes [48, B8, 00, 22, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 0000000076d3c288 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 0000000076d3ccf0 7 bytes [48, B8, 40, 25, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8 0000000076d3ccf8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076d3cd40 7 bytes [48, B8, E0, 24, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8 0000000076d3cd48 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 0000000076d3ce90 7 bytes [48, B8, E0, 22, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8 0000000076d3ce98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4536] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000076d3be00 7 bytes [48, B8, A0, 20, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4536] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8 0000000076d3be08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4536] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 0000000076d3bf70 7 bytes [48, B8, 20, 21, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4536] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8 0000000076d3bf78 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4536] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076d3bf90 7 bytes [48, B8, 10, 25, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4536] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 0000000076d3bf98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4536] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 0000000076d3bfa0 7 bytes [48, B8, 00, 23, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4536] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8 0000000076d3bfa8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4536] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000076d3bfb0 7 bytes [48, B8, 80, 1F, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4536] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 0000000076d3bfb8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4536] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 0000000076d3bfd0 7 bytes [48, B8, F0, 1F, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4536] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 0000000076d3bfd8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4536] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 0000000076d3c020 7 bytes [48, B8, 90, 21, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4536] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8 0000000076d3c028 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4536] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 0000000076d3c030 7 bytes [48, B8, 60, 25, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4536] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8 0000000076d3c038 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4536] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 0000000076d3c060 7 bytes [48, B8, 80, 22, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4536] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8 0000000076d3c068 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4536] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 0000000076d3c100 7 bytes [48, B8, C0, 22, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4536] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8 0000000076d3c108 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4536] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000076d3c280 7 bytes [48, B8, 00, 22, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4536] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 0000000076d3c288 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4536] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 0000000076d3ccf0 7 bytes [48, B8, 40, 25, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4536] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8 0000000076d3ccf8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4536] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076d3cd40 7 bytes [48, B8, E0, 24, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4536] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8 0000000076d3cd48 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4536] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 0000000076d3ce90 7 bytes [48, B8, E0, 22, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4536] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8 0000000076d3ce98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2708] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000076d3be00 7 bytes [48, B8, A0, 20, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2708] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8 0000000076d3be08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 0000000076d3bf70 7 bytes [48, B8, 20, 21, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8 0000000076d3bf78 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076d3bf90 7 bytes [48, B8, 10, 25, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 0000000076d3bf98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2708] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 0000000076d3bfa0 7 bytes [48, B8, 00, 23, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2708] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8 0000000076d3bfa8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2708] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000076d3bfb0 7 bytes [48, B8, 80, 1F, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2708] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 0000000076d3bfb8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2708] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 0000000076d3bfd0 7 bytes [48, B8, F0, 1F, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2708] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 0000000076d3bfd8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 0000000076d3c020 7 bytes [48, B8, 90, 21, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8 0000000076d3c028 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 0000000076d3c030 7 bytes [48, B8, 60, 25, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8 0000000076d3c038 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 0000000076d3c060 7 bytes [48, B8, 80, 22, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8 0000000076d3c068 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2708] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 0000000076d3c100 7 bytes [48, B8, C0, 22, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2708] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8 0000000076d3c108 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2708] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000076d3c280 7 bytes [48, B8, 00, 22, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2708] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 0000000076d3c288 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 0000000076d3ccf0 7 bytes [48, B8, 40, 25, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8 0000000076d3ccf8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076d3cd40 7 bytes [48, B8, E0, 24, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8 0000000076d3cd48 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2708] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 0000000076d3ce90 7 bytes [48, B8, E0, 22, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2708] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8 0000000076d3ce98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[256] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000076d3be00 7 bytes [48, B8, A0, 20, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[256] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8 0000000076d3be08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[256] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 0000000076d3bf70 7 bytes [48, B8, 20, 21, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[256] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8 0000000076d3bf78 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[256] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076d3bf90 7 bytes [48, B8, 10, 25, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[256] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 0000000076d3bf98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[256] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 0000000076d3bfa0 7 bytes [48, B8, 00, 23, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[256] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8 0000000076d3bfa8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[256] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000076d3bfb0 7 bytes [48, B8, 80, 1F, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[256] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 0000000076d3bfb8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[256] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 0000000076d3bfd0 7 bytes [48, B8, F0, 1F, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[256] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 0000000076d3bfd8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[256] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 0000000076d3c020 7 bytes [48, B8, 90, 21, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[256] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8 0000000076d3c028 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[256] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 0000000076d3c030 7 bytes [48, B8, 60, 25, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[256] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8 0000000076d3c038 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[256] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 0000000076d3c060 7 bytes [48, B8, 80, 22, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[256] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8 0000000076d3c068 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[256] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 0000000076d3c100 7 bytes [48, B8, C0, 22, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[256] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8 0000000076d3c108 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[256] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000076d3c280 7 bytes [48, B8, 00, 22, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[256] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 0000000076d3c288 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[256] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 0000000076d3ccf0 7 bytes [48, B8, 40, 25, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[256] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8 0000000076d3ccf8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[256] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076d3cd40 7 bytes [48, B8, E0, 24, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[256] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8 0000000076d3cd48 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[256] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 0000000076d3ce90 7 bytes [48, B8, E0, 22, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[256] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8 0000000076d3ce98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4848] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000076d3be00 7 bytes [48, B8, A0, 20, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4848] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8 0000000076d3be08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4848] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 0000000076d3bf70 7 bytes [48, B8, 20, 21, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4848] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8 0000000076d3bf78 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4848] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076d3bf90 7 bytes [48, B8, 10, 25, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4848] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 0000000076d3bf98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4848] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 0000000076d3bfa0 7 bytes [48, B8, 00, 23, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4848] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8 0000000076d3bfa8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4848] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000076d3bfb0 7 bytes [48, B8, 80, 1F, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4848] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 0000000076d3bfb8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4848] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 0000000076d3bfd0 7 bytes [48, B8, F0, 1F, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4848] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 0000000076d3bfd8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4848] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 0000000076d3c020 7 bytes [48, B8, 90, 21, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4848] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8 0000000076d3c028 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4848] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 0000000076d3c030 7 bytes [48, B8, 60, 25, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4848] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8 0000000076d3c038 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4848] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 0000000076d3c060 7 bytes [48, B8, 80, 22, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4848] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8 0000000076d3c068 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4848] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 0000000076d3c100 7 bytes [48, B8, C0, 22, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4848] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8 0000000076d3c108 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4848] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000076d3c280 7 bytes [48, B8, 00, 22, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4848] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 0000000076d3c288 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4848] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 0000000076d3ccf0 7 bytes [48, B8, 40, 25, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4848] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8 0000000076d3ccf8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4848] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076d3cd40 7 bytes [48, B8, E0, 24, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4848] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8 0000000076d3cd48 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4848] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 0000000076d3ce90 7 bytes [48, B8, E0, 22, 3F, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4848] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8 0000000076d3ce98 6 bytes {ADD [RAX], AL; JMP RAX} ---- User IAT/EAT - GMER 2.2 ---- IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Program Files\Internet Explorer\iexplore.exe[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\USER32.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\GDI32.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\advapi32.DLL[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\shell32.DLL[USER32.dll!MessageBoxW] [7fee4c56840] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\shell32.DLL[USER32.dll!DialogBoxParamW] [7fee4c562b0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\shell32.DLL[USER32.dll!MessageBoxIndirectW] [7fee4c30750] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\shell32.DLL[USER32.dll!EnableWindow] [7fee4c1ef00] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\SHLWAPI.dll[USER32.dll!DialogBoxParamW] [7fee4c562b0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\SHLWAPI.dll[USER32.dll!DialogBoxParamA] [7fee4c561b0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\SHLWAPI.dll[USER32.dll!MessageBoxW] [7fee4c56840] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\iertutil.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\version.DLL[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\IMM32.DLL[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\MSCTF.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\IEFRAME.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\IEFRAME.dll[USER32.dll!EnableWindow] [7fee4c1ef00] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\IEFRAME.dll[USER32.dll!DialogBoxParamW] [7fee4c562b0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\IEFRAME.dll[USER32.dll!MessageBoxW] [7fee4c56840] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\IEFRAME.dll[USER32.dll!MessageBoxIndirectW] [7fee4c30750] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\ole32.dll[USER32.dll!EnableWindow] [7fee4c1ef00] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\ole32.dll[USER32.dll!DialogBoxParamW] [7fee4c562b0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\ole32.dll[USER32.dll!MessageBoxW] [7fee4c56840] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\OLEAUT32.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\OLEAUT32.dll[USER32.dll!EnableWindow] [7fee4c1ef00] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\comctl32.dll[USER32.dll!EnableWindow] [7fee4c1ef00] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\comctl32.dll[USER32.dll!DialogBoxIndirectParamW] [7fee4c560d0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\comctl32.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\comdlg32.dll[USER32.dll!EnableWindow] [7fee4c1ef00] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\comdlg32.dll[USER32.dll!DialogBoxIndirectParamW] [7fee4c560d0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\comdlg32.dll[USER32.dll!MessageBoxW] [7fee4c56840] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\comdlg32.dll[COMCTL32.dll!PropertySheetW] [7fee4c56f30] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\comdlg32.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\uxtheme.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\urlmon.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\urlmon.dll[USER32.dll!EnableWindow] [7fee4c1ef00] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\urlmon.dll[USER32.dll!DialogBoxParamW] [7fee4c562b0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\WININET.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\dwmapi.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Program Files\Internet Explorer\sqmapi.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\Secur32.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\rsaenh.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\CLBCatQ.DLL[USER32.dll!DialogBoxParamW] [7fee4c562b0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\CLBCatQ.DLL[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Program Files\Internet Explorer\ieproxy.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\srvcli.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\wkscli.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\apphelp.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\CRYPT32.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\IEUI.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\PROPSYS.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\windowscodecs.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\oleacc.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\System32\fwpuclnt.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\MLANG.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\SETUPAPI.dll[USER32.dll!DialogBoxParamW] [7fee4c562b0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\SETUPAPI.dll[USER32.dll!EnableWindow] [7fee4c1ef00] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\SETUPAPI.dll[USER32.dll!MessageBoxW] [7fee4c56840] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\CFGMGR32.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\ntmarta.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\WLDAP32.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\bcrypt.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\credssp.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\schannel.DLL[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\WINTRUST.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\cryptnet.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\System32\Wpc.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\System32\wevtapi.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\System32\msxml6.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\POWRPROF.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\MSHTML.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\MSHTML.dll[USER32.dll!MessageBoxW] [7fee4c56840] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\MSHTML.dll[USER32.dll!DialogBoxParamW] [7fee4c562b0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\MSHTML.dll[USER32.dll!EnableWindow] [7fee4c1ef00] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\System32\netprofm.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\System32\nlaapi.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\WINHTTP.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\webio.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\OCCACHE.dll[USER32.dll!DialogBoxParamA] [7fee4c561b0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\OCCACHE.dll[USER32.dll!MessageBoxA] [7fee4c563b0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\OCCACHE.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\OCCACHE.dll[COMCTL32.dll!PropertySheetA] [7fee4c56df0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\EhStorShell.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_a4d981ff711297b6\COMCTL32.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_a4d981ff711297b6\COMCTL32.dll[USER32.dll!EnableWindow] [7fee4c1ef00] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_a4d981ff711297b6\COMCTL32.dll[USER32.dll!DialogBoxIndirectParamW] [7fee4c560d0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\System32\cscui.dll[USER32.dll!EnableWindow] [7fee4c1ef00] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\System32\cscui.dll[USER32.dll!DialogBoxParamW] [7fee4c562b0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\System32\cscui.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\System32\CSCDLL.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\ntshrui.dll[USER32.dll!DialogBoxParamW] [7fee4c562b0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\ntshrui.dll[USER32.dll!EnableWindow] [7fee4c1ef00] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\ntshrui.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\LINKINFO.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\system32\tquery.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4524] @ C:\Windows\System32\StructuredQuery.dll[KERNEL32.dll!GetProcAddress] [7fee4c11c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4852] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenServiceW] [7fed51f440c] C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4852] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!CloseServiceHandle] [7fed51f3ca0] C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4852] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenSCManagerW] [7fed51f43f4] C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4852] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!StartServiceW] [7fed51f4680] C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4852] @ C:\Windows\system32\DWrite.dll[ntdll.dll!NtAlpcConnectPort] [7fed3fde588] C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3748] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenServiceW] [7fed51f440c] C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3748] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!CloseServiceHandle] [7fed51f3ca0] C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3748] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenSCManagerW] [7fed51f43f4] C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3748] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!StartServiceW] [7fed51f4680] C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3748] @ C:\Windows\system32\DWrite.dll[ntdll.dll!NtAlpcConnectPort] [7fed3fde588] C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4540] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenServiceW] [7fed51f440c] C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4540] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!CloseServiceHandle] [7fed51f3ca0] C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4540] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenSCManagerW] [7fed51f43f4] C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4540] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!StartServiceW] [7fed51f4680] C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4540] @ C:\Windows\system32\DWrite.dll[ntdll.dll!NtAlpcConnectPort] [7fed3fde588] C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4536] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenServiceW] [7fed51f440c] C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4536] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!CloseServiceHandle] [7fed51f3ca0] C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4536] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenSCManagerW] [7fed51f43f4] C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4536] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!StartServiceW] [7fed51f4680] C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4536] @ C:\Windows\system32\DWrite.dll[ntdll.dll!NtAlpcConnectPort] [7fed3fde588] C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2708] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenServiceW] [7fed51f440c] C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2708] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!CloseServiceHandle] [7fed51f3ca0] C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2708] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenSCManagerW] [7fed51f43f4] C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2708] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!StartServiceW] [7fed51f4680] C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2708] @ C:\Windows\system32\DWrite.dll[ntdll.dll!NtAlpcConnectPort] [7fed3fde588] C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[256] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenServiceW] [7fed51f440c] C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[256] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!CloseServiceHandle] [7fed51f3ca0] C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[256] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenSCManagerW] [7fed51f43f4] C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[256] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!StartServiceW] [7fed51f4680] C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[256] @ C:\Windows\system32\DWrite.dll[ntdll.dll!NtAlpcConnectPort] [7fed3fde588] C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4848] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenServiceW] [7fed51f440c] C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4848] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!CloseServiceHandle] [7fed51f3ca0] C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4848] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenSCManagerW] [7fed51f43f4] C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4848] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!StartServiceW] [7fed51f4680] C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4848] @ C:\Windows\system32\DWrite.dll[ntdll.dll!NtAlpcConnectPort] [7fed3fde588] C:\Program Files (x86)\Google\Chrome\Application\62.0.3202.94\chrome_child.dll ---- EOF - GMER 2.2 ----