i dumped the LOG of the EasyAntiCheat.exe memory with OllyDebug. here it is
File 'C:\Windows\SysWOW64\EasyAntiCheat.exe'
New process with ID 00001AE0 created
Main thread with ID 000006A4 created
7616AAA0 New thread with ID 00001844 created
77F19D20 New thread with ID 00001968 created
00360000 Module C:\Windows\SysWOW64\EasyAntiCheat.exe
CRC changed, discarding .udd data
6F770000 Module C:\Program Files (x86)\AVG\Av\avghookx.dll
74300000 Module C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_65 95b64144ccf1df_1.1.10586.545_none_1b71dcef144be902 \gdiplus.dll
74B90000 Module C:\Windows\SYSTEM32\CRYPTBASE.dll
74BA0000 Module C:\Windows\SYSTEM32\SspiCli.dll
74C20000 Module C:\Windows\SYSTEM32\cfgmgr32.dll
74C70000 Module C:\Windows\SYSTEM32\GDI32.dll
74DC0000 Module C:\Windows\SYSTEM32\windows.storage.dll
752C0000 Module C:\Windows\SYSTEM32\bcryptPrimitives.dll
75320000 Module C:\Windows\SYSTEM32\powrprof.dll
75820000 Module C:\Windows\SYSTEM32\combase.dll
75D70000 Module C:\Windows\SYSTEM32\profapi.dll
Invalid or compressed Image Export Directory
75E00000 Module C:\Windows\SYSTEM32\msvcrt.dll
75EC0000 Module C:\Windows\SYSTEM32\RPCRT4.dll
76000000 Module C:\Windows\SYSTEM32\USER32.dll
76150000 Module C:\Windows\SYSTEM32\sechost.dll
761A0000 Module C:\Windows\SYSTEM32\shcore.dll
76230000 Module C:\Windows\SYSTEM32\shlwapi.dll
76300000 Module C:\Windows\SYSTEM32\ADVAPI32.dll
76430000 Module C:\Windows\SYSTEM32\ole32.dll
76520000 Module C:\Windows\SYSTEM32\KERNELBASE.dll
766A0000 Module C:\Windows\SYSTEM32\kernel.appcore.dll
766B0000 Module C:\Windows\SYSTEM32\KERNEL32.DLL
769D0000 Module C:\Windows\SYSTEM32\SHELL32.dll
77E70000 Module C:\Windows\SYSTEM32\ntdll.dll
77EE8D20 Attached process paused at ntdll.DbgBreakPoint
Break on new module(s)
Log file closed
hope it helps
These are the files that EAC loads into the memory. But i'm looking at the KERNELBASE.dll and Kernel.appcore.dll files!!!
