GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-05-16 14:23:14 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 PLEXTOR_PX-128M5Pro rev.1.06 119,24GB Running: y96mpsz5.exe; Driver: C:\Users\CRAZIC~1\AppData\Local\Temp\pwryiuoc.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2512] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000760e1401 2 bytes JMP 7675b1ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2512] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000760e1419 2 bytes JMP 7675b31a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2512] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000760e1431 2 bytes JMP 767d8f09 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2512] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000760e144a 2 bytes CALL 76734885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2512] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000760e14dd 2 bytes JMP 767d8802 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2512] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000760e14f5 2 bytes JMP 767d89d8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2512] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000760e150d 2 bytes JMP 767d86f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2512] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000760e1525 2 bytes JMP 767d8ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2512] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000760e153d 2 bytes JMP 7674fc78 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2512] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000760e1555 2 bytes JMP 767568bf C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2512] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000760e156d 2 bytes JMP 767d8fc1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2512] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000760e1585 2 bytes JMP 767d8b22 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2512] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000760e159d 2 bytes JMP 767d86bc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2512] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000760e15b5 2 bytes JMP 7674fd11 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2512] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000760e15cd 2 bytes JMP 7675b2b0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2512] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000760e16b2 2 bytes JMP 767d8e84 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2512] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000760e16bd 2 bytes JMP 767d8651 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[452] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000760e1401 2 bytes JMP 7675b1ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[452] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000760e1419 2 bytes JMP 7675b31a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[452] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000760e1431 2 bytes JMP 767d8f09 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[452] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000760e144a 2 bytes CALL 76734885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[452] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000760e14dd 2 bytes JMP 767d8802 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[452] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000760e14f5 2 bytes JMP 767d89d8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[452] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000760e150d 2 bytes JMP 767d86f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[452] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000760e1525 2 bytes JMP 767d8ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[452] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000760e153d 2 bytes JMP 7674fc78 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[452] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000760e1555 2 bytes JMP 767568bf C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[452] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000760e156d 2 bytes JMP 767d8fc1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[452] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000760e1585 2 bytes JMP 767d8b22 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[452] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000760e159d 2 bytes JMP 767d86bc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[452] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000760e15b5 2 bytes JMP 7674fd11 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[452] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000760e15cd 2 bytes JMP 7675b2b0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[452] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000760e16b2 2 bytes JMP 767d8e84 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[452] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000760e16bd 2 bytes JMP 767d8651 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[2360] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000760e1401 2 bytes JMP 7675b1ef C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[2360] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000760e1419 2 bytes JMP 7675b31a C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[2360] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000760e1431 2 bytes JMP 767d8f09 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[2360] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000760e144a 2 bytes CALL 76734885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[2360] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000760e14dd 2 bytes JMP 767d8802 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[2360] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000760e14f5 2 bytes JMP 767d89d8 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[2360] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000760e150d 2 bytes JMP 767d86f8 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[2360] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000760e1525 2 bytes JMP 767d8ac2 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[2360] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000760e153d 2 bytes JMP 7674fc78 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[2360] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000760e1555 2 bytes JMP 767568bf C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[2360] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000760e156d 2 bytes JMP 767d8fc1 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[2360] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000760e1585 2 bytes JMP 767d8b22 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[2360] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000760e159d 2 bytes JMP 767d86bc C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[2360] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000760e15b5 2 bytes JMP 7674fd11 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[2360] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000760e15cd 2 bytes JMP 7675b2b0 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[2360] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000760e16b2 2 bytes JMP 767d8e84 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[2360] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000760e16bd 2 bytes JMP 767d8651 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.245\deploy\LoLLauncher.exe[1288] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000760e1401 2 bytes JMP 7675b1ef C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.245\deploy\LoLLauncher.exe[1288] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000760e1419 2 bytes JMP 7675b31a C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.245\deploy\LoLLauncher.exe[1288] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000760e1431 2 bytes JMP 767d8f09 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.245\deploy\LoLLauncher.exe[1288] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000760e144a 2 bytes CALL 76734885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.245\deploy\LoLLauncher.exe[1288] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000760e14dd 2 bytes JMP 767d8802 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.245\deploy\LoLLauncher.exe[1288] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000760e14f5 2 bytes JMP 767d89d8 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.245\deploy\LoLLauncher.exe[1288] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000760e150d 2 bytes JMP 767d86f8 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.245\deploy\LoLLauncher.exe[1288] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000760e1525 2 bytes JMP 767d8ac2 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.245\deploy\LoLLauncher.exe[1288] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000760e153d 2 bytes JMP 7674fc78 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.245\deploy\LoLLauncher.exe[1288] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000760e1555 2 bytes JMP 767568bf C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.245\deploy\LoLLauncher.exe[1288] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000760e156d 2 bytes JMP 767d8fc1 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.245\deploy\LoLLauncher.exe[1288] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000760e1585 2 bytes JMP 767d8b22 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.245\deploy\LoLLauncher.exe[1288] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000760e159d 2 bytes JMP 767d86bc C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.245\deploy\LoLLauncher.exe[1288] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000760e15b5 2 bytes JMP 7674fd11 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.245\deploy\LoLLauncher.exe[1288] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000760e15cd 2 bytes JMP 7675b2b0 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.245\deploy\LoLLauncher.exe[1288] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000760e16b2 2 bytes JMP 767d8e84 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.245\deploy\LoLLauncher.exe[1288] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000760e16bd 2 bytes JMP 767d8651 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.29\deploy\LoLPatcher.exe[4788] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000076738769 5 bytes [33, C0, C2, 04, 00] .text C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.29\deploy\LoLPatcher.exe[4788] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000760e1401 2 bytes JMP 7675b1ef C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.29\deploy\LoLPatcher.exe[4788] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000760e1419 2 bytes JMP 7675b31a C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.29\deploy\LoLPatcher.exe[4788] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000760e1431 2 bytes JMP 767d8f09 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.29\deploy\LoLPatcher.exe[4788] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000760e144a 2 bytes CALL 76734885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.29\deploy\LoLPatcher.exe[4788] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000760e14dd 2 bytes JMP 767d8802 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.29\deploy\LoLPatcher.exe[4788] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000760e14f5 2 bytes JMP 767d89d8 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.29\deploy\LoLPatcher.exe[4788] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000760e150d 2 bytes JMP 767d86f8 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.29\deploy\LoLPatcher.exe[4788] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000760e1525 2 bytes JMP 767d8ac2 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.29\deploy\LoLPatcher.exe[4788] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000760e153d 2 bytes JMP 7674fc78 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.29\deploy\LoLPatcher.exe[4788] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000760e1555 2 bytes JMP 767568bf C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.29\deploy\LoLPatcher.exe[4788] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000760e156d 2 bytes JMP 767d8fc1 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.29\deploy\LoLPatcher.exe[4788] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000760e1585 2 bytes JMP 767d8b22 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.29\deploy\LoLPatcher.exe[4788] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000760e159d 2 bytes JMP 767d86bc C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.29\deploy\LoLPatcher.exe[4788] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000760e15b5 2 bytes JMP 7674fd11 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.29\deploy\LoLPatcher.exe[4788] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000760e15cd 2 bytes JMP 7675b2b0 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.29\deploy\LoLPatcher.exe[4788] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000760e16b2 2 bytes JMP 767d8e84 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.29\deploy\LoLPatcher.exe[4788] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000760e16bd 2 bytes JMP 767d8651 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.144\deploy\LolClient.exe[4632] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000760e1401 2 bytes JMP 7675b1ef C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.144\deploy\LolClient.exe[4632] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000760e1419 2 bytes JMP 7675b31a C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.144\deploy\LolClient.exe[4632] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000760e1431 2 bytes JMP 767d8f09 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.144\deploy\LolClient.exe[4632] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000760e144a 2 bytes CALL 76734885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.144\deploy\LolClient.exe[4632] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000760e14dd 2 bytes JMP 767d8802 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.144\deploy\LolClient.exe[4632] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000760e14f5 2 bytes JMP 767d89d8 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.144\deploy\LolClient.exe[4632] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000760e150d 2 bytes JMP 767d86f8 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.144\deploy\LolClient.exe[4632] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000760e1525 2 bytes JMP 767d8ac2 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.144\deploy\LolClient.exe[4632] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000760e153d 2 bytes JMP 7674fc78 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.144\deploy\LolClient.exe[4632] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000760e1555 2 bytes JMP 767568bf C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.144\deploy\LolClient.exe[4632] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000760e156d 2 bytes JMP 767d8fc1 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.144\deploy\LolClient.exe[4632] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000760e1585 2 bytes JMP 767d8b22 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.144\deploy\LolClient.exe[4632] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000760e159d 2 bytes JMP 767d86bc C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.144\deploy\LolClient.exe[4632] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000760e15b5 2 bytes JMP 7674fd11 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.144\deploy\LolClient.exe[4632] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000760e15cd 2 bytes JMP 7675b2b0 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.144\deploy\LolClient.exe[4632] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000760e16b2 2 bytes JMP 767d8e84 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.144\deploy\LolClient.exe[4632] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000760e16bd 2 bytes JMP 767d8651 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1228] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000760e1401 2 bytes JMP 7675b1ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1228] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000760e1419 2 bytes JMP 7675b31a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1228] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000760e1431 2 bytes JMP 767d8f09 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1228] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000760e144a 2 bytes CALL 76734885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1228] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000760e14dd 2 bytes JMP 767d8802 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1228] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000760e14f5 2 bytes JMP 767d89d8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1228] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000760e150d 2 bytes JMP 767d86f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1228] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000760e1525 2 bytes JMP 767d8ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1228] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000760e153d 2 bytes JMP 7674fc78 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1228] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000760e1555 2 bytes JMP 767568bf C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1228] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000760e156d 2 bytes JMP 767d8fc1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1228] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000760e1585 2 bytes JMP 767d8b22 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1228] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000760e159d 2 bytes JMP 767d86bc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1228] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000760e15b5 2 bytes JMP 7674fd11 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1228] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000760e15cd 2 bytes JMP 7675b2b0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1228] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000760e16b2 2 bytes JMP 767d8e84 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1228] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000760e16bd 2 bytes JMP 767d8651 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4692] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000760e1401 2 bytes JMP 7675b1ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4692] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000760e1419 2 bytes JMP 7675b31a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4692] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000760e1431 2 bytes JMP 767d8f09 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4692] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000760e144a 2 bytes CALL 76734885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4692] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000760e14dd 2 bytes JMP 767d8802 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4692] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000760e14f5 2 bytes JMP 767d89d8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4692] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000760e150d 2 bytes JMP 767d86f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4692] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000760e1525 2 bytes JMP 767d8ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4692] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000760e153d 2 bytes JMP 7674fc78 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4692] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000760e1555 2 bytes JMP 767568bf C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4692] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000760e156d 2 bytes JMP 767d8fc1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4692] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000760e1585 2 bytes JMP 767d8b22 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4692] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000760e159d 2 bytes JMP 767d86bc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4692] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000760e15b5 2 bytes JMP 7674fd11 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4692] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000760e15cd 2 bytes JMP 7675b2b0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4692] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000760e16b2 2 bytes JMP 767d8e84 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4692] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000760e16bd 2 bytes JMP 767d8651 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[2712] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000760e1401 2 bytes JMP 7675b1ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[2712] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000760e1419 2 bytes JMP 7675b31a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[2712] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000760e1431 2 bytes JMP 767d8f09 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[2712] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000760e144a 2 bytes CALL 76734885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[2712] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000760e14dd 2 bytes JMP 767d8802 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[2712] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000760e14f5 2 bytes JMP 767d89d8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[2712] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000760e150d 2 bytes JMP 767d86f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[2712] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000760e1525 2 bytes JMP 767d8ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[2712] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000760e153d 2 bytes JMP 7674fc78 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[2712] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000760e1555 2 bytes JMP 767568bf C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[2712] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000760e156d 2 bytes JMP 767d8fc1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[2712] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000760e1585 2 bytes JMP 767d8b22 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[2712] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000760e159d 2 bytes JMP 767d86bc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[2712] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000760e15b5 2 bytes JMP 7674fd11 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[2712] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000760e15cd 2 bytes JMP 7675b2b0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[2712] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000760e16b2 2 bytes JMP 767d8e84 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[2712] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000760e16bd 2 bytes JMP 767d8651 C:\Windows\syswow64\kernel32.dll ---- User IAT/EAT - GMER 2.1 ---- IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Program Files\Internet Explorer\iexplore.exe[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\USER32.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\GDI32.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\advapi32.DLL[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\shell32.DLL[USER32.dll!MessageBoxW] [7fef4686a30] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\shell32.DLL[USER32.dll!DialogBoxParamW] [7fef46864a0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\shell32.DLL[USER32.dll!MessageBoxIndirectW] [7fef465d840] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\shell32.DLL[USER32.dll!EnableWindow] [7fef4643370] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\SHLWAPI.dll[USER32.dll!DialogBoxParamW] [7fef46864a0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\SHLWAPI.dll[USER32.dll!DialogBoxParamA] [7fef46863a0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\SHLWAPI.dll[USER32.dll!MessageBoxW] [7fef4686a30] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\iertutil.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\version.DLL[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\IMM32.DLL[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\MSCTF.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\IEFRAME.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\IEFRAME.dll[USER32.dll!EnableWindow] [7fef4643370] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\IEFRAME.dll[USER32.dll!DialogBoxParamW] [7fef46864a0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\IEFRAME.dll[USER32.dll!MessageBoxW] [7fef4686a30] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\IEFRAME.dll[USER32.dll!MessageBoxIndirectW] [7fef465d840] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\ole32.dll[USER32.dll!EnableWindow] [7fef4643370] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\ole32.dll[USER32.dll!DialogBoxParamW] [7fef46864a0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\ole32.dll[USER32.dll!MessageBoxW] [7fef4686a30] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\OLEAUT32.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\OLEAUT32.dll[USER32.dll!EnableWindow] [7fef4643370] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32.dll[USER32.dll!EnableWindow] [7fef4643370] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32.dll[USER32.dll!DialogBoxIndirectParamW] [7fef46862c0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\comdlg32.dll[USER32.dll!EnableWindow] [7fef4643370] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\comdlg32.dll[USER32.dll!DialogBoxIndirectParamW] [7fef46862c0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\comdlg32.dll[USER32.dll!MessageBoxW] [7fef4686a30] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\comdlg32.dll[COMCTL32.dll!PropertySheetW] [7fef4687120] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\comdlg32.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\uxtheme.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\urlmon.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\urlmon.dll[USER32.dll!EnableWindow] [7fef4643370] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\urlmon.dll[USER32.dll!DialogBoxParamW] [7fef46864a0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\WININET.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\dwmapi.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\Secur32.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\rsaenh.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\CLBCatQ.DLL[USER32.dll!DialogBoxParamW] [7fef46864a0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\CLBCatQ.DLL[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Program Files\Internet Explorer\ieproxy.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\apphelp.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\CRYPT32.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\IEUI.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\PROPSYS.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\System32\fwpuclnt.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\windowscodecs.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\oleacc.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\explorerframe.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\explorerframe.dll[USER32.dll!EnableWindow] [7fef4643370] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\DUser.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\DUI70.dll[USER32.dll!EnableWindow] [7fef4643370] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\DUI70.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\MLANG.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\SETUPAPI.dll[USER32.dll!DialogBoxParamW] [7fef46864a0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\SETUPAPI.dll[USER32.dll!EnableWindow] [7fef4643370] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\SETUPAPI.dll[USER32.dll!MessageBoxW] [7fef4686a30] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\CFGMGR32.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\ntmarta.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\WLDAP32.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\dxgi.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\WINTRUST.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\System32\NaturalLanguage6.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\tquery.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\System32\StructuredQuery.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\System32\msxml6.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\credssp.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\schannel.DLL[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\bcrypt.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\cryptnet.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\LINKINFO.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\ntshrui.dll[USER32.dll!DialogBoxParamW] [7fef46864a0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\ntshrui.dll[USER32.dll!EnableWindow] [7fef4643370] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\ntshrui.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\srvcli.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\WINHTTP.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\webio.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\actxprxy.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\System32\NLSData0000.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\System32\ieapfltr.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Program Files\Windows Defender\MpOav.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[4928] @ C:\Windows\system32\MPR.dll[KERNEL32.dll!GetProcAddress] [7fef4641800] C:\Program Files\Internet Explorer\IEShims.dll ---- EOF - GMER 2.1 ----