Spyware / Malware / Virus Removal
Xplorer just Crashes
249 min read
← Previous
Page 2 of 3
Next →
This thread's last reply is from May 1, 2011, 8:37 PM UTC . Advice, software, and links
below may be out of date — treat specific steps and download links with caution.
Looking for the outcome? ✨ Ask AI
Hi Satchfan hear is more >>> GMER NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1004] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Windows\System32\svchost.exe[1004] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1004] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Windows\System32\svchost.exe[1004] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1004] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Windows\System32\svchost.exe[1004] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1004] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Windows\System32\svchost.exe[1004] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1004] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Windows\System32\svchost.exe[1004] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1004] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [EC, 70]
.text C:\Windows\System32\svchost.exe[1004] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1004] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\System32\svchost.exe[1004] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1004] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Windows\System32\svchost.exe[1004] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1004] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\System32\svchost.exe[1004] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1004] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [04, 71] {ADD AL, 0x71}
.text C:\Windows\System32\svchost.exe[1004] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1004] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Windows\System32\svchost.exe[1004] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1004] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Windows\System32\svchost.exe[1004] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1004] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Windows\System32\svchost.exe[1004] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1004] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Windows\System32\svchost.exe[1004] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
Hi Satchfan hear is more >>> GMER .text C:\Windows\system32\svchost.exe[968] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Windows\system32\svchost.exe[968] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Windows\system32\svchost.exe[968] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Windows\system32\svchost.exe[968] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703F000A
.text C:\Windows\system32\svchost.exe[968] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Windows\system32\svchost.exe[968] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7073000A
.text C:\Windows\system32\svchost.exe[968] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Windows\system32\svchost.exe[968] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Windows\system32\svchost.exe[968] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Windows\system32\svchost.exe[968] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[968] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Windows\system32\svchost.exe[968] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704E000A
.text C:\Windows\system32\svchost.exe[968] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7070000A
.text C:\Windows\system32\svchost.exe[968] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Windows\system32\svchost.exe[968] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7092000A
.text C:\Windows\system32\svchost.exe[968] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7079000A
.text C:\Windows\system32\svchost.exe[968] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7045000A
.text C:\Windows\system32\svchost.exe[968] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A
.text C:\Windows\system32\svchost.exe[968] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7095000A
.text C:\Windows\system32\svchost.exe[968] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Windows\system32\svchost.exe[968] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 704B000A
.text C:\Windows\system32\svchost.exe[968] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A
.text C:\Windows\system32\svchost.exe[968] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Windows\system32\svchost.exe[968] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708B000A
.text C:\Windows\system32\svchost.exe[968] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705B000A
.text C:\Windows\system32\svchost.exe[968] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Windows\system32\svchost.exe[968] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Windows\system32\svchost.exe[968] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Windows\system32\svchost.exe[968] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707F000A
.text C:\Windows\system32\svchost.exe[968] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7082000A
.text C:\Windows\system32\svchost.exe[968] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Windows\system32\svchost.exe[968] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7085000A
.text C:\Windows\system32\svchost.exe[968] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Windows\system32\svchost.exe[968] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Windows\system32\svchost.exe[968] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Windows\system32\svchost.exe[968] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Windows\system32\svchost.exe[968] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7088000A
.text C:\Windows\system32\svchost.exe[968] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[968] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Windows\system32\svchost.exe[968] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Windows\system32\svchost.exe[968] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Windows\system32\svchost.exe[968] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Windows\system32\svchost.exe[968] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Windows\system32\svchost.exe[968] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[968] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
.text C:\Windows\system32\svchost.exe[968] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[968] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70}
.text C:\Windows\system32\svchost.exe[968] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7067000A
.text C:\Windows\system32\svchost.exe[968] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7064000A
.text C:\Windows\system32\svchost.exe[968] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Windows\system32\svchost.exe[968] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 706A000A
.text C:\Windows\system32\svchost.exe[968] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7051000A
.text C:\Windows\system32\svchost.exe[968] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706D000A
.text C:\Windows\system32\svchost.exe[968] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7054000A
.text C:\Windows\system32\svchost.exe[968] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Windows\system32\svchost.exe[968] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Windows\system32\svchost.exe[968] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Windows\system32\svchost.exe[968] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A
.text C:\Windows\system32\svchost.exe[968] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Windows\system32\svchost.exe[968] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Windows\system32\svchost.exe[968] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Windows\system32\svchost.exe[968] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A
.text C:\Windows\System32\svchost.exe[1004] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1004] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Windows\System32\svchost.exe[1004] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1004] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\System32\svchost.exe[1004] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1004] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Windows\System32\svchost.exe[1004] ntdll.dll!
.text C:\Windows\System32\svchost.exe[1004] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Windows\System32\svchost.exe[1004] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 712F000A
.text C:\Windows\System32\svchost.exe[1004] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 711A000A
.text C:\Windows\System32\svchost.exe[1004] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 711D000A
.text C:\Windows\System32\svchost.exe[1004] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 712C000A
.text C:\Windows\System32\svchost.exe[1004] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 7092000A
.text C:\Windows\System32\svchost.exe[1004] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7014000A
.text C:\Windows\System32\svchost.exe[1004] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 7075000A
.text C:\Windows\System32\svchost.exe[1004] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 702A000A
.text C:\Windows\System32\svchost.exe[1004] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 702D000A
.text C:\Windows\System32\svchost.exe[1004] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 700E000A
.text C:\Windows\System32\svchost.exe[1004] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7042000A
.text C:\Windows\System32\svchost.exe[1004] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Windows\System32\svchost.exe[1004] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 7126000A
.text C:\Windows\System32\svchost.exe[1004] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 7048000A
.text C:\Windows\System32\svchost.exe[1004] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 7129000A
.text C:\Windows\System32\svchost.exe[1004] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 70D5000A
.text C:\Windows\System32\svchost.exe[1004] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 70F0000A
.text C:\Windows\System32\svchost.exe[1004] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7102000A
.text C:\Windows\System32\svchost.exe[1004] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 700B000A
.text C:\Windows\System32\svchost.exe[1004] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 70DC000A
.text C:\Windows\System32\svchost.exe[1004] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 703F000A
.text C:\Windows\System32\svchost.exe[1004] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 7095000A
.text C:\Windows\System32\svchost.exe[1004] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70A2000A
.text C:\Windows\System32\svchost.exe[1004] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 7098000A
.text C:\Windows\System32\svchost.exe[1004] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1004] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [39, 71]
.text C:\Windows\System32\svchost.exe[1004] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 701A000A
.text C:\Windows\System32\svchost.exe[1004] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 703C000A
.text C:\Windows\System32\svchost.exe[1004] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 709F000A
.text C:\Windows\System32\svchost.exe[1004] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 705E000A
.text C:\Windows\System32\svchost.exe[1004] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7045000A
.text C:\Windows\System32\svchost.exe[1004] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7011000A
.text C:\Windows\System32\svchost.exe[1004] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 7078000A
.text C:\Windows\System32\svchost.exe[1004] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7061000A
.text C:\Windows\System32\svchost.exe[1004] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 70FF000A
.text C:\Windows\System32\svchost.exe[1004] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 7017000A
.text C:\Windows\System32\svchost.exe[1004] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 7072000A
.text C:\Windows\System32\svchost.exe[1004] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 710B000A
.text C:\Windows\System32\svchost.exe[1004] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 7057000A
.text C:\Windows\System32\svchost.exe[1004] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 7027000A
.text C:\Windows\System32\svchost.exe[1004] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 70D2000A
.text C:\Windows\System32\svchost.exe[1004] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 70CC000A
.text C:\Windows\System32\svchost.exe[1004] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70C6000A
.text C:\Windows\System32\svchost.exe[1004] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 704B000A
.text C:\Windows\System32\svchost.exe[1004] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 704E000A
.text C:\Windows\System32\svchost.exe[1004] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70C9000A
.text C:\Windows\System32\svchost.exe[1004] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7051000A
.text C:\Windows\System32\svchost.exe[1004] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 70CF000A
.text C:\Windows\System32\svchost.exe[1004] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70C0000A
.text C:\Windows\System32\svchost.exe[1004] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70C3000A
.text C:\Windows\System32\svchost.exe[1004] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70BD000A
.text C:\Windows\System32\svchost.exe[1004] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7054000A
.text C:\Windows\System32\svchost.exe[1004] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1004] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [DE, 70]
.text C:\Windows\System32\svchost.exe[1004] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7123000A
.text C:\Windows\System32\svchost.exe[1004] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 70F9000A
.text C:\Windows\System32\svchost.exe[1004] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7120000A
.text C:\Windows\System32\svchost.exe[1004] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 70E2000A
.text C:\Windows\System32\svchost.exe[1004] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1004] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [F5, 70]
.text C:\Windows\System32\svchost.exe[1004] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1004] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [7E, 70] {JLE 0x72}
.text C:\Windows\System32\svchost.exe[1004] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7033000A
.text C:\Windows\System32\svchost.exe[1004] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7030000A
.text C:\Windows\System32\svchost.exe[1004] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 70FC000A
.text C:\Windows\System32\svchost.exe[1004] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 7036000A
.text C:\Windows\System32\svchost.exe[1004] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 701D000A
.text C:\Windows\System32\svchost.exe[1004] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 7039000A
.text C:\Windows\System32\svchost.exe[1004] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7020000A
.text C:\Windows\System32\svchost.exe[1004] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 70F3000A
.text C:\Windows\System32\svchost.exe[1004] USER32.dll!EndTask 7711AD32 6 Bytes JMP 7108000A
.text C:\Windows\System32\svchost.exe[1004] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7114000A
.text C:\Windows\System32\svchost.exe[1004] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 7068000A
.text C:\Windows\System32\svchost.exe[1004] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 710E000A
.text C:\Windows\System32\svchost.exe[1004] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7111000A
.text C:\Windows\System32\svchost.exe[1004] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 7117000A
.text C:\Windows\System32\svchost.exe[1004] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 706B000A
.text C:\Windows\System32\svchost.exe[1216] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1216] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Windows\System32\svchost.exe[1216] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1216] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\System32\svchost.exe[1216] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1216] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Windows\System32\svchost.exe[1216] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1216] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Windows\System32\svchost.exe[1216] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1216] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Windows\System32\svchost.exe[1216] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1216] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Windows\System32\svchost.exe[1216] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1216] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Windows\System32\svchost.exe[1216] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1216] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Windows\System32\svchost.exe[1216] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1216] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71]
.text C:\Windows\System32\svchost.exe[1216] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1216] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\System32\svchost.exe[1216] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1216] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Windows\System32\svchost.exe[1216] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1216] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\System32\svchost.exe[1216] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1216] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71]
.text C:\Windows\System32\svchost.exe[1216] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1216] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Windows\System32\svchost.exe[1216] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1216] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Windows\System32\svchost.exe[1216] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1216] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Windows\System32\svchost.exe[1216] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1216] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Windows\System32\svchost.exe[1216] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1216] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Windows\System32\svchost.exe[1216] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
Hi Satchfan hear is more >>> GMER .text C:\Windows\System32\svchost.exe[1216] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Windows\System32\svchost.exe[1216] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Windows\System32\svchost.exe[1216] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Windows\System32\svchost.exe[1216] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A
.text C:\Windows\System32\svchost.exe[1216] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 703E000A
.text C:\Windows\System32\svchost.exe[1216] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A
.text C:\Windows\System32\svchost.exe[1216] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 7054000A
.text C:\Windows\System32\svchost.exe[1216] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7057000A
.text C:\Windows\System32\svchost.exe[1216] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7038000A
.text C:\Windows\System32\svchost.exe[1216] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 706C000A
.text C:\Windows\System32\svchost.exe[1216] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Windows\System32\svchost.exe[1216] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Windows\System32\svchost.exe[1216] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707C000A
.text C:\Windows\System32\svchost.exe[1216] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Windows\System32\svchost.exe[1216] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Windows\System32\svchost.exe[1216] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Windows\System32\svchost.exe[1216] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Windows\System32\svchost.exe[1216] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 7035000A
.text C:\Windows\System32\svchost.exe[1216] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Windows\System32\svchost.exe[1216] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7069000A
.text C:\Windows\System32\svchost.exe[1216] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Windows\System32\svchost.exe[1216] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Windows\System32\svchost.exe[1216] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Windows\System32\svchost.exe[1216] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1216] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Windows\System32\svchost.exe[1216] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 7044000A
.text C:\Windows\System32\svchost.exe[1216] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7066000A
.text C:\Windows\System32\svchost.exe[1216] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Windows\System32\svchost.exe[1216] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7092000A
.text C:\Windows\System32\svchost.exe[1216] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7079000A
.text C:\Windows\System32\svchost.exe[1216] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 703B000A
.text C:\Windows\System32\svchost.exe[1216] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A
.text C:\Windows\System32\svchost.exe[1216] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7095000A
.text C:\Windows\System32\svchost.exe[1216] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Windows\System32\svchost.exe[1216] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 7041000A
.text C:\Windows\System32\svchost.exe[1216] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A
.text C:\Windows\System32\svchost.exe[1216] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Windows\System32\svchost.exe[1216] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708B000A
.text C:\Windows\System32\svchost.exe[1216] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 7051000A
.text C:\Windows\System32\svchost.exe[1216] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Windows\System32\svchost.exe[1216] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Windows\System32\svchost.exe[1216] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Windows\System32\svchost.exe[1216] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707F000A
.text C:\Windows\System32\svchost.exe[1216] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7082000A
.text C:\Windows\System32\svchost.exe[1216] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Windows\System32\svchost.exe[1216] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7085000A
.text C:\Windows\System32\svchost.exe[1216] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Windows\System32\svchost.exe[1216] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Windows\System32\svchost.exe[1216] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Windows\System32\svchost.exe[1216] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Windows\System32\svchost.exe[1216] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7088000A
.text C:\Windows\System32\svchost.exe[1216] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1216] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Windows\System32\svchost.exe[1216] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Windows\System32\svchost.exe[1216] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Windows\System32\svchost.exe[1216] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Windows\System32\svchost.exe[1216] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Windows\System32\svchost.exe[1216] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1216] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
.text C:\Windows\System32\svchost.exe[1216] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1216] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70}
.text C:\Windows\System32\svchost.exe[1216] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 705D000A
.text C:\Windows\System32\svchost.exe[1216] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 705A000A
.text C:\Windows\System32\svchost.exe[1216] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Windows\System32\svchost.exe[1216] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 7060000A
.text C:\Windows\System32\svchost.exe[1216] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7047000A
.text C:\Windows\System32\svchost.exe[1216] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 7063000A
.text C:\Windows\System32\svchost.exe[1216] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 704A000A
.text C:\Windows\System32\svchost.exe[1216] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Windows\System32\svchost.exe[1216] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Windows\System32\svchost.exe[1216] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Windows\System32\svchost.exe[1216] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A
.text C:\Windows\System32\svchost.exe[1216] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Windows\System32\svchost.exe[1216] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Windows\System32\svchost.exe[1216] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Windows\System32\svchost.exe[1216] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A
.text C:\Windows\System32\svchost.exe[1272] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1272] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Windows\System32\svchost.exe[1272] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1272] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\System32\svchost.exe[1272] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1272] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Windows\System32\svchost.exe[1272] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1272] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Windows\System32\svchost.exe[1272] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1272] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Windows\System32\svchost.exe[1272] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1272] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Windows\System32\svchost.exe[1272] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1272] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Windows\System32\svchost.exe[1272] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1272] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Windows\System32\svchost.exe[1272] ntdll.dll!
Hi Satchfan hear is more >>> GMER NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1272] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71]
.text C:\Windows\System32\svchost.exe[1272] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1272] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\System32\svchost.exe[1272] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1272] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Windows\System32\svchost.exe[1272] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1272] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\System32\svchost.exe[1272] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1272] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71]
.text C:\Windows\System32\svchost.exe[1272] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1272] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Windows\System32\svchost.exe[1272] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1272] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Windows\System32\svchost.exe[1272] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1272] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Windows\System32\svchost.exe[1272] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1272] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Windows\System32\svchost.exe[1272] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1272] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Windows\System32\svchost.exe[1272] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Windows\System32\svchost.exe[1272] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Windows\System32\svchost.exe[1272] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Windows\System32\svchost.exe[1272] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Windows\System32\svchost.exe[1272] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A
.text C:\Windows\System32\svchost.exe[1272] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7048000A
.text C:\Windows\System32\svchost.exe[1272] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A
.text C:\Windows\System32\svchost.exe[1272] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705E000A
.text C:\Windows\System32\svchost.exe[1272] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7061000A
.text C:\Windows\System32\svchost.exe[1272] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7042000A
.text C:\Windows\System32\svchost.exe[1272] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7076000A
.text C:\Windows\System32\svchost.exe[1272] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Windows\System32\svchost.exe[1272] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Windows\System32\svchost.exe[1272] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707C000A
.text C:\Windows\System32\svchost.exe[1272] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Windows\System32\svchost.exe[1272] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Windows\System32\svchost.exe[1272] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Windows\System32\svchost.exe[1272] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Windows\System32\svchost.exe[1272] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703F000A
.text C:\Windows\System32\svchost.exe[1272] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Windows\System32\svchost.exe[1272] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7073000A
.text C:\Windows\System32\svchost.exe[1272] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Windows\System32\svchost.exe[1272] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Windows\System32\svchost.exe[1272] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Windows\System32\svchost.exe[1272] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1272] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Windows\System32\svchost.exe[1272] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704E000A
.text C:\Windows\System32\svchost.exe[1272] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7070000A
.text C:\Windows\System32\svchost.exe[1272] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Windows\System32\svchost.exe[1272] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7092000A
.text C:\Windows\System32\svchost.exe[1272] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7079000A
.text C:\Windows\System32\svchost.exe[1272] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7045000A
.text C:\Windows\System32\svchost.exe[1272] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A
.text C:\Windows\System32\svchost.exe[1272] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7095000A
.text C:\Windows\System32\svchost.exe[1272] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Windows\System32\svchost.exe[1272] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 704B000A
.text C:\Windows\System32\svchost.exe[1272] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A
.text C:\Windows\System32\svchost.exe[1272] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Windows\System32\svchost.exe[1272] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708B000A
.text C:\Windows\System32\svchost.exe[1272] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705B000A
.text C:\Windows\System32\svchost.exe[1272] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Windows\System32\svchost.exe[1272] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Windows\System32\svchost.exe[1272] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Windows\System32\svchost.exe[1272] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707F000A
.text C:\Windows\System32\svchost.exe[1272] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7082000A
.text C:\Windows\System32\svchost.exe[1272] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Windows\System32\svchost.exe[1272] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7085000A
.text C:\Windows\System32\svchost.exe[1272] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Windows\System32\svchost.exe[1272] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Windows\System32\svchost.exe[1272] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Windows\System32\svchost.exe[1272] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Windows\System32\svchost.exe[1272] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7088000A
.text C:\Windows\System32\svchost.exe[1272] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1272] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Windows\System32\svchost.exe[1272] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Windows\System32\svchost.exe[1272] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Windows\System32\svchost.exe[1272] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Windows\System32\svchost.exe[1272] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Windows\System32\svchost.exe[1272] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1272] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
.text C:\Windows\System32\svchost.exe[1272] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[1272] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70}
.text C:\Windows\System32\svchost.exe[1272] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7067000A
.text C:\Windows\System32\svchost.exe[1272] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7064000A
.text C:\Windows\System32\svchost.exe[1272] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Windows\System32\svchost.exe[1272] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 706A000A
.text C:\Windows\System32\svchost.exe[1272] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7051000A
.text C:\Windows\System32\svchost.exe[1272] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706D000A
.text C:\Windows\System32\svchost.exe[1272] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7054000A
.text C:\Windows\System32\svchost.exe[1272] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Windows\System32\svchost.exe[1272] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Windows\System32\svchost.exe[1272] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Windows\System32\svchost.exe[1272] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A
.text C:\Windows\System32\svchost.exe[1272] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Windows\System32\svchost.exe[1272] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Windows\System32\svchost.exe[1272] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Windows\System32\svchost.exe[1272] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A
.text C:\Windows\system32\svchost.exe[1300] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1300] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Windows\system32\svchost.exe[1300] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1300] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\system32\svchost.exe[1300] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1300] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Windows\system32\svchost.exe[1300] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1300] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Windows\system32\svchost.exe[1300] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1300] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Windows\system32\svchost.exe[1300] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1300] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Windows\system32\svchost.exe[1300] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1300] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Windows\system32\svchost.exe[1300] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1300] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Windows\system32\svchost.exe[1300] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1300] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71]
.text C:\Windows\system32\svchost.exe[1300] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1300] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\svchost.exe[1300] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1300] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Windows\system32\svchost.exe[1300] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1300] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\system32\svchost.exe[1300] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1300] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71]
.text C:\Windows\system32\svchost.exe[1300] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1300] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Windows\system32\svchost.exe[1300] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1300] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Windows\system32\svchost.exe[1300] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1300] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Windows\system32\svchost.exe[1300] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1300] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Windows\system32\svchost.exe[1300] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1300] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Windows\system32\svchost.exe[1300] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Windows\system32\svchost.exe[1300] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Windows\system32\svchost.exe[1300] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Windows\system32\svchost.exe[1300] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Windows\system32\svchost.exe[1300] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A
.text C:\Windows\system32\svchost.exe[1300] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7048000A
.text C:\Windows\system32\svchost.exe[1300] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A
.text C:\Windows\system32\svchost.exe[1300] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705E000A
.text C:\Windows\system32\svchost.exe[1300] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7061000A
.text C:\Windows\system32\svchost.exe[1300] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7042000A
.text C:\Windows\system32\svchost.exe[1300] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7076000A
.text C:\Windows\system32\svchost.exe[1300] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\svchost.exe[1300] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Windows\system32\svchost.exe[1300] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707C000A
.text C:\Windows\system32\svchost.exe[1300] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Windows\system32\svchost.exe[1300] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Windows\system32\svchost.exe[1300] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Windows\system32\svchost.exe[1300] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Windows\system32\svchost.exe[1300] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703F000A
.text C:\Windows\system32\svchost.exe[1300] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Windows\system32\svchost.exe[1300] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7073000A
.text C:\Windows\system32\svchost.exe[1300] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Windows\system32\svchost.exe[1300] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Windows\system32\svchost.exe[1300] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Windows\system32\svchost.exe[1300] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1300] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Windows\system32\svchost.exe[1300] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704E000A
.text C:\Windows\system32\svchost.exe[1300] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7070000A
.text C:\Windows\system32\svchost.exe[1300] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Windows\system32\svchost.exe[1300] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7092000A
.text C:\Windows\system32\svchost.exe[1300] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7079000A
.text C:\Windows\system32\svchost.exe[1300] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7045000A
.text C:\Windows\system32\svchost.exe[1300] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A
.text C:\Windows\system32\svchost.exe[1300] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7095000A
.text C:\Windows\system32\svchost.exe[1300] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Windows\system32\svchost.exe[1300] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 704B000A
.text C:\Windows\system32\svchost.exe[1300] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A
.text C:\Windows\system32\svchost.exe[1300] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Windows\system32\svchost.exe[1300] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708B000A
.text C:\Windows\system32\svchost.exe[1300] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705B000A
.text C:\Windows\system32\svchost.exe[1300] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Windows\system32\svchost.exe[1300] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Windows\system32\svchost.exe[1300] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Windows\system32\svchost.exe[1300] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707F000A
.text C:\Windows\system32\svchost.exe[1300] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7082000A
.text C:\Windows\system32\svchost.exe[1300] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Windows\system32\svchost.exe[1300] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7085000A
.text C:\Windows\system32\svchost.exe[1300] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Windows\system32\svchost.exe[1300] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Windows\system32\svchost.exe[1300] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Windows\system32\svchost.exe[1300] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Windows\system32\svchost.exe[1300] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7088000A
.text C:\Windows\system32\svchost.exe[1300] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1300] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Windows\system32\svchost.exe[1300] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Windows\system32\svchost.exe[1300] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Windows\system32\svchost.exe[1300] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Windows\system32\svchost.exe[1300] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Windows\system32\svchost.exe[1300] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1300] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
Hi Satchfan hear is more >>> GMER .text C:\Windows\system32\svchost.exe[1300] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1300] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70}
.text C:\Windows\system32\svchost.exe[1300] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7067000A
.text C:\Windows\system32\svchost.exe[1300] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7064000A
.text C:\Windows\system32\svchost.exe[1300] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Windows\system32\svchost.exe[1300] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 706A000A
.text C:\Windows\system32\svchost.exe[1300] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7051000A
.text C:\Windows\system32\svchost.exe[1300] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706D000A
.text C:\Windows\system32\svchost.exe[1300] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7054000A
.text C:\Windows\system32\svchost.exe[1300] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Windows\system32\svchost.exe[1300] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Windows\system32\svchost.exe[1300] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Windows\system32\svchost.exe[1300] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A
.text C:\Windows\system32\svchost.exe[1300] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Windows\system32\svchost.exe[1300] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Windows\system32\svchost.exe[1300] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Windows\system32\svchost.exe[1300] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A
.text C:\Windows\system32\svchost.exe[1380] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1380] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Windows\system32\svchost.exe[1380] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1380] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\system32\svchost.exe[1380] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1380] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Windows\system32\svchost.exe[1380] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1380] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Windows\system32\svchost.exe[1380] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1380] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Windows\system32\svchost.exe[1380] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1380] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Windows\system32\svchost.exe[1380] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1380] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Windows\system32\svchost.exe[1380] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1380] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Windows\system32\svchost.exe[1380] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1380] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71]
.text C:\Windows\system32\svchost.exe[1380] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1380] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\svchost.exe[1380] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1380] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Windows\system32\svchost.exe[1380] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1380] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\system32\svchost.exe[1380] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1380] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71]
.text C:\Windows\system32\svchost.exe[1380] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1380] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Windows\system32\svchost.exe[1380] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1380] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Windows\system32\svchost.exe[1380] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1380] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Windows\system32\svchost.exe[1380] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1380] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Windows\system32\svchost.exe[1380] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1380] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Windows\system32\svchost.exe[1380] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Windows\system32\svchost.exe[1380] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Windows\system32\svchost.exe[1380] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Windows\system32\svchost.exe[1380] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Windows\system32\svchost.exe[1380] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A
.text C:\Windows\system32\svchost.exe[1380] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7048000A
.text C:\Windows\system32\svchost.exe[1380] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A
.text C:\Windows\system32\svchost.exe[1380] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705E000A
.text C:\Windows\system32\svchost.exe[1380] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7061000A
.text C:\Windows\system32\svchost.exe[1380] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7042000A
.text C:\Windows\system32\svchost.exe[1380] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7076000A
.text C:\Windows\system32\svchost.exe[1380] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\svchost.exe[1380] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Windows\system32\svchost.exe[1380] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707C000A
.text C:\Windows\system32\svchost.exe[1380] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Windows\system32\svchost.exe[1380] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Windows\system32\svchost.exe[1380] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Windows\system32\svchost.exe[1380] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Windows\system32\svchost.exe[1380] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703F000A
.text C:\Windows\system32\svchost.exe[1380] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Windows\system32\svchost.exe[1380] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7073000A
.text C:\Windows\system32\svchost.exe[1380] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Windows\system32\svchost.exe[1380] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Windows\system32\svchost.exe[1380] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Windows\system32\svchost.exe[1380] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1380] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Windows\system32\svchost.exe[1380] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704E000A
.text C:\Windows\system32\svchost.exe[1380] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7070000A
.text C:\Windows\system32\svchost.exe[1380] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Windows\system32\svchost.exe[1380] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7092000A
.text C:\Windows\system32\svchost.exe[1380] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7079000A
.text C:\Windows\system32\svchost.exe[1380] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7045000A
.text C:\Windows\system32\svchost.exe[1380] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A
.text C:\Windows\system32\svchost.exe[1380] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7095000A
.text C:\Windows\system32\svchost.exe[1380] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Windows\system32\svchost.exe[1380] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 704B000A
.text C:\Windows\system32\svchost.exe[1380] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A
.text C:\Windows\system32\svchost.exe[1380] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Windows\system32\svchost.exe[1380] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708B000A
.text C:\Windows\system32\svchost.exe[1380] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705B000A
.text C:\Windows\system32\svchost.exe[1380] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Windows\system32\svchost.exe[1380] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Windows\system32\svchost.exe[1380] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Windows\system32\svchost.exe[1380] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707F000A
.text C:\Windows\system32\svchost.exe[1380] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7082000A
.text C:\Windows\system32\svchost.exe[1380] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Windows\system32\svchost.exe[1380] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7085000A
.text C:\Windows\system32\svchost.exe[1380] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Windows\system32\svchost.exe[1380] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Windows\system32\svchost.exe[1380] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Windows\system32\svchost.exe[1380] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Windows\system32\svchost.exe[1380] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7088000A
.text C:\Windows\system32\svchost.exe[1380] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1380] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Windows\system32\svchost.exe[1380] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Windows\system32\svchost.exe[1380] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Windows\system32\svchost.exe[1380] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Windows\system32\svchost.exe[1380] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Windows\system32\svchost.exe[1380] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1380] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
.text C:\Windows\system32\svchost.exe[1380] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1380] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70}
.text C:\Windows\system32\svchost.exe[1380] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7067000A
.text C:\Windows\system32\svchost.exe[1380] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7064000A
.text C:\Windows\system32\svchost.exe[1380] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Windows\system32\svchost.exe[1380] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 706A000A
.text C:\Windows\system32\svchost.exe[1380] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7051000A
.text C:\Windows\system32\svchost.exe[1380] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706D000A
.text C:\Windows\system32\svchost.exe[1380] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7054000A
.text C:\Windows\system32\svchost.exe[1380] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Windows\system32\svchost.exe[1380] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Windows\system32\svchost.exe[1380] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Windows\system32\svchost.exe[1380] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A
.text C:\Windows\system32\svchost.exe[1380] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Windows\system32\svchost.exe[1380] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Windows\system32\svchost.exe[1380] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Windows\system32\svchost.exe[1380] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A
.text C:\Windows\system32\svchost.exe[1436] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1436] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Windows\system32\svchost.exe[1436] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1436] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\system32\svchost.exe[1436] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1436] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Windows\system32\svchost.exe[1436] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1436] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Windows\system32\svchost.exe[1436] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1436] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Windows\system32\svchost.exe[1436] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1436] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Windows\system32\svchost.exe[1436] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1436] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Windows\system32\svchost.exe[1436] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1436] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Windows\system32\svchost.exe[1436] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1436] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71]
.text C:\Windows\system32\svchost.exe[1436] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1436] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\svchost.exe[1436] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1436] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Windows\system32\svchost.exe[1436] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1436] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\system32\svchost.exe[1436] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1436] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71]
.text C:\Windows\system32\svchost.exe[1436] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1436] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Windows\system32\svchost.exe[1436] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1436] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Windows\system32\svchost.exe[1436] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1436] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Windows\system32\svchost.exe[1436] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1436] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Windows\system32\svchost.exe[1436] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1436] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7042000A
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 7058000A
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 705B000A
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 703C000A
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7070000A
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 7076000A
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 7039000A
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 706D000A
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 7048000A
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 706A000A
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 708C000A
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7073000A
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 703F000A
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 708F000A
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 7045000A
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 7085000A
.text C:\Windows\system32\svchost.exe[1436] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 7055000A
.text C:\Windows\system32\svchost.exe[1436] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Windows\system32\svchost.exe[1436] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Windows\system32\svchost.exe[1436] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Windows\system32\svchost.exe[1436] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 7079000A
.text C:\Windows\system32\svchost.exe[1436] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 707C000A
.text C:\Windows\system32\svchost.exe[1436] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Windows\system32\svchost.exe[1436] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 707F000A
.text C:\Windows\system32\svchost.exe[1436] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Windows\system32\svchost.exe[1436] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Windows\system32\svchost.exe[1436] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Windows\system32\svchost.exe[1436] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Windows\system32\svchost.exe[1436] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7082000A
.text C:\Windows\system32\svchost.exe[1436] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1436] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Windows\system32\svchost.exe[1436] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Windows\system32\svchost.exe[1436] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Windows\system32\svchost.exe[1436] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Windows\system32\svchost.exe[1436] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Windows\system32\svchost.exe[1436] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1436] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
.text C:\Windows\system32\svchost.exe[1436] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1436] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70}
.text C:\Windows\system32\svchost.exe[1436] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7061000A
.text C:\Windows\system32\svchost.exe[1436] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 705E000A
.text C:\Windows\system32\svchost.exe[1436] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Windows\system32\svchost.exe[1436] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 7064000A
.text C:\Windows\system32\svchost.exe[1436] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 704B000A
.text C:\Windows\system32\svchost.exe[1436] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 7067000A
.text C:\Windows\system32\svchost.exe[1436] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 704E000A
.text C:\Windows\system32\svchost.exe[1436] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Windows\system32\svchost.exe[1436] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Windows\system32\svchost.exe[1436] shell32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Windows\system32\svchost.exe[1436] shell32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A
.text C:\Windows\system32\svchost.exe[1436] shell32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Windows\system32\svchost.exe[1436] shell32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Windows\system32\svchost.exe[1436] shell32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Windows\system32\svchost.exe[1436] shell32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A
.text C:\Windows\system32\svchost.exe[1436] WinInet.dll!InternetOpenUrlA 7760F3A4 6 Bytes JMP 7095000A
.text C:\Windows\system32\svchost.exe[1436] WinInet.dll!InternetOpenUrlW 77656D5F 6 Bytes JMP 7092000A
.text C:\Windows\system32\svchost.exe[1548] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1548] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Windows\system32\svchost.exe[1548] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1548] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\system32\svchost.exe[1548] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1548] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Windows\system32\svchost.exe[1548] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1548] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Windows\system32\svchost.exe[1548] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1548] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Windows\system32\svchost.exe[1548] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1548] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Windows\system32\svchost.exe[1548] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1548] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Windows\system32\svchost.exe[1548] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1548] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Windows\system32\svchost.exe[1548] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1548] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71]
.text C:\Windows\system32\svchost.exe[1548] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1548] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\svchost.exe[1548] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1548] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Windows\system32\svchost.exe[1548] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1548] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\system32\svchost.exe[1548] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1548] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71]
.text C:\Windows\system32\svchost.exe[1548] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1548] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Windows\system32\svchost.exe[1548] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1548] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Windows\system32\svchost.exe[1548] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1548] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Windows\system32\svchost.exe[1548] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1548] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Windows\system32\svchost.exe[1548] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1548] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Windows\system32\svchost.exe[1548] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Windows\system32\svchost.exe[1548] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Windows\system32\svchost.exe[1548] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Windows\system32\svchost.exe[1548] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Windows\system32\svchost.exe[1548] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A
.text C:\Windows\system32\svchost.exe[1548] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7048000A
.text C:\Windows\system32\svchost.exe[1548] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A
.text C:\Windows\system32\svchost.exe[1548] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705E000A
.text C:\Windows\system32\svchost.exe[1548] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7061000A
.text C:\Windows\system32\svchost.exe[1548] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7042000A
.text C:\Windows\system32\svchost.exe[1548] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7076000A
.text C:\Windows\system32\svchost.exe[1548] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\svchost.exe[1548] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Windows\system32\svchost.exe[1548] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707C000A
.text C:\Windows\system32\svchost.exe[1548] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Windows\system32\svchost.exe[1548] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Windows\system32\svchost.exe[1548] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Windows\system32\svchost.exe[1548] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Windows\system32\svchost.exe[1548] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703F000A
.text C:\Windows\system32\svchost.exe[1548] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Windows\system32\svchost.exe[1548] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7073000A
.text C:\Windows\system32\svchost.exe[1548] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Windows\system32\svchost.exe[1548] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Windows\system32\svchost.exe[1548] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Windows\system32\svchost.exe[1548] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1548] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Windows\system32\svchost.exe[1548] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704E000A
.text C:\Windows\system32\svchost.exe[1548] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7070000A
.text C:\Windows\system32\svchost.exe[1548] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Windows\system32\svchost.exe[1548] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7092000A
.text C:\Windows\system32\svchost.exe[1548] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7079000A
.text C:\Windows\system32\svchost.exe[1548] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7045000A
.text C:\Windows\system32\svchost.exe[1548] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A
.text C:\Windows\system32\svchost.exe[1548] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7095000A
.text C:\Windows\system32\svchost.exe[1548] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Windows\system32\svchost.exe[1548] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 704B000A
.text C:\Windows\system32\svchost.exe[1548] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A
.text C:\Windows\system32\svchost.exe[1548] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Windows\system32\svchost.exe[1548] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708B000A
.text C:\Windows\system32\svchost.exe[1548] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705B000A
.text C:\Windows\system32\svchost.exe[1548] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Windows\system32\svchost.exe[1548] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Windows\system32\svchost.exe[1548] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Windows\system32\svchost.exe[1548] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707F000A
.text C:\Windows\system32\svchost.exe[1548] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7082000A
.text C:\Windows\system32\svchost.exe[1548] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Windows\system32\svchost.exe[1548] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7085000A
.text C:\Windows\system32\svchost.exe[1548] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Windows\system32\svchost.exe[1548] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Windows\system32\svchost.exe[1548] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Windows\system32\svchost.exe[1548] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Windows\system32\svchost.exe[1548] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7088000A
.text C:\Windows\system32\svchost.exe[1548] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1548] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Windows\system32\svchost.exe[1548] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Windows\system32\svchost.exe[1548] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Windows\system32\svchost.exe[1548] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Windows\system32\svchost.exe[1548] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Windows\system32\svchost.exe[1548] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1548] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
.text C:\Windows\system32\svchost.exe[1548] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1548] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70}
.text C:\Windows\system32\svchost.exe[1548] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7067000A
.text C:\Windows\system32\svchost.exe[1548] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7064000A
.text C:\Windows\system32\svchost.exe[1548] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Windows\system32\svchost.exe[1548] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 706A000A
.text C:\Windows\system32\svchost.exe[1548] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7051000A
.text C:\Windows\system32\svchost.exe[1548] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706D000A
.text C:\Windows\system32\svchost.exe[1548] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7054000A
.text C:\Windows\system32\svchost.exe[1548] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Windows\system32\svchost.exe[1548] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Windows\system32\svchost.exe[1548] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Windows\system32\svchost.exe[1548] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A
.text C:\Windows\system32\svchost.exe[1548] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Windows\system32\svchost.exe[1548] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Windows\system32\svchost.exe[1548] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Windows\system32\svchost.exe[1548] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A
.text C:\Windows\system32\svchost.exe[1724] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1724] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Windows\system32\svchost.exe[1724] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1724] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\system32\svchost.exe[1724] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1724] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Windows\system32\svchost.exe[1724] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1724] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Windows\system32\svchost.exe[1724] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1724] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Windows\system32\svchost.exe[1724] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1724] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Windows\system32\svchost.exe[1724] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1724] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Windows\system32\svchost.exe[1724] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1724] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Windows\system32\svchost.exe[1724] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1724] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71]
.text C:\Windows\system32\svchost.exe[1724] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1724] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\svchost.exe[1724] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1724] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Windows\system32\svchost.exe[1724] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1724] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\system32\svchost.exe[1724] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1724] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71]
.text C:\Windows\system32\svchost.exe[1724] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1724] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Windows\system32\svchost.exe[1724] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1724] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Windows\system32\svchost.exe[1724] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1724] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Windows\system32\svchost.exe[1724] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1724] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Windows\system32\svchost.exe[1724] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1724] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Windows\system32\svchost.exe[1724] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Windows\system32\svchost.exe[1724] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Windows\system32\svchost.exe[1724] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Windows\system32\svchost.exe[1724] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Windows\system32\svchost.exe[1724] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A
.text C:\Windows\system32\svchost.exe[1724] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7048000A
.text C:\Windows\system32\svchost.exe[1724] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A
.text C:\Windows\system32\svchost.exe[1724] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705E000A
.text C:\Windows\system32\svchost.exe[1724] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7061000A
.text C:\Windows\system32\svchost.exe[1724] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7042000A
.text C:\Windows\system32\svchost.exe[1724] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7076000A
.text C:\Windows\system32\svchost.exe[1724] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\svchost.exe[1724] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Windows\system32\svchost.exe[1724] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707C000A
.text C:\Windows\system32\svchost.exe[1724] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Windows\system32\svchost.exe[1724] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Windows\system32\svchost.exe[1724] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Windows\system32\svchost.exe[1724] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Windows\system32\svchost.exe[1724] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703F000A
.text C:\Windows\system32\svchost.exe[1724] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Windows\system32\svchost.exe[1724] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7073000A
.text C:\Windows\system32\svchost.exe[1724] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Windows\system32\svchost.exe[1724] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Windows\system32\svchost.exe[1724] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Windows\system32\svchost.exe[1724] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1724] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Windows\system32\svchost.exe[1724] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704E000A
.text C:\Windows\system32\svchost.exe[1724] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7070000A
.text C:\Windows\system32\svchost.exe[1724] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Windows\system32\svchost.exe[1724] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7092000A
.text C:\Windows\system32\svchost.exe[1724] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7079000A
.text C:\Windows\system32\svchost.exe[1724] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7045000A
.text C:\Windows\system32\svchost.exe[1724] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A
.text C:\Windows\system32\svchost.exe[1724] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7095000A
.text C:\Windows\system32\svchost.exe[1724] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Windows\system32\svchost.exe[1724] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 704B000A
.text C:\Windows\system32\svchost.exe[1724] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A
.text C:\Windows\system32\svchost.exe[1724] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Windows\system32\svchost.exe[1724] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708B000A
.text C:\Windows\system32\svchost.exe[1724] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705B000A
.text C:\Windows\system32\svchost.exe[1724] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Windows\system32\svchost.exe[1724] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Windows\system32\svchost.exe[1724] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Windows\system32\svchost.exe[1724] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707F000A
.text C:\Windows\system32\svchost.exe[1724] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7082000A
.text C:\Windows\system32\svchost.exe[1724] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Windows\system32\svchost.exe[1724] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7085000A
.text C:\Windows\system32\svchost.exe[1724] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Windows\system32\svchost.exe[1724] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Windows\system32\svchost.exe[1724] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Windows\system32\svchost.exe[1724] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Windows\system32\svchost.exe[1724] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7088000A
.text C:\Windows\system32\svchost.exe[1724] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1724] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Windows\system32\svchost.exe[1724] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Windows\system32\svchost.exe[1724] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Windows\system32\svchost.exe[1724] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Windows\system32\svchost.exe[1724] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Windows\system32\svchost.exe[1724] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1724] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
.text C:\Windows\system32\svchost.exe[1724] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[1724] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70}
.text C:\Windows\system32\svchost.exe[1724] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7067000A
.text C:\Windows\system32\svchost.exe[1724] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7064000A
.text C:\Windows\system32\svchost.exe[1724] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Windows\system32\svchost.exe[1724] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 706A000A
.text C:\Windows\system32\svchost.exe[1724] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7051000A
.text C:\Windows\system32\svchost.exe[1724] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706D000A
.text C:\Windows\system32\svchost.exe[1724] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7054000A
.text C:\Windows\system32\svchost.exe[1724] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Windows\system32\svchost.exe[1724] USER32.dll!EndTask
Hi Satchfan hear is more >>> GMER
7711AD32 6 Bytes JMP 713C000A
.text C:\Windows\system32\svchost.exe[1724] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Windows\system32\svchost.exe[1724] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A
.text C:\Windows\system32\svchost.exe[1724] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Windows\system32\svchost.exe[1724] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Windows\system32\svchost.exe[1724] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Windows\system32\svchost.exe[1724] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71]
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71]
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Program Files\iPod\bin\iPodService.exe[1844] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7048000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705E000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7061000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7042000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7076000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707C000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703F000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7073000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iPod\bin\iPodService.exe[1844] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Program Files\iPod\bin\iPodService.exe[1844] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704E000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7070000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7092000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7079000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7045000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7095000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 704B000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708B000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705B000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707F000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7082000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7085000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7088000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iPod\bin\iPodService.exe[1844] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Program Files\iPod\bin\iPodService.exe[1844] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iPod\bin\iPodService.exe[1844] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
.text C:\Program Files\iPod\bin\iPodService.exe[1844] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iPod\bin\iPodService.exe[1844] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70}
.text C:\Program Files\iPod\bin\iPodService.exe[1844] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7067000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7064000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 706A000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7051000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706D000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7054000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Program Files\iPod\bin\iPodService.exe[1844] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\SolutoService.exe[2040] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Program Files\Soluto\SolutoService.exe[2040] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\SolutoService.exe[2040] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\Soluto\SolutoService.exe[2040] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\SolutoService.exe[2040] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Program Files\Soluto\SolutoService.exe[2040] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\SolutoService.exe[2040] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Program Files\Soluto\SolutoService.exe[2040] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\SolutoService.exe[2040] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Program Files\Soluto\SolutoService.exe[2040] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\SolutoService.exe[2040] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Program Files\Soluto\SolutoService.exe[2040] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\SolutoService.exe[2040] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Program Files\Soluto\SolutoService.exe[2040] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\SolutoService.exe[2040] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Program Files\Soluto\SolutoService.exe[2040] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\SolutoService.exe[2040] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [93, 70]
.text C:\Program Files\Soluto\SolutoService.exe[2040] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\SolutoService.exe[2040] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Soluto\SolutoService.exe[2040] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\SolutoService.exe[2040] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Program Files\Soluto\SolutoService.exe[2040] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\SolutoService.exe[2040] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Soluto\SolutoService.exe[2040] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\SolutoService.exe[2040] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [D6, 70]
.text C:\Program Files\Soluto\SolutoService.exe[2040] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\SolutoService.exe[2040] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Program Files\Soluto\SolutoService.exe[2040] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\SolutoService.exe[2040] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Program Files\Soluto\SolutoService.exe[2040] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\SolutoService.exe[2040] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Program Files\Soluto\SolutoService.exe[2040] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\SolutoService.exe[2040] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Program Files\Soluto\SolutoService.exe[2040] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\SolutoService.exe[2040] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Program Files\Soluto\SolutoService.exe[2040] KERNEL32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] KERNEL32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] KERNEL32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] KERNEL32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] KERNEL32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 7016000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] KERNEL32.dll!MoveFileW 776DA2F2 6 Bytes JMP 6F98000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] KERNEL32.dll!CopyFileW 776E0299 6 Bytes JMP 6FF9000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] KERNEL32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 6FAE000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] KERNEL32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 6FB1000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] KERNEL32.dll!MoveFileExW 776F10C8 6 Bytes JMP 6F92000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] KERNEL32.dll!OpenMutexA 776F33F7 6 Bytes JMP 6FC6000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] KERNEL32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Soluto\SolutoService.exe[2040] KERNEL32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] KERNEL32.dll!CreateMutexA 776F9431 6 Bytes JMP 6FCC000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] KERNEL32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] KERNEL32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7075000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] KERNEL32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7097000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] KERNEL32.dll!TerminateThread 777141F7 6 Bytes JMP 70D4000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] KERNEL32.dll!OpenProcess 77717267 6 Bytes JMP 6F8F000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] KERNEL32.dll!GetProcAddress 7771903B 6 Bytes JMP 707C000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] KERNEL32.dll!OpenMutexW 7771AA85 6 Bytes JMP 6FC3000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] KERNEL32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 7019000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] KERNEL32.dll!CreateFileW 7771AECB 6 Bytes JMP 7026000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] KERNEL32.dll!CreateThread 7771C90E 6 Bytes JMP 701C000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] KERNEL32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\SolutoService.exe[2040] KERNEL32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Program Files\Soluto\SolutoService.exe[2040] KERNEL32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 6F9E000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] KERNEL32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 6FC0000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] KERNEL32.dll!CreateFileA 7771CE5F 6 Bytes JMP 7023000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] KERNEL32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 6FE2000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] KERNEL32.dll!CreateMutexW 7771D555 6 Bytes JMP 6FC9000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] KERNEL32.dll!MoveFileExA 77720F0A 6 Bytes JMP 6F95000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] KERNEL32.dll!CopyFileA 77722433 6 Bytes JMP 6FFC000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] KERNEL32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 6FE5000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] KERNEL32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 70D1000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] KERNEL32.dll!MoveFileA 7775F641 6 Bytes JMP 6F9B000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] KERNEL32.dll!CopyFileExA 777619F9 6 Bytes JMP 6FF6000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] KERNEL32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] KERNEL32.dll!SetThreadContext 7776794A 6 Bytes JMP 6FDB000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 6FAB000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7072000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 705B000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 7055000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 6FCF000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 6FD2000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 7058000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 6FD5000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 706F000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 704F000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 7052000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 704C000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 6FD8000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\SolutoService.exe[2040] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [7E, 70] {JLE 0x72}
.text C:\Program Files\Soluto\SolutoService.exe[2040] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 70C7000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7082000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\SolutoService.exe[2040] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [C3, 70]
.text C:\Program Files\Soluto\SolutoService.exe[2040] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Soluto\SolutoService.exe[2040] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [02, 70]
.text C:\Program Files\Soluto\SolutoService.exe[2040] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 6FB7000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 6FB4000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 70CE000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 6FBA000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 6FA1000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 6FBD000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 6FA4000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 709A000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] shell32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] shell32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 6FEC000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] shell32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] shell32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] shell32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Program Files\Soluto\SolutoService.exe[2040] shell32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 6FEF000A
.text C:\Windows\system32\igfxsrvc.exe[2120] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\igfxsrvc.exe[2120] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Windows\system32\igfxsrvc.exe[2120] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\igfxsrvc.exe[2120] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\system32\igfxsrvc.exe[2120] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\igfxsrvc.exe[2120] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Windows\system32\igfxsrvc.exe[2120] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\igfxsrvc.exe[2120] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Windows\system32\igfxsrvc.exe[2120] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\igfxsrvc.exe[2120] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Windows\system32\igfxsrvc.exe[2120] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\igfxsrvc.exe[2120] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Windows\system32\igfxsrvc.exe[2120] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\igfxsrvc.exe[2120] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Windows\system32\igfxsrvc.exe[2120] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\igfxsrvc.exe[2120] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Windows\system32\igfxsrvc.exe[2120] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\igfxsrvc.exe[2120] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71]
.text C:\Windows\system32\igfxsrvc.exe[2120] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\igfxsrvc.exe[2120] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\igfxsrvc.exe[2120] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\igfxsrvc.exe[2120] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Windows\system32\igfxsrvc.exe[2120] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\igfxsrvc.exe[2120] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\system32\igfxsrvc.exe[2120] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\igfxsrvc.exe[2120] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71]
.text C:\Windows\system32\igfxsrvc.exe[2120] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\igfxsrvc.exe[2120] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Windows\system32\igfxsrvc.exe[2120] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\igfxsrvc.exe[2120] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Windows\system32\igfxsrvc.exe[2120] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\igfxsrvc.exe[2120] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Windows\system32\igfxsrvc.exe[2120] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\igfxsrvc.exe[2120] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Windows\system32\igfxsrvc.exe[2120] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\igfxsrvc.exe[2120] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Windows\system32\igfxsrvc.exe[2120] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Windows\system32\igfxsrvc.exe[2120] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Windows\system32\igfxsrvc.exe[2120] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Windows\system32\igfxsrvc.exe[2120] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Windows\system32\igfxsrvc.exe[2120] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A
.text C:\Windows\system32\igfxsrvc.exe[2120] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7048000A
.text C:\Windows\system32\igfxsrvc.exe[2120] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A
.text C:\Windows\system32\igfxsrvc.exe[2120] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705E000A
.text C:\Windows\system32\igfxsrvc.exe[2120] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7061000A
.text C:\Windows\system32\igfxsrvc.exe[2120] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7042000A
.text C:\Windows\system32\igfxsrvc.exe[2120] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7076000A
.text C:\Windows\system32\igfxsrvc.exe[2120] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\igfxsrvc.exe[2120] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Windows\system32\igfxsrvc.exe[2120] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707C000A
.text C:\Windows\system32\igfxsrvc.exe[2120] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Windows\system32\igfxsrvc.exe[2120] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Windows\system32\igfxsrvc.exe[2120] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Windows\system32\igfxsrvc.exe[2120] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Windows\system32\igfxsrvc.exe[2120] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703F000A
.text C:\Windows\system32\igfxsrvc.exe[2120] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Windows\system32\igfxsrvc.exe[2120] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7073000A
.text C:\Windows\system32\igfxsrvc.exe[2120] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Windows\system32\igfxsrvc.exe[2120] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Windows\system32\igfxsrvc.exe[2120] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Windows\system32\igfxsrvc.exe[2120] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\igfxsrvc.exe[2120] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Windows\system32\igfxsrvc.exe[2120] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704E000A
.text C:\Windows\system32\igfxsrvc.exe[2120] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7070000A
.text C:\Windows\system32\igfxsrvc.exe[2120] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Windows\system32\igfxsrvc.exe[2120] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7092000A
.text C:\Windows\system32\igfxsrvc.exe[2120] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7079000A
.text C:\Windows\system32\igfxsrvc.exe[2120] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7045000A
.text C:\Windows\system32\igfxsrvc.exe[2120] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A
.text C:\Windows\system32\igfxsrvc.exe[2120] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7095000A
.text C:\Windows\system32\igfxsrvc.exe[2120] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Windows\system32\igfxsrvc.exe[2120] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 704B000A
.text C:\Windows\system32\igfxsrvc.exe[2120] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A
.text C:\Windows\system32\igfxsrvc.exe[2120] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Windows\system32\igfxsrvc.exe[2120] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708B000A
.text C:\Windows\system32\igfxsrvc.exe[2120] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\igfxsrvc.exe[2120] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Windows\system32\igfxsrvc.exe[2120] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Windows\system32\igfxsrvc.exe[2120] USER32.dll!ChangeDisplaySettingsExA 770D6FE7 6 Bytes JMP 5F3E0F5A
.text C:\Windows\system32\igfxsrvc.exe[2120] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Windows\system32\igfxsrvc.exe[2120] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Windows\system32\igfxsrvc.exe[2120] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Windows\system32\igfxsrvc.exe[2120] USER32.dll!SetForegroundWindow 770DB8A6 6 Bytes JMP 5F370F5A
.text C:\Windows\system32\igfxsrvc.exe[2120] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\igfxsrvc.exe[2120] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
.text C:\Windows\system32\igfxsrvc.exe[2120] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\igfxsrvc.exe[2120] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70}
.text C:\Windows\system32\igfxsrvc.exe[2120] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7067000A
.text C:\Windows\system32\igfxsrvc.exe[2120] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7064000A
.text C:\Windows\system32\igfxsrvc.exe[2120] USER32.dll!SetWindowPos 770E35E3 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\igfxsrvc.exe[2120] USER32.dll!SetWindowPos + 4 770E35E7 2 Bytes [3C, 5F] {CMP AL, 0x5f}
.text C:\Windows\system32\igfxsrvc.exe[2120] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Windows\system32\igfxsrvc.exe[2120] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 706A000A
.text C:\Windows\system32\igfxsrvc.exe[2120] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7051000A
.text C:\Windows\system32\igfxsrvc.exe[2120] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706D000A
.text C:\Windows\system32\igfxsrvc.exe[2120] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7054000A
.text C:\Windows\system32\igfxsrvc.exe[2120] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Windows\system32\igfxsrvc.exe[2120] USER32.dll!ChangeDisplaySettingsExW 7711A9E4 6 Bytes JMP 5F410F5A
.text C:\Windows\system32\igfxsrvc.exe[2120] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Windows\system32\igfxsrvc.exe[2120] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705B000A
.text C:\Windows\system32\igfxsrvc.exe[2120] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Windows\system32\igfxsrvc.exe[2120] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Windows\system32\igfxsrvc.exe[2120] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Windows\system32\igfxsrvc.exe[2120] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707F000A
.text C:\Windows\system32\igfxsrvc.exe[2120] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7082000A
.text C:\Windows\system32\igfxsrvc.exe[2120] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Windows\system32\igfxsrvc.exe[2120] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7085000A
.text C:\Windows\system32\igfxsrvc.exe[2120] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Windows\system32\igfxsrvc.exe[2120] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Windows\system32\igfxsrvc.exe[2120] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Windows\system32\igfxsrvc.exe[2120] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Windows\system32\igfxsrvc.exe[2120] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7088000A
.text C:\Windows\system32\igfxsrvc.exe[2120] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Windows\system32\igfxsrvc.exe[2120] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A
.text C:\Windows\system32\igfxsrvc.exe[2120] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Windows\system32\igfxsrvc.exe[2120] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Windows\system32\igfxsrvc.exe[2120] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Windows\system32\igfxsrvc.exe[2120] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [C9, 70]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [EB, 70] {JMP 0x72}
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] KERNEL32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] KERNEL32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] KERNEL32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] KERNEL32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] KERNEL32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 706E000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] KERNEL32.dll!MoveFileW 776DA2F2 6 Bytes JMP 6FF0000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] KERNEL32.dll!CopyFileW 776E0299 6 Bytes JMP 7051000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] KERNEL32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 7006000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] KERNEL32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7009000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] KERNEL32.dll!MoveFileExW 776F10C8 6 Bytes JMP 6FEA000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] KERNEL32.dll!OpenMutexA 776F33F7 6 Bytes JMP 701E000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] KERNEL32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] KERNEL32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] KERNEL32.dll!CreateMutexA 776F9431 6 Bytes JMP 7024000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] KERNEL32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] KERNEL32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 70B2000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] KERNEL32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 70CD000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] KERNEL32.dll!TerminateThread 777141F7 6 Bytes JMP 70E9000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] KERNEL32.dll!OpenProcess 77717267 6 Bytes JMP 6FE7000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] KERNEL32.dll!GetProcAddress 7771903B 6 Bytes JMP 70B9000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] KERNEL32.dll!OpenMutexW 7771AA85 6 Bytes JMP 701B000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] KERNEL32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 7071000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] KERNEL32.dll!CreateFileW 7771AECB 6 Bytes JMP 707E000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] KERNEL32.dll!CreateThread 7771C90E 6 Bytes JMP 7074000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] KERNEL32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] KERNEL32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] KERNEL32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 6FF6000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] KERNEL32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7018000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] KERNEL32.dll!CreateFileA 7771CE5F 6 Bytes JMP 707B000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] KERNEL32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 703A000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] KERNEL32.dll!CreateMutexW 7771D555 6 Bytes JMP 7021000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] KERNEL32.dll!MoveFileExA 77720F0A 4 Bytes [FF, 25, 1E, 00]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] KERNEL32.dll!MoveFileExA + 5 77720F0F 1 Byte [6F]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] KERNEL32.dll!CopyFileA 77722433 6 Bytes JMP 7054000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] KERNEL32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 703D000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] KERNEL32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 70E6000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] KERNEL32.dll!MoveFileA 7775F641 6 Bytes JMP 6FF3000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] KERNEL32.dll!CopyFileExA 777619F9 6 Bytes JMP 704E000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] KERNEL32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] KERNEL32.dll!SetThreadContext 7776794A 6 Bytes JMP 7033000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 7003000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 70AF000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 70A9000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70A3000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 7027000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 702A000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70A6000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 702D000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 70AC000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 709D000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70A0000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 709A000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7030000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [BB, 70]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] USER32.dll!ChangeDisplaySettingsExA 770D6FE7 6 Bytes JMP 5F3E0F5A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 70D6000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 70BF000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] USER32.dll!SetForegroundWindow 770DB8A6 6 Bytes JMP 5F370F5A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [D2, 70]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [5A, 70]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 700F000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 700C000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] USER32.dll!SetWindowPos 770E35E3 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] USER32.dll!SetWindowPos + 4 770E35E7 2 Bytes [3C, 5F] {CMP AL, 0x5f}
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 70D9000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 7012000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 6FF9000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 7015000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 6FFC000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 70D0000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] USER32.dll!ChangeDisplaySettingsExW 7711A9E4 6 Bytes JMP 5F410F5A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] shell32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] shell32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 7044000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] shell32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] shell32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176] shell32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Acer\Empowering Technology\SysMonitor.exe[2176]
Hi Satchfan hear is more >>> GMER shell32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 7047000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71]
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71]
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7041000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 7057000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 705A000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 703B000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7070000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 7076000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 7038000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 706D000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 7047000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 706A000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 708C000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7073000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 703E000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 708F000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 7044000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 7085000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 7054000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 7079000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 707C000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 707F000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7082000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] USER32.dll!ChangeDisplaySettingsExA 770D6FE7 6 Bytes JMP 5F3E0F5A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] USER32.dll!SetForegroundWindow 770DB8A6 6 Bytes JMP 5F370F5A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70}
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7061000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 705E000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] USER32.dll!SetWindowPos 770E35E3 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] USER32.dll!SetWindowPos + 4 770E35E7 2 Bytes [3C, 5F] {CMP AL, 0x5f}
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 7064000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 704A000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 7067000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 704D000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] USER32.dll!ChangeDisplaySettingsExW 7711A9E4 6 Bytes JMP 5F410F5A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] WININET.DLL!InternetOpenUrlA 7760F3A4 6 Bytes JMP 7095000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2188] WININET.DLL!InternetOpenUrlW 77656D5F 6 Bytes JMP 7092000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71]
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71]
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C5000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7036000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A8000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 704C000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 704F000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7030000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7064000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 706A000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 702D000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7061000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] kernel32.dll!CreateThread + 1A 7771C928 4 Bytes CALL 0044B8D9 C:\Program Files\Spyware Doctor\pctsTray.exe (PC Tools Tray Application/PC Tools)
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 703C000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 705E000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 708E000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7067000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7033000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AB000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7091000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 7039000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A5000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 7084000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B1, 70] {MOV CL, 0x70}
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7055000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7052000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 7058000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 703F000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 705B000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7042000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 7049000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 706D000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 707B000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 707E000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7081000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] shell32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] shell32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709B000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] shell32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] shell32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] shell32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[2204] shell32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709E000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71]
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71]
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7048000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705E000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7061000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7042000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7076000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707C000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703F000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7073000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704E000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7070000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7092000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7079000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7045000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7095000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 704B000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708B000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705B000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707F000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7082000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7085000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7088000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] USER32.dll!ChangeDisplaySettingsExA 770D6FE7 6 Bytes JMP 5F3E0F5A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] USER32.dll!SetForegroundWindow 770DB8A6 6 Bytes JMP 5F370F5A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70}
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7067000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7064000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] USER32.dll!SetWindowPos 770E35E3 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] USER32.dll!SetWindowPos + 4 770E35E7 2 Bytes [3C, 5F] {CMP AL, 0x5f}
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 706A000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7051000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706D000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7054000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] USER32.dll!ChangeDisplaySettingsExW 7711A9E4 6 Bytes JMP 5F410F5A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Program Files\Windows Sidebar\sidebar.exe[2240] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7042000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 7058000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 705B000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 703C000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7070000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 7076000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 7039000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 706D000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 7048000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 706A000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 708C000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7073000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 703F000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 708F000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 7045000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 7085000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] USER32.dll!ChangeDisplaySettingsExA 770D6FE7 6 Bytes JMP 5F3E0F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] USER32.dll!SetForegroundWindow 770DB8A6 6 Bytes JMP 5F370F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70}
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7061000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 705E000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] USER32.dll!SetWindowPos 770E35E3 3 Bytes [FF, 25, 1E]
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] USER32.dll!SetWindowPos + 4 770E35E7 2 Bytes [3C, 5F] {CMP AL, 0x5f}
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 7064000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 704B000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 7067000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 704E000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] USER32.dll!ChangeDisplaySettingsExW 7711A9E4 6 Bytes JMP 5F410F5A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 7055000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 7079000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 707C000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 707F000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7082000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] WININET.dll!InternetOpenUrlA 7760F3A4 6 Bytes JMP 7095000A
.text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[2268] WININET.dll!InternetOpenUrlW 77656D5F 6 Bytes JMP 7092000A
Hi Satchfan hear is more >>> GMER .text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71]
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71]
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7048000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705E000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7061000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7042000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7076000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707C000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703F000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7073000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704E000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7070000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7092000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7079000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7045000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7095000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 704B000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708B000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] advapi32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705B000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] advapi32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] advapi32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] advapi32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] advapi32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707F000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] advapi32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7082000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] advapi32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] advapi32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7085000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] advapi32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] advapi32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] advapi32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] advapi32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] advapi32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7088000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] USER32.dll!ChangeDisplaySettingsExA 770D6FE7 6 Bytes JMP 5F3E0F5A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] USER32.dll!SetForegroundWindow 770DB8A6 6 Bytes JMP 5F370F5A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70}
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7067000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7064000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] USER32.dll!SetWindowPos 770E35E3 3 Bytes [FF, 25, 1E]
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] USER32.dll!SetWindowPos + 4 770E35E7 2 Bytes [3C, 5F] {CMP AL, 0x5f}
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 706A000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7051000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706D000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7054000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] USER32.dll!ChangeDisplaySettingsExW 7711A9E4 6 Bytes JMP 5F410F5A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] shell32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] shell32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] shell32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] shell32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] shell32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Program Files\PC Cleaner\PCCleanerTray.exe[2276] shell32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71]
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71]
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7042000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 7058000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 705B000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 703C000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7070000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 7076000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 7039000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 706D000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 7048000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 706A000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 708C000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7073000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 703F000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 708F000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 7045000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 7085000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 7055000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 7079000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 707C000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 707F000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7082000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] USER32.dll!ChangeDisplaySettingsExA 770D6FE7 6 Bytes JMP 5F3E0F5A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] USER32.dll!SetForegroundWindow 770DB8A6 6 Bytes JMP 5F370F5A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70}
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7061000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 705E000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] USER32.dll!SetWindowPos 770E35E3 3 Bytes [FF, 25, 1E]
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] USER32.dll!SetWindowPos + 4 770E35E7 2 Bytes [3C, 5F] {CMP AL, 0x5f}
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 7064000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 704B000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 7067000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 704E000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] USER32.dll!ChangeDisplaySettingsExW 7711A9E4 6 Bytes JMP 5F410F5A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] WININET.dll!InternetOpenUrlA 7760F3A4 6 Bytes JMP 7095000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] WININET.dll!InternetOpenUrlW 77656D5F 6 Bytes JMP 7092000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe[2292] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71]
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71]
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7048000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705E000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7061000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7042000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7076000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707C000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703F000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7073000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704E000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7070000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7092000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7079000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7045000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7095000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 704B000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708B000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] USER32.dll!ChangeDisplaySettingsExA 770D6FE7 6 Bytes JMP 5F3E0F5A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] USER32.dll!SetForegroundWindow 770DB8A6 6 Bytes JMP 5F370F5A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70}
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7067000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7064000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] USER32.dll!SetWindowPos 770E35E3 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] USER32.dll!SetWindowPos + 4 770E35E7 2 Bytes [3C, 5F] {CMP AL, 0x5f}
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 706A000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7051000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706D000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7054000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] USER32.dll!ChangeDisplaySettingsExW 7711A9E4 6 Bytes JMP 5F410F5A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705B000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707F000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7082000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7085000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ADVAPI32.dll!RegOpenKeyExW
Hi Satchfan hear is more >>> GMER 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7088000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Users\Jai\AppData\Roaming\Dropbox\bin\Dropbox.exe[2300] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71]
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71]
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7048000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705E000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7061000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7042000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7076000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707C000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703F000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7073000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704E000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7070000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7092000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7079000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7045000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7095000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 704B000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708B000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70}
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7067000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7064000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 706A000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7051000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706D000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7054000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705B000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707F000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7082000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7085000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7088000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe[2388] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71]
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71]
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C5000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 702F000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A8000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 7045000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7048000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7029000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 705D000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 7063000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 7026000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 705A000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 7035000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7057000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7084000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7060000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 702C000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AB000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 708B000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 7032000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A5000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 707D000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B1, 70] {MOV CL, 0x70}
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 704E000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 704B000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 7051000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7038000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 7054000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 703B000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 7042000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 7066000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7069000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 706C000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 707A000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709B000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709E000A
.text C:\Program Files\Acer Arcade Live\Acer TV Share\Kernel\DMSTV\CLMSServer.exe[2408] WININET.dll!InternetOpenUrlA 7760F3A4 6 Bytes JMP 7091000A
.text C:\Program Files\Acer Arcade Live\Acer TV
Hi Satchfan hear is more >>> GMER Share\Kernel\DMSTV\CLMSServer.exe[2408] WININET.dll!InternetOpenUrlW 77656D5F 6 Bytes JMP 708E000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71]
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71]
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7048000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705E000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7061000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7042000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7076000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707C000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703F000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7073000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704E000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7070000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7092000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7079000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7045000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7095000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 704B000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708B000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70}
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7067000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7064000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 706A000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7051000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706D000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7054000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705B000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707F000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7082000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7085000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7088000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Program Files\Intel\IntelDH\CCU\AlertService.exe[2432] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7047000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705E000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7061000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7041000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7076000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707C000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703E000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7073000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704D000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7070000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7092000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7079000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7044000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7095000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 704A000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708B000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705A000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707F000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7082000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7085000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7088000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70}
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7067000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7064000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 706A000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7050000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706D000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7053000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2472] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7048000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705E000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7061000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7042000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7076000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707C000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703F000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7073000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704E000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7070000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7092000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7079000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7045000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7095000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 704B000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708B000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705B000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707F000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7082000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7085000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7088000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70}
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7067000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7064000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 706A000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7051000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706D000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7054000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[2512] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A
.text C:\Windows\system32\dgdersvc.exe[2528] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\dgdersvc.exe[2528] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Windows\system32\dgdersvc.exe[2528] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\dgdersvc.exe[2528] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\system32\dgdersvc.exe[2528] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\dgdersvc.exe[2528] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Windows\system32\dgdersvc.exe[2528] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\dgdersvc.exe[2528] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Windows\system32\dgdersvc.exe[2528] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\dgdersvc.exe[2528] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Windows\system32\dgdersvc.exe[2528] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\dgdersvc.exe[2528] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Windows\system32\dgdersvc.exe[2528] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\dgdersvc.exe[2528] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Windows\system32\dgdersvc.exe[2528] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\dgdersvc.exe[2528] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Windows\system32\dgdersvc.exe[2528] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\dgdersvc.exe[2528] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71]
.text C:\Windows\system32\dgdersvc.exe[2528] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\dgdersvc.exe[2528] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\dgdersvc.exe[2528] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\dgdersvc.exe[2528] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Windows\system32\dgdersvc.exe[2528] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\dgdersvc.exe[2528] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\system32\dgdersvc.exe[2528] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\dgdersvc.exe[2528] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71]
.text C:\Windows\system32\dgdersvc.exe[2528] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\dgdersvc.exe[2528] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Windows\system32\dgdersvc.exe[2528] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\dgdersvc.exe[2528] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Windows\system32\dgdersvc.exe[2528] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\dgdersvc.exe[2528] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Windows\system32\dgdersvc.exe[2528] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\dgdersvc.exe[2528] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Windows\system32\dgdersvc.exe[2528] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\dgdersvc.exe[2528] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Windows\system32\dgdersvc.exe[2528] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Windows\system32\dgdersvc.exe[2528] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Windows\system32\dgdersvc.exe[2528] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Windows\system32\dgdersvc.exe[2528] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Windows\system32\dgdersvc.exe[2528] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A
.text C:\Windows\system32\dgdersvc.exe[2528] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7048000A
.text C:\Windows\system32\dgdersvc.exe[2528] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A
.text C:\Windows\system32\dgdersvc.exe[2528] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705E000A
.text C:\Windows\system32\dgdersvc.exe[2528] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7061000A
.text C:\Windows\system32\dgdersvc.exe[2528] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7042000A
.text C:\Windows\system32\dgdersvc.exe[2528] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7076000A
.text C:\Windows\system32\dgdersvc.exe[2528] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\dgdersvc.exe[2528] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Windows\system32\dgdersvc.exe[2528] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707C000A
.text C:\Windows\system32\dgdersvc.exe[2528] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Windows\system32\dgdersvc.exe[2528] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Windows\system32\dgdersvc.exe[2528] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Windows\system32\dgdersvc.exe[2528] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Windows\system32\dgdersvc.exe[2528] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703F000A
.text C:\Windows\system32\dgdersvc.exe[2528] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Windows\system32\dgdersvc.exe[2528] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7073000A
.text C:\Windows\system32\dgdersvc.exe[2528] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Windows\system32\dgdersvc.exe[2528] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Windows\system32\dgdersvc.exe[2528] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Windows\system32\dgdersvc.exe[2528] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\dgdersvc.exe[2528] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Windows\system32\dgdersvc.exe[2528] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704E000A
.text C:\Windows\system32\dgdersvc.exe[2528] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7070000A
.text C:\Windows\system32\dgdersvc.exe[2528] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Windows\system32\dgdersvc.exe[2528] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7092000A
.text C:\Windows\system32\dgdersvc.exe[2528] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7079000A
.text C:\Windows\system32\dgdersvc.exe[2528] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7045000A
.text C:\Windows\system32\dgdersvc.exe[2528] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A
.text C:\Windows\system32\dgdersvc.exe[2528] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7095000A
.text C:\Windows\system32\dgdersvc.exe[2528] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Windows\system32\dgdersvc.exe[2528] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 704B000A
.text C:\Windows\system32\dgdersvc.exe[2528] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A
.text C:\Windows\system32\dgdersvc.exe[2528] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Windows\system32\dgdersvc.exe[2528] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708B000A
.text C:\Windows\system32\dgdersvc.exe[2528] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705B000A
.text C:\Windows\system32\dgdersvc.exe[2528] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Windows\system32\dgdersvc.exe[2528] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Windows\system32\dgdersvc.exe[2528] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Windows\system32\dgdersvc.exe[2528] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707F000A
.text C:\Windows\system32\dgdersvc.exe[2528] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7082000A
.text C:\Windows\system32\dgdersvc.exe[2528] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Windows\system32\dgdersvc.exe[2528] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7085000A
.text C:\Windows\system32\dgdersvc.exe[2528] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Windows\system32\dgdersvc.exe[2528] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Windows\system32\dgdersvc.exe[2528] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Windows\system32\dgdersvc.exe[2528] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Windows\system32\dgdersvc.exe[2528] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7088000A
.text C:\Windows\system32\dgdersvc.exe[2528] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Windows\system32\dgdersvc.exe[2528] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A
.text C:\Windows\system32\dgdersvc.exe[2528] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Windows\system32\dgdersvc.exe[2528] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Windows\system32\dgdersvc.exe[2528] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Windows\system32\dgdersvc.exe[2528] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A
.text C:\Windows\system32\dgdersvc.exe[2528] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\dgdersvc.exe[2528] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Windows\system32\dgdersvc.exe[2528] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Windows\system32\dgdersvc.exe[2528] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Windows\system32\dgdersvc.exe[2528] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Windows\system32\dgdersvc.exe[2528] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Windows\system32\dgdersvc.exe[2528] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\dgdersvc.exe[2528] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
.text C:\Windows\system32\dgdersvc.exe[2528] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\dgdersvc.exe[2528] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70}
.text C:\Windows\system32\dgdersvc.exe[2528] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7067000A
.text C:\Windows\system32\dgdersvc.exe[2528] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7064000A
.text C:\Windows\system32\dgdersvc.exe[2528] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Windows\system32\dgdersvc.exe[2528] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 706A000A
.text C:\Windows\system32\dgdersvc.exe[2528] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7051000A
.text C:\Windows\system32\dgdersvc.exe[2528] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706D000A
.text C:\Windows\system32\dgdersvc.exe[2528] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7054000A
.text C:\Windows\system32\dgdersvc.exe[2528] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Windows\system32\dgdersvc.exe[2528] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71]
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
Hi Satchfan hear is more >>> GMER .text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71]
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7048000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705E000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7061000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7042000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7076000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707C000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703F000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7073000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704E000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7070000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7092000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7079000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7045000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7095000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 704B000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708B000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705B000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707F000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7082000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7085000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7088000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70}
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7067000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7064000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 706A000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7051000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706D000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7054000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe[2544] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\FsUsbExService.Exe[2560] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Windows\system32\FsUsbExService.Exe[2560] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\FsUsbExService.Exe[2560] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\system32\FsUsbExService.Exe[2560] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\FsUsbExService.Exe[2560] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Windows\system32\FsUsbExService.Exe[2560] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\FsUsbExService.Exe[2560] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Windows\system32\FsUsbExService.Exe[2560] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\FsUsbExService.Exe[2560] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Windows\system32\FsUsbExService.Exe[2560] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\FsUsbExService.Exe[2560] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Windows\system32\FsUsbExService.Exe[2560] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\FsUsbExService.Exe[2560] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Windows\system32\FsUsbExService.Exe[2560] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\FsUsbExService.Exe[2560] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Windows\system32\FsUsbExService.Exe[2560] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\FsUsbExService.Exe[2560] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71]
.text C:\Windows\system32\FsUsbExService.Exe[2560] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\FsUsbExService.Exe[2560] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\FsUsbExService.Exe[2560] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\FsUsbExService.Exe[2560] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Windows\system32\FsUsbExService.Exe[2560] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\FsUsbExService.Exe[2560] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\system32\FsUsbExService.Exe[2560] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\FsUsbExService.Exe[2560] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71]
.text C:\Windows\system32\FsUsbExService.Exe[2560] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\FsUsbExService.Exe[2560] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Windows\system32\FsUsbExService.Exe[2560] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\FsUsbExService.Exe[2560] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Windows\system32\FsUsbExService.Exe[2560] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\FsUsbExService.Exe[2560] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Windows\system32\FsUsbExService.Exe[2560] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\FsUsbExService.Exe[2560] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Windows\system32\FsUsbExService.Exe[2560] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\FsUsbExService.Exe[2560] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Windows\system32\FsUsbExService.Exe[2560] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7048000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705E000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7061000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7042000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7076000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\FsUsbExService.Exe[2560] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707C000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703F000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7073000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\FsUsbExService.Exe[2560] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Windows\system32\FsUsbExService.Exe[2560] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704E000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7070000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7092000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7079000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7045000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7095000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 704B000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708B000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\FsUsbExService.Exe[2560] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Windows\system32\FsUsbExService.Exe[2560] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\FsUsbExService.Exe[2560] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
.text C:\Windows\system32\FsUsbExService.Exe[2560] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\FsUsbExService.Exe[2560] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70}
.text C:\Windows\system32\FsUsbExService.Exe[2560] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7067000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7064000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 706A000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7051000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706D000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7054000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705B000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707F000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7082000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7085000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7088000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Windows\system32\FsUsbExService.Exe[2560] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A
.text C:\Windows\system32\svchost.exe[2760] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[2760] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Windows\system32\svchost.exe[2760] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[2760] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\system32\svchost.exe[2760] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[2760] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Windows\system32\svchost.exe[2760] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[2760] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Windows\system32\svchost.exe[2760] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[2760] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Windows\system32\svchost.exe[2760] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[2760] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Windows\system32\svchost.exe[2760] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[2760] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Windows\system32\svchost.exe[2760] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[2760] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Windows\system32\svchost.exe[2760] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[2760] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71]
.text C:\Windows\system32\svchost.exe[2760] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[2760] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\svchost.exe[2760] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[2760] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Windows\system32\svchost.exe[2760] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[2760] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\system32\svchost.exe[2760] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[2760] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71]
.text C:\Windows\system32\svchost.exe[2760] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[2760] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Windows\system32\svchost.exe[2760] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[2760] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Windows\system32\svchost.exe[2760] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[2760] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Windows\system32\svchost.exe[2760] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[2760] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Windows\system32\svchost.exe[2760] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[2760] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Windows\system32\svchost.exe[2760] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Windows\system32\svchost.exe[2760] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Windows\system32\svchost.exe[2760] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Windows\system32\svchost.exe[2760] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Windows\system32\svchost.exe[2760] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A
.text C:\Windows\system32\svchost.exe[2760] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7048000A
.text C:\Windows\system32\svchost.exe[2760] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A
.text C:\Windows\system32\svchost.exe[2760] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705E000A
.text C:\Windows\system32\svchost.exe[2760] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7061000A
.text C:\Windows\system32\svchost.exe[2760] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7042000A
.text C:\Windows\system32\svchost.exe[2760] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7076000A
.text C:\Windows\system32\svchost.exe[2760] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\svchost.exe[2760] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Windows\system32\svchost.exe[2760] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707C000A
.text C:\Windows\system32\svchost.exe[2760] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Windows\system32\svchost.exe[2760] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Windows\system32\svchost.exe[2760] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Windows\system32\svchost.exe[2760] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Windows\system32\svchost.exe[2760] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703F000A
.text C:\Windows\system32\svchost.exe[2760] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Windows\system32\svchost.exe[2760] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7073000A
.text C:\Windows\system32\svchost.exe[2760] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Windows\system32\svchost.exe[2760] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Windows\system32\svchost.exe[2760] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Windows\system32\svchost.exe[2760] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[2760] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Windows\system32\svchost.exe[2760] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704E000A
.text C:\Windows\system32\svchost.exe[2760] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7070000A
.text C:\Windows\system32\svchost.exe[2760] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Windows\system32\svchost.exe[2760] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7092000A
.text C:\Windows\system32\svchost.exe[2760] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7079000A
.text C:\Windows\system32\svchost.exe[2760] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7045000A
.text C:\Windows\system32\svchost.exe[2760] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A
.text C:\Windows\system32\svchost.exe[2760] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7095000A
.text C:\Windows\system32\svchost.exe[2760] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Windows\system32\svchost.exe[2760] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 704B000A
.text C:\Windows\system32\svchost.exe[2760] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A
.text C:\Windows\system32\svchost.exe[2760] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Windows\system32\svchost.exe[2760] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708B000A
.text C:\Windows\system32\svchost.exe[2760] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705B000A
.text C:\Windows\system32\svchost.exe[2760] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Windows\system32\svchost.exe[2760] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Windows\system32\svchost.exe[2760] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Windows\system32\svchost.exe[2760] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707F000A
.text C:\Windows\system32\svchost.exe[2760] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7082000A
.text C:\Windows\system32\svchost.exe[2760] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Windows\system32\svchost.exe[2760] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7085000A
.text C:\Windows\system32\svchost.exe[2760] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Windows\system32\svchost.exe[2760] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Windows\system32\svchost.exe[2760] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Windows\system32\svchost.exe[2760] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Windows\system32\svchost.exe[2760] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7088000A
.text C:\Windows\system32\svchost.exe[2760] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[2760] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Windows\system32\svchost.exe[2760] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Windows\system32\svchost.exe[2760] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Windows\system32\svchost.exe[2760] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Windows\system32\svchost.exe[2760] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Windows\system32\svchost.exe[2760] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[2760] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
.text C:\Windows\system32\svchost.exe[2760] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[2760] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70}
.text C:\Windows\system32\svchost.exe[2760] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7067000A
.text C:\Windows\system32\svchost.exe[2760] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7064000A
.text C:\Windows\system32\svchost.exe[2760] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Windows\system32\svchost.exe[2760] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 706A000A
.text C:\Windows\system32\svchost.exe[2760] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7051000A
.text C:\Windows\system32\svchost.exe[2760] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706D000A
.text C:\Windows\system32\svchost.exe[2760] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7054000A
.text C:\Windows\system32\svchost.exe[2760] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Windows\system32\svchost.exe[2760] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Windows\system32\svchost.exe[2760] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Windows\system32\svchost.exe[2760] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A
.text C:\Windows\system32\svchost.exe[2760] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Windows\system32\svchost.exe[2760] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Windows\system32\svchost.exe[2760] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Windows\system32\svchost.exe[2760] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7048000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705E000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7061000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7042000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7076000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707C000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703F000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7073000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704E000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7070000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7092000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7079000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7045000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7095000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 704B000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708B000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70}
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7067000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7064000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 706A000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7051000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706D000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7054000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705B000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707F000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7082000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7085000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7088000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[2852] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A
.text C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe[2984] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe[2984] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe[2984] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe[2984] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe[2984] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe[2984] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe[2984] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe[2984] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe[2984] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe[2984] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe[2984] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe[2984] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe[2984] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe[2984] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe[2984] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe[2984] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe[2984] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe[2984] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe[2984] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe[2984] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe[2984] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe[2984] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe[2984] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe[2984] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe[2984] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe[2984] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe[2984] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe[2984] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe[2984] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe[2984] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe[2984] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe[2984] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe[2984] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
Hi Satchfan hear is more >>> GMER text C:\Program Files\Spyware Doctor\TFEngine\TFService.exe[3456] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Spyware Doctor\TFEngine\TFService.exe[3456] kernel32.dll!CreateRemoteThread + 175 7771CAAA 4 Bytes [00, 00, 6E, 71]
.text C:\Program Files\Spyware Doctor\TFEngine\TFService.exe[3456] USER32.dll!ChangeDisplaySettingsExA 770D6FE7 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Spyware Doctor\TFEngine\TFService.exe[3456] USER32.dll!SetForegroundWindow 770DB8A6 6 Bytes JMP 5F040F5A
.text C:\Program Files\Spyware Doctor\TFEngine\TFService.exe[3456] USER32.dll!SetWindowPos 770E35E3 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Spyware Doctor\TFEngine\TFService.exe[3456] USER32.dll!SetWindowPos + 4 770E35E7 2 Bytes [0B, 5F]
.text C:\Program Files\Spyware Doctor\TFEngine\TFService.exe[3456] USER32.dll!ChangeDisplaySettingsExW 7711A9E4 6 Bytes JMP 5F100F5A
.text C:\Windows\system32\svchost.exe[3492] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[3492] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Windows\system32\svchost.exe[3492] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[3492] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\system32\svchost.exe[3492] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[3492] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Windows\system32\svchost.exe[3492] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[3492] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Windows\system32\svchost.exe[3492] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[3492] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Windows\system32\svchost.exe[3492] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[3492] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Windows\system32\svchost.exe[3492] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[3492] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Windows\system32\svchost.exe[3492] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[3492] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Windows\system32\svchost.exe[3492] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[3492] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71]
.text C:\Windows\system32\svchost.exe[3492] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[3492] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\svchost.exe[3492] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[3492] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Windows\system32\svchost.exe[3492] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[3492] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\system32\svchost.exe[3492] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[3492] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71]
.text C:\Windows\system32\svchost.exe[3492] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[3492] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Windows\system32\svchost.exe[3492] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[3492] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Windows\system32\svchost.exe[3492] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[3492] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Windows\system32\svchost.exe[3492] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[3492] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Windows\system32\svchost.exe[3492] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[3492] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Windows\system32\svchost.exe[3492] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Windows\system32\svchost.exe[3492] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Windows\system32\svchost.exe[3492] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Windows\system32\svchost.exe[3492] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Windows\system32\svchost.exe[3492] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A
.text C:\Windows\system32\svchost.exe[3492] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7048000A
.text C:\Windows\system32\svchost.exe[3492] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A
.text C:\Windows\system32\svchost.exe[3492] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705E000A
.text C:\Windows\system32\svchost.exe[3492] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7061000A
.text C:\Windows\system32\svchost.exe[3492] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7042000A
.text C:\Windows\system32\svchost.exe[3492] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7076000A
.text C:\Windows\system32\svchost.exe[3492] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\svchost.exe[3492] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Windows\system32\svchost.exe[3492] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707C000A
.text C:\Windows\system32\svchost.exe[3492] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Windows\system32\svchost.exe[3492] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Windows\system32\svchost.exe[3492] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Windows\system32\svchost.exe[3492] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Windows\system32\svchost.exe[3492] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703F000A
.text C:\Windows\system32\svchost.exe[3492] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Windows\system32\svchost.exe[3492] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7073000A
.text C:\Windows\system32\svchost.exe[3492] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Windows\system32\svchost.exe[3492] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Windows\system32\svchost.exe[3492] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Windows\system32\svchost.exe[3492] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[3492] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Windows\system32\svchost.exe[3492] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704E000A
.text C:\Windows\system32\svchost.exe[3492] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7070000A
.text C:\Windows\system32\svchost.exe[3492] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Windows\system32\svchost.exe[3492] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7092000A
.text C:\Windows\system32\svchost.exe[3492] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7079000A
.text C:\Windows\system32\svchost.exe[3492] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7045000A
.text C:\Windows\system32\svchost.exe[3492] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A
.text C:\Windows\system32\svchost.exe[3492] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7095000A
.text C:\Windows\system32\svchost.exe[3492] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Windows\system32\svchost.exe[3492] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 704B000A
.text C:\Windows\system32\svchost.exe[3492] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A
.text C:\Windows\system32\svchost.exe[3492] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Windows\system32\svchost.exe[3492] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708B000A
.text C:\Windows\system32\svchost.exe[3492] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705B000A
.text C:\Windows\system32\svchost.exe[3492] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Windows\system32\svchost.exe[3492] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Windows\system32\svchost.exe[3492] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Windows\system32\svchost.exe[3492] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707F000A
.text C:\Windows\system32\svchost.exe[3492] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7082000A
.text C:\Windows\system32\svchost.exe[3492] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Windows\system32\svchost.exe[3492] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7085000A
.text C:\Windows\system32\svchost.exe[3492] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Windows\system32\svchost.exe[3492] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Windows\system32\svchost.exe[3492] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Windows\system32\svchost.exe[3492] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Windows\system32\svchost.exe[3492] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7088000A
.text C:\Windows\system32\svchost.exe[3492] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[3492] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Windows\system32\svchost.exe[3492] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Windows\system32\svchost.exe[3492] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Windows\system32\svchost.exe[3492] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Windows\system32\svchost.exe[3492] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Windows\system32\svchost.exe[3492] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[3492] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
.text C:\Windows\system32\svchost.exe[3492] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[3492] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70}
.text C:\Windows\system32\svchost.exe[3492] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7067000A
.text C:\Windows\system32\svchost.exe[3492] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7064000A
.text C:\Windows\system32\svchost.exe[3492] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Windows\system32\svchost.exe[3492] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 706A000A
.text C:\Windows\system32\svchost.exe[3492] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7051000A
.text C:\Windows\system32\svchost.exe[3492] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706D000A
.text C:\Windows\system32\svchost.exe[3492] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7054000A
.text C:\Windows\system32\svchost.exe[3492] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Windows\system32\svchost.exe[3492] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Windows\system32\svchost.exe[3492] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Windows\system32\svchost.exe[3492] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A
.text C:\Windows\system32\svchost.exe[3492] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Windows\system32\svchost.exe[3492] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Windows\system32\svchost.exe[3492] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Windows\system32\svchost.exe[3492] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71]
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71]
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7046000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705C000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 705F000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7040000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7074000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707A000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703D000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7071000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704C000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 706E000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7092000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7077000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7043000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7095000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 7049000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708B000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70}
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7065000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7062000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 7068000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 704F000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706B000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7052000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 7059000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707D000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7080000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7083000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7088000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Program Files\StumbleUpon\StumbleUponUpdateService.exe[3508] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A
.text C:\Windows\System32\svchost.exe[3756] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[3756] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Windows\System32\svchost.exe[3756] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[3756] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\System32\svchost.exe[3756] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[3756] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Windows\System32\svchost.exe[3756] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[3756] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Windows\System32\svchost.exe[3756] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[3756] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Windows\System32\svchost.exe[3756] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[3756] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Windows\System32\svchost.exe[3756] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[3756] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Windows\System32\svchost.exe[3756] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[3756] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Windows\System32\svchost.exe[3756] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[3756] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71]
.text C:\Windows\System32\svchost.exe[3756] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[3756] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\System32\svchost.exe[3756] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[3756] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Windows\System32\svchost.exe[3756] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[3756] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\System32\svchost.exe[3756] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[3756] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71]
.text C:\Windows\System32\svchost.exe[3756] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[3756] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Windows\System32\svchost.exe[3756] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[3756] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Windows\System32\svchost.exe[3756] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[3756] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Windows\System32\svchost.exe[3756] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[3756] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Windows\System32\svchost.exe[3756] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[3756] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Windows\System32\svchost.exe[3756] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Windows\System32\svchost.exe[3756] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Windows\System32\svchost.exe[3756] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Windows\System32\svchost.exe[3756] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Windows\System32\svchost.exe[3756] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A
.text C:\Windows\System32\svchost.exe[3756] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7048000A
.text C:\Windows\System32\svchost.exe[3756] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A
.text C:\Windows\System32\svchost.exe[3756] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705E000A
.text C:\Windows\System32\svchost.exe[3756] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7061000A
.text C:\Windows\System32\svchost.exe[3756] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7042000A
.text C:\Windows\System32\svchost.exe[3756] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7076000A
.text C:\Windows\System32\svchost.exe[3756] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Windows\System32\svchost.exe[3756] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Windows\System32\svchost.exe[3756] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707C000A
.text C:\Windows\System32\svchost.exe[3756] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Windows\System32\svchost.exe[3756] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Windows\System32\svchost.exe[3756] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Windows\System32\svchost.exe[3756] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Windows\System32\svchost.exe[3756] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703F000A
.text C:\Windows\System32\svchost.exe[3756] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Windows\System32\svchost.exe[3756] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7073000A
.text C:\Windows\System32\svchost.exe[3756] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Windows\System32\svchost.exe[3756] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Windows\System32\svchost.exe[3756] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Windows\System32\svchost.exe[3756] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[3756] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Windows\System32\svchost.exe[3756] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704E000A
.text C:\Windows\System32\svchost.exe[3756] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7070000A
.text C:\Windows\System32\svchost.exe[3756] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Windows\System32\svchost.exe[3756] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7092000A
.text C:\Windows\System32\svchost.exe[3756] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7079000A
.text C:\Windows\System32\svchost.exe[3756] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7045000A
.text C:\Windows\System32\svchost.exe[3756] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A
.text C:\Windows\System32\svchost.exe[3756] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7095000A
.text C:\Windows\System32\svchost.exe[3756] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Windows\System32\svchost.exe[3756] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 704B000A
.text C:\Windows\System32\svchost.exe[3756] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A
.text C:\Windows\System32\svchost.exe[3756] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Windows\System32\svchost.exe[3756] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708B000A
Hi Satchfan hear is more >>> GMER .text C:\Windows\System32\svchost.exe[3756] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705B000A
.text C:\Windows\System32\svchost.exe[3756] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Windows\System32\svchost.exe[3756] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Windows\System32\svchost.exe[3756] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Windows\System32\svchost.exe[3756] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707F000A
.text C:\Windows\System32\svchost.exe[3756] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7082000A
.text C:\Windows\System32\svchost.exe[3756] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Windows\System32\svchost.exe[3756] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7085000A
.text C:\Windows\System32\svchost.exe[3756] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Windows\System32\svchost.exe[3756] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Windows\System32\svchost.exe[3756] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Windows\System32\svchost.exe[3756] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Windows\System32\svchost.exe[3756] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7088000A
.text C:\Windows\System32\svchost.exe[3756] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[3756] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Windows\System32\svchost.exe[3756] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Windows\System32\svchost.exe[3756] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Windows\System32\svchost.exe[3756] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Windows\System32\svchost.exe[3756] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Windows\System32\svchost.exe[3756] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[3756] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
.text C:\Windows\System32\svchost.exe[3756] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\svchost.exe[3756] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70}
.text C:\Windows\System32\svchost.exe[3756] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7067000A
.text C:\Windows\System32\svchost.exe[3756] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7064000A
.text C:\Windows\System32\svchost.exe[3756] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Windows\System32\svchost.exe[3756] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 706A000A
.text C:\Windows\System32\svchost.exe[3756] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7051000A
.text C:\Windows\System32\svchost.exe[3756] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706D000A
.text C:\Windows\System32\svchost.exe[3756] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7054000A
.text C:\Windows\System32\svchost.exe[3756] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Windows\System32\svchost.exe[3756] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Windows\System32\svchost.exe[3756] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Windows\System32\svchost.exe[3756] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A
.text C:\Windows\System32\svchost.exe[3756] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Windows\System32\svchost.exe[3756] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Windows\System32\svchost.exe[3756] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Windows\System32\svchost.exe[3756] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A
.text C:\Windows\system32\SearchIndexer.exe[3788] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\SearchIndexer.exe[3788] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Windows\system32\SearchIndexer.exe[3788] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\SearchIndexer.exe[3788] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\system32\SearchIndexer.exe[3788] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\SearchIndexer.exe[3788] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Windows\system32\SearchIndexer.exe[3788] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\SearchIndexer.exe[3788] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Windows\system32\SearchIndexer.exe[3788] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\SearchIndexer.exe[3788] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Windows\system32\SearchIndexer.exe[3788] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\SearchIndexer.exe[3788] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Windows\system32\SearchIndexer.exe[3788] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\SearchIndexer.exe[3788] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Windows\system32\SearchIndexer.exe[3788] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\SearchIndexer.exe[3788] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Windows\system32\SearchIndexer.exe[3788] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\SearchIndexer.exe[3788] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71]
.text C:\Windows\system32\SearchIndexer.exe[3788] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\SearchIndexer.exe[3788] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\SearchIndexer.exe[3788] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\SearchIndexer.exe[3788] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Windows\system32\SearchIndexer.exe[3788] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\SearchIndexer.exe[3788] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\system32\SearchIndexer.exe[3788] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\SearchIndexer.exe[3788] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71]
.text C:\Windows\system32\SearchIndexer.exe[3788] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\SearchIndexer.exe[3788] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Windows\system32\SearchIndexer.exe[3788] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\SearchIndexer.exe[3788] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Windows\system32\SearchIndexer.exe[3788] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\SearchIndexer.exe[3788] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Windows\system32\SearchIndexer.exe[3788] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\SearchIndexer.exe[3788] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Windows\system32\SearchIndexer.exe[3788] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\SearchIndexer.exe[3788] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Windows\system32\SearchIndexer.exe[3788] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Windows\system32\SearchIndexer.exe[3788] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Windows\system32\SearchIndexer.exe[3788] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Windows\system32\SearchIndexer.exe[3788] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Windows\system32\SearchIndexer.exe[3788] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A
.text C:\Windows\system32\SearchIndexer.exe[3788] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7047000A
.text C:\Windows\system32\SearchIndexer.exe[3788] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A
.text C:\Windows\system32\SearchIndexer.exe[3788] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705E000A
.text C:\Windows\system32\SearchIndexer.exe[3788] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7061000A
.text C:\Windows\system32\SearchIndexer.exe[3788] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7041000A
.text C:\Windows\system32\SearchIndexer.exe[3788] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7076000A
.text C:\Windows\system32\SearchIndexer.exe[3788] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\SearchIndexer.exe[3788] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Windows\system32\SearchIndexer.exe[3788] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707C000A
.text C:\Windows\system32\SearchIndexer.exe[3788] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Windows\system32\SearchIndexer.exe[3788] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Windows\system32\SearchIndexer.exe[3788] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Windows\system32\SearchIndexer.exe[3788] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Windows\system32\SearchIndexer.exe[3788] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703E000A
.text C:\Windows\system32\SearchIndexer.exe[3788] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Windows\system32\SearchIndexer.exe[3788] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7073000A
.text C:\Windows\system32\SearchIndexer.exe[3788] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Windows\system32\SearchIndexer.exe[3788] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Windows\system32\SearchIndexer.exe[3788] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Windows\system32\SearchIndexer.exe[3788] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\SearchIndexer.exe[3788] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Windows\system32\SearchIndexer.exe[3788] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704D000A
.text C:\Windows\system32\SearchIndexer.exe[3788] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7070000A
.text C:\Windows\system32\SearchIndexer.exe[3788] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Windows\system32\SearchIndexer.exe[3788] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7092000A
.text C:\Windows\system32\SearchIndexer.exe[3788] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7079000A
.text C:\Windows\system32\SearchIndexer.exe[3788] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7044000A
.text C:\Windows\system32\SearchIndexer.exe[3788] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A
.text C:\Windows\system32\SearchIndexer.exe[3788] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7095000A
.text C:\Windows\system32\SearchIndexer.exe[3788] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Windows\system32\SearchIndexer.exe[3788] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 704A000A
.text C:\Windows\system32\SearchIndexer.exe[3788] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A
.text C:\Windows\system32\SearchIndexer.exe[3788] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Windows\system32\SearchIndexer.exe[3788] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708B000A
.text C:\Windows\system32\SearchIndexer.exe[3788] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705A000A
.text C:\Windows\system32\SearchIndexer.exe[3788] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Windows\system32\SearchIndexer.exe[3788] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Windows\system32\SearchIndexer.exe[3788] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Windows\system32\SearchIndexer.exe[3788] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707F000A
.text C:\Windows\system32\SearchIndexer.exe[3788] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7082000A
.text C:\Windows\system32\SearchIndexer.exe[3788] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Windows\system32\SearchIndexer.exe[3788] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7085000A
.text C:\Windows\system32\SearchIndexer.exe[3788] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Windows\system32\SearchIndexer.exe[3788] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Windows\system32\SearchIndexer.exe[3788] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Windows\system32\SearchIndexer.exe[3788] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Windows\system32\SearchIndexer.exe[3788] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7088000A
.text C:\Windows\system32\SearchIndexer.exe[3788] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\SearchIndexer.exe[3788] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Windows\system32\SearchIndexer.exe[3788] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Windows\system32\SearchIndexer.exe[3788] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Windows\system32\SearchIndexer.exe[3788] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Windows\system32\SearchIndexer.exe[3788] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Windows\system32\SearchIndexer.exe[3788] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\SearchIndexer.exe[3788] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
.text C:\Windows\system32\SearchIndexer.exe[3788] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\SearchIndexer.exe[3788] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70}
.text C:\Windows\system32\SearchIndexer.exe[3788] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7067000A
.text C:\Windows\system32\SearchIndexer.exe[3788] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7064000A
.text C:\Windows\system32\SearchIndexer.exe[3788] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Windows\system32\SearchIndexer.exe[3788] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 706A000A
.text C:\Windows\system32\SearchIndexer.exe[3788] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7050000A
.text C:\Windows\system32\SearchIndexer.exe[3788] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706D000A
.text C:\Windows\system32\SearchIndexer.exe[3788] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7053000A
.text C:\Windows\system32\SearchIndexer.exe[3788] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Windows\system32\SearchIndexer.exe[3788] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Windows\system32\SearchIndexer.exe[3788] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Windows\system32\SearchIndexer.exe[3788] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A
.text C:\Windows\system32\SearchIndexer.exe[3788] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Windows\system32\SearchIndexer.exe[3788] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Windows\system32\SearchIndexer.exe[3788] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Windows\system32\SearchIndexer.exe[3788] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71]
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71]
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] KERNEL32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] KERNEL32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] KERNEL32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] KERNEL32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] KERNEL32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] KERNEL32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7048000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] KERNEL32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] KERNEL32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705E000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] KERNEL32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7061000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] KERNEL32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7042000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] KERNEL32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7076000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] KERNEL32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] KERNEL32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] KERNEL32.dll!CreateMutexA 776F9431 6 Bytes JMP 707C000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] KERNEL32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] KERNEL32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] KERNEL32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] KERNEL32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] KERNEL32.dll!OpenProcess 77717267 6 Bytes JMP 703F000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] KERNEL32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] KERNEL32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7073000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] KERNEL32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] KERNEL32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] KERNEL32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] KERNEL32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] KERNEL32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] KERNEL32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704E000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] KERNEL32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7070000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] KERNEL32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] KERNEL32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7092000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] KERNEL32.dll!CreateMutexW 7771D555 6 Bytes JMP 7079000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] KERNEL32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7045000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] KERNEL32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] KERNEL32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7095000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] KERNEL32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] KERNEL32.dll!MoveFileA 7775F641 6 Bytes JMP 704B000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] KERNEL32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] KERNEL32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] KERNEL32.dll!SetThreadContext 7776794A 6 Bytes JMP 708B000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705B000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707F000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7082000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7085000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7088000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70}
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7067000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7064000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 706A000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7051000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706D000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7054000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] shell32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] shell32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] shell32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] shell32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] shell32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe[3892] shell32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A
.text C:\Windows\system32\WUDFHost.exe[3900] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\WUDFHost.exe[3900] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Windows\system32\WUDFHost.exe[3900] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\WUDFHost.exe[3900] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\system32\WUDFHost.exe[3900] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\WUDFHost.exe[3900] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Windows\system32\WUDFHost.exe[3900] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\WUDFHost.exe[3900] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Windows\system32\WUDFHost.exe[3900] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\WUDFHost.exe[3900] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Windows\system32\WUDFHost.exe[3900] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\WUDFHost.exe[3900] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Windows\system32\WUDFHost.exe[3900] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\WUDFHost.exe[3900] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Windows\system32\WUDFHost.exe[3900] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\WUDFHost.exe[3900] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Windows\system32\WUDFHost.exe[3900] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\WUDFHost.exe[3900] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71]
.text C:\Windows\system32\WUDFHost.exe[3900] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\WUDFHost.exe[3900] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\WUDFHost.exe[3900] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\WUDFHost.exe[3900] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Windows\system32\WUDFHost.exe[3900] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\WUDFHost.exe[3900] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\system32\WUDFHost.exe[3900] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\WUDFHost.exe[3900] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71]
.text C:\Windows\system32\WUDFHost.exe[3900] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\WUDFHost.exe[3900] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Windows\system32\WUDFHost.exe[3900] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\WUDFHost.exe[3900] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Windows\system32\WUDFHost.exe[3900] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\WUDFHost.exe[3900] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Windows\system32\WUDFHost.exe[3900] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\WUDFHost.exe[3900] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Windows\system32\WUDFHost.exe[3900] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\WUDFHost.exe[3900] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Windows\system32\WUDFHost.exe[3900] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Windows\system32\WUDFHost.exe[3900] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Windows\system32\WUDFHost.exe[3900] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Windows\system32\WUDFHost.exe[3900] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Windows\system32\WUDFHost.exe[3900] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A
.text C:\Windows\system32\WUDFHost.exe[3900] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7048000A
.text C:\Windows\system32\WUDFHost.exe[3900] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A
.text C:\Windows\system32\WUDFHost.exe[3900] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705E000A
.text C:\Windows\system32\WUDFHost.exe[3900] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7061000A
.text C:\Windows\system32\WUDFHost.exe[3900] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7042000A
.text C:\Windows\system32\WUDFHost.exe[3900] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7076000A
.text C:\Windows\system32\WUDFHost.exe[3900] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\WUDFHost.exe[3900] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Windows\system32\WUDFHost.exe[3900] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707C000A
.text C:\Windows\system32\WUDFHost.exe[3900] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Windows\system32\WUDFHost.exe[3900] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Windows\system32\WUDFHost.exe[3900] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Windows\system32\WUDFHost.exe[3900] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Windows\system32\WUDFHost.exe[3900] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703F000A
.text C:\Windows\system32\WUDFHost.exe[3900] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Windows\system32\WUDFHost.exe[3900] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7073000A
.text C:\Windows\system32\WUDFHost.exe[3900] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Windows\system32\WUDFHost.exe[3900] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Windows\system32\WUDFHost.exe[3900] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Windows\system32\WUDFHost.exe[3900] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\WUDFHost.exe[3900] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Windows\system32\WUDFHost.exe[3900] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704E000A
.text C:\Windows\system32\WUDFHost.exe[3900] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7070000A
.text C:\Windows\system32\WUDFHost.exe[3900] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Windows\system32\WUDFHost.exe[3900] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7092000A
.text C:\Windows\system32\WUDFHost.exe[3900] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7079000A
.text C:\Windows\system32\WUDFHost.exe[3900] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7045000A
.text C:\Windows\system32\WUDFHost.exe[3900] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A
.text C:\Windows\system32\WUDFHost.exe[3900] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7095000A
.text C:\Windows\system32\WUDFHost.exe[3900] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Windows\system32\WUDFHost.exe[3900] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 704B000A
.text C:\Windows\system32\WUDFHost.exe[3900] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A
.text C:\Windows\system32\WUDFHost.exe[3900] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Windows\system32\WUDFHost.exe[3900] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708B000A
.text C:\Windows\system32\WUDFHost.exe[3900] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705B000A
.text C:\Windows\system32\WUDFHost.exe[3900] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Windows\system32\WUDFHost.exe[3900] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Windows\system32\WUDFHost.exe[3900] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Windows\system32\WUDFHost.exe[3900] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707F000A
.text C:\Windows\system32\WUDFHost.exe[3900] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7082000A
.text C:\Windows\system32\WUDFHost.exe[3900] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Windows\system32\WUDFHost.exe[3900] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7085000A
.text C:\Windows\system32\WUDFHost.exe[3900] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Windows\system32\WUDFHost.exe[3900] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Windows\system32\WUDFHost.exe[3900] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Windows\system32\WUDFHost.exe[3900] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Windows\system32\WUDFHost.exe[3900] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7088000A
.text C:\Windows\system32\WUDFHost.exe[3900] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\WUDFHost.exe[3900] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Windows\system32\WUDFHost.exe[3900] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Windows\system32\WUDFHost.exe[3900] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Windows\system32\WUDFHost.exe[3900] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Windows\system32\WUDFHost.exe[3900] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Windows\system32\WUDFHost.exe[3900] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\WUDFHost.exe[3900] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
.text C:\Windows\system32\WUDFHost.exe[3900] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\WUDFHost.exe[3900] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70}
.text C:\Windows\system32\WUDFHost.exe[3900] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7067000A
.text C:\Windows\system32\WUDFHost.exe[3900] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7064000A
.text C:\Windows\system32\WUDFHost.exe[3900] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Windows\system32\WUDFHost.exe[3900] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 706A000A
.text C:\Windows\system32\WUDFHost.exe[3900] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7051000A
.text C:\Windows\system32\WUDFHost.exe[3900] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706D000A
.text C:\Windows\system32\WUDFHost.exe[3900] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7054000A
.text C:\Windows\system32\WUDFHost.exe[3900] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Windows\system32\WUDFHost.exe[3900] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Windows\system32\WUDFHost.exe[3900] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Windows\system32\WUDFHost.exe[3900] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A
.text C:\Windows\system32\WUDFHost.exe[3900] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Windows\system32\WUDFHost.exe[3900] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Windows\system32\WUDFHost.exe[3900] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Windows\system32\WUDFHost.exe[3900] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71]
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71]
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7042000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 7058000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 705B000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 703C000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7070000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 7076000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 7039000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 706D000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] kernel32.dll!CreateThread + 1A 7771C928 4 Bytes CALL 0044BC05 C:\Program Files\Spyware Doctor\pctsSvc.exe (PC Tools Security Service/PC Tools)
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 7048000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 706A000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 708C000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7073000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 703F000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 708F000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 7045000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 7085000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70}
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7061000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 705E000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 7064000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 704B000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 7067000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 704E000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 7055000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 7079000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 707C000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 707F000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7082000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] shell32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] shell32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] shell32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] shell32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] shell32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] shell32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] wininet.dll!InternetOpenUrlA 7760F3A4 6 Bytes JMP 7095000A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[3936] wininet.dll!InternetOpenUrlW 77656D5F 6 Bytes JMP 7092000A
.text C:\Windows\ehome\ehsched.exe[4292] ntdll.dll!NtClose
Hi Satchfan hear is more >>> GMER
.
77C74164 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehsched.exe[4292] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Windows\ehome\ehsched.exe[4292] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehsched.exe[4292] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\ehome\ehsched.exe[4292] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehsched.exe[4292] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Windows\ehome\ehsched.exe[4292] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehsched.exe[4292] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Windows\ehome\ehsched.exe[4292] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehsched.exe[4292] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Windows\ehome\ehsched.exe[4292] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehsched.exe[4292] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Windows\ehome\ehsched.exe[4292] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehsched.exe[4292] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Windows\ehome\ehsched.exe[4292] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehsched.exe[4292] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Windows\ehome\ehsched.exe[4292] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehsched.exe[4292] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71]
.text C:\Windows\ehome\ehsched.exe[4292] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehsched.exe[4292] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\ehome\ehsched.exe[4292] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehsched.exe[4292] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Windows\ehome\ehsched.exe[4292] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehsched.exe[4292] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\ehome\ehsched.exe[4292] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehsched.exe[4292] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71]
.text C:\Windows\ehome\ehsched.exe[4292] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehsched.exe[4292] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Windows\ehome\ehsched.exe[4292] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehsched.exe[4292] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Windows\ehome\ehsched.exe[4292] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehsched.exe[4292] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Windows\ehome\ehsched.exe[4292] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehsched.exe[4292] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Windows\ehome\ehsched.exe[4292] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehsched.exe[4292] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Windows\ehome\ehsched.exe[4292] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Windows\ehome\ehsched.exe[4292] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Windows\ehome\ehsched.exe[4292] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Windows\ehome\ehsched.exe[4292] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Windows\ehome\ehsched.exe[4292] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A
.text C:\Windows\ehome\ehsched.exe[4292] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7048000A
.text C:\Windows\ehome\ehsched.exe[4292] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A
.text C:\Windows\ehome\ehsched.exe[4292] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705E000A
.text C:\Windows\ehome\ehsched.exe[4292] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7061000A
.text C:\Windows\ehome\ehsched.exe[4292] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7042000A
.text C:\Windows\ehome\ehsched.exe[4292] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7076000A
.text C:\Windows\ehome\ehsched.exe[4292] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Windows\ehome\ehsched.exe[4292] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Windows\ehome\ehsched.exe[4292] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707C000A
.text C:\Windows\ehome\ehsched.exe[4292] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Windows\ehome\ehsched.exe[4292] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Windows\ehome\ehsched.exe[4292] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Windows\ehome\ehsched.exe[4292] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Windows\ehome\ehsched.exe[4292] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703F000A
.text C:\Windows\ehome\ehsched.exe[4292] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Windows\ehome\ehsched.exe[4292] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7073000A
.text C:\Windows\ehome\ehsched.exe[4292] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Windows\ehome\ehsched.exe[4292] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Windows\ehome\ehsched.exe[4292] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Windows\ehome\ehsched.exe[4292] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehsched.exe[4292] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Windows\ehome\ehsched.exe[4292] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704E000A
.text C:\Windows\ehome\ehsched.exe[4292] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7070000A
.text C:\Windows\ehome\ehsched.exe[4292] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Windows\ehome\ehsched.exe[4292] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7092000A
.text C:\Windows\ehome\ehsched.exe[4292] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7079000A
.text C:\Windows\ehome\ehsched.exe[4292] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7045000A
.text C:\Windows\ehome\ehsched.exe[4292] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A
.text C:\Windows\ehome\ehsched.exe[4292] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7095000A
.text C:\Windows\ehome\ehsched.exe[4292] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Windows\ehome\ehsched.exe[4292] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 704B000A
.text C:\Windows\ehome\ehsched.exe[4292] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A
.text C:\Windows\ehome\ehsched.exe[4292] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Windows\ehome\ehsched.exe[4292] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708B000A
.text C:\Windows\ehome\ehsched.exe[4292] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705B000A
.text C:\Windows\ehome\ehsched.exe[4292] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Windows\ehome\ehsched.exe[4292] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Windows\ehome\ehsched.exe[4292] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Windows\ehome\ehsched.exe[4292] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707F000A
.text C:\Windows\ehome\ehsched.exe[4292] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7082000A
.text C:\Windows\ehome\ehsched.exe[4292] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Windows\ehome\ehsched.exe[4292] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7085000A
.text C:\Windows\ehome\ehsched.exe[4292] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Windows\ehome\ehsched.exe[4292] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Windows\ehome\ehsched.exe[4292] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Windows\ehome\ehsched.exe[4292] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Windows\ehome\ehsched.exe[4292] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7088000A
.text C:\Windows\ehome\ehsched.exe[4292] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehsched.exe[4292] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Windows\ehome\ehsched.exe[4292] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Windows\ehome\ehsched.exe[4292] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Windows\ehome\ehsched.exe[4292] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Windows\ehome\ehsched.exe[4292] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Windows\ehome\ehsched.exe[4292] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehsched.exe[4292] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
.text C:\Windows\ehome\ehsched.exe[4292] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehsched.exe[4292] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70}
.text C:\Windows\ehome\ehsched.exe[4292] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7067000A
.text C:\Windows\ehome\ehsched.exe[4292] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7064000A
.text C:\Windows\ehome\ehsched.exe[4292] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Windows\ehome\ehsched.exe[4292] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 706A000A
.text C:\Windows\ehome\ehsched.exe[4292] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7051000A
.text C:\Windows\ehome\ehsched.exe[4292] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706D000A
.text C:\Windows\ehome\ehsched.exe[4292] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7054000A
.text C:\Windows\ehome\ehsched.exe[4292] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Windows\ehome\ehsched.exe[4292] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Windows\ehome\ehsched.exe[4292] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Windows\ehome\ehsched.exe[4292] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A
.text C:\Windows\ehome\ehsched.exe[4292] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Windows\ehome\ehsched.exe[4292] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Windows\ehome\ehsched.exe[4292] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Windows\ehome\ehsched.exe[4292] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A
.text C:\Windows\system32\svchost.exe[4316] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[4316] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Windows\system32\svchost.exe[4316] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[4316] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\system32\svchost.exe[4316] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[4316] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Windows\system32\svchost.exe[4316] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[4316] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Windows\system32\svchost.exe[4316] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[4316] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Windows\system32\svchost.exe[4316] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[4316] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Windows\system32\svchost.exe[4316] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[4316] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Windows\system32\svchost.exe[4316] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[4316] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Windows\system32\svchost.exe[4316] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[4316] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71]
.text C:\Windows\system32\svchost.exe[4316] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[4316] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\svchost.exe[4316] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[4316] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Windows\system32\svchost.exe[4316] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[4316] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\system32\svchost.exe[4316] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[4316] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71]
.text C:\Windows\system32\svchost.exe[4316] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[4316] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Windows\system32\svchost.exe[4316] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[4316] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Windows\system32\svchost.exe[4316] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[4316] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Windows\system32\svchost.exe[4316] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[4316] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Windows\system32\svchost.exe[4316] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[4316] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Windows\system32\svchost.exe[4316] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Windows\system32\svchost.exe[4316] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Windows\system32\svchost.exe[4316] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Windows\system32\svchost.exe[4316] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Windows\system32\svchost.exe[4316] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A
.text C:\Windows\system32\svchost.exe[4316] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7048000A
.text C:\Windows\system32\svchost.exe[4316] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A
.text C:\Windows\system32\svchost.exe[4316] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705E000A
.text C:\Windows\system32\svchost.exe[4316] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7061000A
.text C:\Windows\system32\svchost.exe[4316] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7042000A
.text C:\Windows\system32\svchost.exe[4316] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7076000A
.text C:\Windows\system32\svchost.exe[4316] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\svchost.exe[4316] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Windows\system32\svchost.exe[4316] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707C000A
.text C:\Windows\system32\svchost.exe[4316] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Windows\system32\svchost.exe[4316] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Windows\system32\svchost.exe[4316] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Windows\system32\svchost.exe[4316] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Windows\system32\svchost.exe[4316] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703F000A
.text C:\Windows\system32\svchost.exe[4316] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Windows\system32\svchost.exe[4316] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7073000A
.text C:\Windows\system32\svchost.exe[4316] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Windows\system32\svchost.exe[4316] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Windows\system32\svchost.exe[4316] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Windows\system32\svchost.exe[4316] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[4316] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Windows\system32\svchost.exe[4316] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704E000A
.text C:\Windows\system32\svchost.exe[4316] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7070000A
.text C:\Windows\system32\svchost.exe[4316] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Windows\system32\svchost.exe[4316] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7092000A
.text C:\Windows\system32\svchost.exe[4316] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7079000A
.text C:\Windows\system32\svchost.exe[4316] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7045000A
.text C:\Windows\system32\svchost.exe[4316] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A
.text C:\Windows\system32\svchost.exe[4316] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7095000A
.text C:\Windows\system32\svchost.exe[4316] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Windows\system32\svchost.exe[4316] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 704B000A
.text C:\Windows\system32\svchost.exe[4316] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A
.text C:\Windows\system32\svchost.exe[4316] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Windows\system32\svchost.exe[4316] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708B000A
.text C:\Windows\system32\svchost.exe[4316] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705B000A
.text C:\Windows\system32\svchost.exe[4316] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Windows\system32\svchost.exe[4316] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Windows\system32\svchost.exe[4316] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Windows\system32\svchost.exe[4316] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707F000A
.text C:\Windows\system32\svchost.exe[4316] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7082000A
.text C:\Windows\system32\svchost.exe[4316] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Windows\system32\svchost.exe[4316] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7085000A
.text C:\Windows\system32\svchost.exe[4316] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Windows\system32\svchost.exe[4316] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Windows\system32\svchost.exe[4316] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Windows\system32\svchost.exe[4316] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Windows\system32\svchost.exe[4316] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7088000A
.text C:\Windows\system32\svchost.exe[4316] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[4316] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Windows\system32\svchost.exe[4316] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Windows\system32\svchost.exe[4316] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Windows\system32\svchost.exe[4316] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Windows\system32\svchost.exe[4316] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Windows\system32\svchost.exe[4316] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[4316] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
.text C:\Windows\system32\svchost.exe[4316] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\svchost.exe[4316] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70}
.text C:\Windows\system32\svchost.exe[4316] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7067000A
.text C:\Windows\system32\svchost.exe[4316] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7064000A
.text C:\Windows\system32\svchost.exe[4316] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Windows\system32\svchost.exe[4316] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 706A000A
.text C:\Windows\system32\svchost.exe[4316] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7051000A
.text C:\Windows\system32\svchost.exe[4316] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706D000A
.text C:\Windows\system32\svchost.exe[4316] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7054000A
.text C:\Windows\system32\svchost.exe[4316] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Windows\system32\svchost.exe[4316] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Windows\system32\svchost.exe[4316] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Windows\system32\svchost.exe[4316] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A
.text C:\Windows\system32\svchost.exe[4316] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Windows\system32\svchost.exe[4316] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Windows\system32\svchost.exe[4316] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Windows\system32\svchost.exe[4316] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A
.text C:\Windows\ehome\ehRecvr.exe[4392] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehRecvr.exe[4392] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Windows\ehome\ehRecvr.exe[4392] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehRecvr.exe[4392] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\ehome\ehRecvr.exe[4392] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehRecvr.exe[4392] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Windows\ehome\ehRecvr.exe[4392] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehRecvr.exe[4392] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Windows\ehome\ehRecvr.exe[4392] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehRecvr.exe[4392] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Windows\ehome\ehRecvr.exe[4392] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehRecvr.exe[4392] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Windows\ehome\ehRecvr.exe[4392] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehRecvr.exe[4392] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Windows\ehome\ehRecvr.exe[4392] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehRecvr.exe[4392] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Windows\ehome\ehRecvr.exe[4392] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehRecvr.exe[4392] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71]
.text C:\Windows\ehome\ehRecvr.exe[4392] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehRecvr.exe[4392] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\ehome\ehRecvr.exe[4392] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehRecvr.exe[4392] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Windows\ehome\ehRecvr.exe[4392] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehRecvr.exe[4392] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\ehome\ehRecvr.exe[4392] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehRecvr.exe[4392] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71]
.text C:\Windows\ehome\ehRecvr.exe[4392] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehRecvr.exe[4392] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Windows\ehome\ehRecvr.exe[4392] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehRecvr.exe[4392] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Windows\ehome\ehRecvr.exe[4392] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehRecvr.exe[4392] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Windows\ehome\ehRecvr.exe[4392] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehRecvr.exe[4392] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Windows\ehome\ehRecvr.exe[4392] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehRecvr.exe[4392] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Windows\ehome\ehRecvr.exe[4392] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Windows\ehome\ehRecvr.exe[4392] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Windows\ehome\ehRecvr.exe[4392] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Windows\ehome\ehRecvr.exe[4392] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Windows\ehome\ehRecvr.exe[4392] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C5000A
.text C:\Windows\ehome\ehRecvr.exe[4392] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 702A000A
.text C:\Windows\ehome\ehRecvr.exe[4392] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A8000A
.text C:\Windows\ehome\ehRecvr.exe[4392] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 7044000A
.text C:\Windows\ehome\ehRecvr.exe[4392] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7047000A
.text C:\Windows\ehome\ehRecvr.exe[4392] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7024000A
.text C:\Windows\ehome\ehRecvr.exe[4392] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 705C000A
.text C:\Windows\ehome\ehRecvr.exe[4392] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Windows\ehome\ehRecvr.exe[4392] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Windows\ehome\ehRecvr.exe[4392] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 7062000A
.text C:\Windows\ehome\ehRecvr.exe[4392] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Windows\ehome\ehRecvr.exe[4392] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Windows\ehome\ehRecvr.exe[4392] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Windows\ehome\ehRecvr.exe[4392] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Windows\ehome\ehRecvr.exe[4392] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 7021000A
.text C:\Windows\ehome\ehRecvr.exe[4392] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Windows\ehome\ehRecvr.exe[4392] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7059000A
.text C:\Windows\ehome\ehRecvr.exe[4392] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Windows\ehome\ehRecvr.exe[4392] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Windows\ehome\ehRecvr.exe[4392] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Windows\ehome\ehRecvr.exe[4392] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehRecvr.exe[4392] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Windows\ehome\ehRecvr.exe[4392] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 7034000A
.text C:\Windows\ehome\ehRecvr.exe[4392] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7056000A
.text C:\Windows\ehome\ehRecvr.exe[4392] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Windows\ehome\ehRecvr.exe[4392] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7083000A
.text C:\Windows\ehome\ehRecvr.exe[4392] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 705F000A
.text C:\Windows\ehome\ehRecvr.exe[4392] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7027000A
.text C:\Windows\ehome\ehRecvr.exe[4392] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AB000A
.text C:\Windows\ehome\ehRecvr.exe[4392] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7088000A
.text C:\Windows\ehome\ehRecvr.exe[4392] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Windows\ehome\ehRecvr.exe[4392] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 702D000A
.text C:\Windows\ehome\ehRecvr.exe[4392] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A5000A
.text C:\Windows\ehome\ehRecvr.exe[4392] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Windows\ehome\ehRecvr.exe[4392] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 707C000A
.text C:\Windows\ehome\ehRecvr.exe[4392] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 7041000A
.text C:\Windows\ehome\ehRecvr.exe[4392] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Windows\ehome\ehRecvr.exe[4392] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Windows\ehome\ehRecvr.exe[4392] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Windows\ehome\ehRecvr.exe[4392] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 7065000A
.text C:\Windows\ehome\ehRecvr.exe[4392] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7068000A
.text C:\Windows\ehome\ehRecvr.exe[4392] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Windows\ehome\ehRecvr.exe[4392] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 706B000A
.text C:\Windows\ehome\ehRecvr.exe[4392] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Windows\ehome\ehRecvr.exe[4392] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Windows\ehome\ehRecvr.exe[4392] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Windows\ehome\ehRecvr.exe[4392] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Windows\ehome\ehRecvr.exe[4392] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7079000A
.text C:\Windows\ehome\ehRecvr.exe[4392] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehRecvr.exe[4392] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Windows\ehome\ehRecvr.exe[4392] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Windows\ehome\ehRecvr.exe[4392] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Windows\ehome\ehRecvr.exe[4392] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Windows\ehome\ehRecvr.exe[4392] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Windows\ehome\ehRecvr.exe[4392] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehRecvr.exe[4392] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
.text C:\Windows\ehome\ehRecvr.exe[4392] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Windows\ehome\ehRecvr.exe[4392] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B1, 70] {MOV CL, 0x70}
.text C:\Windows\ehome\ehRecvr.exe[4392] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 704D000A
.text C:\Windows\ehome\ehRecvr.exe[4392] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 704A000A
.text C:\Windows\ehome\ehRecvr.exe[4392] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Windows\ehome\ehRecvr.exe[4392] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 7050000A
.text C:\Windows\ehome\ehRecvr.exe[4392] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7037000A
.text C:\Windows\ehome\ehRecvr.exe[4392] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 7053000A
.text C:\Windows\ehome\ehRecvr.exe[4392] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 703A000A
.text C:\Windows\ehome\ehRecvr.exe[4392] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Windows\ehome\ehRecvr.exe[4392] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Windows\ehome\ehRecvr.exe[4392] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Windows\ehome\ehRecvr.exe[4392] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709B000A
.text C:\Windows\ehome\ehRecvr.exe[4392] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Windows\ehome\ehRecvr.exe[4392] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Windows\ehome\ehRecvr.exe[4392] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Windows\ehome\ehRecvr.exe[4392] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709E000A
.text C:\Windows\ehome\ehRecvr.exe[4392] WININET.dll!InternetOpenUrlA 7760F3A4 6 Bytes JMP 7091000A
.text C:\Windows\ehome\ehRecvr.exe[4392] WININET.dll!InternetOpenUrlW 77656D5F 6 Bytes JMP 708E000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71]
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71]
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7041000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 7057000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 705A000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 703B000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7070000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 7076000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 7038000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 706D000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 7047000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 706A000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 708C000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7073000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 703E000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 708F000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 7044000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 7085000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 7054000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 7079000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 707C000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 707F000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7082000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70}
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7061000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 705E000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 7064000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 704A000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 7067000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 704D000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] WININET.dll!InternetOpenUrlA 7760F3A4 6 Bytes JMP 7095000A
.text C:\Program Files\Google\Update\1.3.21.53\GoogleCrashHandler.exe[5088] WININET.dll!InternetOpenUrlW 77656D5F 6 Bytes JMP 7092000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\Desktop\gmer.exe[5204] ntdll.dll!NtClose + 4 77C74168 2 Bytes [42, 5F] {INC EDX; POP EDI}
.text C:\Users\Jai\Desktop\gmer.exe[5204] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\Desktop\gmer.exe[5204] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [24, 5F] {AND AL, 0x5f}
.text C:\Users\Jai\Desktop\gmer.exe[5204] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\Desktop\gmer.exe[5204] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Users\Jai\Desktop\gmer.exe[5204] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\Desktop\gmer.exe[5204] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [36, 5F]
.text C:\Users\Jai\Desktop\gmer.exe[5204] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\Desktop\gmer.exe[5204] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [39, 5F]
.text C:\Users\Jai\Desktop\gmer.exe[5204] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\Desktop\gmer.exe[5204] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [30, 5F]
.text C:\Users\Jai\Desktop\gmer.exe[5204] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\Desktop\gmer.exe[5204] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [18, 5F]
.text C:\Users\Jai\Desktop\gmer.exe[5204] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\Desktop\gmer.exe[5204] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [1E, 5F] {PUSH DS; POP EDI}
.text C:\Users\Jai\Desktop\gmer.exe[5204] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\Desktop\gmer.exe[5204] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [1F, 71]
.text C:\Users\Jai\Desktop\gmer.exe[5204] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\Desktop\gmer.exe[5204] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [21, 5F]
.text C:\Users\Jai\Desktop\gmer.exe[5204] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\Desktop\gmer.exe[5204] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [2D, 5F]
.text C:\Users\Jai\Desktop\gmer.exe[5204] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\Desktop\gmer.exe[5204] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [1B, 5F]
.text C:\Users\Jai\Desktop\gmer.exe[5204] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\Desktop\gmer.exe[5204] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [37, 71]
.text C:\Users\Jai\Desktop\gmer.exe[5204] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\Desktop\gmer.exe[5204] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [3C, 5F] {CMP AL, 0x5f}
.text C:\Users\Jai\Desktop\gmer.exe[5204] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\Desktop\gmer.exe[5204] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [27, 5F] {DAA ; POP EDI}
.text C:\Users\Jai\Desktop\gmer.exe[5204] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\Desktop\gmer.exe[5204] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [2A, 5F]
.text C:\Users\Jai\Desktop\gmer.exe[5204] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\Desktop\gmer.exe[5204] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [3F, 5F] {AAS ; POP EDI}
.text C:\Users\Jai\Desktop\gmer.exe[5204] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\Desktop\gmer.exe[5204] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [33, 5F]
.text C:\Users\Jai\Desktop\gmer.exe[5204] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7162000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714D000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7150000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 715F000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C5000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7047000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A8000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705D000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7060000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7041000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7075000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Users\Jai\Desktop\gmer.exe[5204] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 7159000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707B000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715C000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7108000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7123000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7135000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703E000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 710F000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7072000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C8000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D5000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CB000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\Desktop\gmer.exe[5204] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6C, 71]
.text C:\Users\Jai\Desktop\gmer.exe[5204] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704D000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 706F000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D2000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7091000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7078000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7044000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AB000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7094000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7132000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 704A000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A5000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713E000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708A000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\Desktop\gmer.exe[5204] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [11, 71]
.text C:\Users\Jai\Desktop\gmer.exe[5204] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7156000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] USER32.dll!ChangeDisplaySettingsExA 770D6FE7 6 Bytes JMP 5F0D0F5A
.text C:\Users\Jai\Desktop\gmer.exe[5204] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712C000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7153000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7115000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] USER32.dll!SetForegroundWindow 770DB8A6 6 Bytes JMP 5F040F5A
.text C:\Users\Jai\Desktop\gmer.exe[5204] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\Desktop\gmer.exe[5204] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [28, 71]
.text C:\Users\Jai\Desktop\gmer.exe[5204] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\Desktop\gmer.exe[5204] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B1, 70] {MOV CL, 0x70}
.text C:\Users\Jai\Desktop\gmer.exe[5204] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7066000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7063000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] USER32.dll!SetWindowPos 770E35E3 3 Bytes [FF, 25, 1E]
.text C:\Users\Jai\Desktop\gmer.exe[5204] USER32.dll!SetWindowPos + 4 770E35E7 2 Bytes [0B, 5F]
.text C:\Users\Jai\Desktop\gmer.exe[5204] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 712F000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 7069000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7050000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706C000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7053000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7126000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] USER32.dll!ChangeDisplaySettingsExW 7711A9E4 6 Bytes JMP 5F100F5A
.text C:\Users\Jai\Desktop\gmer.exe[5204] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713B000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705A000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7105000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 70FF000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70F9000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707E000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7081000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FC000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7084000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7102000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F3000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F6000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F0000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7087000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7147000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709B000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7141000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7144000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714A000A
.text C:\Users\Jai\Desktop\gmer.exe[5204] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709E000A
.text C:\Windows\system32\wuauclt.exe[5600] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wuauclt.exe[5600] ntdll.dll!NtClose + 4 77C74168 2 Bytes [35, 5F]
.text C:\Windows\system32\wuauclt.exe[5600] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wuauclt.exe[5600] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Windows\system32\wuauclt.exe[5600] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wuauclt.exe[5600] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [05, 5F]
.text C:\Windows\system32\wuauclt.exe[5600] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wuauclt.exe[5600] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [29, 5F]
.text C:\Windows\system32\wuauclt.exe[5600] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wuauclt.exe[5600] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [2C, 5F] {SUB AL, 0x5f}
.text C:\Windows\system32\wuauclt.exe[5600] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wuauclt.exe[5600] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [23, 5F]
.text C:\Windows\system32\wuauclt.exe[5600] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wuauclt.exe[5600] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [0B, 5F]
.text C:\Windows\system32\wuauclt.exe[5600] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wuauclt.exe[5600] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [11, 5F]
.text C:\Windows\system32\wuauclt.exe[5600] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wuauclt.exe[5600] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [20, 71]
.text C:\Windows\system32\wuauclt.exe[5600] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wuauclt.exe[5600] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\wuauclt.exe[5600] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wuauclt.exe[5600] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [20, 5F]
.text C:\Windows\system32\wuauclt.exe[5600] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wuauclt.exe[5600] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\Windows\system32\wuauclt.exe[5600] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wuauclt.exe[5600] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [38, 71]
.text C:\Windows\system32\wuauclt.exe[5600] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wuauclt.exe[5600] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Windows\system32\wuauclt.exe[5600] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wuauclt.exe[5600] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [1A, 5F]
.text C:\Windows\system32\wuauclt.exe[5600] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wuauclt.exe[5600] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [1D, 5F]
.text C:\Windows\system32\wuauclt.exe[5600] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wuauclt.exe[5600] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [32, 5F]
.text C:\Windows\system32\wuauclt.exe[5600] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wuauclt.exe[5600] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [26, 5F]
.text C:\Windows\system32\wuauclt.exe[5600] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7163000A
.text C:\Windows\system32\wuauclt.exe[5600] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714E000A
.text C:\Windows\system32\wuauclt.exe[5600] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7151000A
.text C:\Windows\system32\wuauclt.exe[5600] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 7160000A
.text C:\Windows\system32\wuauclt.exe[5600] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C6000A
.text C:\Windows\system32\wuauclt.exe[5600] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7048000A
.text C:\Windows\system32\wuauclt.exe[5600] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A9000A
.text C:\Windows\system32\wuauclt.exe[5600] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705E000A
.text C:\Windows\system32\wuauclt.exe[5600] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7061000A
.text C:\Windows\system32\wuauclt.exe[5600] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7042000A
.text C:\Windows\system32\wuauclt.exe[5600] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7076000A
.text C:\Windows\system32\wuauclt.exe[5600] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\wuauclt.exe[5600] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 715A000A
.text C:\Windows\system32\wuauclt.exe[5600] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707C000A
.text C:\Windows\system32\wuauclt.exe[5600] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715D000A
.text C:\Windows\system32\wuauclt.exe[5600] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7109000A
.text C:\Windows\system32\wuauclt.exe[5600] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7124000A
.text C:\Windows\system32\wuauclt.exe[5600] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7136000A
.text C:\Windows\system32\wuauclt.exe[5600] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703F000A
.text C:\Windows\system32\wuauclt.exe[5600] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 7110000A
.text C:\Windows\system32\wuauclt.exe[5600] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7073000A
.text C:\Windows\system32\wuauclt.exe[5600] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C9000A
.text C:\Windows\system32\wuauclt.exe[5600] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D6000A
.text C:\Windows\system32\wuauclt.exe[5600] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CC000A
.text C:\Windows\system32\wuauclt.exe[5600] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wuauclt.exe[5600] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6D, 71]
.text C:\Windows\system32\wuauclt.exe[5600] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704E000A
.text C:\Windows\system32\wuauclt.exe[5600] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 7070000A
.text C:\Windows\system32\wuauclt.exe[5600] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D3000A
.text C:\Windows\system32\wuauclt.exe[5600] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7092000A
.text C:\Windows\system32\wuauclt.exe[5600] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7079000A
.text C:\Windows\system32\wuauclt.exe[5600] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7045000A
.text C:\Windows\system32\wuauclt.exe[5600] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AC000A
.text C:\Windows\system32\wuauclt.exe[5600] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7095000A
.text C:\Windows\system32\wuauclt.exe[5600] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7133000A
.text C:\Windows\system32\wuauclt.exe[5600] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 704B000A
.text C:\Windows\system32\wuauclt.exe[5600] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A6000A
.text C:\Windows\system32\wuauclt.exe[5600] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713F000A
.text C:\Windows\system32\wuauclt.exe[5600] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708B000A
.text C:\Windows\system32\wuauclt.exe[5600] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wuauclt.exe[5600] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [12, 71]
.text C:\Windows\system32\wuauclt.exe[5600] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7157000A
.text C:\Windows\system32\wuauclt.exe[5600] USER32.dll!ChangeDisplaySettingsExA 770D6FE7 6 Bytes JMP 5F3E0F5A
.text C:\Windows\system32\wuauclt.exe[5600] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712D000A
.text C:\Windows\system32\wuauclt.exe[5600] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7154000A
.text C:\Windows\system32\wuauclt.exe[5600] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7116000A
.text C:\Windows\system32\wuauclt.exe[5600] USER32.dll!SetForegroundWindow 770DB8A6 6 Bytes JMP 5F370F5A
.text C:\Windows\system32\wuauclt.exe[5600] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wuauclt.exe[5600] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [29, 71]
.text C:\Windows\system32\wuauclt.exe[5600] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wuauclt.exe[5600] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B2, 70] {MOV DL, 0x70}
.text C:\Windows\system32\wuauclt.exe[5600] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7067000A
.text C:\Windows\system32\wuauclt.exe[5600] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7064000A
.text C:\Windows\system32\wuauclt.exe[5600] USER32.dll!SetWindowPos 770E35E3 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wuauclt.exe[5600] USER32.dll!SetWindowPos + 4 770E35E7 2 Bytes [3C, 5F] {CMP AL, 0x5f}
.text C:\Windows\system32\wuauclt.exe[5600] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 7130000A
.text C:\Windows\system32\wuauclt.exe[5600] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 706A000A
.text C:\Windows\system32\wuauclt.exe[5600] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7051000A
.text C:\Windows\system32\wuauclt.exe[5600] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706D000A
.text C:\Windows\system32\wuauclt.exe[5600] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7054000A
.text C:\Windows\system32\wuauclt.exe[5600] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7127000A
.text C:\Windows\system32\wuauclt.exe[5600] USER32.dll!ChangeDisplaySettingsExW 7711A9E4 6 Bytes JMP 5F410F5A
.text C:\Windows\system32\wuauclt.exe[5600] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713C000A
.text C:\Windows\system32\wuauclt.exe[5600] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705B000A
.text C:\Windows\system32\wuauclt.exe[5600] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7106000A
.text C:\Windows\system32\wuauclt.exe[5600] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 7100000A
.text C:\Windows\system32\wuauclt.exe[5600] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70FA000A
.text C:\Windows\system32\wuauclt.exe[5600] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707F000A
.text C:\Windows\system32\wuauclt.exe[5600] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7082000A
.text C:\Windows\system32\wuauclt.exe[5600] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FD000A
.text C:\Windows\system32\wuauclt.exe[5600] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7085000A
.text C:\Windows\system32\wuauclt.exe[5600] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7103000A
.text C:\Windows\system32\wuauclt.exe[5600] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F4000A
.text C:\Windows\system32\wuauclt.exe[5600] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F7000A
.text C:\Windows\system32\wuauclt.exe[5600] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F1000A
.text C:\Windows\system32\wuauclt.exe[5600] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7088000A
.text C:\Windows\system32\wuauclt.exe[5600] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7148000A
.text C:\Windows\system32\wuauclt.exe[5600] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709C000A
.text C:\Windows\system32\wuauclt.exe[5600] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7142000A
.text C:\Windows\system32\wuauclt.exe[5600] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7145000A
.text C:\Windows\system32\wuauclt.exe[5600] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714B000A
.text C:\Windows\system32\wuauclt.exe[5600] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709F000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ntdll.dll!NtClose + 4 77C74168 2 Bytes [42, 5F] {INC EDX; POP EDI}
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [24, 5F] {AND AL, 0x5f}
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [36, 5F]
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [39, 5F]
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [30, 5F]
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [18, 5F]
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [1E, 5F] {PUSH DS; POP EDI}
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [1F, 71]
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [21, 5F]
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [2D, 5F]
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [1B, 5F]
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [37, 71]
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [3C, 5F] {CMP AL, 0x5f}
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [27, 5F] {DAA ; POP EDI}
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [2A, 5F]
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [3F, 5F] {AAS ; POP EDI}
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [33, 5F]
.text C:\Windows\system32\wbem\unsecapp.exe[5656] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7162000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714D000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7150000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 715F000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C5000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7047000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A8000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705D000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7060000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7041000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7075000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 7159000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707B000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715C000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7108000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7123000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7135000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703E000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 710F000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7072000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C8000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D5000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CB000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\unsecapp.exe[5656] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6C, 71]
.text C:\Windows\system32\wbem\unsecapp.exe[5656] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704D000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 706F000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D2000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7091000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7078000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7044000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AB000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7094000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7132000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 704A000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A5000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713E000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708A000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705A000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7105000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 70FF000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70F9000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707E000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7081000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FC000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7084000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7102000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F3000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F6000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F0000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7087000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\unsecapp.exe[5656] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [11, 71]
.text C:\Windows\system32\wbem\unsecapp.exe[5656] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7156000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] USER32.dll!ChangeDisplaySettingsExA 770D6FE7 6 Bytes JMP 5F0D0F5A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712C000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7153000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7115000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] USER32.dll!SetForegroundWindow 770DB8A6 6 Bytes JMP 5F040F5A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\unsecapp.exe[5656] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [28, 71]
.text C:\Windows\system32\wbem\unsecapp.exe[5656] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\unsecapp.exe[5656] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B1, 70] {MOV CL, 0x70}
.text C:\Windows\system32\wbem\unsecapp.exe[5656] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7066000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7063000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] USER32.dll!SetWindowPos 770E35E3 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\unsecapp.exe[5656] USER32.dll!SetWindowPos + 4 770E35E7 2 Bytes [0B, 5F]
.text C:\Windows\system32\wbem\unsecapp.exe[5656] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 712F000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 7069000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7050000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706C000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7053000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7126000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] USER32.dll!ChangeDisplaySettingsExW 7711A9E4 6 Bytes JMP 5F100F5A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713B000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7147000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709B000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7141000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7144000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714A000A
.text C:\Windows\system32\wbem\unsecapp.exe[5656] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709E000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\NOTEPAD.EXE[5972] ntdll.dll!NtClose + 4 77C74168 2 Bytes [42, 5F] {INC EDX; POP EDI}
.text C:\Windows\system32\NOTEPAD.EXE[5972] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\NOTEPAD.EXE[5972] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [24, 5F] {AND AL, 0x5f}
.text C:\Windows\system32\NOTEPAD.EXE[5972] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\NOTEPAD.EXE[5972] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\NOTEPAD.EXE[5972] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\NOTEPAD.EXE[5972] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [36, 5F]
.text C:\Windows\system32\NOTEPAD.EXE[5972] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\NOTEPAD.EXE[5972] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [39, 5F]
.text C:\Windows\system32\NOTEPAD.EXE[5972] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\NOTEPAD.EXE[5972] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [30, 5F]
.text C:\Windows\system32\NOTEPAD.EXE[5972] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\NOTEPAD.EXE[5972] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [18, 5F]
.text C:\Windows\system32\NOTEPAD.EXE[5972] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\NOTEPAD.EXE[5972] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [1E, 5F] {PUSH DS; POP EDI}
.text C:\Windows\system32\NOTEPAD.EXE[5972] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\NOTEPAD.EXE[5972] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [1F, 71]
.text C:\Windows\system32\NOTEPAD.EXE[5972] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\NOTEPAD.EXE[5972] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [21, 5F]
.text C:\Windows\system32\NOTEPAD.EXE[5972] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\NOTEPAD.EXE[5972] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [2D, 5F]
.text C:\Windows\system32\NOTEPAD.EXE[5972] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\NOTEPAD.EXE[5972] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [1B, 5F]
.text C:\Windows\system32\NOTEPAD.EXE[5972] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\NOTEPAD.EXE[5972] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [37, 71]
.text C:\Windows\system32\NOTEPAD.EXE[5972] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\NOTEPAD.EXE[5972] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [3C, 5F] {CMP AL, 0x5f}
.text C:\Windows\system32\NOTEPAD.EXE[5972] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\NOTEPAD.EXE[5972] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [27, 5F] {DAA ; POP EDI}
.text C:\Windows\system32\NOTEPAD.EXE[5972] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\NOTEPAD.EXE[5972] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [2A, 5F]
.text C:\Windows\system32\NOTEPAD.EXE[5972] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\NOTEPAD.EXE[5972] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [3F, 5F] {AAS ; POP EDI}
.text C:\Windows\system32\NOTEPAD.EXE[5972] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\NOTEPAD.EXE[5972] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [33, 5F]
.text C:\Windows\system32\NOTEPAD.EXE[5972] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7162000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714D000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7150000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 715F000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C5000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7047000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A8000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705D000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7060000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7041000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7075000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\NOTEPAD.EXE[5972] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 7159000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707B000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715C000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7108000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7123000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7135000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703E000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 710F000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7072000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C8000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D5000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CB000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\NOTEPAD.EXE[5972] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6C, 71]
.text C:\Windows\system32\NOTEPAD.EXE[5972] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704D000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 706F000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D2000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7091000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7078000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7044000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AB000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7094000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7132000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 704A000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A5000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713E000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708A000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705A000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7105000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 70FF000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70F9000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707E000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7081000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FC000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7084000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7102000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F3000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F6000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F0000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7087000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\NOTEPAD.EXE[5972] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [11, 71]
.text C:\Windows\system32\NOTEPAD.EXE[5972] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7156000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] USER32.dll!ChangeDisplaySettingsExA 770D6FE7 6 Bytes JMP 5F0D0F5A
.text C:\Windows\system32\NOTEPAD.EXE[5972] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712C000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7153000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7115000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] USER32.dll!SetForegroundWindow 770DB8A6 6 Bytes JMP 5F040F5A
.text C:\Windows\system32\NOTEPAD.EXE[5972] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\NOTEPAD.EXE[5972] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [28, 71]
.text C:\Windows\system32\NOTEPAD.EXE[5972] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\NOTEPAD.EXE[5972] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B1, 70] {MOV CL, 0x70}
.text C:\Windows\system32\NOTEPAD.EXE[5972] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7066000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7063000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] USER32.dll!SetWindowPos 770E35E3 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\NOTEPAD.EXE[5972] USER32.dll!SetWindowPos + 4 770E35E7 2 Bytes [0B, 5F]
.text C:\Windows\system32\NOTEPAD.EXE[5972] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 712F000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 7069000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7050000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706C000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7053000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7126000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] USER32.dll!ChangeDisplaySettingsExW 7711A9E4 6 Bytes JMP 5F100F5A
.text C:\Windows\system32\NOTEPAD.EXE[5972] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713B000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7147000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709B000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7141000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7144000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714A000A
.text C:\Windows\system32\NOTEPAD.EXE[5972] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709E000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ntdll.dll!NtClose 77C74164 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ntdll.dll!NtClose + 4 77C74168 2 Bytes [42, 5F] {INC EDX; POP EDI}
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ntdll.dll!NtCreateFile 77C74224 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ntdll.dll!NtCreateFile + 4 77C74228 2 Bytes [24, 5F] {AND AL, 0x5f}
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ntdll.dll!NtCreateKey 77C74264 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ntdll.dll!NtCreateKey + 4 77C74268 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ntdll.dll!NtCreateProcess 77C742E4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ntdll.dll!NtCreateProcess + 4 77C742E8 2 Bytes [36, 5F]
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ntdll.dll!NtCreateProcessEx 77C742F4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ntdll.dll!NtCreateProcessEx + 4 77C742F8 2 Bytes [39, 5F]
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ntdll.dll!NtCreateSection 77C74314 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ntdll.dll!NtCreateSection + 4 77C74318 2 Bytes [30, 5F]
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ntdll.dll!NtDeleteKey 77C74614 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ntdll.dll!NtDeleteKey + 4 77C74618 2 Bytes [18, 5F]
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ntdll.dll!NtDeleteValueKey 77C74644 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ntdll.dll!NtDeleteValueKey + 4 77C74648 2 Bytes [1E, 5F] {PUSH DS; POP EDI}
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ntdll.dll!NtLoadDriver 77C748B4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ntdll.dll!NtLoadDriver + 4 77C748B8 2 Bytes [1F, 71]
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ntdll.dll!NtRenameKey 77C74F14 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ntdll.dll!NtRenameKey + 4 77C74F18 2 Bytes [21, 5F]
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ntdll.dll!NtSetInformationFile 77C75134 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ntdll.dll!NtSetInformationFile + 4 77C75138 2 Bytes [2D, 5F]
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ntdll.dll!NtSetValueKey 77C752A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ntdll.dll!NtSetValueKey + 4 77C752A8 2 Bytes [1B, 5F]
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ntdll.dll!NtSuspendProcess 77C75304 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ntdll.dll!NtSuspendProcess + 4 77C75308 2 Bytes [37, 71]
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ntdll.dll!NtTerminateProcess 77C75344 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ntdll.dll!NtTerminateProcess + 4 77C75348 2 Bytes [3C, 5F] {CMP AL, 0x5f}
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ntdll.dll!NtWriteFile 77C75494 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ntdll.dll!NtWriteFile + 4 77C75498 2 Bytes [27, 5F] {DAA ; POP EDI}
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ntdll.dll!NtWriteFileGather 77C754A4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ntdll.dll!NtWriteFileGather + 4 77C754A8 2 Bytes [2A, 5F]
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ntdll.dll!NtWriteVirtualMemory 77C754C4 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ntdll.dll!NtWriteVirtualMemory + 4 77C754C8 2 Bytes [3F, 5F] {AAS ; POP EDI}
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ntdll.dll!NtCreateUserProcess 77C75654 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ntdll.dll!NtCreateUserProcess + 4 77C75658 2 Bytes [33, 5F]
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] kernel32.dll!TerminateProcess 776D18EF 6 Bytes JMP 7162000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] kernel32.dll!CreateProcessW 776D1BF3 6 Bytes JMP 714D000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] kernel32.dll!CreateProcessA 776D1C28 6 Bytes JMP 7150000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] kernel32.dll!WriteProcessMemory 776D1CB8 6 Bytes JMP 715F000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] kernel32.dll!VirtualProtect 776D1DC3 6 Bytes JMP 70C5000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] kernel32.dll!MoveFileW 776DA2F2 6 Bytes JMP 7047000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] kernel32.dll!CopyFileW 776E0299 6 Bytes JMP 70A8000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] kernel32.dll!DeleteFileW 776EF4B6 6 Bytes JMP 705D000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] kernel32.dll!DeleteFileA 776EF5D2 6 Bytes JMP 7060000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] kernel32.dll!MoveFileExW 776F10C8 6 Bytes JMP 7041000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] kernel32.dll!OpenMutexA 776F33F7 6 Bytes JMP 7075000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] kernel32.dll!LoadLibraryExW 776F9109 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] kernel32.dll!LoadLibraryW 776F9362 6 Bytes JMP 7159000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] kernel32.dll!CreateMutexA 776F9431 6 Bytes JMP 707B000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] kernel32.dll!LoadLibraryA 776F94DC 6 Bytes JMP 715C000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] kernel32.dll!GetVolumeInformationW 776FD7FE 6 Bytes JMP 7108000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] kernel32.dll!VirtualProtectEx 776FDBDA 6 Bytes JMP 7123000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] kernel32.dll!TerminateThread 777141F7 6 Bytes JMP 7135000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] kernel32.dll!OpenProcess 77717267 6 Bytes JMP 703E000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] kernel32.dll!GetProcAddress 7771903B 6 Bytes JMP 710F000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] kernel32.dll!OpenMutexW 7771AA85 6 Bytes JMP 7072000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] kernel32.dll!VirtualAlloc 7771AD55 6 Bytes JMP 70C8000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] kernel32.dll!CreateFileW 7771AECB 6 Bytes JMP 70D5000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] kernel32.dll!CreateThread 7771C90E 6 Bytes JMP 70CB000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] kernel32.dll!CreateRemoteThread 7771C935 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] kernel32.dll!CreateRemoteThread + 4 7771C939 2 Bytes [6C, 71]
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] kernel32.dll!WideCharToMultiByte 7771CBF8 6 Bytes JMP 704D000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] kernel32.dll!MultiByteToWideChar 7771CCDB 6 Bytes JMP 706F000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] kernel32.dll!CreateFileA 7771CE5F 6 Bytes JMP 70D2000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] kernel32.dll!CreateDirectoryW 7771D166 6 Bytes JMP 7091000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] kernel32.dll!CreateMutexW 7771D555 6 Bytes JMP 7078000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] kernel32.dll!MoveFileExA 77720F0A 6 Bytes JMP 7044000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] kernel32.dll!CopyFileA 77722433 6 Bytes JMP 70AB000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] kernel32.dll!CreateDirectoryA 777270F4 6 Bytes JMP 7094000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] kernel32.dll!DebugActiveProcess 77759A61 6 Bytes JMP 7132000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] kernel32.dll!MoveFileA 7775F641 6 Bytes JMP 704A000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] kernel32.dll!CopyFileExA 777619F9 6 Bytes JMP 70A5000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] kernel32.dll!WinExec 77765CF7 6 Bytes JMP 713E000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] kernel32.dll!SetThreadContext 7776794A 6 Bytes JMP 708A000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ADVAPI32.dll!RegDeleteKeyA 76E31C8C 6 Bytes JMP 705A000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ADVAPI32.dll!RegCreateKeyExA 76E339AB 6 Bytes JMP 7105000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ADVAPI32.dll!RegCreateKeyA 76E33BA9 6 Bytes JMP 70FF000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ADVAPI32.dll!RegOpenKeyA 76E389C7 6 Bytes JMP 70F9000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ADVAPI32.dll!AdjustTokenPrivileges 76E399CD 6 Bytes JMP 707E000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ADVAPI32.dll!LookupPrivilegeValueW 76E436FF 6 Bytes JMP 7081000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ADVAPI32.dll!RegCreateKeyW 76E4391E 6 Bytes JMP 70FC000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ADVAPI32.dll!LookupPrivilegeValueA 76E43A0F 6 Bytes JMP 7084000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ADVAPI32.dll!RegCreateKeyExW 76E441F1 6 Bytes JMP 7102000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ADVAPI32.dll!RegOpenKeyExA 76E47C42 6 Bytes JMP 70F3000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ADVAPI32.dll!RegOpenKeyW 76E4E2B5 6 Bytes JMP 70F6000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ADVAPI32.dll!RegOpenKeyExW 76E57BA1 6 Bytes JMP 70F0000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] ADVAPI32.dll!OpenProcessToken 76E57DDC 6 Bytes JMP 7087000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] USER32.dll!RegisterRawInputDevices 770D6161 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] USER32.dll!RegisterRawInputDevices + 4 770D6165 2 Bytes [11, 71]
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] USER32.dll!SetWindowsHookExA 770D6322 6 Bytes JMP 7156000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] USER32.dll!ChangeDisplaySettingsExA 770D6FE7 6 Bytes JMP 5F0D0F5A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] USER32.dll!GetAsyncKeyState 770D863C 6 Bytes JMP 712C000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] USER32.dll!SetWindowsHookExW 770D87AD 6 Bytes JMP 7153000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] USER32.dll!SetWinEventHook 770D9F3A 6 Bytes JMP 7115000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] USER32.dll!SetForegroundWindow 770DB8A6 6 Bytes JMP 5F040F5A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] USER32.dll!GetKeyboardState 770DBD7D 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] USER32.dll!GetKeyboardState + 4 770DBD81 2 Bytes [28, 71]
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] USER32.dll!ShowWindow 770DCA10 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] USER32.dll!ShowWindow + 4 770DCA14 2 Bytes [B1, 70] {MOV CL, 0x70}
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] USER32.dll!CreateWindowExA 770DDC2A 6 Bytes JMP 7066000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] USER32.dll!CreateWindowExW 770E1305 6 Bytes JMP 7063000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] USER32.dll!SetWindowPos 770E35E3 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] USER32.dll!SetWindowPos + 4 770E35E7 2 Bytes [0B, 5F]
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] USER32.dll!GetKeyState 770E8CB1 6 Bytes JMP 712F000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] USER32.dll!DrawTextW 770E97D3 6 Bytes JMP 7069000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] USER32.dll!SetWindowTextW 770E9815 6 Bytes JMP 7050000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] USER32.dll!DrawTextA 770F558D 6 Bytes JMP 706C000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] USER32.dll!SetWindowTextA 770FA4E6 6 Bytes JMP 7053000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] USER32.dll!DdeConnect 77119A1F 6 Bytes JMP 7126000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] USER32.dll!ChangeDisplaySettingsExW 7711A9E4 6 Bytes JMP 5F100F5A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] USER32.dll!EndTask 7711AD32 6 Bytes JMP 713B000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] SHELL32.dll!ShellExecuteW 762C9725 6 Bytes JMP 7147000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] SHELL32.dll!Shell_NotifyIconW 76308642 6 Bytes JMP 709B000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] SHELL32.dll!ShellExecuteExW 7631C155 6 Bytes JMP 7141000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] SHELL32.dll!ShellExecuteEx 764CA292 6 Bytes JMP 7144000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] SHELL32.dll!ShellExecuteA 764CA32D 6 Bytes JMP 714A000A
.text C:\Windows\system32\wbem\wmiprvse.exe[6084] SHELL32.dll!Shell_NotifyIcon 764CBAED 6 Bytes JMP 709E000A
—- Devices - GMER 1.0.15 —-
AttachedDevice \FileSystem\Ntfs \Ntfs TfFsMon.sys (ThreatFire Filesystem Monitor/PC Tools)
AttachedDevice \Driver\tdx \Device\Tcp pctgntdi.sys
Device \Driver\PCTSDInjDriver32 \Device\PCTSDInjDriver32 PCTSDInj32.sys
AttachedDevice \Driver\tdx \Device\Udp bdftdif.sys
—- Registry - GMER 1.0.15 —-
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Media Center\Service\Scheduler@Heartbeat 0x60 0x5E 0x54 0xCB …
—- Files - GMER 1.0.15 —-
File C:\Windows\SoftwareDistribution\DataStore\Logs\tmp.edb 65536 bytes
—- EOF - GMER 1.0.15 —-
Hi echoesP2P P2P software, (LimeWire Perils of P2P File Sharing Control Panel, Programs , and then Programs and Features .Start, Run and type in, (or copy and paste),:sfc /scannow in the command window and press Enter .c and the /
