Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-10-01 17:00:36
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1 TOSHIBA_DT01ACA100 rev.MS2OA750 931,51GB
Running: Gmer-19357.exe; Driver: C:\Users\*****\AppData\Local\Temp\kxldqpow.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avp.exe[2324] C:\Windows\SysWOW64\ntdll.dll!NtQueryValueKey 0000000077a4fae8 5 bytes JMP 00000001724028d0
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avp.exe[2324] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077a50078 5 bytes JMP 0000000172402890
.text C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075cc1401 2 bytes JMP 7565b20b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe[2716] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075cc1419 2 bytes JMP 7565b336 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075cc1431 2 bytes JMP 756d8f39 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075cc144a 2 bytes CALL 75634885 C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe[2716] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075cc14dd 2 bytes JMP 756d8832 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075cc14f5 2 bytes JMP 756d8a08 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe[2716] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075cc150d 2 bytes JMP 756d8728 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075cc1525 2 bytes JMP 756d8af2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075cc153d 2 bytes JMP 7564fc98 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe[2716] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075cc1555 2 bytes JMP 756568df C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075cc156d 2 bytes JMP 756d8ff1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075cc1585 2 bytes JMP 756d8b52 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe[2716] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075cc159d 2 bytes JMP 756d86ec C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075cc15b5 2 bytes JMP 7564fd31 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075cc15cd 2 bytes JMP 7565b2cc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075cc16b2 2 bytes JMP 756d8eb4 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075cc16bd 2 bytes JMP 756d8681 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2868] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 0000000075cc1401 2 bytes JMP 7565b20b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2868] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17 0000000075cc1419 2 bytes JMP 7565b336 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2868] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17 0000000075cc1431 2 bytes JMP 756d8f39 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2868] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42 0000000075cc144a 2 bytes CALL 75634885 C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2868] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 0000000075cc14dd 2 bytes JMP 756d8832 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2868] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 0000000075cc14f5 2 bytes JMP 756d8a08 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2868] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 0000000075cc150d 2 bytes JMP 756d8728 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2868] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 0000000075cc1525 2 bytes JMP 756d8af2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2868] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 0000000075cc153d 2 bytes JMP 7564fc98 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2868] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17 0000000075cc1555 2 bytes JMP 756568df C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2868] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 0000000075cc156d 2 bytes JMP 756d8ff1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2868] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17 0000000075cc1585 2 bytes JMP 756d8b52 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2868] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17 0000000075cc159d 2 bytes JMP 756d86ec C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2868] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 0000000075cc15b5 2 bytes JMP 7564fd31 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2868] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 0000000075cc15cd 2 bytes JMP 7565b2cc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2868] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 0000000075cc16b2 2 bytes JMP 756d8eb4 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2868] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 0000000075cc16bd 2 bytes JMP 756d8681 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[1620] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075cc1401 2 bytes JMP 7565b20b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[1620] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075cc1419 2 bytes JMP 7565b336 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[1620] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075cc1431 2 bytes JMP 756d8f39 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[1620] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075cc144a 2 bytes CALL 75634885 C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[1620] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075cc14dd 2 bytes JMP 756d8832 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[1620] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075cc14f5 2 bytes JMP 756d8a08 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[1620] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075cc150d 2 bytes JMP 756d8728 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[1620] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075cc1525 2 bytes JMP 756d8af2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[1620] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075cc153d 2 bytes JMP 7564fc98 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[1620] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075cc1555 2 bytes JMP 756568df C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[1620] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075cc156d 2 bytes JMP 756d8ff1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[1620] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075cc1585 2 bytes JMP 756d8b52 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[1620] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075cc159d 2 bytes JMP 756d86ec C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[1620] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075cc15b5 2 bytes JMP 7564fd31 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[1620] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075cc15cd 2 bytes JMP 7565b2cc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[1620] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075cc16b2 2 bytes JMP 756d8eb4 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[1620] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075cc16bd 2 bytes JMP 756d8681 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000778513ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077851544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000778518ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077851ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077851d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077851e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077851f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077852238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778526e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007789da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007789dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007789dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007789dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007789de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007789e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007789e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007789eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752d13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752d146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752d16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752d19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752d19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752d1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075cc1401 2 bytes JMP 7565b20b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075cc1419 2 bytes JMP 7565b336 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075cc1431 2 bytes JMP 756d8f39 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075cc144a 2 bytes CALL 75634885 C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075cc14dd 2 bytes JMP 756d8832 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075cc14f5 2 bytes JMP 756d8a08 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075cc150d 2 bytes JMP 756d8728 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075cc1525 2 bytes JMP 756d8af2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075cc153d 2 bytes JMP 7564fc98 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075cc1555 2 bytes JMP 756568df C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075cc156d 2 bytes JMP 756d8ff1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075cc1585 2 bytes JMP 756d8b52 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075cc159d 2 bytes JMP 756d86ec C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075cc15b5 2 bytes JMP 7564fd31 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075cc15cd 2 bytes JMP 7565b2cc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075cc16b2 2 bytes JMP 756d8eb4 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5760] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075cc16bd 2 bytes JMP 756d8681 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000778513ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077851544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000778518ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077851ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077851d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077851e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077851f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077852238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778526e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007789da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007789dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007789dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007789dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007789de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007789e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007789e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007789eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752d13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752d146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752d16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752d19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752d19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752d1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 0000000075cc1401 2 bytes JMP 7565b20b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17 0000000075cc1419 2 bytes JMP 7565b336 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17 0000000075cc1431 2 bytes JMP 756d8f39 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42 0000000075cc144a 2 bytes CALL 75634885 C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 0000000075cc14dd 2 bytes JMP 756d8832 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 0000000075cc14f5 2 bytes JMP 756d8a08 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 0000000075cc150d 2 bytes JMP 756d8728 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 0000000075cc1525 2 bytes JMP 756d8af2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 0000000075cc153d 2 bytes JMP 7564fc98 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17 0000000075cc1555 2 bytes JMP 756568df C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 0000000075cc156d 2 bytes JMP 756d8ff1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17 0000000075cc1585 2 bytes JMP 756d8b52 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17 0000000075cc159d 2 bytes JMP 756d86ec C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 0000000075cc15b5 2 bytes JMP 7564fd31 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 0000000075cc15cd 2 bytes JMP 7565b2cc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 0000000075cc16b2 2 bytes JMP 756d8eb4 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\Steam.exe[3684] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 0000000075cc16bd 2 bytes JMP 756d8681 C:\Windows\syswow64\kernel32.dll
.text C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000778513ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077851544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000778518ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077851ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077851d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077851e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077851f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077852238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778526e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007789da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007789dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007789dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007789dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007789de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007789e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007789e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007789eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752d13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752d146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752d16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752d19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752d19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752d1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075cc1401 2 bytes JMP 7565b20b C:\Windows\syswow64\kernel32.dll
.text C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075cc1419 2 bytes JMP 7565b336 C:\Windows\syswow64\kernel32.dll
.text C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075cc1431 2 bytes JMP 756d8f39 C:\Windows\syswow64\kernel32.dll
.text C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075cc144a 2 bytes CALL 75634885 C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075cc14dd 2 bytes JMP 756d8832 C:\Windows\syswow64\kernel32.dll
.text C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075cc14f5 2 bytes JMP 756d8a08 C:\Windows\syswow64\kernel32.dll
.text C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075cc150d 2 bytes JMP 756d8728 C:\Windows\syswow64\kernel32.dll
.text C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075cc1525 2 bytes JMP 756d8af2 C:\Windows\syswow64\kernel32.dll
.text C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075cc153d 2 bytes JMP 7564fc98 C:\Windows\syswow64\kernel32.dll
.text C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075cc1555 2 bytes JMP 756568df C:\Windows\syswow64\kernel32.dll
.text C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075cc156d 2 bytes JMP 756d8ff1 C:\Windows\syswow64\kernel32.dll
.text C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075cc1585 2 bytes JMP 756d8b52 C:\Windows\syswow64\kernel32.dll
.text C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075cc159d 2 bytes JMP 756d86ec C:\Windows\syswow64\kernel32.dll
.text C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075cc15b5 2 bytes JMP 7564fd31 C:\Windows\syswow64\kernel32.dll
.text C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075cc15cd 2 bytes JMP 7565b2cc C:\Windows\syswow64\kernel32.dll
.text C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075cc16b2 2 bytes JMP 756d8eb4 C:\Windows\syswow64\kernel32.dll
.text C:\Users\*****\AppData\Local\Dropbox\Update\DropboxUpdate.exe[4012] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075cc16bd 2 bytes JMP 756d8681 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000778513ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077851544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000778518ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077851ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077851d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077851e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077851f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077852238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778526e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007789da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007789dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007789dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007789dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007789de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007789e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007789e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007789eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752d13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752d146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752d16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752d19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752d19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[5948] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752d1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000778513ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077851544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000778518ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077851ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077851d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077851e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077851f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077852238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778526e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007789da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007789dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007789dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007789dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007789de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007789e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007789e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007789eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752d13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752d146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752d16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752d19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752d19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[6232] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752d1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000778513ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077851544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000778518ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077851ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077851d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077851e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077851f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077852238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778526e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007789da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007789dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007789dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007789dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007789de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007789e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007789e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007789eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752d13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752d146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752d16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752d19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752d19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe[6240] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752d1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000778513ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077851544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000778518ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077851ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077851d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077851e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077851f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077852238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778526e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007789da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007789dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007789dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007789dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007789de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007789e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007789e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007789eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752d13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752d146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752d16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752d19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752d19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe[6280] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752d1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000778513ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077851544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000778518ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077851ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077851d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077851e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077851f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077852238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778526e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007789da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007789dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007789dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007789dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007789de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007789e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007789e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007789eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752d13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752d146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752d16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752d19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752d19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Browny02\BrYNSvc.exe[6392] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752d1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000778513ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077851544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000778518ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077851ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077851d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077851e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077851f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077852238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778526e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007789da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007789dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007789dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007789dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007789de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007789e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007789e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007789eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752d13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752d146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752d16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752d19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752d19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[6720] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752d1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000778513ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077851544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000778518ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077851ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077851d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077851e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077851f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077852238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778526e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007789da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007789dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007789dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007789dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007789de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007789e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007789e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007789eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752d13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752d146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752d16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752d19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752d19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752d1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075cc1401 2 bytes JMP 7565b20b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075cc1419 2 bytes JMP 7565b336 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075cc1431 2 bytes JMP 756d8f39 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075cc144a 2 bytes CALL 75634885 C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075cc14dd 2 bytes JMP 756d8832 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075cc14f5 2 bytes JMP 756d8a08 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075cc150d 2 bytes JMP 756d8728 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075cc1525 2 bytes JMP 756d8af2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075cc153d 2 bytes JMP 7564fc98 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075cc1555 2 bytes JMP 756568df C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075cc156d 2 bytes JMP 756d8ff1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075cc1585 2 bytes JMP 756d8b52 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075cc159d 2 bytes JMP 756d86ec C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075cc15b5 2 bytes JMP 7564fd31 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075cc15cd 2 bytes JMP 7565b2cc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075cc16b2 2 bytes JMP 756d8eb4 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[7808] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075cc16bd 2 bytes JMP 756d8681 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000778513ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077851544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000778518ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077851ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077851d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077851e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077851f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077852238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778526e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007789da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007789dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007789dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007789dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007789de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007789e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007789e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007789eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752d13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752d146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752d16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752d19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752d19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752d1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 0000000075cc1401 2 bytes JMP 7565b20b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17 0000000075cc1419 2 bytes JMP 7565b336 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17 0000000075cc1431 2 bytes JMP 756d8f39 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42 0000000075cc144a 2 bytes CALL 75634885 C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 0000000075cc14dd 2 bytes JMP 756d8832 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 0000000075cc14f5 2 bytes JMP 756d8a08 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 0000000075cc150d 2 bytes JMP 756d8728 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 0000000075cc1525 2 bytes JMP 756d8af2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 0000000075cc153d 2 bytes JMP 7564fc98 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17 0000000075cc1555 2 bytes JMP 756568df C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 0000000075cc156d 2 bytes JMP 756d8ff1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17 0000000075cc1585 2 bytes JMP 756d8b52 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17 0000000075cc159d 2 bytes JMP 756d86ec C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 0000000075cc15b5 2 bytes JMP 7564fd31 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 0000000075cc15cd 2 bytes JMP 7565b2cc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 0000000075cc16b2 2 bytes JMP 756d8eb4 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[7944] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 0000000075cc16bd 2 bytes JMP 756d8681 C:\Windows\syswow64\kernel32.dll
.text C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000778513ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077851544 8 bytes [60, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000778518ce 8 bytes [50, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077851ba8 8 bytes [40, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077851d25 8 bytes [30, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077851e8f 8 bytes [20, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077851f75 8 bytes [10, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680 0000000077852238 8 bytes [00, 6E, F8, 7E, 00, 00, 00, ...]
.text C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778526e0 8 bytes [F0, 6D, F8, 7E, 00, 00, 00, ...]
.text C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 000000007789da80 8 bytes {JMP QWORD [RIP-0x4bd61]}
.text C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 000000007789dc00 8 bytes {JMP QWORD [RIP-0x4bd77]}
.text C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007789dc30 8 bytes {JMP QWORD [RIP-0x4c6f2]}
.text C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007789dd50 8 bytes {JMP QWORD [RIP-0x4c1ae]}
.text C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 000000007789de00 8 bytes {JMP QWORD [RIP-0x4c538]}
.text C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 000000007789e430 8 bytes {JMP QWORD [RIP-0x4bd56]}
.text C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 000000007789e680 8 bytes {JMP QWORD [RIP-0x4c44e]}
.text C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000000007789eee0 8 bytes {JMP QWORD [RIP-0x4cf71]}
.text C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000752d13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 00000000752d146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000752d16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000752d19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000752d19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\*****\Desktop\Gmer-19357.exe[4956] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 00000000752d1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\606c667c0adc
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\68172963c29c
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\6817296ab930
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\606c667c0adc (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\68172963c29c (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\6817296ab930 (not active ControlSet)
---- EOF - GMER 2.1 ----
|
Lesestoff:
Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
AdwCleaner auf deinen Desktop.
FRST 32-Bit | FRST 64-Bit