GMER 2.2.19882 - http://www.gmer.net Rootkit scan 2017-06-25 12:32:37 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 SAMSUNG_ rev.1AG0 298,09GB Running: vwxn3bw4.exe; Driver: C:\Users\Proteus\AppData\Local\Temp\agldapog.sys ---- User code sections - GMER 2.2 ---- .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[3832] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000077681401 2 bytes JMP 767cb233 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[3832] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000077681419 2 bytes JMP 767cb35e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[3832] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000077681431 2 bytes JMP 76849149 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[3832] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007768144a 2 bytes CALL 767a4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[3832] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000776814dd 2 bytes JMP 76848a42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[3832] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000776814f5 2 bytes JMP 76848c18 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[3832] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007768150d 2 bytes JMP 76848938 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[3832] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000077681525 2 bytes JMP 76848d02 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[3832] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007768153d 2 bytes JMP 767bfcc0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[3832] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000077681555 2 bytes JMP 767c6907 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[3832] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007768156d 2 bytes JMP 76849201 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[3832] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000077681585 2 bytes JMP 76848d62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[3832] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007768159d 2 bytes JMP 768488fc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[3832] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000776815b5 2 bytes JMP 767bfd59 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[3832] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000776815cd 2 bytes JMP 767cb2f4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[3832] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000776816b2 2 bytes JMP 768490c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[3832] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000776816bd 2 bytes JMP 76848891 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\EaseUS\Todo Backup\bin\TodoBackupService.exe[3860] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000077681401 2 bytes JMP 767cb233 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\EaseUS\Todo Backup\bin\TodoBackupService.exe[3860] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000077681419 2 bytes JMP 767cb35e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\EaseUS\Todo Backup\bin\TodoBackupService.exe[3860] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000077681431 2 bytes JMP 76849149 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\EaseUS\Todo Backup\bin\TodoBackupService.exe[3860] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007768144a 2 bytes CALL 767a4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\EaseUS\Todo Backup\bin\TodoBackupService.exe[3860] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000776814dd 2 bytes JMP 76848a42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\EaseUS\Todo Backup\bin\TodoBackupService.exe[3860] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000776814f5 2 bytes JMP 76848c18 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\EaseUS\Todo Backup\bin\TodoBackupService.exe[3860] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007768150d 2 bytes JMP 76848938 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\EaseUS\Todo Backup\bin\TodoBackupService.exe[3860] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000077681525 2 bytes JMP 76848d02 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\EaseUS\Todo Backup\bin\TodoBackupService.exe[3860] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007768153d 2 bytes JMP 767bfcc0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\EaseUS\Todo Backup\bin\TodoBackupService.exe[3860] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000077681555 2 bytes JMP 767c6907 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\EaseUS\Todo Backup\bin\TodoBackupService.exe[3860] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007768156d 2 bytes JMP 76849201 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\EaseUS\Todo Backup\bin\TodoBackupService.exe[3860] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000077681585 2 bytes JMP 76848d62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\EaseUS\Todo Backup\bin\TodoBackupService.exe[3860] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007768159d 2 bytes JMP 768488fc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\EaseUS\Todo Backup\bin\TodoBackupService.exe[3860] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000776815b5 2 bytes JMP 767bfd59 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\EaseUS\Todo Backup\bin\TodoBackupService.exe[3860] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000776815cd 2 bytes JMP 767cb2f4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\EaseUS\Todo Backup\bin\TodoBackupService.exe[3860] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000776816b2 2 bytes JMP 768490c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\EaseUS\Todo Backup\bin\TodoBackupService.exe[3860] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000776816bd 2 bytes JMP 76848891 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\rundll32.exe[2288] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathW + 4 0000000068a413b0 2 bytes JMP 75175590 C:\Windows\syswow64\SHELL32.dll .text C:\Windows\SysWOW64\rundll32.exe[2288] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathW + 20 0000000068a413c0 2 bytes CALL 76319cee C:\Windows\syswow64\msvcrt.dll .text ... * 20 .text C:\Windows\SysWOW64\rundll32.exe[2288] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathA + 22 0000000068a4153e 2 bytes CALL 75207324 C:\Windows\syswow64\SHELL32.dll .text C:\Windows\SysWOW64\rundll32.exe[2288] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathA + 43 0000000068a41553 2 bytes CALL 767a10ff C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5696] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000077681401 2 bytes JMP 767cb233 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5696] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000077681419 2 bytes JMP 767cb35e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5696] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000077681431 2 bytes JMP 76849149 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5696] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007768144a 2 bytes CALL 767a4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5696] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000776814dd 2 bytes JMP 76848a42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5696] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000776814f5 2 bytes JMP 76848c18 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5696] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007768150d 2 bytes JMP 76848938 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5696] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000077681525 2 bytes JMP 76848d02 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5696] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007768153d 2 bytes JMP 767bfcc0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5696] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000077681555 2 bytes JMP 767c6907 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5696] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007768156d 2 bytes JMP 76849201 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5696] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000077681585 2 bytes JMP 76848d62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5696] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007768159d 2 bytes JMP 768488fc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5696] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000776815b5 2 bytes JMP 767bfd59 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5696] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000776815cd 2 bytes JMP 767cb2f4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5696] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000776816b2 2 bytes JMP 768490c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[5696] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000776816bd 2 bytes JMP 76848891 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5932] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000077681401 2 bytes JMP 767cb233 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5932] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000077681419 2 bytes JMP 767cb35e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5932] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000077681431 2 bytes JMP 76849149 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5932] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007768144a 2 bytes CALL 767a4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5932] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000776814dd 2 bytes JMP 76848a42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5932] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000776814f5 2 bytes JMP 76848c18 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5932] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007768150d 2 bytes JMP 76848938 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5932] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000077681525 2 bytes JMP 76848d02 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5932] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007768153d 2 bytes JMP 767bfcc0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5932] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000077681555 2 bytes JMP 767c6907 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5932] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007768156d 2 bytes JMP 76849201 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5932] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000077681585 2 bytes JMP 76848d62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5932] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007768159d 2 bytes JMP 768488fc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5932] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000776815b5 2 bytes JMP 767bfd59 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5932] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000776815cd 2 bytes JMP 767cb2f4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5932] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000776816b2 2 bytes JMP 768490c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5932] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000776816bd 2 bytes JMP 76848891 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe[6052] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000077681401 2 bytes JMP 767cb233 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe[6052] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000077681419 2 bytes JMP 767cb35e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe[6052] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000077681431 2 bytes JMP 76849149 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe[6052] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007768144a 2 bytes CALL 767a4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe[6052] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000776814dd 2 bytes JMP 76848a42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe[6052] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000776814f5 2 bytes JMP 76848c18 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe[6052] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007768150d 2 bytes JMP 76848938 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe[6052] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000077681525 2 bytes JMP 76848d02 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe[6052] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007768153d 2 bytes JMP 767bfcc0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe[6052] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000077681555 2 bytes JMP 767c6907 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe[6052] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007768156d 2 bytes JMP 76849201 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe[6052] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000077681585 2 bytes JMP 76848d62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe[6052] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007768159d 2 bytes JMP 768488fc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe[6052] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000776815b5 2 bytes JMP 767bfd59 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe[6052] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000776815cd 2 bytes JMP 767cb2f4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe[6052] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000776816b2 2 bytes JMP 768490c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe[6052] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000776816bd 2 bytes JMP 76848891 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[6132] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000077681401 2 bytes JMP 767cb233 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[6132] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000077681419 2 bytes JMP 767cb35e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[6132] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000077681431 2 bytes JMP 76849149 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[6132] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007768144a 2 bytes CALL 767a4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[6132] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000776814dd 2 bytes JMP 76848a42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[6132] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000776814f5 2 bytes JMP 76848c18 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[6132] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007768150d 2 bytes JMP 76848938 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[6132] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000077681525 2 bytes JMP 76848d02 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[6132] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007768153d 2 bytes JMP 767bfcc0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[6132] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000077681555 2 bytes JMP 767c6907 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[6132] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007768156d 2 bytes JMP 76849201 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[6132] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000077681585 2 bytes JMP 76848d62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[6132] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007768159d 2 bytes JMP 768488fc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[6132] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000776815b5 2 bytes JMP 767bfd59 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[6132] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000776815cd 2 bytes JMP 767cb2f4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[6132] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000776816b2 2 bytes JMP 768490c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe[6132] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000776816bd 2 bytes JMP 76848891 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[6172] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000077681401 2 bytes JMP 767cb233 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[6172] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000077681419 2 bytes JMP 767cb35e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[6172] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000077681431 2 bytes JMP 76849149 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[6172] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007768144a 2 bytes CALL 767a4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[6172] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000776814dd 2 bytes JMP 76848a42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[6172] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000776814f5 2 bytes JMP 76848c18 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[6172] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007768150d 2 bytes JMP 76848938 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[6172] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000077681525 2 bytes JMP 76848d02 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[6172] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007768153d 2 bytes JMP 767bfcc0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[6172] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000077681555 2 bytes JMP 767c6907 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[6172] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007768156d 2 bytes JMP 76849201 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[6172] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000077681585 2 bytes JMP 76848d62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[6172] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007768159d 2 bytes JMP 768488fc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[6172] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000776815b5 2 bytes JMP 767bfd59 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[6172] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000776815cd 2 bytes JMP 767cb2f4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[6172] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000776816b2 2 bytes JMP 768490c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[6172] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000776816bd 2 bytes JMP 76848891 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4464] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007751bfb0 14 bytes {MOV RAX, 0x7fee92862b0; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007751be00 7 bytes [48, B8, 60, F9, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8 000000007751be08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 000000007751bf70 7 bytes [48, B8, E0, F9, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8 000000007751bf78 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 000000007751bf90 7 bytes [48, B8, D0, FD, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 000000007751bf98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 000000007751bfa0 7 bytes [48, B8, C0, FB, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8 000000007751bfa8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007751bfb0 7 bytes [48, B8, 40, F8, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 000000007751bfb8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 000000007751bfd0 7 bytes [48, B8, B0, F8, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 000000007751bfd8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 000000007751c020 7 bytes [48, B8, 50, FA, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8 000000007751c028 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 000000007751c030 7 bytes [48, B8, 20, FE, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8 000000007751c038 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 000000007751c060 7 bytes [48, B8, 40, FB, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8 000000007751c068 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 000000007751c100 7 bytes [48, B8, 80, FB, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8 000000007751c108 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 000000007751c280 7 bytes [48, B8, C0, FA, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 000000007751c288 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 000000007751ccf0 7 bytes [48, B8, 00, FE, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8 000000007751ccf8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 000000007751cd40 7 bytes [48, B8, A0, FD, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8 000000007751cd48 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 000000007751ce90 7 bytes [48, B8, A0, FB, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[1504] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8 000000007751ce98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007751be00 7 bytes [48, B8, 60, F9, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8 000000007751be08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 000000007751bf70 7 bytes [48, B8, E0, F9, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8 000000007751bf78 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 000000007751bf90 7 bytes [48, B8, D0, FD, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 000000007751bf98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 000000007751bfa0 7 bytes [48, B8, C0, FB, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8 000000007751bfa8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007751bfb0 7 bytes [48, B8, 40, F8, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 000000007751bfb8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 000000007751bfd0 7 bytes [48, B8, B0, F8, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 000000007751bfd8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 000000007751c020 7 bytes [48, B8, 50, FA, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8 000000007751c028 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 000000007751c030 7 bytes [48, B8, 20, FE, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8 000000007751c038 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 000000007751c060 7 bytes [48, B8, 40, FB, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8 000000007751c068 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 000000007751c100 7 bytes [48, B8, 80, FB, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8 000000007751c108 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 000000007751c280 7 bytes [48, B8, C0, FA, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 000000007751c288 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 000000007751ccf0 7 bytes [48, B8, 00, FE, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8 000000007751ccf8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 000000007751cd40 7 bytes [48, B8, A0, FD, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8 000000007751cd48 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 000000007751ce90 7 bytes [48, B8, A0, FB, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8 000000007751ce98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4740] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007751be00 7 bytes [48, B8, 60, F9, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4740] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8 000000007751be08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4740] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 000000007751bf70 7 bytes [48, B8, E0, F9, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4740] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8 000000007751bf78 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4740] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 000000007751bf90 7 bytes [48, B8, D0, FD, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4740] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 000000007751bf98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4740] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 000000007751bfa0 7 bytes [48, B8, C0, FB, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4740] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8 000000007751bfa8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4740] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007751bfb0 7 bytes [48, B8, 40, F8, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4740] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 000000007751bfb8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4740] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 000000007751bfd0 7 bytes [48, B8, B0, F8, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4740] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 000000007751bfd8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4740] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 000000007751c020 7 bytes [48, B8, 50, FA, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4740] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8 000000007751c028 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4740] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 000000007751c030 7 bytes [48, B8, 20, FE, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4740] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8 000000007751c038 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4740] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 000000007751c060 7 bytes [48, B8, 40, FB, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4740] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8 000000007751c068 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4740] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 000000007751c100 7 bytes [48, B8, 80, FB, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4740] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8 000000007751c108 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4740] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 000000007751c280 7 bytes [48, B8, C0, FA, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4740] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 000000007751c288 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4740] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 000000007751ccf0 7 bytes [48, B8, 00, FE, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4740] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8 000000007751ccf8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4740] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 000000007751cd40 7 bytes [48, B8, A0, FD, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4740] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8 000000007751cd48 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4740] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 000000007751ce90 7 bytes [48, B8, A0, FB, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4740] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8 000000007751ce98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[9156] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007751be00 7 bytes [48, B8, 60, F9, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[9156] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8 000000007751be08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[9156] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 000000007751bf70 7 bytes [48, B8, E0, F9, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[9156] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8 000000007751bf78 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[9156] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 000000007751bf90 7 bytes [48, B8, D0, FD, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[9156] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 000000007751bf98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[9156] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 000000007751bfa0 7 bytes [48, B8, C0, FB, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[9156] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8 000000007751bfa8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[9156] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007751bfb0 7 bytes [48, B8, 40, F8, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[9156] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 000000007751bfb8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[9156] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 000000007751bfd0 7 bytes [48, B8, B0, F8, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[9156] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 000000007751bfd8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[9156] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 000000007751c020 7 bytes [48, B8, 50, FA, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[9156] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8 000000007751c028 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[9156] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 000000007751c030 7 bytes [48, B8, 20, FE, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[9156] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8 000000007751c038 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[9156] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 000000007751c060 7 bytes [48, B8, 40, FB, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[9156] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8 000000007751c068 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[9156] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 000000007751c100 7 bytes [48, B8, 80, FB, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[9156] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8 000000007751c108 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[9156] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 000000007751c280 7 bytes [48, B8, C0, FA, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[9156] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 000000007751c288 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[9156] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 000000007751ccf0 7 bytes [48, B8, 00, FE, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[9156] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8 000000007751ccf8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[9156] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 000000007751cd40 7 bytes [48, B8, A0, FD, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[9156] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8 000000007751cd48 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[9156] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 000000007751ce90 7 bytes [48, B8, A0, FB, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[9156] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8 000000007751ce98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7148] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007751be00 7 bytes [48, B8, 60, F9, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7148] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8 000000007751be08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 000000007751bf70 7 bytes [48, B8, E0, F9, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8 000000007751bf78 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 000000007751bf90 7 bytes [48, B8, D0, FD, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 000000007751bf98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7148] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 000000007751bfa0 7 bytes [48, B8, C0, FB, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7148] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8 000000007751bfa8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7148] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007751bfb0 7 bytes [48, B8, 40, F8, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7148] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 000000007751bfb8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7148] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 000000007751bfd0 7 bytes [48, B8, B0, F8, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7148] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 000000007751bfd8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 000000007751c020 7 bytes [48, B8, 50, FA, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8 000000007751c028 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 000000007751c030 7 bytes [48, B8, 20, FE, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8 000000007751c038 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 000000007751c060 7 bytes [48, B8, 40, FB, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8 000000007751c068 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7148] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 000000007751c100 7 bytes [48, B8, 80, FB, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7148] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8 000000007751c108 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7148] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 000000007751c280 7 bytes [48, B8, C0, FA, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7148] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 000000007751c288 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 000000007751ccf0 7 bytes [48, B8, 00, FE, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8 000000007751ccf8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 000000007751cd40 7 bytes [48, B8, A0, FD, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8 000000007751cd48 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7148] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 000000007751ce90 7 bytes [48, B8, A0, FB, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7148] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8 000000007751ce98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7580] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007751be00 7 bytes [48, B8, 60, F9, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7580] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8 000000007751be08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 000000007751bf70 7 bytes [48, B8, E0, F9, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8 000000007751bf78 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 000000007751bf90 7 bytes [48, B8, D0, FD, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 000000007751bf98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7580] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 000000007751bfa0 7 bytes [48, B8, C0, FB, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7580] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8 000000007751bfa8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7580] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007751bfb0 7 bytes [48, B8, 40, F8, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7580] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 000000007751bfb8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7580] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 000000007751bfd0 7 bytes [48, B8, B0, F8, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7580] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 000000007751bfd8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 000000007751c020 7 bytes [48, B8, 50, FA, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8 000000007751c028 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 000000007751c030 7 bytes [48, B8, 20, FE, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8 000000007751c038 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 000000007751c060 7 bytes [48, B8, 40, FB, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8 000000007751c068 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7580] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 000000007751c100 7 bytes [48, B8, 80, FB, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7580] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8 000000007751c108 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7580] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 000000007751c280 7 bytes [48, B8, C0, FA, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7580] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 000000007751c288 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 000000007751ccf0 7 bytes [48, B8, 00, FE, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8 000000007751ccf8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 000000007751cd40 7 bytes [48, B8, A0, FD, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7580] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8 000000007751cd48 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7580] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 000000007751ce90 7 bytes [48, B8, A0, FB, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7580] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8 000000007751ce98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8804] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007751be00 7 bytes [48, B8, 60, F9, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8804] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8 000000007751be08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8804] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 000000007751bf70 7 bytes [48, B8, E0, F9, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8804] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8 000000007751bf78 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8804] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 000000007751bf90 7 bytes [48, B8, D0, FD, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8804] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 000000007751bf98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8804] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 000000007751bfa0 7 bytes [48, B8, C0, FB, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8804] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8 000000007751bfa8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8804] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007751bfb0 7 bytes [48, B8, 40, F8, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8804] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 000000007751bfb8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8804] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 000000007751bfd0 7 bytes [48, B8, B0, F8, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8804] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 000000007751bfd8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8804] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 000000007751c020 7 bytes [48, B8, 50, FA, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8804] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8 000000007751c028 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8804] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 000000007751c030 7 bytes [48, B8, 20, FE, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8804] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8 000000007751c038 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8804] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 000000007751c060 7 bytes [48, B8, 40, FB, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8804] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8 000000007751c068 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8804] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 000000007751c100 7 bytes [48, B8, 80, FB, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8804] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8 000000007751c108 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8804] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 000000007751c280 7 bytes [48, B8, C0, FA, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8804] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 000000007751c288 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8804] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 000000007751ccf0 7 bytes [48, B8, 00, FE, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8804] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8 000000007751ccf8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8804] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 000000007751cd40 7 bytes [48, B8, A0, FD, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8804] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8 000000007751cd48 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8804] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 000000007751ce90 7 bytes [48, B8, A0, FB, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8804] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8 000000007751ce98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007751be00 7 bytes [48, B8, 60, F9, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8 000000007751be08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 000000007751bf70 7 bytes [48, B8, E0, F9, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8 000000007751bf78 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 000000007751bf90 7 bytes [48, B8, D0, FD, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 000000007751bf98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 000000007751bfa0 7 bytes [48, B8, C0, FB, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8 000000007751bfa8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007751bfb0 7 bytes [48, B8, 40, F8, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 000000007751bfb8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 000000007751bfd0 7 bytes [48, B8, B0, F8, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 000000007751bfd8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 000000007751c020 7 bytes [48, B8, 50, FA, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8 000000007751c028 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 000000007751c030 7 bytes [48, B8, 20, FE, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8 000000007751c038 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 000000007751c060 7 bytes [48, B8, 40, FB, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8 000000007751c068 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 000000007751c100 7 bytes [48, B8, 80, FB, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8 000000007751c108 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 000000007751c280 7 bytes [48, B8, C0, FA, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 000000007751c288 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 000000007751ccf0 7 bytes [48, B8, 00, FE, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8 000000007751ccf8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 000000007751cd40 7 bytes [48, B8, A0, FD, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8 000000007751cd48 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 000000007751ce90 7 bytes [48, B8, A0, FB, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4292] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8 000000007751ce98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7812] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007751be00 7 bytes [48, B8, 60, F9, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7812] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8 000000007751be08 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7812] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken 000000007751bf70 7 bytes [48, B8, E0, F9, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7812] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8 000000007751bf78 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7812] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 000000007751bf90 7 bytes [48, B8, D0, FD, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7812] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8 000000007751bf98 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7812] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 000000007751bfa0 7 bytes [48, B8, C0, FB, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7812] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8 000000007751bfa8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7812] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007751bfb0 7 bytes [48, B8, 40, F8, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7812] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8 000000007751bfb8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7812] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection 000000007751bfd0 7 bytes [48, B8, B0, F8, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7812] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8 000000007751bfd8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7812] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx 000000007751c020 7 bytes [48, B8, 50, FA, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7812] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8 000000007751c028 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7812] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx 000000007751c030 7 bytes [48, B8, 20, FE, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7812] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8 000000007751c038 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7812] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 000000007751c060 7 bytes [48, B8, 40, FB, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7812] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8 000000007751c068 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7812] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile 000000007751c100 7 bytes [48, B8, 80, FB, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7812] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8 000000007751c108 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7812] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 000000007751c280 7 bytes [48, B8, C0, FA, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7812] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8 000000007751c288 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7812] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken 000000007751ccf0 7 bytes [48, B8, 00, FE, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7812] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8 000000007751ccf8 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7812] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 000000007751cd40 7 bytes [48, B8, A0, FD, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7812] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8 000000007751cd48 6 bytes {ADD [RAX], AL; JMP RAX} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7812] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile 000000007751ce90 7 bytes [48, B8, A0, FB, 6D, 3F, 01] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7812] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8 000000007751ce98 6 bytes {ADD [RAX], AL; JMP RAX} ---- User IAT/EAT - GMER 2.2 ---- IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5856] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenServiceW] [7fee2f36490] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5856] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!CloseServiceHandle] [7fee2f35ca0] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5856] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenSCManagerW] [7fee2f36470] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5856] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!StartServiceW] [7fee2f366e0] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5856] @ C:\Windows\system32\DWrite.dll[ntdll.dll!NtAlpcConnectPort] [7fee2072730] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4740] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenServiceW] [7fee2f36490] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4740] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!CloseServiceHandle] [7fee2f35ca0] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4740] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenSCManagerW] [7fee2f36470] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4740] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!StartServiceW] [7fee2f366e0] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4740] @ C:\Windows\system32\DWrite.dll[ntdll.dll!NtAlpcConnectPort] [7fee2072730] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[9156] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenServiceW] [7fee2f36490] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[9156] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!CloseServiceHandle] [7fee2f35ca0] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[9156] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenSCManagerW] [7fee2f36470] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[9156] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!StartServiceW] [7fee2f366e0] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[9156] @ C:\Windows\system32\DWrite.dll[ntdll.dll!NtAlpcConnectPort] [7fee2072730] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7148] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenServiceW] [7fee2f36490] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7148] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!CloseServiceHandle] [7fee2f35ca0] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7148] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenSCManagerW] [7fee2f36470] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7148] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!StartServiceW] [7fee2f366e0] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7148] @ C:\Windows\system32\DWrite.dll[ntdll.dll!NtAlpcConnectPort] [7fee2072730] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7580] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenServiceW] [7fee2f36490] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7580] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!CloseServiceHandle] [7fee2f35ca0] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7580] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenSCManagerW] [7fee2f36470] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7580] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!StartServiceW] [7fee2f366e0] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7580] @ C:\Windows\system32\DWrite.dll[ntdll.dll!NtAlpcConnectPort] [7fee2072730] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8804] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenServiceW] [7fee2f36490] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8804] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!CloseServiceHandle] [7fee2f35ca0] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8804] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenSCManagerW] [7fee2f36470] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8804] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!StartServiceW] [7fee2f366e0] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[8804] @ C:\Windows\system32\DWrite.dll[ntdll.dll!NtAlpcConnectPort] [7fee2072730] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4292] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenServiceW] [7fee2f36490] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4292] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!CloseServiceHandle] [7fee2f35ca0] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4292] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenSCManagerW] [7fee2f36470] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4292] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!StartServiceW] [7fee2f366e0] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4292] @ C:\Windows\system32\DWrite.dll[ntdll.dll!NtAlpcConnectPort] [7fee2072730] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7812] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenServiceW] [7fee2f36490] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7812] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!CloseServiceHandle] [7fee2f35ca0] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7812] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenSCManagerW] [7fee2f36470] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7812] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!StartServiceW] [7fee2f366e0] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll IAT C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[7812] @ C:\Windows\system32\DWrite.dll[ntdll.dll!NtAlpcConnectPort] [7fee2072730] C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome_child.dll ---- Registry - GMER 2.2 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0009dd500e2b Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Teredo\PreviousState\64-70-02-d8-2f-ac@TeredoAddress 2001:0:9d38:90d7:1c13:f5c2:e048:dc60 Reg HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Epoch@Epoch 8733 Reg HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Epoch2@Epoch 14388 Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0009dd500e2b (not active ControlSet) ---- EOF - GMER 2.2 ----