write protected zip/thumb/flash drive

Gents, This is a new one. My external flash/thumb/zip drive denies me access to some files and will not allow me to save to it, saying the drive is write protected. It is not. How shall I proceed to allow you to diagnose? Regards.

Hello paultpa,

Not really sure. Let's just check some diagnostic scan logs, and see.


If the system is Vista/Windows7, when running any of the scan files we use, be sure to right click the file, then select "Run as administrator" to start the scan/tool.

And To make sure you have an accurate view of files there, make sure you can View Hidden Files. Also uncheck "Hide Extensions for Known File Types"


To keep them from interfering with the repairs, be sure to temporarily disable all antivirus/anti-spyware softwares while these steps are being completed. This can usually be done through right clicking the software's Taskbar icons, or accessing each software through Start - Programs. Here are some antivirus disable tips if needed.

——-

Click here and download OldTimer's OTL to your desktop, then click that to open the scan display. At the top click "Scan All Users", then click "Run Scan". Make no other changes at this time.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are also saved in the same location as OTL.exe. Post the contents of those back here please.

Malware and it's changes showing. And a really outdated version of AVG. Once malware repairs are completed we can discuss that as well.

This scan does include some looks at usb/flash drives, which show autorun.inf files. Assuming you did not use some protective tool to create those, we will assume they are malware as well.

Be sure to continue to temporarily disable any protective software when running the scan tools we use here. Including your firewall program. They have done all they can, for the moment.


The malware has included an autorun type component, so if any external drives have been used on this computer recently be sure to install them now, and leave them installed until ALL repairs on it are completed. If not, they will remain infected and can re-infect the computer (or others).


To keep them from interfering with the repairs, be sure to temporarily disable all antivirus/anti-spyware softwares while these steps are being completed. This can usually be done through right clicking the software's Taskbar icons, or accessing each software through Start - Programs.


Click here and download Flash_Disinfector.exe and save it to your desktop.

Doubleclick on Flash_Disinfector.exe to run it and follow the prompts. Wait until it has finished scanning and then exit the program.

The utility may ask you to insert your flash drive and/or other external/removable drives. Please do so and allow the utility to clean up those drives as well.

Then leave any drives installed until all repairs here have been completed.

This will also create autorun.inf folders on all drives there, which serves to block autoloading infection from creating some of their bad files they need to infect other drives and systems.

——-

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"=-
"ProxyServer"=-

Open Notepad (Start - Run, type Notepad then press OK), and copy the text inside the box above and paste it into the open Notepad textbox.

Save this to your desktop as "fixer.reg"

Be sure to include the "" quotes in the name.

Then right click fixer.reg, select Merge, and allow it to merge the new information with the Registry.

——

Download ComboFix.exe from here to your desktop, but I would like you to rename the file as you download it (do not download it directly without renaming it - use right click "Save Target/Link As" ). For this, rename the downloading file to iexplore.exe, then click the renamed iexplore.exe to run that scan.

Be sure to install the Recovery Console if you are asked to do so. When the scan completes, a text window with your log will open. Please copy and paste that log back here.

A caution - do not touch your mouse/keyboard until the scan has completed. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop.

Allow the scan to run. When completed a text window will appear - please copy/paste the contents back here. This log can also be found at C:\ComboFix.txt.

Problem! The ComboFix scan does not complete. It terminates approx.halfway thru. Therefore, there is no scan file for you. The Flash Disinfector ran, and I merged "fixer.reg" with the new Registry. However, after 3-4 attempts (and saving the d/loads in different folders) to run the final ComboFix scan it stops and never produces a result. Ideas?

You are sure ThreatFire and AVG are completely disabled, to the best of your knowledge? Let's do some different checks.

See if you can access Safe Mode, where the malware (and security) is less active. At startup tap the F8 key about once per half-second, then select Safe Mode with Networking from the menu that will appear.

Try ComboFix again. If it completes, then still do the next steps.

—————-

Click here and download the installer for Gmer to your desktop, then click that file to run Gmer.


Once the opening scan finishes, click on Scan (again, before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while this scan completes. Also do not use your computer during the scan).

When completed, click on the Copy button and rightclick on your Desktop, choose "New" > Text document. Once the file is created, open it and rightclick again and choose Paste. Copy the information and post it here please.

Note - If Gmer shows it has located infection once it's opening scan completes, do not click the Scan button. We don't want hidden malware settings to cause any problems. Instead, just click on the Copy button and rightclick on your Desktop, choose "New" > Text document. Once the file is created, open it and rightclick again and choose Paste. Copy the information and post it here please.

———–

Download aswMBR ( 511KB ) to your desktop.

• Double click the aswMBR.exe icon to run it
• Decline a download of avast itself if offered
• If avast! antivirus is already installed, go to the dropdown next to AV engine: and select (none)
• Click the Scan button to start the scan
• On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.

Some changes we need to make, and once all these scans are completed it really would be best to uninstall all that older AVG software. But let's check the other scan results first.

JIntan, GMER scan continued, post # 2: .text C:\WINDOWS\System32\svchost.exe[1396] ntdll.dll!NtLoadDriver 7C90D46E 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\svchost.exe[1396] ntdll.dll!NtLoadDriver + 4 7C90D472 2 Bytes [22, 71] .text C:\WINDOWS\System32\svchost.exe[1396] ntdll.dll!NtSuspendProcess 7C90DE2E 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\svchost.exe[1396] ntdll.dll!NtSuspendProcess + 4 7C90DE32 2 Bytes [3A, 71] .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!DeviceIoControl 7C801629 6 Bytes JMP 70AB000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!CreateFileA 7C801A28 6 Bytes JMP 70DE000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!VirtualProtectEx 7C801A61 6 Bytes JMP 7126000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!VirtualProtect 7C801AD4 6 Bytes JMP 70D2000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!LoadLibraryExW 7C801AF5 6 Bytes JMP 716B000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!LoadLibraryA 7C801D7B 6 Bytes JMP 715F000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 7165000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 7162000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 7150000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 7153000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!VirtualAlloc 7C809AF1 6 Bytes JMP 70D5000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!MultiByteToWideChar 7C809C98 6 Bytes JMP 7084000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!LoadResource 7C80A055 6 Bytes JMP 70C0000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!WideCharToMultiByte 7C80A174 6 Bytes JMP 7063000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!GetProcAddress 7C80AE40 6 Bytes JMP 7114000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!LoadLibraryW 7C80AEEB 6 Bytes JMP 715C000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!CreateMutexW 7C80E957 6 Bytes JMP 708D000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!CreateMutexA 7C80E9DF 6 Bytes JMP 7090000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!OpenMutexW 7C80EA35 6 Bytes JMP 7087000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!OpenMutexA 7C80EABB 6 Bytes JMP 708A000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!GetVolumeInformationW 7C80FA85 6 Bytes JMP 710E000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [6D, 71] .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!CreateThread 7C8106D7 6 Bytes JMP 70D8000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!CreateFileW 7C810800 6 Bytes JMP 70E1000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!WriteFile 7C810E27 6 Bytes JMP 70A2000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!TerminateThread 7C81CB3B 6 Bytes JMP 7138000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!MoveFileW 7C821261 6 Bytes JMP 705D000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!CreateDirectoryA 7C8217AC 6 Bytes JMP 70A8000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!GetVolumeInformationA 7C821BA5 6 Bytes JMP 7111000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 70B4000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!CopyFileA 7C8286EE 6 Bytes JMP 70BD000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!CopyFileW 7C82F87B 6 Bytes JMP 70BA000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!OpenProcess 7C8309E9 6 Bytes JMP 7054000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!DeleteFileA 7C831EDD 6 Bytes JMP 7075000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!DeleteFileW 7C831F63 6 Bytes JMP 7072000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!CreateDirectoryW 7C832402 6 Bytes JMP 70A5000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!MoveFileExW 7C83568B 6 Bytes JMP 7057000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!MoveFileA 7C835EBF 6 Bytes JMP 7060000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!DebugActiveProcess 7C85B0FB 6 Bytes JMP 7135000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!MoveFileExA 7C85E49B 6 Bytes JMP 705A000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!CopyFileExA 7C85F39C 6 Bytes JMP 70B7000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!WinExec 7C86250D 6 Bytes JMP 7141000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!SetThreadContext 7C863C09 6 Bytes JMP 709F000A .text C:\WINDOWS\System32\svchost.exe[1396] kernel32.dll!CreateToolhelp32Snapshot 7C865C7F 6 Bytes JMP 70DB000A .text C:\WINDOWS\System32\svchost.exe[1396] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 6 Bytes JMP 70F6000A .text C:\WINDOWS\System32\svchost.exe[1396] ADVAPI32.dll!RegQueryValueExW 77DD6FFF 6 Bytes JMP 70E4000A .text C:\WINDOWS\System32\svchost.exe[1396] ADVAPI32.dll!RegCreateKeyExW 77DD776C 6 Bytes JMP 7108000A .text C:\WINDOWS\System32\svchost.exe[1396] ADVAPI32.dll!RegOpenKeyExA 77DD7852 6 Bytes JMP 70F9000A .text C:\WINDOWS\System32\svchost.exe[1396] ADVAPI32.dll!RegOpenKeyW 77DD7946 6 Bytes JMP 70FC000A .text C:\WINDOWS\System32\svchost.exe[1396] ADVAPI32.dll!OpenProcessToken 77DD798B 6 Bytes JMP 709C000A .text C:\WINDOWS\System32\svchost.exe[1396] ADVAPI32.dll!RegQueryValueExA 77DD7ABB 6 Bytes JMP 70E7000A .text C:\WINDOWS\System32\svchost.exe[1396] ADVAPI32.dll!RegSetValueExW 77DDD767 6 Bytes JMP 70F0000A .text C:\WINDOWS\System32\svchost.exe[1396] ADVAPI32.dll!RegQueryValueW 77DDD87A 6 Bytes JMP 70EA000A .text C:\WINDOWS\System32\svchost.exe[1396] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 6 Bytes JMP 710B000A .text C:\WINDOWS\System32\svchost.exe[1396] ADVAPI32.dll!RegSetValueExA 77DDEAE7 6 Bytes JMP 70F3000A .text C:\WINDOWS\System32\svchost.exe[1396] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 6 Bytes JMP 70FF000A .text C:\WINDOWS\System32\svchost.exe[1396] ADVAPI32.dll!AdjustTokenPrivileges 77DDF00C 6 Bytes JMP 7093000A .text C:\WINDOWS\System32\svchost.exe[1396] ADVAPI32.dll!RegDeleteKeyA 77DE42A0 6 Bytes JMP 706F000A .text C:\WINDOWS\System32\svchost.exe[1396] ADVAPI32.dll!RegDeleteKeyW 77DE559B 6 Bytes JMP 706C000A .text C:\WINDOWS\System32\svchost.exe[1396] ADVAPI32.dll!OpenSCManagerW 77DE6F55 6 Bytes JMP 70CC000A .text C:\WINDOWS\System32\svchost.exe[1396] ADVAPI32.dll!OpenSCManagerA 77DF69AE 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\svchost.exe[1396] ADVAPI32.dll!OpenSCManagerA + 4 77DF69B2 2 Bytes [CE, 70] .text C:\WINDOWS\System32\svchost.exe[1396] ADVAPI32.dll!LookupPrivilegeValueW 77DFB8DF 6 Bytes JMP 7096000A .text C:\WINDOWS\System32\svchost.exe[1396] ADVAPI32.dll!RegCreateKeyW 77DFBA55 6 Bytes JMP 7102000A .text C:\WINDOWS\System32\svchost.exe[1396] ADVAPI32.dll!RegQueryValueA 77DFBB8D 4 Bytes JMP EC001E25 .text C:\WINDOWS\System32\svchost.exe[1396] ADVAPI32.dll!RegQueryValueA + 5 77DFBB92 1 Byte [70] .text C:\WINDOWS\System32\svchost.exe[1396] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 6 Bytes JMP 7105000A .text C:\WINDOWS\System32\svchost.exe[1396] ADVAPI32.dll!LookupPrivilegeValueA 77DFC238 6 Bytes JMP 7099000A .text C:\WINDOWS\System32\svchost.exe[1396] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 7168000A .text C:\WINDOWS\System32\svchost.exe[1396] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 7120000A .text C:\WINDOWS\System32\svchost.exe[1396] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 711D000A .text C:\WINDOWS\System32\svchost.exe[1396] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 7156000A .text C:\WINDOWS\System32\svchost.exe[1396] USER32.dll!SetWindowTextW 7E42960E 6 Bytes JMP 7066000A .text C:\WINDOWS\System32\svchost.exe[1396] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 7132000A .text C:\WINDOWS\System32\svchost.exe[1396] USER32.dll!GetWindowTextW 7E42A5CD 6 Bytes JMP 70C6000A .text C:\WINDOWS\System32\svchost.exe[1396] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 712F000A .text C:\WINDOWS\System32\svchost.exe[1396] USER32.dll!ShowWindow 7E42AF56 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\svchost.exe[1396] USER32.dll!ShowWindow + 4 7E42AF5A 2 Bytes [C2, 70] .text C:\WINDOWS\System32\svchost.exe[1396] USER32.dll!CreateWindowExW 7E42D0A3 6 Bytes JMP 7078000A .text C:\WINDOWS\System32\svchost.exe[1396] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\svchost.exe[1396] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [2B, 71] .text C:\WINDOWS\System32\svchost.exe[1396] USER32.dll!DrawTextW 7E42D7E2 6 Bytes JMP 707E000A .text C:\WINDOWS\System32\svchost.exe[1396] USER32.dll!CreateWindowExA 7E42E4A9 6 Bytes JMP 707B000A .text C:\WINDOWS\System32\svchost.exe[1396] USER32.dll!SetWindowTextA 7E42F56B 6 Bytes JMP 7069000A .text C:\WINDOWS\System32\svchost.exe[1396] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 7159000A .text C:\WINDOWS\System32\svchost.exe[1396] USER32.dll!SetWinEventHook 7E4317F7 6 Bytes JMP 711A000A .text C:\WINDOWS\System32\svchost.exe[1396] USER32.dll!GetWindowTextA 7E43216B 6 Bytes JMP 70C9000A .text C:\WINDOWS\System32\svchost.exe[1396] USER32.dll!DrawTextA 7E43C702 6 Bytes JMP 7081000A .text C:\WINDOWS\System32\svchost.exe[1396] USER32.dll!DdeConnect 7E4581C3 6 Bytes JMP 7129000A .text C:\WINDOWS\System32\svchost.exe[1396] USER32.dll!EndTask 7E45A0A5 6 Bytes JMP 713E000A .text C:\WINDOWS\System32\svchost.exe[1396] USER32.dll!RegisterRawInputDevices 7E46CE0E 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\svchost.exe[1396] USER32.dll!RegisterRawInputDevices + 4 7E46CE12 2 Bytes [16, 71] .text C:\WINDOWS\System32\svchost.exe[1396] SHELL32.dll!ShellExecuteExW 7CA098CB 6 Bytes JMP 7144000A .text C:\WINDOWS\System32\svchost.exe[1396] SHELL32.dll!Shell_NotifyIcon 7CA28BC6 6 Bytes JMP 70B1000A .text C:\WINDOWS\System32\svchost.exe[1396] SHELL32.dll!Shell_NotifyIconW 7CA2A537 6 Bytes JMP 70AE000A .text C:\WINDOWS\System32\svchost.exe[1396] SHELL32.dll!ShellExecuteEx 7CA40E45 6 Bytes JMP 7147000A .text C:\WINDOWS\System32\svchost.exe[1396] SHELL32.dll!ShellExecuteA 7CA41170 6 Bytes JMP 714D000A .text C:\WINDOWS\System32\svchost.exe[1396] SHELL32.dll!ShellExecuteW 7CAB5D48 6 Bytes JMP 714A000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] ntdll.dll!NtLoadDriver 7C90D46E 3 Bytes [FF, 25, 1E] .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] ntdll.dll!NtLoadDriver + 4 7C90D472 2 Bytes [22, 71] .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] ntdll.dll!NtSuspendProcess 7C90DE2E 3 Bytes [FF, 25, 1E] .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] ntdll.dll!NtSuspendProcess + 4 7C90DE32 2 Bytes [3A, 71] .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!DeviceIoControl 7C801629 6 Bytes JMP 70AB000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!CreateFileA 7C801A28 6 Bytes JMP 70DE000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!VirtualProtectEx 7C801A61 6 Bytes JMP 7126000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!VirtualProtect 7C801AD4 6 Bytes JMP 70D2000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!LoadLibraryExW 7C801AF5 6 Bytes JMP 716B000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!LoadLibraryA 7C801D7B 6 Bytes JMP 715F000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 7165000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 7162000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 7150000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 7153000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!VirtualAlloc 7C809AF1 6 Bytes JMP 70D5000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!MultiByteToWideChar 7C809C98 6 Bytes JMP 7084000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!LoadResource 7C80A055 6 Bytes JMP 70C0000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!WideCharToMultiByte 7C80A174 6 Bytes JMP 7063000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!GetProcAddress 7C80AE40 6 Bytes JMP 7114000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!LoadLibraryW 7C80AEEB 6 Bytes JMP 715C000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!CreateMutexW 7C80E957 6 Bytes JMP 708D000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!CreateMutexA 7C80E9DF 6 Bytes JMP 7090000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!OpenMutexW 7C80EA35 6 Bytes JMP 7087000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!OpenMutexA 7C80EABB 6 Bytes JMP 708A000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!GetVolumeInformationW 7C80FA85 6 Bytes JMP 710E000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E] .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [6D, 71] .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!CreateThread 7C8106D7 6 Bytes JMP 70D8000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!CreateFileW 7C810800 6 Bytes JMP 70E1000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!WriteFile 7C810E27 6 Bytes JMP 70A2000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!TerminateThread 7C81CB3B 6 Bytes JMP 7138000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!MoveFileW 7C821261 6 Bytes JMP 705D000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!CreateDirectoryA 7C8217AC 6 Bytes JMP 70A8000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!GetVolumeInformationA 7C821BA5 6 Bytes JMP 7111000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 70B4000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!CopyFileA 7C8286EE 6 Bytes JMP 70BD000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!CopyFileW 7C82F87B 6 Bytes JMP 70BA000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!OpenProcess 7C8309E9 6 Bytes JMP 7054000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!DeleteFileA 7C831EDD 6 Bytes JMP 7075000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!DeleteFileW 7C831F63 6 Bytes JMP 7072000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!CreateDirectoryW 7C832402 6 Bytes JMP 70A5000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!MoveFileExW 7C83568B 6 Bytes JMP 7057000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!MoveFileA 7C835EBF 6 Bytes JMP 7060000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!DebugActiveProcess 7C85B0FB 6 Bytes JMP 7135000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!MoveFileExA 7C85E49B 6 Bytes JMP 705A000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!CopyFileExA 7C85F39C 6 Bytes JMP 70B7000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!WinExec 7C86250D 6 Bytes JMP 7141000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!SetThreadContext 7C863C09 6 Bytes JMP 709F000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] kernel32.dll!CreateToolhelp32Snapshot 7C865C7F 6 Bytes JMP 70DB000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 6 Bytes JMP 70F6000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] ADVAPI32.dll!RegQueryValueExW 77DD6FFF 6 Bytes JMP 70E4000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] ADVAPI32.dll!RegCreateKeyExW 77DD776C 6 Bytes JMP 7108000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] ADVAPI32.dll!RegOpenKeyExA 77DD7852 6 Bytes JMP 70F9000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] ADVAPI32.dll!RegOpenKeyW 77DD7946 6 Bytes JMP 70FC000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] ADVAPI32.dll!OpenProcessToken 77DD798B 6 Bytes JMP 709C000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] ADVAPI32.dll!RegQueryValueExA 77DD7ABB 6 Bytes JMP 70E7000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] ADVAPI32.dll!RegSetValueExW 77DDD767 6 Bytes JMP 70F0000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] ADVAPI32.dll!RegQueryValueW 77DDD87A 6 Bytes JMP 70EA000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 6 Bytes JMP 710B000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] ADVAPI32.dll!RegSetValueExA 77DDEAE7 6 Bytes JMP 70F3000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 6 Bytes JMP 70FF000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] ADVAPI32.dll!AdjustTokenPrivileges 77DDF00C 6 Bytes JMP 7093000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] ADVAPI32.dll!RegDeleteKeyA 77DE42A0 6 Bytes JMP 706F000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] ADVAPI32.dll!RegDeleteKeyW 77DE559B 6 Bytes JMP 706C000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] ADVAPI32.dll!OpenSCManagerW 77DE6F55 6 Bytes JMP 70CC000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] ADVAPI32.dll!OpenSCManagerA 77DF69AE 3 Bytes [FF, 25, 1E] .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] ADVAPI32.dll!OpenSCManagerA + 4 77DF69B2 2 Bytes [CE, 70] .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] ADVAPI32.dll!LookupPrivilegeValueW 77DFB8DF 6 Bytes JMP 7096000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] ADVAPI32.dll!RegCreateKeyW 77DFBA55 6 Bytes JMP 7102000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] ADVAPI32.dll!RegQueryValueA 77DFBB8D 4 Bytes JMP EC001E25 .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] ADVAPI32.dll!RegQueryValueA + 5 77DFBB92 1 Byte [70] .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 6 Bytes JMP 7105000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] ADVAPI32.dll!LookupPrivilegeValueA 77DFC238 6 Bytes JMP 7099000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 7168000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 7120000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 711D000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 7156000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] USER32.dll!SetWindowTextW 7E42960E 6 Bytes JMP 7066000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 7132000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] USER32.dll!GetWindowTextW 7E42A5CD 6 Bytes JMP 70C6000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 712F000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] USER32.dll!ShowWindow 7E42AF56 3 Bytes [FF, 25, 1E] .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] USER32.dll!ShowWindow + 4 7E42AF5A 2 Bytes [C2, 70] .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] USER32.dll!CreateWindowExW 7E42D0A3 6 Bytes JMP 7078000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E] .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [2B, 71] .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] USER32.dll!DrawTextW 7E42D7E2 6 Bytes JMP 707E000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] USER32.dll!CreateWindowExA 7E42E4A9 6 Bytes JMP 707B000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] USER32.dll!SetWindowTextA 7E42F56B 6 Bytes JMP 7069000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 7159000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] USER32.dll!SetWinEventHook 7E4317F7 6 Bytes JMP 711A000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] USER32.dll!GetWindowTextA 7E43216B 6 Bytes JMP 70C9000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] USER32.dll!DrawTextA 7E43C702 6 Bytes JMP 7081000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] USER32.dll!DdeConnect 7E4581C3 6 Bytes JMP 7129000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] USER32.dll!EndTask 7E45A0A5 6 Bytes JMP 713E000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] USER32.dll!RegisterRawInputDevices 7E46CE0E 3 Bytes [FF, 25, 1E] .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] USER32.dll!RegisterRawInputDevices + 4 7E46CE12 2 Bytes [16, 71] .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] SHELL32.dll!ShellExecuteExW 7CA098CB 6 Bytes JMP 7144000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] SHELL32.dll!Shell_NotifyIcon 7CA28BC6 6 Bytes JMP 70B1000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] SHELL32.dll!Shell_NotifyIconW 7CA2A537 6 Bytes JMP 70AE000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] SHELL32.dll!ShellExecuteEx 7CA40E45 6 Bytes JMP 7147000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] SHELL32.dll!ShellExecuteA 7CA41170 6 Bytes JMP 714D000A .text C:\Program Files\AVG\AVG9\avgwdsvc.exe[1428] SHELL32.dll!ShellExecuteW 7CAB5D48 6 Bytes JMP 714A000A .text C:\Program Files\ThreatFire\TFService.exe[1448] kernel32.dll!CreateRemoteThread + 174 7C810640 4 Bytes JMP 716F0000 .text C:\WINDOWS\system32\winlogon.exe[1512] kernel32.dll!DeviceIoControl 7C801629 6 Bytes JMP 7102000A .text C:\WINDOWS\system32\winlogon.exe[1512] kernel32.dll!CreateFileA 7C801A28 6 Bytes JMP 7135000A .text C:\WINDOWS\system32\winlogon.exe[1512] kernel32.dll!VirtualProtect 7C801AD4 6 Bytes JMP 7129000A .text C:\WINDOWS\system32\winlogon.exe[1512] kernel32.dll!LoadLibraryExW 7C801AF5 6 Bytes JMP 716B000A .text C:\WINDOWS\system32\winlogon.exe[1512] kernel32.dll!VirtualAlloc 7C809AF1 6 Bytes JMP 712C000A .text C:\WINDOWS\system32\winlogon.exe[1512] kernel32.dll!MultiByteToWideChar 7C809C98 6 Bytes JMP 70DB000A .text C:\WINDOWS\system32\winlogon.exe[1512] kernel32.dll!LoadResource 7C80A055 6 Bytes JMP 7117000A .text C:\WINDOWS\system32\winlogon.exe[1512] kernel32.dll!WideCharToMultiByte 7C80A174 6 Bytes JMP 70BA000A .text C:\WINDOWS\system32\winlogon.exe[1512] kernel32.dll!GetProcAddress 7C80AE40 6 Bytes JMP 716E000A .text C:\WINDOWS\system32\winlogon.exe[1512] kernel32.dll!CreateMutexW 7C80E957 6 Bytes JMP 70E4000A .text C:\WINDOWS\system32\winlogon.exe[1512] kernel32.dll!CreateMutexA 7C80E9DF 6 Bytes JMP 70E7000A .text C:\WINDOWS\system32\winlogon.exe[1512] kernel32.dll!OpenMutexW 7C80EA35 6 Bytes JMP 70DE000A .text C:\WINDOWS\system32\winlogon.exe[1512] kernel32.dll!OpenMutexA 7C80EABB 6 Bytes JMP 70E1000A .text C:\WINDOWS\system32\winlogon.exe[1512] kernel32.dll!GetVolumeInformationW 7C80FA85 6 Bytes JMP 7165000A .text C:\WINDOWS\system32\winlogon.exe[1512] kernel32.dll!CreateThread 7C8106D7 6 Bytes JMP 712F000A .text C:\WINDOWS\system32\winlogon.exe[1512] kernel32.dll!CreateFileW 7C810800 6 Bytes JMP 7138000A .text C:\WINDOWS\system32\winlogon.exe[1512] kernel32.dll!WriteFile 7C810E27 6 Bytes JMP 70F9000A .text C:\WINDOWS\system32\winlogon.exe[1512] kernel32.dll!MoveFileW 7C821261 6 Bytes JMP 70B4000A .text C:\WINDOWS\system32\winlogon.exe[1512] kernel32.dll!CreateDirectoryA 7C8217AC 6 Bytes JMP 70FF000A .text C:\WINDOWS\system32\winlogon.exe[1512] kernel32.dll!GetVolumeInformationA 7C821BA5 6 Bytes JMP 7168000A .text C:\WINDOWS\system32\winlogon.exe[1512] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 710B000A .text C:\WINDOWS\system32\winlogon.exe[1512] kernel32.dll!CopyFileA 7C8286EE 6 Bytes JMP 7114000A .text C:\WINDOWS\system32\winlogon.exe[1512] kernel32.dll!CopyFileW 7C82F87B 6 Bytes JMP 7111000A .text C:\WINDOWS\system32\winlogon.exe[1512] kernel32.dll!OpenProcess 7C8309E9 6 Bytes JMP 70AB000A .text C:\WINDOWS\system32\winlogon.exe[1512] kernel32.dll!DeleteFileA 7C831EDD 6 Bytes JMP 70CC000A .text C:\WINDOWS\system32\winlogon.exe[1512] kernel32.dll!DeleteFileW 7C831F63 6 Bytes JMP 70C9000A .text C:\WINDOWS\system32\winlogon.exe[1512] kernel32.dll!CreateDirectoryW 7C832402 6 Bytes JMP 70FC000A .text C:\WINDOWS\system32\winlogon.exe[1512] kernel32.dll!MoveFileExW 7C83568B 6 Bytes JMP 70AE000A .text C:\WINDOWS\system32\winlogon.exe[1512] kernel32.dll!MoveFileA 7C835EBF 6 Bytes JMP 70B7000A .text C:\WINDOWS\system32\winlogon.exe[1512] kernel32.dll!MoveFileExA 7C85E49B 6 Bytes JMP 70B1000A .text C:\WINDOWS\system32\winlogon.exe[1512] kernel32.dll!CopyFileExA 7C85F39C 6 Bytes JMP 710E000A .text C:\WINDOWS\system32\winlogon.exe[1512] kernel32.dll!SetThreadContext 7C863C09 6 Bytes JMP 70F6000A .text C:\WINDOWS\system32\winlogon.exe[1512] kernel32.dll!CreateToolhelp32Snapshot 7C865C7F 6 Bytes JMP 7132000A .text C:\WINDOWS\system32\winlogon.exe[1512] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 6 Bytes JMP 714D000A .text C:\WINDOWS\system32\winlogon.exe[1512] ADVAPI32.dll!RegQueryValueExW 77DD6FFF 6 Bytes JMP 713B000A .text C:\WINDOWS\system32\winlogon.exe[1512] ADVAPI32.dll!RegCreateKeyExW 77DD776C 6 Bytes JMP 715F000A .text C:\WINDOWS\system32\winlogon.exe[1512] ADVAPI32.dll!RegOpenKeyExA 77DD7852 6 Bytes JMP 7150000A .text C:\WINDOWS\system32\winlogon.exe[1512] ADVAPI32.dll!RegOpenKeyW 77DD7946 6 Bytes JMP 7153000A .text C:\WINDOWS\system32\winlogon.exe[1512] ADVAPI32.dll!OpenProcessToken 77DD798B 6 Bytes JMP 70F3000A .text C:\WINDOWS\system32\winlogon.exe[1512] ADVAPI32.dll!RegQueryValueExA 77DD7ABB 6 Bytes JMP 713E000A .text C:\WINDOWS\system32\winlogon.exe[1512] ADVAPI32.dll!RegSetValueExW 77DDD767 6 Bytes JMP 7147000A .text C:\WINDOWS\system32\winlogon.exe[1512] ADVAPI32.dll!RegQueryValueW 77DDD87A 6 Bytes JMP 7141000A .text C:\WINDOWS\system32\winlogon.exe[1512] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 6 Bytes JMP 7162000A .text C:\WINDOWS\system32\winlogon.exe[1512] ADVAPI32.dll!RegSetValueExA 77DDEAE7 6 Bytes JMP 714A000A .text C:\WINDOWS\system32\winlogon.exe[1512] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 6 Bytes JMP 7156000A .text C:\WINDOWS\system32\winlogon.exe[1512] ADVAPI32.dll!AdjustTokenPrivileges 77DDF00C 6 Bytes JMP 70EA000A .text C:\WINDOWS\system32\winlogon.exe[1512] ADVAPI32.dll!RegDeleteKeyA 77DE42A0 6 Bytes JMP 70C6000A .text C:\WINDOWS\system32\winlogon.exe[1512] ADVAPI32.dll!RegDeleteKeyW 77DE559B 6 Bytes JMP 70C3000A .text C:\WINDOWS\system32\winlogon.exe[1512] ADVAPI32.dll!OpenSCManagerW 77DE6F55 6 Bytes JMP 7123000A .text C:\WINDOWS\system32\winlogon.exe[1512] ADVAPI32.dll!OpenSCManagerA 77DF69AE 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\winlogon.exe[1512] ADVAPI32.dll!OpenSCManagerA + 4 77DF69B2 2 Bytes [25, 71] .text C:\WINDOWS\system32\winlogon.exe[1512] ADVAPI32.dll!LookupPrivilegeValueW 77DFB8DF 4 Bytes JMP EC001E25 .text C:\WINDOWS\system32\winlogon.exe[1512] ADVAPI32.dll!LookupPrivilegeValueW + 5 77DFB8E4 1 Byte [70] .text C:\WINDOWS\system32\winlogon.exe[1512] ADVAPI32.dll!RegCreateKeyW 77DFBA55 6 Bytes JMP 7159000A .text C:\WINDOWS\system32\winlogon.exe[1512] ADVAPI32.dll!RegQueryValueA 77DFBB8D 6 Bytes JMP 7144000A .text C:\WINDOWS\system32\winlogon.exe[1512] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 6 Bytes JMP 715C000A .text C:\WINDOWS\system32\winlogon.exe[1512] ADVAPI32.dll!LookupPrivilegeValueA 77DFC238 6 Bytes JMP 70F0000A .text C:\WINDOWS\system32\winlogon.exe[1512] USER32.dll!SetWindowTextW 7E42960E 6 Bytes JMP 70BD000A .text C:\WINDOWS\system32\winlogon.exe[1512] USER32.dll!GetWindowTextW 7E42A5CD 6 Bytes JMP 711D000A .text C:\WINDOWS\system32\winlogon.exe[1512] USER32.dll!ShowWindow 7E42AF56 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\winlogon.exe[1512] USER32.dll!ShowWindow + 4 7E42AF5A 2 Bytes [19, 71] .text C:\WINDOWS\system32\winlogon.exe[1512] USER32.dll!CreateWindowExW 7E42D0A3 6 Bytes JMP 70CF000A .text C:\WINDOWS\system32\winlogon.exe[1512] USER32.dll!DrawTextW 7E42D7E2 6 Bytes JMP 70D5000A .text C:\WINDOWS\system32\winlogon.exe[1512] USER32.dll!CreateWindowExA 7E42E4A9 6 Bytes JMP 70D2000A .text C:\WINDOWS\system32\winlogon.exe[1512] USER32.dll!SetWindowTextA 7E42F56B 6 Bytes JMP 70C0000A .text C:\WINDOWS\system32\winlogon.exe[1512] USER32.dll!GetWindowTextA 7E43216B 6 Bytes JMP 7120000A .text C:\WINDOWS\system32\winlogon.exe[1512] USER32.dll!DrawTextA 7E43C702 6 Bytes JMP 70D8000A .text C:\WINDOWS\system32\winlogon.exe[1512] SHELL32.dll!Shell_NotifyIcon 7CA28BC6 6 Bytes JMP 7108000A .text C:\WINDOWS\system32\winlogon.exe[1512] SHELL32.dll!Shell_NotifyIconW 7CA2A537 6 Bytes JMP 7105000A .text C:\WINDOWS\system32\services.exe[1556] ntdll.dll!NtLoadDriver 7C90D46E 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\services.exe[1556] ntdll.dll!NtLoadDriver + 4 7C90D472 2 Bytes [22, 71] .text C:\WINDOWS\system32\services.exe[1556] ntdll.dll!NtSuspendProcess 7C90DE2E 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\services.exe[1556] ntdll.dll!NtSuspendProcess + 4 7C90DE32 2 Bytes [3A, 71] .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!DeviceIoControl 7C801629 6 Bytes JMP 70AB000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!CreateFileA 7C801A28 6 Bytes JMP 70DE000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!VirtualProtectEx 7C801A61 6 Bytes JMP 7126000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!VirtualProtect 7C801AD4 6 Bytes JMP 70D2000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!LoadLibraryExW 7C801AF5 6 Bytes JMP 716B000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!LoadLibraryA 7C801D7B 6 Bytes JMP 715F000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 7165000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 7162000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 7150000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 7153000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!VirtualAlloc 7C809AF1 6 Bytes JMP 70D5000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!MultiByteToWideChar 7C809C98 6 Bytes JMP 7084000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!LoadResource 7C80A055 6 Bytes JMP 70C0000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!WideCharToMultiByte 7C80A174 6 Bytes JMP 7063000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!GetProcAddress 7C80AE40 6 Bytes JMP 7114000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!LoadLibraryW 7C80AEEB 6 Bytes JMP 715C000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!CreateMutexW 7C80E957 6 Bytes JMP 708D000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!CreateMutexA 7C80E9DF 6 Bytes JMP 7090000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!OpenMutexW 7C80EA35 6 Bytes JMP 7087000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!OpenMutexA 7C80EABB 6 Bytes JMP 708A000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!GetVolumeInformationW 7C80FA85 6 Bytes JMP 710E000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [6D, 71] .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!CreateThread 7C8106D7 6 Bytes JMP 70D8000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!CreateFileW 7C810800 6 Bytes JMP 70E1000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!WriteFile 7C810E27 6 Bytes JMP 70A2000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!TerminateThread 7C81CB3B 6 Bytes JMP 7138000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!MoveFileW 7C821261 6 Bytes JMP 705D000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!CreateDirectoryA 7C8217AC 6 Bytes JMP 70A8000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!GetVolumeInformationA 7C821BA5 6 Bytes JMP 7111000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 70B4000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!CopyFileA 7C8286EE 6 Bytes JMP 70BD000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!CopyFileW 7C82F87B 6 Bytes JMP 70BA000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!OpenProcess 7C8309E9 6 Bytes JMP 7054000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!DeleteFileA 7C831EDD 6 Bytes JMP 7075000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!DeleteFileW 7C831F63 6 Bytes JMP 7072000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!CreateDirectoryW 7C832402 6 Bytes JMP 70A5000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!MoveFileExW 7C83568B 6 Bytes JMP 7057000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!MoveFileA 7C835EBF 6 Bytes JMP 7060000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!DebugActiveProcess 7C85B0FB 6 Bytes JMP 7135000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!MoveFileExA 7C85E49B 6 Bytes JMP 705A000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!CopyFileExA 7C85F39C 6 Bytes JMP 70B7000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!WinExec 7C86250D 6 Bytes JMP 7141000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!SetThreadContext 7C863C09 6 Bytes JMP 709F000A .text C:\WINDOWS\system32\services.exe[1556] kernel32.dll!CreateToolhelp32Snapshot 7C865C7F 6 Bytes JMP 70DB000A .text C:\WINDOWS\system32\services.exe[1556] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 6 Bytes JMP 70F6000A .text C:\WINDOWS\system32\services.exe[1556] ADVAPI32.dll!RegQueryValueExW 77DD6FFF 6 Bytes JMP 70E4000A .text C:\WINDOWS\system32\services.exe[1556] ADVAPI32.dll!RegCreateKeyExW 77DD776C 6 Bytes JMP 7108000A .text C:\WINDOWS\system32\services.exe[1556] ADVAPI32.dll!RegOpenKeyExA 77DD7852 6 Bytes JMP 70F9000A .text C:\WINDOWS\system32\services.exe[1556] ADVAPI32.dll!RegOpenKeyW 77DD7946 6 Bytes JMP 70FC000A .text C:\WINDOWS\system32\services.exe[1556] ADVAPI32.dll!OpenProcessToken 77DD798B 6 Bytes JMP 709C000A .text C:\WINDOWS\system32\services.exe[1556] ADVAPI32.dll!RegQueryValueExA 77DD7ABB 6 Bytes JMP 70E7000A .text C:\WINDOWS\system32\services.exe[1556] ADVAPI32.dll!RegSetValueExW 77DDD767 6 Bytes JMP 70F0000A .text C:\WINDOWS\system32\services.exe[1556] ADVAPI32.dll!RegQueryValueW 77DDD87A 6 Bytes JMP 70EA000A .text C:\WINDOWS\system32\services.exe[1556] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 6 Bytes JMP 710B000A .text C:\WINDOWS\system32\services.exe[1556] ADVAPI32.dll!RegSetValueExA 77DDEAE7 6 Bytes JMP 70F3000A .text C:\WINDOWS\system32\services.exe[1556] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 6 Bytes JMP 70FF000A .text C:\WINDOWS\system32\services.exe[1556] ADVAPI32.dll!AdjustTokenPrivileges 77DDF00C 6 Bytes JMP 7093000A .text C:\WINDOWS\system32\services.exe[1556] ADVAPI32.dll!RegDeleteKeyA 77DE42A0 6 Bytes JMP 706F000A .text C:\WINDOWS\system32\services.exe[1556] ADVAPI32.dll!RegDeleteKeyW 77DE559B 6 Bytes JMP 706C000A .text C:\WINDOWS\system32\services.exe[1556] ADVAPI32.dll!OpenSCManagerW 77DE6F55 6 Bytes JMP 70CC000A .text C:\WINDOWS\system32\services.exe[1556] ADVAPI32.dll!OpenSCManagerA 77DF69AE 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\services.exe[1556] ADVAPI32.dll!OpenSCManagerA + 4 77DF69B2 2 Bytes [CE, 70] .text C:\WINDOWS\system32\services.exe[1556] ADVAPI32.dll!LookupPrivilegeValueW 77DFB8DF 6 Bytes JMP 7096000A .text C:\WINDOWS\system32\services.exe[1556] ADVAPI32.dll!RegCreateKeyW 77DFBA55 6 Bytes JMP 7102000A .text C:\WINDOWS\system32\services.exe[1556] ADVAPI32.dll!RegQueryValueA 77DFBB8D 4 Bytes JMP EC001E25 .text C:\WINDOWS\system32\services.exe[1556] ADVAPI32.dll!RegQueryValueA + 5 77DFBB92 1 Byte [70] .text C:\WINDOWS\system32\services.exe[1556] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 6 Bytes JMP 7105000A .text C:\WINDOWS\system32\services.exe[1556] ADVAPI32.dll!LookupPrivilegeValueA 77DFC238 6 Bytes JMP 7099000A .text C:\WINDOWS\system32\services.exe[1556] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 7168000A .text C:\WINDOWS\system32\services.exe[1556] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 7120000A .text C:\WINDOWS\system32\services.exe[1556] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 711D000A .text C:\WINDOWS\system32\services.exe[1556] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 7156000A .text C:\WINDOWS\system32\services.exe[1556] USER32.dll!SetWindowTextW 7E42960E 6 Bytes JMP 7066000A .text C:\WINDOWS\system32\services.exe[1556] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 7132000A .text C:\WINDOWS\system32\services.exe[1556] USER32.dll!GetWindowTextW 7E42A5CD 6 Bytes JMP 70C6000A .text C:\WINDOWS\system32\services.exe[1556] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 712F000A .text C:\WINDOWS\system32\services.exe[1556] USER32.dll!ShowWindow 7E42AF56 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\services.exe[1556] USER32.dll!ShowWindow + 4 7E42AF5A 2 Bytes [C2, 70] .text C:\WINDOWS\system32\services.exe[1556] USER32.dll!CreateWindowExW 7E42D0A3 6 Bytes JMP 7078000A .text C:\WINDOWS\system32\services.exe[1556] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\services.exe[1556] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [2B, 71] .text C:\WINDOWS\system32\services.exe[1556] USER32.dll!DrawTextW 7E42D7E2 6 Bytes JMP 707E000A .text C:\WINDOWS\system32\services.exe[1556] USER32.dll!CreateWindowExA 7E42E4A9 6 Bytes JMP 707B000A .text C:\WINDOWS\system32\services.exe[1556] USER32.dll!SetWindowTextA 7E42F56B 6 Bytes JMP 7069000A .text C:\WINDOWS\system32\services.exe[1556] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 7159000A .text C:\WINDOWS\system32\services.exe[1556] USER32.dll!SetWinEventHook 7E4317F7 6 Bytes JMP 711A000A .text C:\WINDOWS\system32\services.exe[1556] USER32.dll!GetWindowTextA 7E43216B 6 Bytes JMP 70C9000A .text C:\WINDOWS\system32\services.exe[1556] USER32.dll!DrawTextA 7E43C702 6 Bytes JMP 7081000A .text C:\WINDOWS\system32\services.exe[1556] USER32.dll!DdeConnect 7E4581C3 6 Bytes JMP 7129000A .text C:\WINDOWS\system32\services.exe[1556] USER32.dll!EndTask 7E45A0A5 6 Bytes JMP 713E000A .text C:\WINDOWS\system32\services.exe[1556] USER32.dll!RegisterRawInputDevices 7E46CE0E 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\services.exe[1556] USER32.dll!RegisterRawInputDevices + 4 7E46CE12 2 Bytes [16, 71] .text C:\WINDOWS\system32\services.exe[1556] SHELL32.dll!ShellExecuteExW 7CA098CB 6 Bytes JMP 7144000A .text C:\WINDOWS\system32\services.exe[1556] SHELL32.dll!Shell_NotifyIcon 7CA28BC6 6 Bytes JMP 70B1000A .text C:\WINDOWS\system32\services.exe[1556] SHELL32.dll!Shell_NotifyIconW 7CA2A537 6 Bytes JMP 70AE000A .text C:\WINDOWS\system32\services.exe[1556] SHELL32.dll!ShellExecuteEx 7CA40E45 6 Bytes JMP 7147000A .text C:\WINDOWS\system32\services.exe[1556] SHELL32.dll!ShellExecuteA 7CA41170 6 Bytes JMP 714D000A .text C:\WINDOWS\system32\services.exe[1556] SHELL32.dll!ShellExecuteW 7CAB5D48 6 Bytes JMP 714A000A .text C:\WINDOWS\system32\lsass.exe[1568] ntdll.dll!NtLoadDriver 7C90D46E 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\lsass.exe[1568] ntdll.dll!NtLoadDriver + 4 7C90D472 2 Bytes [22, 71] .text C:\WINDOWS\system32\lsass.exe[1568] ntdll.dll!NtSuspendProcess 7C90DE2E 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\lsass.exe[1568] ntdll.dll!NtSuspendProcess + 4 7C90DE32 2 Bytes [3A, 71] .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!DeviceIoControl 7C801629 6 Bytes JMP 70AB000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!CreateFileA 7C801A28 6 Bytes JMP 70DE000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!VirtualProtectEx 7C801A61 6 Bytes JMP 7126000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!VirtualProtect 7C801AD4 6 Bytes JMP 70D2000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!LoadLibraryExW 7C801AF5 6 Bytes JMP 716B000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!LoadLibraryA 7C801D7B 6 Bytes JMP 715F000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 7165000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 7162000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 7150000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 7153000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!VirtualAlloc 7C809AF1 6 Bytes JMP 70D5000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!MultiByteToWideChar 7C809C98 6 Bytes JMP 7084000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!LoadResource 7C80A055 6 Bytes JMP 70C0000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!WideCharToMultiByte 7C80A174 6 Bytes JMP 7063000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!GetProcAddress 7C80AE40 6 Bytes JMP 7114000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!LoadLibraryW 7C80AEEB 6 Bytes JMP 715C000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!CreateMutexW 7C80E957 6 Bytes JMP 708D000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!CreateMutexA 7C80E9DF 6 Bytes JMP 7090000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!OpenMutexW 7C80EA35 6 Bytes JMP 7087000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!OpenMutexA 7C80EABB 6 Bytes JMP 708A000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!GetVolumeInformationW 7C80FA85 6 Bytes JMP 710E000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [6D, 71] .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!CreateThread 7C8106D7 6 Bytes JMP 70D8000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!CreateFileW 7C810800 6 Bytes JMP 70E1000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!WriteFile 7C810E27 6 Bytes JMP 70A2000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!TerminateThread 7C81CB3B 6 Bytes JMP 7138000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!MoveFileW 7C821261 6 Bytes JMP 705D000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!CreateDirectoryA 7C8217AC 6 Bytes JMP 70A8000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!GetVolumeInformationA 7C821BA5 6 Bytes JMP 7111000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 70B4000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!CopyFileA 7C8286EE 6 Bytes JMP 70BD000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!CopyFileW 7C82F87B 6 Bytes JMP 70BA000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!OpenProcess 7C8309E9 6 Bytes JMP 7054000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!DeleteFileA 7C831EDD 6 Bytes JMP 7075000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!DeleteFileW 7C831F63 6 Bytes JMP 7072000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!CreateDirectoryW 7C832402 6 Bytes JMP 70A5000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!MoveFileExW 7C83568B 6 Bytes JMP 7057000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!MoveFileA 7C835EBF 6 Bytes JMP 7060000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!DebugActiveProcess 7C85B0FB 6 Bytes JMP 7135000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!MoveFileExA 7C85E49B 6 Bytes JMP 705A000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!CopyFileExA 7C85F39C 6 Bytes JMP 70B7000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!WinExec 7C86250D 6 Bytes JMP 7141000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!SetThreadContext 7C863C09 6 Bytes JMP 709F000A .text C:\WINDOWS\system32\lsass.exe[1568] kernel32.dll!CreateToolhelp32Snapshot 7C865C7F 6 Bytes JMP 70DB000A .text C:\WINDOWS\system32\lsass.exe[1568] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 6 Bytes JMP 70F6000A .text C:\WINDOWS\system32\lsass.exe[1568] ADVAPI32.dll!RegQueryValueExW 77DD6FFF 6 Bytes JMP 70E4000A .text C:\WINDOWS\system32\lsass.exe[1568] ADVAPI32.dll!RegCreateKeyExW 77DD776C 6 Bytes JMP 7108000A .text C:\WINDOWS\system32\lsass.exe[1568] ADVAPI32.dll!RegOpenKeyExA 77DD7852 6 Bytes JMP 70F9000A .text C:\WINDOWS\system32\lsass.exe[1568] ADVAPI32.dll!RegOpenKeyW 77DD7946 6 Bytes JMP 70FC000A .text C:\WINDOWS\system32\lsass.exe[1568] ADVAPI32.dll!OpenProcessToken 77DD798B 6 Bytes JMP 709C000A .text C:\WINDOWS\system32\lsass.exe[1568] ADVAPI32.dll!RegQueryValueExA 77DD7ABB 6 Bytes JMP 70E7000A .text C:\WINDOWS\system32\lsass.exe[1568] ADVAPI32.dll!RegSetValueExW 77DDD767 6 Bytes JMP 70F0000A .text C:\WINDOWS\system32\lsass.exe[1568] ADVAPI32.dll!RegQueryValueW 77DDD87A 6 Bytes JMP 70EA000A .text C:\WINDOWS\system32\lsass.exe[1568] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 6 Bytes JMP 710B000A .text C:\WINDOWS\system32\lsass.exe[1568] ADVAPI32.dll!RegSetValueExA 77DDEAE7 6 Bytes JMP 70F3000A .text C:\WINDOWS\system32\lsass.exe[1568] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 6 Bytes JMP 70FF000A .text C:\WINDOWS\system32\lsass.exe[1568] ADVAPI32.dll!AdjustTokenPrivileges 77DDF00C 6 Bytes JMP 7093000A .text C:\WINDOWS\system32\lsass.exe[1568] ADVAPI32.dll!RegDeleteKeyA 77DE42A0 6 Bytes JMP 706F000A .text C:\WINDOWS\system32\lsass.exe[1568] ADVAPI32.dll!RegDeleteKeyW 77DE559B 6 Bytes JMP 706C000A .text C:\WINDOWS\system32\lsass.exe[1568] ADVAPI32.dll!OpenSCManagerW 77DE6F55 6 Bytes JMP 70CC000A .text C:\WINDOWS\system32\lsass.exe[1568] ADVAPI32.dll!OpenSCManagerA 77DF69AE 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\lsass.exe[1568] ADVAPI32.dll!OpenSCManagerA + 4 77DF69B2 2 Bytes [CE, 70] .text C:\WINDOWS\system32\lsass.exe[1568] ADVAPI32.dll!LookupPrivilegeValueW 77DFB8DF 6 Bytes JMP 7096000A .text C:\WINDOWS\system32\lsass.exe[1568] ADVAPI32.dll!RegCreateKeyW 77DFBA55 6 Bytes JMP 7102000A .text C:\WINDOWS\system32\lsass.exe[1568] ADVAPI32.dll!RegQueryValueA 77DFBB8D 4 Bytes JMP EC001E25 .text C:\WINDOWS\system32\lsass.exe[1568] ADVAPI32.dll!RegQueryValueA + 5 77DFBB92 1 Byte [70] .text C:\WINDOWS\system32\lsass.exe[1568] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 6 Bytes JMP 7105000A .text C:\WINDOWS\system32\lsass.exe[1568] ADVAPI32.dll!LookupPrivilegeValueA 77DFC238 6 Bytes JMP 7099000A .text C:\WINDOWS\system32\lsass.exe[1568] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 7168000A .text C:\WINDOWS\system32\lsass.exe[1568] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 7120000A .text C:\WINDOWS\system32\lsass.exe[1568] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 711D000A .text C:\WINDOWS\system32\lsass.exe[1568] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 7156000A .text C:\WINDOWS\system32\lsass.exe[1568] USER32.dll!SetWindowTextW 7E42960E 6 Bytes JMP 7066000A .text C:\WINDOWS\system32\lsass.exe[1568] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 7132000A .text C:\WINDOWS\system32\lsass.exe[1568] USER32.dll!GetWindowTextW 7E42A5CD 6 Bytes JMP 70C6000A .text C:\WINDOWS\system32\lsass.exe[1568] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 712F000A .text C:\WINDOWS\system32\lsass.exe[1568] USER32.dll!ShowWindow 7E42AF56 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\lsass.exe[1568] USER32.dll!ShowWindow + 4 7E42AF5A 2 Bytes [C2, 70] .text C:\WINDOWS\system32\lsass.exe[1568] USER32.dll!CreateWindowExW 7E42D0A3 6 Bytes JMP 7078000A .text C:\WINDOWS\system32\lsass.exe[1568] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\lsass.exe[1568] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [2B, 71] .text C:\WINDOWS\system32\lsass.exe[1568] USER32.dll!DrawTextW 7E42D7E2 6 Bytes JMP 707E000A .text C:\WINDOWS\system32\lsass.exe[1568] USER32.dll!CreateWindowExA 7E42E4A9 6 Bytes JMP 707B000A .text C:\WINDOWS\system32\lsass.exe[1568] USER32.dll!SetWindowTextA 7E42F56B 6 Bytes JMP 7069000A .text C:\WINDOWS\system32\lsass.exe[1568] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 7159000A .text C:\WINDOWS\system32\lsass.exe[1568] USER32.dll!SetWinEventHook 7E4317F7 6 Bytes JMP 711A000A .text C:\WINDOWS\system32\lsass.exe[1568] USER32.dll!GetWindowTextA 7E43216B 6 Bytes JMP 70C9000A .text C:\WINDOWS\system32\lsass.exe[1568] USER32.dll!DrawTextA 7E43C702 6 Bytes JMP 7081000A .text C:\WINDOWS\system32\lsass.exe[1568] USER32.dll!DdeConnect 7E4581C3 6 Bytes JMP 7129000A .text C:\WINDOWS\system32\lsass.exe[1568] USER32.dll!EndTask 7E45A0A5 6 Bytes JMP 713E000A .text C:\WINDOWS\system32\lsass.exe[1568] USER32.dll!RegisterRawInputDevices 7E46CE0E 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\lsass.exe[1568] USER32.dll!RegisterRawInputDevices + 4 7E46CE12 2 Bytes [16, 71] .text C:\WINDOWS\system32\lsass.exe[1568] SHELL32.dll!ShellExecuteExW 7CA098CB 6 Bytes JMP 7144000A .text C:\WINDOWS\system32\lsass.exe[1568] SHELL32.dll!Shell_NotifyIcon 7CA28BC6 6 Bytes JMP 70B1000A .text C:\WINDOWS\system32\lsass.exe[1568] SHELL32.dll!Shell_NotifyIconW 7CA2A537 6 Bytes JMP 70AE000A .text C:\WINDOWS\system32\lsass.exe[1568] SHELL32.dll!ShellExecuteEx 7CA40E45 6 Bytes JMP 7147000A .text C:\WINDOWS\system32\lsass.exe[1568] SHELL32.dll!ShellExecuteA 7CA41170 6 Bytes JMP 714D000A .text C:\WINDOWS\system32\lsass.exe[1568] SHELL32.dll!ShellExecuteW 7CAB5D48 6 Bytes JMP 714A000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] ntdll.dll!NtLoadDriver 7C90D46E 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\Ati2evxx.exe[1748] ntdll.dll!NtLoadDriver + 4 7C90D472 2 Bytes [22, 71] .text C:\WINDOWS\System32\Ati2evxx.exe[1748] ntdll.dll!NtSuspendProcess 7C90DE2E 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\Ati2evxx.exe[1748] ntdll.dll!NtSuspendProcess + 4 7C90DE32 2 Bytes [3A, 71] .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!DeviceIoControl 7C801629 6 Bytes JMP 70AB000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!CreateFileA 7C801A28 6 Bytes JMP 70DE000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!VirtualProtectEx 7C801A61 6 Bytes JMP 7126000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!VirtualProtect 7C801AD4 6 Bytes JMP 70D2000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!LoadLibraryExW 7C801AF5 6 Bytes JMP 716B000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!LoadLibraryA 7C801D7B 6 Bytes JMP 715F000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 7165000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 7162000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 7150000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 7153000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!VirtualAlloc 7C809AF1 6 Bytes JMP 70D5000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!MultiByteToWideChar 7C809C98 6 Bytes JMP 7084000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!LoadResource 7C80A055 6 Bytes JMP 70C0000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!WideCharToMultiByte 7C80A174 6 Bytes JMP 7063000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!GetProcAddress 7C80AE40 6 Bytes JMP 7114000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!LoadLibraryW 7C80AEEB 6 Bytes JMP 715C000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!CreateMutexW 7C80E957 6 Bytes JMP 708D000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!CreateMutexA 7C80E9DF 6 Bytes JMP 7090000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!OpenMutexW 7C80EA35 6 Bytes JMP 7087000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!OpenMutexA 7C80EABB 6 Bytes JMP 708A000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!GetVolumeInformationW 7C80FA85 6 Bytes JMP 710E000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [6D, 71] .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!CreateThread 7C8106D7 6 Bytes JMP 70D8000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!CreateFileW 7C810800 6 Bytes JMP 70E1000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!WriteFile 7C810E27 6 Bytes JMP 70A2000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!TerminateThread 7C81CB3B 6 Bytes JMP 7138000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!MoveFileW 7C821261 6 Bytes JMP 705D000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!CreateDirectoryA 7C8217AC 6 Bytes JMP 70A8000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!GetVolumeInformationA 7C821BA5 6 Bytes JMP 7111000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 70B4000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!CopyFileA 7C8286EE 6 Bytes JMP 70BD000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!CopyFileW 7C82F87B 6 Bytes JMP 70BA000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!OpenProcess 7C8309E9 6 Bytes JMP 7054000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!DeleteFileA 7C831EDD 6 Bytes JMP 7075000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!DeleteFileW 7C831F63 6 Bytes JMP 7072000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!CreateDirectoryW 7C832402 6 Bytes JMP 70A5000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!MoveFileExW 7C83568B 6 Bytes JMP 7057000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!MoveFileA 7C835EBF 6 Bytes JMP 7060000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!DebugActiveProcess 7C85B0FB 6 Bytes JMP 7135000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!MoveFileExA 7C85E49B 6 Bytes JMP 705A000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!CopyFileExA 7C85F39C 6 Bytes JMP 70B7000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!WinExec 7C86250D 6 Bytes JMP 7141000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!SetThreadContext 7C863C09 6 Bytes JMP 709F000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] kernel32.dll!CreateToolhelp32Snapshot 7C865C7F 6 Bytes JMP 70DB000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 7156000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] USER32.dll!SetWindowTextW 7E42960E 6 Bytes JMP 7066000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 7132000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] USER32.dll!GetWindowTextW 7E42A5CD 6 Bytes JMP 70C6000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 712F000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] USER32.dll!ShowWindow 7E42AF56 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\Ati2evxx.exe[1748] USER32.dll!ShowWindow + 4 7E42AF5A 2 Bytes [C2, 70] .text C:\WINDOWS\System32\Ati2evxx.exe[1748] USER32.dll!CreateWindowExW 7E42D0A3 6 Bytes JMP 7078000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\Ati2evxx.exe[1748] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [2B, 71] .text C:\WINDOWS\System32\Ati2evxx.exe[1748] USER32.dll!DrawTextW 7E42D7E2 6 Bytes JMP 707E000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] USER32.dll!CreateWindowExA 7E42E4A9 6 Bytes JMP 707B000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] USER32.dll!SetWindowTextA 7E42F56B 6 Bytes JMP 7069000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 7159000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] USER32.dll!SetWinEventHook 7E4317F7 6 Bytes JMP 711A000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] USER32.dll!GetWindowTextA 7E43216B 6 Bytes JMP 70C9000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] USER32.dll!DrawTextA 7E43C702 6 Bytes JMP 7081000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] USER32.dll!DdeConnect 7E4581C3 6 Bytes JMP 7129000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] USER32.dll!EndTask 7E45A0A5 6 Bytes JMP 713E000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] USER32.dll!RegisterRawInputDevices 7E46CE0E 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\Ati2evxx.exe[1748] USER32.dll!RegisterRawInputDevices + 4 7E46CE12 2 Bytes [16, 71] .text C:\WINDOWS\System32\Ati2evxx.exe[1748] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 6 Bytes JMP 70F6000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] ADVAPI32.dll!RegQueryValueExW 77DD6FFF 6 Bytes JMP 70E4000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] ADVAPI32.dll!RegCreateKeyExW 77DD776C 6 Bytes JMP 7108000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] ADVAPI32.dll!RegOpenKeyExA 77DD7852 6 Bytes JMP 70F9000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] ADVAPI32.dll!RegOpenKeyW 77DD7946 6 Bytes JMP 70FC000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] ADVAPI32.dll!OpenProcessToken 77DD798B 6 Bytes JMP 709C000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] ADVAPI32.dll!RegQueryValueExA 77DD7ABB 6 Bytes JMP 70E7000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] ADVAPI32.dll!RegSetValueExW 77DDD767 6 Bytes JMP 70F0000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] ADVAPI32.dll!RegQueryValueW 77DDD87A 6 Bytes JMP 70EA000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 6 Bytes JMP 710B000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] ADVAPI32.dll!RegSetValueExA 77DDEAE7 6 Bytes JMP 70F3000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 6 Bytes JMP 70FF000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] ADVAPI32.dll!AdjustTokenPrivileges 77DDF00C 6 Bytes JMP 7093000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] ADVAPI32.dll!RegDeleteKeyA 77DE42A0 6 Bytes JMP 706F000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] ADVAPI32.dll!RegDeleteKeyW 77DE559B 6 Bytes JMP 706C000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] ADVAPI32.dll!OpenSCManagerW 77DE6F55 6 Bytes JMP 70CC000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] ADVAPI32.dll!OpenSCManagerA 77DF69AE 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\Ati2evxx.exe[1748] ADVAPI32.dll!OpenSCManagerA + 4 77DF69B2 2 Bytes [CE, 70] .text C:\WINDOWS\System32\Ati2evxx.exe[1748] ADVAPI32.dll!LookupPrivilegeValueW 77DFB8DF 6 Bytes JMP 7096000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] ADVAPI32.dll!RegCreateKeyW 77DFBA55 6 Bytes JMP 7102000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] ADVAPI32.dll!RegQueryValueA 77DFBB8D 4 Bytes JMP EC001E25 .text C:\WINDOWS\System32\Ati2evxx.exe[1748] ADVAPI32.dll!RegQueryValueA + 5 77DFBB92 1 Byte [70] .text C:\WINDOWS\System32\Ati2evxx.exe[1748] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 6 Bytes JMP 7105000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] ADVAPI32.dll!LookupPrivilegeValueA 77DFC238 6 Bytes JMP 7099000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 7168000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 7120000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 711D000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] SHELL32.dll!ShellExecuteExW 7CA098CB 6 Bytes JMP 7144000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] SHELL32.dll!Shell_NotifyIcon 7CA28BC6 6 Bytes JMP 70B1000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] SHELL32.dll!Shell_NotifyIconW 7CA2A537 6 Bytes JMP 70AE000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] SHELL32.dll!ShellExecuteEx 7CA40E45 6 Bytes JMP 7147000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] SHELL32.dll!ShellExecuteA 7CA41170 6 Bytes JMP 714D000A .text C:\WINDOWS\System32\Ati2evxx.exe[1748] SHELL32.dll!ShellExecuteW 7CAB5D48 6 Bytes JMP 714A000A .text C:\WINDOWS\system32\svchost.exe[1760] ntdll.dll!NtLoadDriver 7C90D46E 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[1760] ntdll.dll!NtLoadDriver + 4 7C90D472 2 Bytes [22, 71] .text C:\WINDOWS\system32\svchost.exe[1760] ntdll.dll!NtSuspendProcess 7C90DE2E 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[1760] ntdll.dll!NtSuspendProcess + 4 7C90DE32 2 Bytes [3A, 71] .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!DeviceIoControl 7C801629 6 Bytes JMP 70AB000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!CreateFileA 7C801A28 6 Bytes JMP 70DE000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!VirtualProtectEx 7C801A61 6 Bytes JMP 7126000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!VirtualProtect 7C801AD4 6 Bytes JMP 70D2000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!LoadLibraryExW 7C801AF5 6 Bytes JMP 716B000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!LoadLibraryA 7C801D7B 6 Bytes JMP 715F000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 7165000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 7162000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 7150000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 7153000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!VirtualAlloc 7C809AF1 6 Bytes JMP 70D5000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!MultiByteToWideChar 7C809C98 6 Bytes JMP 7084000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!LoadResource 7C80A055 6 Bytes JMP 70C0000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!WideCharToMultiByte 7C80A174 6 Bytes JMP 7063000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!GetProcAddress 7C80AE40 6 Bytes JMP 7114000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!LoadLibraryW 7C80AEEB 6 Bytes JMP 715C000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!CreateMutexW 7C80E957 6 Bytes JMP 708D000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!CreateMutexA 7C80E9DF 6 Bytes JMP 7090000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!OpenMutexW 7C80EA35 6 Bytes JMP 7087000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!OpenMutexA 7C80EABB 6 Bytes JMP 708A000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!GetVolumeInformationW 7C80FA85 6 Bytes JMP 710E000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [6D, 71] .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!CreateThread 7C8106D7 6 Bytes JMP 70D8000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!CreateFileW 7C810800 6 Bytes JMP 70E1000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!WriteFile 7C810E27 6 Bytes JMP 70A2000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!TerminateThread 7C81CB3B 6 Bytes JMP 7138000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!MoveFileW 7C821261 6 Bytes JMP 705D000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!CreateDirectoryA 7C8217AC 6 Bytes JMP 70A8000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!GetVolumeInformationA 7C821BA5 6 Bytes JMP 7111000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 70B4000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!CopyFileA 7C8286EE 6 Bytes JMP 70BD000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!CopyFileW 7C82F87B 6 Bytes JMP 70BA000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!OpenProcess 7C8309E9 6 Bytes JMP 7054000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!DeleteFileA 7C831EDD 6 Bytes JMP 7075000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!DeleteFileW 7C831F63 6 Bytes JMP 7072000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!CreateDirectoryW 7C832402 6 Bytes JMP 70A5000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!MoveFileExW 7C83568B 6 Bytes JMP 7057000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!MoveFileA 7C835EBF 6 Bytes JMP 7060000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!DebugActiveProcess 7C85B0FB 6 Bytes JMP 7135000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!MoveFileExA 7C85E49B 6 Bytes JMP 705A000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!CopyFileExA 7C85F39C 6 Bytes JMP 70B7000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!WinExec 7C86250D 6 Bytes JMP 7141000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!SetThreadContext 7C863C09 6 Bytes JMP 709F000A .text C:\WINDOWS\system32\svchost.exe[1760] kernel32.dll!CreateToolhelp32Snapshot 7C865C7F 6 Bytes JMP 70DB000A .text C:\WINDOWS\system32\svchost.exe[1760] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 6 Bytes JMP 70F6000A .text C:\WINDOWS\system32\svchost.exe[1760] ADVAPI32.dll!RegQueryValueExW 77DD6FFF 6 Bytes JMP 70E4000A .text C:\WINDOWS\system32\svchost.exe[1760] ADVAPI32.dll!RegCreateKeyExW 77DD776C 6 Bytes JMP 7108000A .text C:\WINDOWS\system32\svchost.exe[1760] ADVAPI32.dll!RegOpenKeyExA 77DD7852 6 Bytes JMP 70F9000A .text C:\WINDOWS\system32\svchost.exe[1760] ADVAPI32.dll!RegOpenKeyW 77DD7946 6 Bytes JMP 70FC000A .text C:\WINDOWS\system32\svchost.exe[1760] ADVAPI32.dll!OpenProcessToken 77DD798B 6 Bytes JMP 709C000A .text C:\WINDOWS\system32\svchost.exe[1760] ADVAPI32.dll!RegQueryValueExA 77DD7ABB 6 Bytes JMP 70E7000A .text C:\WINDOWS\system32\svchost.exe[1760] ADVAPI32.dll!RegSetValueExW 77DDD767 6 Bytes JMP 70F0000A .text C:\WINDOWS\system32\svchost.exe[1760] ADVAPI32.dll!RegQueryValueW 77DDD87A 6 Bytes JMP 70EA000A .text C:\WINDOWS\system32\svchost.exe[1760] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 6 Bytes JMP 710B000A .text C:\WINDOWS\system32\svchost.exe[1760] ADVAPI32.dll!RegSetValueExA 77DDEAE7 6 Bytes JMP 70F3000A .text C:\WINDOWS\system32\svchost.exe[1760] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 6 Bytes JMP 70FF000A .text C:\WINDOWS\system32\svchost.exe[1760] ADVAPI32.dll!AdjustTokenPrivileges 77DDF00C 6 Bytes JMP 7093000A .text C:\WINDOWS\system32\svchost.exe[1760] ADVAPI32.dll!RegDeleteKeyA 77DE42A0 6 Bytes JMP 706F000A .text C:\WINDOWS\system32\svchost.exe[1760] ADVAPI32.dll!RegDeleteKeyW 77DE559B 6 Bytes JMP 706C000A .text C:\WINDOWS\system32\svchost.exe[1760] ADVAPI32.dll!OpenSCManagerW 77DE6F55 6 Bytes JMP 70CC000A .text C:\WINDOWS\system32\svchost.exe[1760] ADVAPI32.dll!OpenSCManagerA 77DF69AE 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[1760] ADVAPI32.dll!OpenSCManagerA + 4 77DF69B2 2 Bytes [CE, 70] .text C:\WINDOWS\system32\svchost.exe[1760] ADVAPI32.dll!LookupPrivilegeValueW 77DFB8DF 6 Bytes JMP 7096000A .text C:\WINDOWS\system32\svchost.exe[1760] ADVAPI32.dll!RegCreateKeyW 77DFBA55 6 Bytes JMP 7102000A .text C:\WINDOWS\system32\svchost.exe[1760] ADVAPI32.dll!RegQueryValueA 77DFBB8D 4 Bytes JMP EC001E25 .text C:\WINDOWS\system32\svchost.exe[1760] ADVAPI32.dll!RegQueryValueA + 5 77DFBB92 1 Byte [70] .text C:\WINDOWS\system32\svchost.exe[1760] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 6 Bytes JMP 7105000A .text C:\WINDOWS\system32\svchost.exe[1760] ADVAPI32.dll!LookupPrivilegeValueA 77DFC238 6 Bytes JMP 7099000A .text C:\WINDOWS\system32\svchost.exe[1760] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 7168000A .text C:\WINDOWS\system32\svchost.exe[1760] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 7120000A .text C:\WINDOWS\system32\svchost.exe[1760] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 711D000A .text C:\WINDOWS\system32\svchost.exe[1760] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 7156000A .text C:\WINDOWS\system32\svchost.exe[1760] USER32.dll!SetWindowTextW 7E42960E 6 Bytes JMP 7066000A .text C:\WINDOWS\system32\svchost.exe[1760] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 7132000A .text C:\WINDOWS\system32\svchost.exe[1760] USER32.dll!GetWindowTextW 7E42A5CD 6 Bytes JMP 70C6000A .text C:\WINDOWS\system32\svchost.exe[1760] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 712F000A .text C:\WINDOWS\system32\svchost.exe[1760] USER32.dll!ShowWindow 7E42AF56 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[1760] USER32.dll!ShowWindow + 4 7E42AF5A 2 Bytes [C2, 70] .text C:\WINDOWS\system32\svchost.exe[1760] USER32.dll!CreateWindowExW 7E42D0A3 6 Bytes JMP 7078000A .text C:\WINDOWS\system32\svchost.exe[1760] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[1760] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [2B, 71] .text C:\WINDOWS\system32\svchost.exe[1760] USER32.dll!DrawTextW 7E42D7E2 6 Bytes JMP 707E000A .text C:\WINDOWS\system32\svchost.exe[1760] USER32.dll!CreateWindowExA 7E42E4A9 6 Bytes JMP 707B000A .text C:\WINDOWS\system32\svchost.exe[1760] USER32.dll!SetWindowTextA 7E42F56B 6 Bytes JMP 7069000A .text C:\WINDOWS\system32\svchost.exe[1760] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 7159000A .text C:\WINDOWS\system32\svchost.exe[1760] USER32.dll!SetWinEventHook 7E4317F7 6 Bytes JMP 711A000A .text C:\WINDOWS\system32\svchost.exe[1760] USER32.dll!GetWindowTextA 7E43216B 6 Bytes JMP 70C9000A .text C:\WINDOWS\system32\svchost.exe[1760] USER32.dll!DrawTextA 7E43C702 6 Bytes JMP 7081000A .text C:\WINDOWS\system32\svchost.exe[1760] USER32.dll!DdeConnect 7E4581C3 6 Bytes JMP 7129000A .text C:\WINDOWS\system32\svchost.exe[1760] USER32.dll!EndTask 7E45A0A5 6 Bytes JMP 713E000A .text C:\WINDOWS\system32\svchost.exe[1760] USER32.dll!RegisterRawInputDevices 7E46CE0E 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[1760] USER32.dll!RegisterRawInputDevices + 4 7E46CE12 2 Bytes [16, 71] .text C:\WINDOWS\system32\svchost.exe[1760] SHELL32.dll!ShellExecuteExW 7CA098CB 6 Bytes JMP 7144000A .text C:\WINDOWS\system32\svchost.exe[1760] SHELL32.dll!Shell_NotifyIcon 7CA28BC6 6 Bytes JMP 70B1000A .text C:\WINDOWS\system32\svchost.exe[1760] SHELL32.dll!Shell_NotifyIconW 7CA2A537 6 Bytes JMP 70AE000A .text C:\WINDOWS\system32\svchost.exe[1760] SHELL32.dll!ShellExecuteEx 7CA40E45 6 Bytes JMP 7147000A .text C:\WINDOWS\system32\svchost.exe[1760] SHELL32.dll!ShellExecuteA 7CA41170 6 Bytes JMP 714D000A .text C:\WINDOWS\system32\svchost.exe[1760] SHELL32.dll!ShellExecuteW 7CAB5D48 6 Bytes JMP 714A000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] ntdll.dll!NtLoadDriver 7C90D46E 3 Bytes [FF, 25, 1E] .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] ntdll.dll!NtLoadDriver + 4 7C90D472 2 Bytes [22, 71] .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] ntdll.dll!NtSuspendProcess 7C90DE2E 3 Bytes [FF, 25, 1E] .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] ntdll.dll!NtSuspendProcess + 4 7C90DE32 2 Bytes [3A, 71] .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!DeviceIoControl 7C801629 6 Bytes JMP 70AA000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!CreateFileA 7C801A28 6 Bytes JMP 70DD000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!VirtualProtectEx 7C801A61 6 Bytes JMP 7126000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!VirtualProtect 7C801AD4 6 Bytes JMP 70D1000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!LoadLibraryExW 7C801AF5 6 Bytes JMP 716B000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!LoadLibraryA 7C801D7B 6 Bytes JMP 715F000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 7165000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 7162000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 7150000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 7153000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!VirtualAlloc 7C809AF1 6 Bytes JMP 70D4000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!MultiByteToWideChar 7C809C98 6 Bytes JMP 7083000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!LoadResource 7C80A055 6 Bytes JMP 70BF000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!WideCharToMultiByte 7C80A174 6 Bytes JMP 7062000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!GetProcAddress 7C80AE40 6 Bytes JMP 7113000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!LoadLibraryW 7C80AEEB 6 Bytes JMP 715C000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!CreateMutexW 7C80E957 6 Bytes JMP 708C000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!CreateMutexA 7C80E9DF 6 Bytes JMP 708F000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!OpenMutexW 7C80EA35 6 Bytes JMP 7086000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!OpenMutexA 7C80EABB 6 Bytes JMP 7089000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!GetVolumeInformationW 7C80FA85 6 Bytes JMP 710D000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E] .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [6D, 71] .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!CreateThread 7C8106D7 6 Bytes JMP 70D7000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!CreateFileW 7C810800 6 Bytes JMP 70E0000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!WriteFile 7C810E27 6 Bytes JMP 70A1000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!TerminateThread 7C81CB3B 6 Bytes JMP 7138000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!MoveFileW 7C821261 6 Bytes JMP 705C000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!CreateDirectoryA 7C8217AC 6 Bytes JMP 70A7000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!GetVolumeInformationA 7C821BA5 6 Bytes JMP 7110000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 70B3000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!CopyFileA 7C8286EE 6 Bytes JMP 70BC000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!CopyFileW 7C82F87B 6 Bytes JMP 70B9000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!OpenProcess 7C8309E9 6 Bytes JMP 7053000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!DeleteFileA 7C831EDD 6 Bytes JMP 7074000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!DeleteFileW 7C831F63 6 Bytes JMP 7071000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!CreateDirectoryW 7C832402 6 Bytes JMP 70A4000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!MoveFileExW 7C83568B 6 Bytes JMP 7056000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!MoveFileA 7C835EBF 6 Bytes JMP 705F000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!DebugActiveProcess 7C85B0FB 6 Bytes JMP 7135000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!MoveFileExA 7C85E49B 6 Bytes JMP 7059000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!CopyFileExA 7C85F39C 6 Bytes JMP 70B6000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!WinExec 7C86250D 6 Bytes JMP 7141000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!SetThreadContext 7C863C09 6 Bytes JMP 709E000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] kernel32.dll!CreateToolhelp32Snapshot 7C865C7F 6 Bytes JMP 70DA000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 6 Bytes JMP 70F5000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] ADVAPI32.dll!RegQueryValueExW 77DD6FFF 6 Bytes JMP 70E3000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] ADVAPI32.dll!RegCreateKeyExW 77DD776C 6 Bytes JMP 7107000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] ADVAPI32.dll!RegOpenKeyExA 77DD7852 6 Bytes JMP 70F8000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] ADVAPI32.dll!RegOpenKeyW 77DD7946 6 Bytes JMP 70FB000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] ADVAPI32.dll!OpenProcessToken 77DD798B 6 Bytes JMP 709B000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] ADVAPI32.dll!RegQueryValueExA 77DD7ABB 6 Bytes JMP 70E6000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] ADVAPI32.dll!RegSetValueExW 77DDD767 6 Bytes JMP 70EF000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] ADVAPI32.dll!RegQueryValueW 77DDD87A 6 Bytes JMP 70E9000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 6 Bytes JMP 710A000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] ADVAPI32.dll!RegSetValueExA 77DDEAE7 6 Bytes JMP 70F2000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 6 Bytes JMP 70FE000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] ADVAPI32.dll!AdjustTokenPrivileges 77DDF00C 6 Bytes JMP 7092000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] ADVAPI32.dll!RegDeleteKeyA 77DE42A0 6 Bytes JMP 706E000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] ADVAPI32.dll!RegDeleteKeyW 77DE559B 6 Bytes JMP 706B000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] ADVAPI32.dll!OpenSCManagerW 77DE6F55 6 Bytes JMP 70CB000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] ADVAPI32.dll!OpenSCManagerA 77DF69AE 3 Bytes [FF, 25, 1E] .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] ADVAPI32.dll!OpenSCManagerA + 4 77DF69B2 2 Bytes [CD, 70] {INT 0x70} .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] ADVAPI32.dll!LookupPrivilegeValueW 77DFB8DF 6 Bytes JMP 7095000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] ADVAPI32.dll!RegCreateKeyW 77DFBA55 6 Bytes JMP 7101000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] ADVAPI32.dll!RegQueryValueA 77DFBB8D 6 Bytes JMP 70EC000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 6 Bytes JMP 7104000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] ADVAPI32.dll!LookupPrivilegeValueA 77DFC238 6 Bytes JMP 7098000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 7168000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 7120000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 711D000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 7156000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] USER32.dll!SetWindowTextW 7E42960E 6 Bytes JMP 7065000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 7132000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] USER32.dll!GetWindowTextW 7E42A5CD 6 Bytes JMP 70C5000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 712F000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] USER32.dll!ShowWindow 7E42AF56 3 Bytes [FF, 25, 1E] .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] USER32.dll!ShowWindow + 4 7E42AF5A 2 Bytes [C1, 70] .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] USER32.dll!CreateWindowExW 7E42D0A3 6 Bytes JMP 7077000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E] .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [2B, 71] .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] USER32.dll!DrawTextW 7E42D7E2 6 Bytes JMP 707D000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] USER32.dll!CreateWindowExA 7E42E4A9 6 Bytes JMP 707A000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] USER32.dll!SetWindowTextA 7E42F56B 6 Bytes JMP 7068000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 7159000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] USER32.dll!SetWinEventHook 7E4317F7 6 Bytes JMP 7119000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] USER32.dll!GetWindowTextA 7E43216B 6 Bytes JMP 70C8000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] USER32.dll!DrawTextA 7E43C702 6 Bytes JMP 7080000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] USER32.dll!DdeConnect 7E4581C3 6 Bytes JMP 7129000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] USER32.dll!EndTask 7E45A0A5 6 Bytes JMP 713E000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] USER32.dll!RegisterRawInputDevices 7E46CE0E 3 Bytes [FF, 25, 1E] .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] USER32.dll!RegisterRawInputDevices + 4 7E46CE12 2 Bytes [15, 71] .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] SHELL32.dll!ShellExecuteExW 7CA098CB 6 Bytes JMP 7144000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] SHELL32.dll!Shell_NotifyIcon 7CA28BC6 6 Bytes JMP 70B0000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] SHELL32.dll!Shell_NotifyIconW 7CA2A537 6 Bytes JMP 70AD000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] SHELL32.dll!ShellExecuteEx 7CA40E45 6 Bytes JMP 7147000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] SHELL32.dll!ShellExecuteA 7CA41170 6 Bytes JMP 714D000A .text C:\Program Files\Java\jre6\bin\jqs.exe[1784] SHELL32.dll!ShellExecuteW 7CAB5D48 6 Bytes JMP 714A000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] ntdll.dll!NtLoadDriver 7C90D46E 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] ntdll.dll!NtLoadDriver + 4 7C90D472 2 Bytes [22, 71] .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] ntdll.dll!NtSuspendProcess 7C90DE2E 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] ntdll.dll!NtSuspendProcess + 4 7C90DE32 2 Bytes [3A, 71] .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!DeviceIoControl 7C801629 6 Bytes JMP 70AB000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!CreateFileA 7C801A28 6 Bytes JMP 70DE000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!VirtualProtectEx 7C801A61 6 Bytes JMP 7126000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!VirtualProtect 7C801AD4 6 Bytes JMP 70D2000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!LoadLibraryExW 7C801AF5 6 Bytes JMP 716B000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!LoadLibraryA 7C801D7B 6 Bytes JMP 715F000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 7165000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 7162000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 7150000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 7153000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!VirtualAlloc 7C809AF1 6 Bytes JMP 70D5000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!MultiByteToWideChar 7C809C98 6 Bytes JMP 7084000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!LoadResource 7C80A055 6 Bytes JMP 70C0000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!WideCharToMultiByte 7C80A174 6 Bytes JMP 7063000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!GetProcAddress 7C80AE40 6 Bytes JMP 7114000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!LoadLibraryW 7C80AEEB 6 Bytes JMP 715C000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!CreateMutexW 7C80E957 6 Bytes JMP 708D000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!CreateMutexA 7C80E9DF 6 Bytes JMP 7090000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!OpenMutexW 7C80EA35 6 Bytes JMP 7087000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!OpenMutexA 7C80EABB 6 Bytes JMP 708A000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!GetVolumeInformationW 7C80FA85 6 Bytes JMP 710E000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [6D, 71] .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!CreateThread 7C8106D7 6 Bytes JMP 70D8000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!CreateFileW 7C810800 6 Bytes JMP 70E1000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!WriteFile 7C810E27 6 Bytes JMP 70A2000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!TerminateThread 7C81CB3B 6 Bytes JMP 7138000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!MoveFileW 7C821261 6 Bytes JMP 705D000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!CreateDirectoryA 7C8217AC 6 Bytes JMP 70A8000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!GetVolumeInformationA 7C821BA5 6 Bytes JMP 7111000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 70B4000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!CopyFileA 7C8286EE 6 Bytes JMP 70BD000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!CopyFileW 7C82F87B 6 Bytes JMP 70BA000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!OpenProcess 7C8309E9 6 Bytes JMP 7054000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!DeleteFileA 7C831EDD 6 Bytes JMP 7075000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!DeleteFileW 7C831F63 6 Bytes JMP 7072000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!CreateDirectoryW 7C832402 6 Bytes JMP 70A5000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!MoveFileExW 7C83568B 6 Bytes JMP 7057000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!MoveFileA 7C835EBF 6 Bytes JMP 7060000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!DebugActiveProcess 7C85B0FB 6 Bytes JMP 7135000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!MoveFileExA 7C85E49B 6 Bytes JMP 705A000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!CopyFileExA 7C85F39C 6 Bytes JMP 70B7000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!WinExec 7C86250D 6 Bytes JMP 7141000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!SetThreadContext 7C863C09 6 Bytes JMP 709F000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] kernel32.dll!CreateToolhelp32Snapshot 7C865C7F 6 Bytes JMP 70DB000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 7156000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] USER32.dll!SetWindowTextW 7E42960E 6 Bytes JMP 7066000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 7132000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] USER32.dll!GetWindowTextW 7E42A5CD 6 Bytes JMP 70C6000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 712F000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] USER32.dll!ShowWindow 7E42AF56 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] USER32.dll!ShowWindow + 4 7E42AF5A 2 Bytes [C2, 70] .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] USER32.dll!CreateWindowExW 7E42D0A3 6 Bytes JMP 7078000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [2B, 71] .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] USER32.dll!DrawTextW 7E42D7E2 6 Bytes JMP 707E000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] USER32.dll!CreateWindowExA 7E42E4A9 6 Bytes JMP 707B000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] USER32.dll!SetWindowTextA 7E42F56B 6 Bytes JMP 7069000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 7159000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] USER32.dll!SetWinEventHook 7E4317F7 6 Bytes JMP 711A000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] USER32.dll!GetWindowTextA 7E43216B 6 Bytes JMP 70C9000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] USER32.dll!DrawTextA 7E43C702 6 Bytes JMP 7081000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] USER32.dll!DdeConnect 7E4581C3 6 Bytes JMP 7129000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] USER32.dll!EndTask 7E45A0A5 6 Bytes JMP 713E000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] USER32.dll!RegisterRawInputDevices 7E46CE0E 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] USER32.dll!RegisterRawInputDevices + 4 7E46CE12 2 Bytes [16, 71] .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 6 Bytes JMP 70F6000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] ADVAPI32.dll!RegQueryValueExW 77DD6FFF 6 Bytes JMP 70E4000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] ADVAPI32.dll!RegCreateKeyExW 77DD776C 6 Bytes JMP 7108000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] ADVAPI32.dll!RegOpenKeyExA 77DD7852 6 Bytes JMP 70F9000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] ADVAPI32.dll!RegOpenKeyW 77DD7946 6 Bytes JMP 70FC000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] ADVAPI32.dll!OpenProcessToken 77DD798B 6 Bytes JMP 709C000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] ADVAPI32.dll!RegQueryValueExA 77DD7ABB 6 Bytes JMP 70E7000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] ADVAPI32.dll!RegSetValueExW 77DDD767 6 Bytes JMP 70F0000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] ADVAPI32.dll!RegQueryValueW 77DDD87A 6 Bytes JMP 70EA000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 6 Bytes JMP 710B000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] ADVAPI32.dll!RegSetValueExA 77DDEAE7 6 Bytes JMP 70F3000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 6 Bytes JMP 70FF000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] ADVAPI32.dll!AdjustTokenPrivileges 77DDF00C 6 Bytes JMP 7093000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] ADVAPI32.dll!RegDeleteKeyA 77DE42A0 6 Bytes JMP 706F000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] ADVAPI32.dll!RegDeleteKeyW 77DE559B 6 Bytes JMP 706C000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] ADVAPI32.dll!OpenSCManagerW 77DE6F55 6 Bytes JMP 70CC000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] ADVAPI32.dll!OpenSCManagerA 77DF69AE 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] ADVAPI32.dll!OpenSCManagerA + 4 77DF69B2 2 Bytes [CE, 70] .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] ADVAPI32.dll!LookupPrivilegeValueW 77DFB8DF 6 Bytes JMP 7096000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] ADVAPI32.dll!RegCreateKeyW 77DFBA55 6 Bytes JMP 7102000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] ADVAPI32.dll!RegQueryValueA 77DFBB8D 4 Bytes JMP EC001E25 .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] ADVAPI32.dll!RegQueryValueA + 5 77DFBB92 1 Byte [70] .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 6 Bytes JMP 7105000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] ADVAPI32.dll!LookupPrivilegeValueA 77DFC238 6 Bytes JMP 7099000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 7168000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 7120000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 711D000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] SHELL32.dll!ShellExecuteExW 7CA098CB 6 Bytes JMP 7144000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] SHELL32.dll!Shell_NotifyIcon 7CA28BC6 6 Bytes JMP 70B1000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] SHELL32.dll!Shell_NotifyIconW 7CA2A537 6 Bytes JMP 70AE000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] SHELL32.dll!ShellExecuteEx 7CA40E45 6 Bytes JMP 7147000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] SHELL32.dll!ShellExecuteA 7CA41170 6 Bytes JMP 714D000A .text C:\Program Files\Common Files\Motive\McciCMService.exe[1812] SHELL32.dll!ShellExecuteW 7CAB5D48 6 Bytes JMP 714A000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] ntdll.dll!NtLoadDriver 7C90D46E 3 Bytes [FF, 25, 1E] .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] ntdll.dll!NtLoadDriver + 4 7C90D472 2 Bytes [22, 71] .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] ntdll.dll!NtSuspendProcess 7C90DE2E 3 Bytes [FF, 25, 1E] .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] ntdll.dll!NtSuspendProcess + 4 7C90DE32 2 Bytes [3A, 71] .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!DeviceIoControl 7C801629 6 Bytes JMP 70AB000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!CreateFileA 7C801A28 6 Bytes JMP 70DE000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!VirtualProtectEx 7C801A61 6 Bytes JMP 7126000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!VirtualProtect 7C801AD4 6 Bytes JMP 70D2000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!LoadLibraryExW 7C801AF5 6 Bytes JMP 716B000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!LoadLibraryA 7C801D7B 6 Bytes JMP 715F000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 7165000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 7162000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 7150000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 7153000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!VirtualAlloc 7C809AF1 6 Bytes JMP 70D5000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!MultiByteToWideChar 7C809C98 6 Bytes JMP 707E000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!LoadResource 7C80A055 6 Bytes JMP 70C0000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!WideCharToMultiByte 7C80A174 6 Bytes JMP 705D000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!GetProcAddress 7C80AE40 6 Bytes JMP 7114000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!LoadLibraryW 7C80AEEB 6 Bytes JMP 715C000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!CreateMutexW 7C80E957 6 Bytes JMP 7087000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!CreateMutexA 7C80E9DF 6 Bytes JMP 708A000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!OpenMutexW 7C80EA35 6 Bytes JMP 7081000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!OpenMutexA 7C80EABB 6 Bytes JMP 7084000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!GetVolumeInformationW 7C80FA85 6 Bytes JMP 710E000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E] .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [6D, 71] .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!CreateThread 7C8106D7 6 Bytes JMP 70D8000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!CreateFileW 7C810800 6 Bytes JMP 70E1000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!WriteFile 7C810E27 6 Bytes JMP 709C000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!TerminateThread 7C81CB3B 6 Bytes JMP 7138000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!MoveFileW 7C821261 6 Bytes JMP 7057000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!CreateDirectoryA 7C8217AC 6 Bytes JMP 70A2000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!GetVolumeInformationA 7C821BA5 6 Bytes JMP 7111000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 70B4000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!CopyFileA 7C8286EE 6 Bytes JMP 70BD000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!CopyFileW 7C82F87B 6 Bytes JMP 70BA000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!OpenProcess 7C8309E9 6 Bytes JMP 704E000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!DeleteFileA 7C831EDD 6 Bytes JMP 706F000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!DeleteFileW 7C831F63 6 Bytes JMP 706C000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!CreateDirectoryW 7C832402 6 Bytes JMP 709F000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!MoveFileExW 7C83568B 6 Bytes JMP 7051000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!MoveFileA 7C835EBF 6 Bytes JMP 705A000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!DebugActiveProcess 7C85B0FB 6 Bytes JMP 7135000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!MoveFileExA 7C85E49B 6 Bytes JMP 7054000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!CopyFileExA 7C85F39C 6 Bytes JMP 70B7000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!WinExec 7C86250D 6 Bytes JMP 7141000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!SetThreadContext 7C863C09 6 Bytes JMP 7099000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] kernel32.dll!CreateToolhelp32Snapshot 7C865C7F 6 Bytes JMP 70DB000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 7156000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] USER32.dll!SetWindowTextW 7E42960E 6 Bytes JMP 7060000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 7132000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] USER32.dll!GetWindowTextW 7E42A5CD 6 Bytes JMP 70C6000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 712F000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] USER32.dll!ShowWindow 7E42AF56 3 Bytes [FF, 25, 1E] .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] USER32.dll!ShowWindow + 4 7E42AF5A 2 Bytes [C2, 70] .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] USER32.dll!CreateWindowExW 7E42D0A3 6 Bytes JMP 7072000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E] .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [2B, 71] .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] USER32.dll!DrawTextW 7E42D7E2 6 Bytes JMP 7078000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] USER32.dll!CreateWindowExA 7E42E4A9 6 Bytes JMP 7075000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] USER32.dll!SetWindowTextA 7E42F56B 6 Bytes JMP 7063000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 7159000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] USER32.dll!SetWinEventHook 7E4317F7 6 Bytes JMP 711A000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] USER32.dll!GetWindowTextA 7E43216B 6 Bytes JMP 70C9000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] USER32.dll!DrawTextA 7E43C702 6 Bytes JMP 707B000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] USER32.dll!DdeConnect 7E4581C3 6 Bytes JMP 7129000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] USER32.dll!EndTask 7E45A0A5 6 Bytes JMP 713E000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] USER32.dll!RegisterRawInputDevices 7E46CE0E 3 Bytes [FF, 25, 1E] .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] USER32.dll!RegisterRawInputDevices + 4 7E46CE12 2 Bytes [16, 71] .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 6 Bytes JMP 70F6000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] ADVAPI32.dll!RegQueryValueExW 77DD6FFF 6 Bytes JMP 70E4000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] ADVAPI32.dll!RegCreateKeyExW 77DD776C 6 Bytes JMP 7108000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] ADVAPI32.dll!RegOpenKeyExA 77DD7852 6 Bytes JMP 70F9000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] ADVAPI32.dll!RegOpenKeyW 77DD7946 6 Bytes JMP 70FC000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] ADVAPI32.dll!OpenProcessToken 77DD798B 6 Bytes JMP 7096000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] ADVAPI32.dll!RegQueryValueExA 77DD7ABB 6 Bytes JMP 70E7000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] ADVAPI32.dll!RegSetValueExW 77DDD767 6 Bytes JMP 70F0000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] ADVAPI32.dll!RegQueryValueW 77DDD87A 6 Bytes JMP 70EA000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 6 Bytes JMP 710B000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] ADVAPI32.dll!RegSetValueExA 77DDEAE7 6 Bytes JMP 70F3000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 6 Bytes JMP 70FF000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] ADVAPI32.dll!AdjustTokenPrivileges 77DDF00C 6 Bytes JMP 708D000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] ADVAPI32.dll!RegDeleteKeyA 77DE42A0 6 Bytes JMP 7069000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] ADVAPI32.dll!RegDeleteKeyW 77DE559B 6 Bytes JMP 7066000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] ADVAPI32.dll!OpenSCManagerW 77DE6F55 6 Bytes JMP 70CC000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] ADVAPI32.dll!OpenSCManagerA 77DF69AE 3 Bytes [FF, 25, 1E] .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] ADVAPI32.dll!OpenSCManagerA + 4 77DF69B2 2 Bytes [CE, 70] .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] ADVAPI32.dll!LookupPrivilegeValueW 77DFB8DF 6 Bytes JMP 7090000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] ADVAPI32.dll!RegCreateKeyW 77DFBA55 6 Bytes JMP 7102000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] ADVAPI32.dll!RegQueryValueA 77DFBB8D 4 Bytes JMP EC001E25 .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] ADVAPI32.dll!RegQueryValueA + 5 77DFBB92 1 Byte [70] .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 6 Bytes JMP 7105000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] ADVAPI32.dll!LookupPrivilegeValueA 77DFC238 6 Bytes JMP 7093000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 7168000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 7120000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 711D000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] SHELL32.dll!ShellExecuteExW 7CA098CB 6 Bytes JMP 7144000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] SHELL32.dll!Shell_NotifyIcon 7CA28BC6 6 Bytes JMP 70B1000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] SHELL32.dll!Shell_NotifyIconW 7CA2A537 6 Bytes JMP 70AE000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] SHELL32.dll!ShellExecuteEx 7CA40E45 6 Bytes JMP 7147000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] SHELL32.dll!ShellExecuteA 7CA41170 6 Bytes JMP 714D000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] SHELL32.dll!ShellExecuteW 7CAB5D48 6 Bytes JMP 714A000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] WININET.dll!InternetOpenUrlA 3D95F3BC 6 Bytes JMP 70A8000A .text C:\Program Files\PC Tools Firewall Plus\FWService.exe[1816] WININET.dll!InternetOpenUrlW 3D9A6DFF 6 Bytes JMP 70A5000A .text C:\WINDOWS\system32\svchost.exe[1860] ntdll.dll!NtLoadDriver 7C90D46E 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[1860] ntdll.dll!NtLoadDriver + 4 7C90D472 2 Bytes [22, 71] .text C:\WINDOWS\system32\svchost.exe[1860] ntdll.dll!NtSuspendProcess 7C90DE2E 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[1860] ntdll.dll!NtSuspendProcess + 4 7C90DE32 2 Bytes [3A, 71] .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!DeviceIoControl 7C801629 6 Bytes JMP 70AB000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!CreateFileA 7C801A28 6 Bytes JMP 70DE000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!VirtualProtectEx 7C801A61 6 Bytes JMP 7126000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!VirtualProtect 7C801AD4 6 Bytes JMP 70D2000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!LoadLibraryExW 7C801AF5 6 Bytes JMP 716B000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!LoadLibraryA 7C801D7B 6 Bytes JMP 715F000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 7165000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 7162000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 7150000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 7153000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!VirtualAlloc 7C809AF1 6 Bytes JMP 70D5000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!MultiByteToWideChar 7C809C98 6 Bytes JMP 7084000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!LoadResource 7C80A055 6 Bytes JMP 70C0000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!WideCharToMultiByte 7C80A174 6 Bytes JMP 7063000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!GetProcAddress 7C80AE40 6 Bytes JMP 7114000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!LoadLibraryW 7C80AEEB 6 Bytes JMP 715C000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!CreateMutexW 7C80E957 6 Bytes JMP 708D000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!CreateMutexA 7C80E9DF 6 Bytes JMP 7090000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!OpenMutexW 7C80EA35 6 Bytes JMP 7087000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!OpenMutexA 7C80EABB 6 Bytes JMP 708A000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!GetVolumeInformationW 7C80FA85 6 Bytes JMP 710E000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [6D, 71] .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!CreateThread 7C8106D7 6 Bytes JMP 70D8000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!CreateFileW 7C810800 6 Bytes JMP 70E1000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!WriteFile 7C810E27 6 Bytes JMP 70A2000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!TerminateThread 7C81CB3B 6 Bytes JMP 7138000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!MoveFileW 7C821261 6 Bytes JMP 705D000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!CreateDirectoryA 7C8217AC 6 Bytes JMP 70A8000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!GetVolumeInformationA 7C821BA5 6 Bytes JMP 7111000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 70B4000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!CopyFileA 7C8286EE 6 Bytes JMP 70BD000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!CopyFileW 7C82F87B 6 Bytes JMP 70BA000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!OpenProcess 7C8309E9 6 Bytes JMP 7054000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!DeleteFileA 7C831EDD 6 Bytes JMP 7075000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!DeleteFileW 7C831F63 6 Bytes JMP 7072000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!CreateDirectoryW 7C832402 6 Bytes JMP 70A5000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!MoveFileExW 7C83568B 6 Bytes JMP 7057000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!MoveFileA 7C835EBF 6 Bytes JMP 7060000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!DebugActiveProcess 7C85B0FB 6 Bytes JMP 7135000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!MoveFileExA 7C85E49B 6 Bytes JMP 705A000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!CopyFileExA 7C85F39C 6 Bytes JMP 70B7000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!WinExec 7C86250D 6 Bytes JMP 7141000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!SetThreadContext 7C863C09 6 Bytes JMP 709F000A .text C:\WINDOWS\system32\svchost.exe[1860] kernel32.dll!CreateToolhelp32Snapshot 7C865C7F 6 Bytes JMP 70DB000A .text C:\WINDOWS\system32\svchost.exe[1860] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 6 Bytes JMP 70F6000A .text C:\WINDOWS\system32\svchost.exe[1860] ADVAPI32.dll!RegQueryValueExW 77DD6FFF 6 Bytes JMP 70E4000A .text C:\WINDOWS\system32\svchost.exe[1860] ADVAPI32.dll!RegCreateKeyExW 77DD776C 6 Bytes JMP 7108000A .text C:\WINDOWS\system32\svchost.exe[1860] ADVAPI32.dll!RegOpenKeyExA 77DD7852 6 Bytes JMP 70F9000A .text C:\WINDOWS\system32\svchost.exe[1860] ADVAPI32.dll!RegOpenKeyW 77DD7946 6 Bytes JMP 70FC000A .text C:\WINDOWS\system32\svchost.exe[1860] ADVAPI32.dll!OpenProcessToken 77DD798B 6 Bytes JMP 709C000A .text C:\WINDOWS\system32\svchost.exe[1860] ADVAPI32.dll!RegQueryValueExA 77DD7ABB 6 Bytes JMP 70E7000A .text C:\WINDOWS\system32\svchost.exe[1860] ADVAPI32.dll!RegSetValueExW 77DDD767 6 Bytes JMP 70F0000A .text C:\WINDOWS\system32\svchost.exe[1860] ADVAPI32.dll!RegQueryValueW 77DDD87A 6 Bytes JMP 70EA000A .text C:\WINDOWS\system32\svchost.exe[1860] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 6 Bytes JMP 710B000A .text C:\WINDOWS\system32\svchost.exe[1860] ADVAPI32.dll!RegSetValueExA 77DDEAE7 6 Bytes JMP 70F3000A .text C:\WINDOWS\system32\svchost.exe[1860] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 6 Bytes JMP 70FF000A .text C:\WINDOWS\system32\svchost.exe[1860] ADVAPI32.dll!AdjustTokenPrivileges 77DDF00C 6 Bytes JMP 7093000A .text C:\WINDOWS\system32\svchost.exe[1860] ADVAPI32.dll!RegDeleteKeyA 77DE42A0 6 Bytes JMP 706F000A .text C:\WINDOWS\system32\svchost.exe[1860] ADVAPI32.dll!RegDeleteKeyW 77DE559B 6 Bytes JMP 706C000A .text C:\WINDOWS\system32\svchost.exe[1860] ADVAPI32.dll!OpenSCManagerW 77DE6F55 6 Bytes JMP 70CC000A .text C:\WINDOWS\system32\svchost.exe[1860] ADVAPI32.dll!OpenSCManagerA 77DF69AE 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[1860] ADVAPI32.dll!OpenSCManagerA + 4 77DF69B2 2 Bytes [CE, 70] .text C:\WINDOWS\system32\svchost.exe[1860] ADVAPI32.dll!LookupPrivilegeValueW 77DFB8DF 6 Bytes JMP 7096000A .text C:\WINDOWS\system32\svchost.exe[1860] ADVAPI32.dll!RegCreateKeyW 77DFBA55 6 Bytes JMP 7102000A .text C:\WINDOWS\system32\svchost.exe[1860] ADVAPI32.dll!RegQueryValueA 77DFBB8D 4 Bytes JMP EC001E25 .text C:\WINDOWS\system32\svchost.exe[1860] ADVAPI32.dll!RegQueryValueA + 5 77DFBB92 1 Byte [70] .text C:\WINDOWS\system32\svchost.exe[1860] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 6 Bytes JMP 7105000A .text C:\WINDOWS\system32\svchost.exe[1860] ADVAPI32.dll!LookupPrivilegeValueA 77DFC238 6 Bytes JMP 7099000A .text C:\WINDOWS\system32\svchost.exe[1860] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 7168000A .text C:\WINDOWS\system32\svchost.exe[1860] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 7120000A .text C:\WINDOWS\system32\svchost.exe[1860] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 711D000A .text C:\WINDOWS\system32\svchost.exe[1860] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 7156000A .text C:\WINDOWS\system32\svchost.exe[1860] USER32.dll!SetWindowTextW 7E42960E 6 Bytes JMP 7066000A .text C:\WINDOWS\system32\svchost.exe[1860] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 7132000A .text C:\WINDOWS\system32\svchost.exe[1860] USER32.dll!GetWindowTextW 7E42A5CD 6 Bytes JMP 70C6000A .text C:\WINDOWS\system32\svchost.exe[1860] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 712F000A .text C:\WINDOWS\system32\svchost.exe[1860] USER32.dll!ShowWindow 7E42AF56 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[1860] USER32.dll!ShowWindow + 4 7E42AF5A 2 Bytes [C2, 70] .text C:\WINDOWS\system32\svchost.exe[1860] USER32.dll!CreateWindowExW 7E42D0A3 6 Bytes JMP 7078000A .text C:\WINDOWS\system32\svchost.exe[1860] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[1860] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [2B, 71] .text C:\WINDOWS\system32\svchost.exe[1860] USER32.dll!DrawTextW 7E42D7E2 6 Bytes JMP 707E000A .text C:\WINDOWS\system32\svchost.exe[1860] USER32.dll!CreateWindowExA 7E42E4A9 6 Bytes JMP 707B000A .text C:\WINDOWS\system32\svchost.exe[1860] USER32.dll!SetWindowTextA 7E42F56B 6 Bytes JMP 7069000A .text C:\WINDOWS\system32\svchost.exe[1860] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 7159000A .text C:\WINDOWS\system32\svchost.exe[1860] USER32.dll!SetWinEventHook 7E4317F7 6 Bytes JMP 711A000A .text C:\WINDOWS\system32\svchost.exe[1860] USER32.dll!GetWindowTextA 7E43216B 6 Bytes JMP 70C9000A .text C:\WINDOWS\system32\svchost.exe[1860] USER32.dll!DrawTextA 7E43C702 6 Bytes JMP 7081000A .text C:\WINDOWS\system32\svchost.exe[1860] USER32.dll!DdeConnect 7E4581C3 6 Bytes JMP 7129000A .text C:\WINDOWS\system32\svchost.exe[1860] USER32.dll!EndTask 7E45A0A5 6 Bytes JMP 713E000A .text C:\WINDOWS\system32\svchost.exe[1860] USER32.dll!RegisterRawInputDevices 7E46CE0E 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[1860] USER32.dll!RegisterRawInputDevices + 4 7E46CE12 2 Bytes [16, 71] .text C:\WINDOWS\system32\svchost.exe[1860] SHELL32.dll!ShellExecuteExW 7CA098CB 6 Bytes JMP 7144000A .text C:\WINDOWS\system32\svchost.exe[1860] SHELL32.dll!Shell_NotifyIcon 7CA28BC6 6 Bytes JMP 70B1000A .text C:\WINDOWS\system32\svchost.exe[1860] SHELL32.dll!Shell_NotifyIconW 7CA2A537 6 Bytes JMP 70AE000A .text C:\WINDOWS\system32\svchost.exe[1860] SHELL32.dll!ShellExecuteEx 7CA40E45 6 Bytes JMP 7147000A .text C:\WINDOWS\system32\svchost.exe[1860] SHELL32.dll!ShellExecuteA 7CA41170 6 Bytes JMP 714D000A .text C:\WINDOWS\system32\svchost.exe[1860] SHELL32.dll!ShellExecuteW 7CAB5D48 6 Bytes JMP 714A000A .text C:\WINDOWS\System32\svchost.exe[1896] ntdll.dll!NtLoadDriver 7C90D46E 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\svchost.exe[1896] ntdll.dll!NtLoadDriver + 4 7C90D472 2 Bytes [22, 71] .text C:\WINDOWS\System32\svchost.exe[1896] ntdll.dll!NtSuspendProcess 7C90DE2E 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\svchost.exe[1896] ntdll.dll!NtSuspendProcess + 4 7C90DE32 2 Bytes [3A, 71] .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!DeviceIoControl 7C801629 6 Bytes JMP 70AB000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!CreateFileA 7C801A28 6 Bytes JMP 70DE000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!VirtualProtectEx 7C801A61 6 Bytes JMP 7126000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!VirtualProtect 7C801AD4 6 Bytes JMP 70D2000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!LoadLibraryExW 7C801AF5 6 Bytes JMP 716B000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!LoadLibraryA 7C801D7B 6 Bytes JMP 715F000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 7165000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 7162000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 7150000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 7153000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!VirtualAlloc 7C809AF1 6 Bytes JMP 70D5000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!MultiByteToWideChar 7C809C98 6 Bytes JMP 707D000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!LoadResource 7C80A055 6 Bytes JMP 70C0000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!WideCharToMultiByte 7C80A174 6 Bytes JMP 705C000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!GetProcAddress 7C80AE40 6 Bytes JMP 7114000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!LoadLibraryW 7C80AEEB 6 Bytes JMP 715C000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!CreateMutexW 7C80E957 6 Bytes JMP 7086000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!CreateMutexA 7C80E9DF 6 Bytes JMP 7089000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!OpenMutexW 7C80EA35 6 Bytes JMP 7080000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!OpenMutexA 7C80EABB 6 Bytes JMP 7083000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!GetVolumeInformationW 7C80FA85 6 Bytes JMP 710E000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [6D, 71] .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!CreateThread 7C8106D7 6 Bytes JMP 70D8000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!CreateFileW 7C810800 6 Bytes JMP 70E1000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!WriteFile 7C810E27 6 Bytes JMP 709C000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!TerminateThread 7C81CB3B 6 Bytes JMP 7138000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!MoveFileW 7C821261 6 Bytes JMP 7056000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!CreateDirectoryA 7C8217AC 6 Bytes JMP 70A2000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!GetVolumeInformationA 7C821BA5 6 Bytes JMP 7111000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 70B4000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!CopyFileA 7C8286EE 6 Bytes JMP 70BD000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!CopyFileW 7C82F87B 6 Bytes JMP 70BA000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!OpenProcess 7C8309E9 6 Bytes JMP 704D000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!DeleteFileA 7C831EDD 6 Bytes JMP 706E000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!DeleteFileW 7C831F63 6 Bytes JMP 706B000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!CreateDirectoryW 7C832402 6 Bytes JMP 709F000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!MoveFileExW 7C83568B 6 Bytes JMP 7050000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!MoveFileA 7C835EBF 6 Bytes JMP 7059000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!DebugActiveProcess 7C85B0FB 6 Bytes JMP 7135000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!MoveFileExA 7C85E49B 6 Bytes JMP 7053000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!CopyFileExA 7C85F39C 6 Bytes JMP 70B7000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!WinExec 7C86250D 6 Bytes JMP 7141000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!SetThreadContext 7C863C09 6 Bytes JMP 7099000A .text C:\WINDOWS\System32\svchost.exe[1896] kernel32.dll!CreateToolhelp32Snapshot 7C865C7F 6 Bytes JMP 70DB000A .text C:\WINDOWS\System32\svchost.exe[1896] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 6 Bytes JMP 70F6000A .text C:\WINDOWS\System32\svchost.exe[1896] ADVAPI32.dll!RegQueryValueExW 77DD6FFF 6 Bytes JMP 70E4000A .text C:\WINDOWS\System32\svchost.exe[1896] ADVAPI32.dll!RegCreateKeyExW 77DD776C 6 Bytes JMP 7108000A .text C:\WINDOWS\System32\svchost.exe[1896] ADVAPI32.dll!RegOpenKeyExA 77DD7852 6 Bytes JMP 70F9000A .text C:\WINDOWS\System32\svchost.exe[1896] ADVAPI32.dll!RegOpenKeyW 77DD7946 6 Bytes JMP 70FC000A .text C:\WINDOWS\System32\svchost.exe[1896] ADVAPI32.dll!OpenProcessToken 77DD798B 6 Bytes JMP 7096000A .text C:\WINDOWS\System32\svchost.exe[1896] ADVAPI32.dll!RegQueryValueExA 77DD7ABB 6 Bytes JMP 70E7000A .text C:\WINDOWS\System32\svchost.exe[1896] ADVAPI32.dll!RegSetValueExW 77DDD767 6 Bytes JMP 70F0000A .text C:\WINDOWS\System32\svchost.exe[1896] ADVAPI32.dll!RegQueryValueW 77DDD87A 6 Bytes JMP 70EA000A .text C:\WINDOWS\System32\svchost.exe[1896] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 6 Bytes JMP 710B000A .text C:\WINDOWS\System32\svchost.exe[1896] ADVAPI32.dll!RegSetValueExA 77DDEAE7 6 Bytes JMP 70F3000A .text C:\WINDOWS\System32\svchost.exe[1896] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 6 Bytes JMP 70FF000A .text C:\WINDOWS\System32\svchost.exe[1896] ADVAPI32.dll!AdjustTokenPrivileges 77DDF00C 6 Bytes JMP 708D000A .text C:\WINDOWS\System32\svchost.exe[1896] ADVAPI32.dll!RegDeleteKeyA 77DE42A0 6 Bytes JMP 7068000A .text C:\WINDOWS\System32\svchost.exe[1896] ADVAPI32.dll!RegDeleteKeyW 77DE559B 6 Bytes JMP 7065000A .text C:\WINDOWS\System32\svchost.exe[1896] ADVAPI32.dll!OpenSCManagerW 77DE6F55 6 Bytes JMP 70CC000A .text C:\WINDOWS\System32\svchost.exe[1896] ADVAPI32.dll!OpenSCManagerA 77DF69AE 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\svchost.exe[1896] ADVAPI32.dll!OpenSCManagerA + 4 77DF69B2 2 Bytes [CE, 70] .text C:\WINDOWS\System32\svchost.exe[1896] ADVAPI32.dll!LookupPrivilegeValueW 77DFB8DF 6 Bytes JMP 7090000A .text C:\WINDOWS\System32\svchost.exe[1896] ADVAPI32.dll!RegCreateKeyW 77DFBA55 6 Bytes JMP 7102000A .text C:\WINDOWS\System32\svchost.exe[1896] ADVAPI32.dll!RegQueryValueA 77DFBB8D 4 Bytes JMP EC001E25 .text C:\WINDOWS\System32\svchost.exe[1896] ADVAPI32.dll!RegQueryValueA + 5 77DFBB92 1 Byte [70] .text C:\WINDOWS\System32\svchost.exe[1896] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 6 Bytes JMP 7105000A .text C:\WINDOWS\System32\svchost.exe[1896] ADVAPI32.dll!LookupPrivilegeValueA 77DFC238 6 Bytes JMP 7093000A .text C:\WINDOWS\System32\svchost.exe[1896] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 7168000A .text C:\WINDOWS\System32\svchost.exe[1896] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 7120000A .text C:\WINDOWS\System32\svchost.exe[1896] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 711D000A .text C:\WINDOWS\System32\svchost.exe[1896] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 7156000A .text C:\WINDOWS\System32\svchost.exe[1896] USER32.dll!SetWindowTextW 7E42960E 6 Bytes JMP 705F000A .text C:\WINDOWS\System32\svchost.exe[1896] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 7132000A .text C:\WINDOWS\System32\svchost.exe[1896] USER32.dll!GetWindowTextW 7E42A5CD 6 Bytes JMP 70C6000A .text C:\WINDOWS\System32\svchost.exe[1896] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 712F000A .text C:\WINDOWS\System32\svchost.exe[1896] USER32.dll!ShowWindow 7E42AF56 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\svchost.exe[1896] USER32.dll!ShowWindow + 4 7E42AF5A 2 Bytes [C2, 70] .text C:\WINDOWS\System32\svchost.exe[1896] USER32.dll!CreateWindowExW 7E42D0A3 6 Bytes JMP 7071000A .text C:\WINDOWS\System32\svchost.exe[1896] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\svchost.exe[1896] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [2B, 71] .text C:\WINDOWS\System32\svchost.exe[1896] USER32.dll!DrawTextW 7E42D7E2 6 Bytes JMP 7077000A .text C:\WINDOWS\System32\svchost.exe[1896] USER32.dll!CreateWindowExA 7E42E4A9 6 Bytes JMP 7074000A .text C:\WINDOWS\System32\svchost.exe[1896] USER32.dll!SetWindowTextA 7E42F56B 6 Bytes JMP 7062000A .text C:\WINDOWS\System32\svchost.exe[1896] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 7159000A .text C:\WINDOWS\System32\svchost.exe[1896] USER32.dll!SetWinEventHook 7E4317F7 6 Bytes JMP 711A000A .text C:\WINDOWS\System32\svchost.exe[1896] USER32.dll!GetWindowTextA 7E43216B 6 Bytes JMP 70C9000A .text C:\WINDOWS\System32\svchost.exe[1896] USER32.dll!DrawTextA 7E43C702 6 Bytes JMP 707A000A .text C:\WINDOWS\System32\svchost.exe[1896] USER32.dll!DdeConnect 7E4581C3 6 Bytes JMP 7129000A .text C:\WINDOWS\System32\svchost.exe[1896] USER32.dll!EndTask 7E45A0A5 6 Bytes JMP 713E000A .text C:\WINDOWS\System32\svchost.exe[1896] USER32.dll!RegisterRawInputDevices 7E46CE0E 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\svchost.exe[1896] USER32.dll!RegisterRawInputDevices + 4 7E46CE12 2 Bytes [16, 71] .text C:\WINDOWS\System32\svchost.exe[1896] SHELL32.dll!ShellExecuteExW 7CA098CB 6 Bytes JMP 7144000A .text C:\WINDOWS\System32\svchost.exe[1896] SHELL32.dll!Shell_NotifyIcon 7CA28BC6 6 Bytes JMP 70B1000A .text C:\WINDOWS\System32\svchost.exe[1896] SHELL32.dll!Shell_NotifyIconW 7CA2A537 6 Bytes JMP 70AE000A .text C:\WINDOWS\System32\svchost.exe[1896] SHELL32.dll!ShellExecuteEx 7CA40E45 6 Bytes JMP 7147000A .text C:\WINDOWS\System32\svchost.exe[1896] SHELL32.dll!ShellExecuteA 7CA41170 6 Bytes JMP 714D000A .text C:\WINDOWS\System32\svchost.exe[1896] SHELL32.dll!ShellExecuteW 7CAB5D48 6 Bytes JMP 714A000A .text C:\WINDOWS\System32\svchost.exe[1896] WININET.dll!InternetOpenUrlA 3D95F3BC 6 Bytes JMP 70A8000A .text C:\WINDOWS\System32\svchost.exe[1896] WININET.dll!InternetOpenUrlW 3D9A6DFF 6 Bytes JMP 70A5000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] ntdll.dll!NtLoadDriver 7C90D46E 3 Bytes [FF, 25, 1E] .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] ntdll.dll!NtLoadDriver + 4 7C90D472 2 Bytes [22, 71] .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] ntdll.dll!NtSuspendProcess 7C90DE2E 3 Bytes [FF, 25, 1E] .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] ntdll.dll!NtSuspendProcess + 4 7C90DE32 2 Bytes [3A, 71] .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!DeviceIoControl 7C801629 6 Bytes JMP 70AB000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!CreateFileA 7C801A28 6 Bytes JMP 70DE000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!VirtualProtectEx 7C801A61 6 Bytes JMP 7126000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!VirtualProtect 7C801AD4 6 Bytes JMP 70D2000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!LoadLibraryExW 7C801AF5 6 Bytes JMP 716B000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!LoadLibraryA 7C801D7B 6 Bytes JMP 715F000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 7165000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 7162000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 7150000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 7153000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!VirtualAlloc 7C809AF1 6 Bytes JMP 70D5000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!MultiByteToWideChar 7C809C98 6 Bytes JMP 7084000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!LoadResource 7C80A055 6 Bytes JMP 70C0000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!WideCharToMultiByte 7C80A174 6 Bytes JMP 7063000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!GetProcAddress 7C80AE40 6 Bytes JMP 7114000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!LoadLibraryW 7C80AEEB 6 Bytes JMP 715C000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!CreateMutexW 7C80E957 6 Bytes JMP 708D000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!CreateMutexA 7C80E9DF 6 Bytes JMP 7090000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!OpenMutexW 7C80EA35 6 Bytes JMP 7087000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!OpenMutexA 7C80EABB 6 Bytes JMP 708A000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!GetVolumeInformationW 7C80FA85 6 Bytes JMP 710E000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E] .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [6D, 71] .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!CreateThread 7C8106D7 6 Bytes JMP 70D8000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!CreateFileW 7C810800 6 Bytes JMP 70E1000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!WriteFile 7C810E27 6 Bytes JMP 70A2000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!TerminateThread 7C81CB3B 6 Bytes JMP 7138000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!MoveFileW 7C821261 6 Bytes JMP 705D000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!CreateDirectoryA 7C8217AC 6 Bytes JMP 70A8000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!GetVolumeInformationA 7C821BA5 6 Bytes JMP 7111000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 70B4000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!CopyFileA 7C8286EE 6 Bytes JMP 70BD000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!CopyFileW 7C82F87B 6 Bytes JMP 70BA000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!OpenProcess 7C8309E9 6 Bytes JMP 7054000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!DeleteFileA 7C831EDD 6 Bytes JMP 7075000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!DeleteFileW 7C831F63 6 Bytes JMP 7072000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!CreateDirectoryW 7C832402 6 Bytes JMP 70A5000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!MoveFileExW 7C83568B 6 Bytes JMP 7057000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!MoveFileA 7C835EBF 6 Bytes JMP 7060000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!DebugActiveProcess 7C85B0FB 6 Bytes JMP 7135000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!MoveFileExA 7C85E49B 6 Bytes JMP 705A000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!CopyFileExA 7C85F39C 6 Bytes JMP 70B7000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!WinExec 7C86250D 6 Bytes JMP 7141000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!SetThreadContext 7C863C09 6 Bytes JMP 709F000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] kernel32.dll!CreateToolhelp32Snapshot 7C865C7F 6 Bytes JMP 70DB000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 7156000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] USER32.dll!SetWindowTextW 7E42960E 6 Bytes JMP 7066000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 7132000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] USER32.dll!GetWindowTextW 7E42A5CD 6 Bytes JMP 70C6000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 712F000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] USER32.dll!ShowWindow 7E42AF56 3 Bytes [FF, 25, 1E] .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] USER32.dll!ShowWindow + 4 7E42AF5A 2 Bytes [C2, 70] .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] USER32.dll!CreateWindowExW 7E42D0A3 6 Bytes JMP 7078000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E] .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [2B, 71] .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] USER32.dll!DrawTextW 7E42D7E2 6 Bytes JMP 707E000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] USER32.dll!CreateWindowExA 7E42E4A9 6 Bytes JMP 707B000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] USER32.dll!SetWindowTextA 7E42F56B 6 Bytes JMP 7069000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 7159000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] USER32.dll!SetWinEventHook 7E4317F7 6 Bytes JMP 711A000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] USER32.dll!GetWindowTextA 7E43216B 6 Bytes JMP 70C9000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] USER32.dll!DrawTextA 7E43C702 6 Bytes JMP 7081000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] USER32.dll!DdeConnect 7E4581C3 6 Bytes JMP 7129000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] USER32.dll!EndTask 7E45A0A5 6 Bytes JMP 713E000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] USER32.dll!RegisterRawInputDevices 7E46CE0E 3 Bytes [FF, 25, 1E] .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] USER32.dll!RegisterRawInputDevices + 4 7E46CE12 2 Bytes [16, 71] .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 6 Bytes JMP 70F6000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] ADVAPI32.dll!RegQueryValueExW 77DD6FFF 6 Bytes JMP 70E4000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] ADVAPI32.dll!RegCreateKeyExW 77DD776C 6 Bytes JMP 7108000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] ADVAPI32.dll!RegOpenKeyExA 77DD7852 6 Bytes JMP 70F9000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] ADVAPI32.dll!RegOpenKeyW 77DD7946 6 Bytes JMP 70FC000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] ADVAPI32.dll!OpenProcessToken 77DD798B 6 Bytes JMP 709C000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] ADVAPI32.dll!RegQueryValueExA 77DD7ABB 6 Bytes JMP 70E7000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] ADVAPI32.dll!RegSetValueExW 77DDD767 6 Bytes JMP 70F0000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] ADVAPI32.dll!RegQueryValueW 77DDD87A 6 Bytes JMP 70EA000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 6 Bytes JMP 710B000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] ADVAPI32.dll!RegSetValueExA 77DDEAE7 6 Bytes JMP 70F3000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 6 Bytes JMP 70FF000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] ADVAPI32.dll!AdjustTokenPrivileges 77DDF00C 6 Bytes JMP 7093000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] ADVAPI32.dll!RegDeleteKeyA 77DE42A0 6 Bytes JMP 706F000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] ADVAPI32.dll!RegDeleteKeyW 77DE559B 6 Bytes JMP 706C000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] ADVAPI32.dll!OpenSCManagerW 77DE6F55 6 Bytes JMP 70CC000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] ADVAPI32.dll!OpenSCManagerA 77DF69AE 3 Bytes [FF, 25, 1E] .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] ADVAPI32.dll!OpenSCManagerA + 4 77DF69B2 2 Bytes [CE, 70] .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] ADVAPI32.dll!LookupPrivilegeValueW 77DFB8DF 6 Bytes JMP 7096000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] ADVAPI32.dll!RegCreateKeyW 77DFBA55 6 Bytes JMP 7102000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] ADVAPI32.dll!RegQueryValueA 77DFBB8D 4 Bytes JMP EC001E25 .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] ADVAPI32.dll!RegQueryValueA + 5 77DFBB92 1 Byte [70] .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 6 Bytes JMP 7105000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] ADVAPI32.dll!LookupPrivilegeValueA 77DFC238 6 Bytes JMP 7099000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 7168000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 7120000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 711D000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] SHELL32.dll!ShellExecuteExW 7CA098CB 6 Bytes JMP 7144000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] SHELL32.dll!Shell_NotifyIcon 7CA28BC6 6 Bytes JMP 70B1000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] SHELL32.dll!Shell_NotifyIconW 7CA2A537 6 Bytes JMP 70AE000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] SHELL32.dll!ShellExecuteEx 7CA40E45 6 Bytes JMP 7147000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] SHELL32.dll!ShellExecuteA 7CA41170 6 Bytes JMP 714D000A .text C:\PROGRA~1\Iomega\System32\AppServices.exe[1936] SHELL32.dll!ShellExecuteW 7CAB5D48 6 Bytes JMP 714A000A .text C:\WINDOWS\System32\svchost.exe[1952] ntdll.dll!NtLoadDriver 7C90D46E 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\svchost.exe[1952] ntdll.dll!NtLoadDriver + 4 7C90D472 2 Bytes [22, 71] .text C:\WINDOWS\System32\svchost.exe[1952] ntdll.dll!NtSuspendProcess 7C90DE2E 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\svchost.exe[1952] ntdll.dll!NtSuspendProcess + 4 7C90DE32 2 Bytes [3A, 71] .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!DeviceIoControl 7C801629 6 Bytes JMP 70AB000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!CreateFileA 7C801A28 6 Bytes JMP 70DE000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!VirtualProtectEx 7C801A61 6 Bytes JMP 7126000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!VirtualProtect 7C801AD4 6 Bytes JMP 70D2000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!LoadLibraryExW 7C801AF5 6 Bytes JMP 716B000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!LoadLibraryA 7C801D7B 6 Bytes JMP 715F000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 7165000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 7162000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 7150000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 7153000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!VirtualAlloc 7C809AF1 6 Bytes JMP 70D5000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!MultiByteToWideChar 7C809C98 6 Bytes JMP 7084000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!LoadResource 7C80A055 6 Bytes JMP 70C0000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!WideCharToMultiByte 7C80A174 6 Bytes JMP 7063000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!GetProcAddress 7C80AE40 6 Bytes JMP 7114000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!LoadLibraryW 7C80AEEB 6 Bytes JMP 715C000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!CreateMutexW 7C80E957 6 Bytes JMP 708D000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!CreateMutexA 7C80E9DF 6 Bytes JMP 7090000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!OpenMutexW 7C80EA35 6 Bytes JMP 7087000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!OpenMutexA 7C80EABB 6 Bytes JMP 708A000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!GetVolumeInformationW 7C80FA85 6 Bytes JMP 710E000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [6D, 71] .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!CreateThread 7C8106D7 6 Bytes JMP 70D8000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!CreateFileW 7C810800 6 Bytes JMP 70E1000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!WriteFile 7C810E27 6 Bytes JMP 70A2000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!TerminateThread 7C81CB3B 6 Bytes JMP 7138000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!MoveFileW 7C821261 6 Bytes JMP 705D000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!CreateDirectoryA 7C8217AC 6 Bytes JMP 70A8000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!GetVolumeInformationA 7C821BA5 6 Bytes JMP 7111000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 70B4000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!CopyFileA 7C8286EE 6 Bytes JMP 70BD000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!CopyFileW 7C82F87B 6 Bytes JMP 70BA000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!OpenProcess 7C8309E9 6 Bytes JMP 7054000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!DeleteFileA 7C831EDD 6 Bytes JMP 7075000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!DeleteFileW 7C831F63 6 Bytes JMP 7072000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!CreateDirectoryW 7C832402 6 Bytes JMP 70A5000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!MoveFileExW 7C83568B 6 Bytes JMP 7057000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!MoveFileA 7C835EBF 6 Bytes JMP 7060000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!DebugActiveProcess 7C85B0FB 6 Bytes JMP 7135000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!MoveFileExA 7C85E49B 6 Bytes JMP 705A000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!CopyFileExA 7C85F39C 6 Bytes JMP 70B7000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!WinExec 7C86250D 6 Bytes JMP 7141000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!SetThreadContext 7C863C09 6 Bytes JMP 709F000A .text C:\WINDOWS\System32\svchost.exe[1952] kernel32.dll!CreateToolhelp32Snapshot 7C865C7F 6 Bytes JMP 70DB000A .text C:\WINDOWS\System32\svchost.exe[1952] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 6 Bytes JMP 70F6000A .text C:\WINDOWS\System32\svchost.exe[1952] ADVAPI32.dll!RegQueryValueExW 77DD6FFF 6 Bytes JMP 70E4000A .text C:\WINDOWS\System32\svchost.exe[1952] ADVAPI32.dll!RegCreateKeyExW 77DD776C 6 Bytes JMP 7108000A .text C:\WINDOWS\System32\svchost.exe[1952] ADVAPI32.dll!RegOpenKeyExA 77DD7852 6 Bytes JMP 70F9000A .text C:\WINDOWS\System32\svchost.exe[1952] ADVAPI32.dll!RegOpenKeyW 77DD7946 6 Bytes JMP 70FC000A .text C:\WINDOWS\System32\svchost.exe[1952] ADVAPI32.dll!OpenProcessToken 77DD798B 6 Bytes JMP 709C000A .text C:\WINDOWS\System32\svchost.exe[1952] ADVAPI32.dll!RegQueryValueExA 77DD7ABB 6 Bytes JMP 70E7000A .text C:\WINDOWS\System32\svchost.exe[1952] ADVAPI32.dll!RegSetValueExW 77DDD767 6 Bytes JMP 70F0000A .text C:\WINDOWS\System32\svchost.exe[1952] ADVAPI32.dll!RegQueryValueW 77DDD87A 6 Bytes JMP 70EA000A .text C:\WINDOWS\System32\svchost.exe[1952] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 6 Bytes JMP 710B000A .text C:\WINDOWS\System32\svchost.exe[1952] ADVAPI32.dll!RegSetValueExA 77DDEAE7 6 Bytes JMP 70F3000A .text C:\WINDOWS\System32\svchost.exe[1952] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 6 Bytes JMP 70FF000A .text C:\WINDOWS\System32\svchost.exe[1952] ADVAPI32.dll!AdjustTokenPrivileges 77DDF00C 6 Bytes JMP 7093000A .text C:\WINDOWS\System32\svchost.exe[1952] ADVAPI32.dll!RegDeleteKeyA 77DE42A0 6 Bytes JMP 706F000A .text C:\WINDOWS\System32\svchost.exe[1952] ADVAPI32.dll!RegDeleteKeyW 77DE559B 6 Bytes JMP 706C000A .text C:\WINDOWS\System32\svchost.exe[1952] ADVAPI32.dll!OpenSCManagerW 77DE6F55 6 Bytes JMP 70CC000A .text C:\WINDOWS\System32\svchost.exe[1952] ADVAPI32.dll!OpenSCManagerA 77DF69AE 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\svchost.exe[1952] ADVAPI32.dll!OpenSCManagerA + 4 77DF69B2 2 Bytes [CE, 70] .text C:\WINDOWS\System32\svchost.exe[1952] ADVAPI32.dll!LookupPrivilegeValueW 77DFB8DF 6 Bytes JMP 7096000A .text C:\WINDOWS\System32\svchost.exe[1952] ADVAPI32.dll!RegCreateKeyW 77DFBA55 6 Bytes JMP 7102000A .text C:\WINDOWS\System32\svchost.exe[1952] ADVAPI32.dll!RegQueryValueA 77DFBB8D 4 Bytes JMP EC001E25 .text C:\WINDOWS\System32\svchost.exe[1952] ADVAPI32.dll!RegQueryValueA + 5 77DFBB92 1 Byte [70] .text C:\WINDOWS\System32\svchost.exe[1952] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 6 Bytes JMP 7105000A .text C:\WINDOWS\System32\svchost.exe[1952] ADVAPI32.dll!LookupPrivilegeValueA 77DFC238 6 Bytes JMP 7099000A .text C:\WINDOWS\System32\svchost.exe[1952] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 7168000A .text C:\WINDOWS\System32\svchost.exe[1952] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 7120000A .text C:\WINDOWS\System32\svchost.exe[1952] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 711D000A .text C:\WINDOWS\System32\svchost.exe[1952] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 7156000A .text C:\WINDOWS\System32\svchost.exe[1952] USER32.dll!SetWindowTextW 7E42960E 6 Bytes JMP 7066000A .text C:\WINDOWS\System32\svchost.exe[1952] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 7132000A .text C:\WINDOWS\System32\svchost.exe[1952] USER32.dll!GetWindowTextW 7E42A5CD 6 Bytes JMP 70C6000A .text C:\WINDOWS\System32\svchost.exe[1952] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 712F000A .text C:\WINDOWS\System32\svchost.exe[1952] USER32.dll!ShowWindow 7E42AF56 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\svchost.exe[1952] USER32.dll!ShowWindow + 4 7E42AF5A 2 Bytes [C2, 70] .text C:\WINDOWS\System32\svchost.exe[1952] USER32.dll!CreateWindowExW 7E42D0A3 6 Bytes JMP 7078000A .text C:\WINDOWS\System32\svchost.exe[1952] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\svchost.exe[1952] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [2B, 71] .text C:\WINDOWS\System32\svchost.exe[1952] USER32.dll!DrawTextW 7E42D7E2 6 Bytes JMP 707E000A .text C:\WINDOWS\System32\svchost.exe[1952] USER32.dll!CreateWindowExA 7E42E4A9 6 Bytes JMP 707B000A .text C:\WINDOWS\System32\svchost.exe[1952] USER32.dll!SetWindowTextA 7E42F56B 6 Bytes JMP 7069000A .text C:\WINDOWS\System32\svchost.exe[1952] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 7159000A .text C:\WINDOWS\System32\svchost.exe[1952] USER32.dll!SetWinEventHook 7E4317F7 6 Bytes JMP 711A000A .text C:\WINDOWS\System32\svchost.exe[1952] USER32.dll!GetWindowTextA 7E43216B 6 Bytes JMP 70C9000A .text C:\WINDOWS\System32\svchost.exe[1952] USER32.dll!DrawTextA 7E43C702 6 Bytes JMP 7081000A .text C:\WINDOWS\System32\svchost.exe[1952] USER32.dll!DdeConnect 7E4581C3 6 Bytes JMP 7129000A .text C:\WINDOWS\System32\svchost.exe[1952] USER32.dll!EndTask 7E45A0A5 6 Bytes JMP 713E000A .text C:\WINDOWS\System32\svchost.exe[1952] USER32.dll!RegisterRawInputDevices 7E46CE0E 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\svchost.exe[1952] USER32.dll!RegisterRawInputDevices + 4 7E46CE12 2 Bytes [16, 71] .text C:\WINDOWS\System32\svchost.exe[1952] SHELL32.dll!ShellExecuteExW 7CA098CB 6 Bytes JMP 7144000A .text C:\WINDOWS\System32\svchost.exe[1952] SHELL32.dll!Shell_NotifyIcon 7CA28BC6 6 Bytes JMP 70B1000A .text C:\WINDOWS\System32\svchost.exe[1952] SHELL32.dll!Shell_NotifyIconW 7CA2A537 6 Bytes JMP 70AE000A .text C:\WINDOWS\System32\svchost.exe[1952] SHELL32.dll!ShellExecuteEx 7CA40E45 6 Bytes JMP 7147000A .text C:\WINDOWS\System32\svchost.exe[1952] SHELL32.dll!ShellExecuteA 7CA41170 6 Bytes JMP 714D000A .text C:\WINDOWS\System32\svchost.exe[1952] SHELL32.dll!ShellExecuteW 7CAB5D48 6 Bytes JMP 714A000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] ntdll.dll!NtLoadDriver 7C90D46E 3 Bytes [FF, 25, 1E] .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] ntdll.dll!NtLoadDriver + 4 7C90D472 2 Bytes [22, 71] .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] ntdll.dll!NtSuspendProcess 7C90DE2E 3 Bytes [FF, 25, 1E] .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] ntdll.dll!NtSuspendProcess + 4 7C90DE32 2 Bytes [3A, 71] .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!DeviceIoControl 7C801629 6 Bytes JMP 70AB000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!CreateFileA 7C801A28 6 Bytes JMP 70DE000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!VirtualProtectEx 7C801A61 6 Bytes JMP 7126000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!VirtualProtect 7C801AD4 6 Bytes JMP 70D2000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!LoadLibraryExW 7C801AF5 6 Bytes JMP 716B000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!LoadLibraryA 7C801D7B 6 Bytes JMP 715F000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 7165000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 7162000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 7150000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 7153000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!VirtualAlloc 7C809AF1 6 Bytes JMP 70D5000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!MultiByteToWideChar 7C809C98 6 Bytes JMP 7084000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!LoadResource 7C80A055 6 Bytes JMP 70C0000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!WideCharToMultiByte 7C80A174 6 Bytes JMP 7063000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!GetProcAddress 7C80AE40 6 Bytes JMP 7114000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!LoadLibraryW 7C80AEEB 6 Bytes JMP 715C000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!CreateMutexW 7C80E957 6 Bytes JMP 708D000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!CreateMutexA 7C80E9DF 6 Bytes JMP 7090000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!OpenMutexW 7C80EA35 6 Bytes JMP 7087000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!OpenMutexA 7C80EABB 6 Bytes JMP 708A000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!GetVolumeInformationW 7C80FA85 6 Bytes JMP 710E000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E] .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [6D, 71] .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!CreateThread 7C8106D7 6 Bytes JMP 70D8000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!CreateFileW 7C810800 6 Bytes JMP 70E1000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!WriteFile 7C810E27 6 Bytes JMP 70A2000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!TerminateThread 7C81CB3B 6 Bytes JMP 7138000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!MoveFileW 7C821261 6 Bytes JMP 705D000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!CreateDirectoryA 7C8217AC 6 Bytes JMP 70A8000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!GetVolumeInformationA 7C821BA5 6 Bytes JMP 7111000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 70B4000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!CopyFileA 7C8286EE 6 Bytes JMP 70BD000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!CopyFileW 7C82F87B 6 Bytes JMP 70BA000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!OpenProcess 7C8309E9 6 Bytes JMP 7054000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!DeleteFileA 7C831EDD 6 Bytes JMP 7075000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!DeleteFileW 7C831F63 6 Bytes JMP 7072000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!CreateDirectoryW 7C832402 6 Bytes JMP 70A5000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!MoveFileExW 7C83568B 6 Bytes JMP 7057000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!MoveFileA 7C835EBF 6 Bytes JMP 7060000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!DebugActiveProcess 7C85B0FB 6 Bytes JMP 7135000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!MoveFileExA 7C85E49B 6 Bytes JMP 705A000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!CopyFileExA 7C85F39C 6 Bytes JMP 70B7000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!WinExec 7C86250D 6 Bytes JMP 7141000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!SetThreadContext 7C863C09 6 Bytes JMP 709F000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] kernel32.dll!CreateToolhelp32Snapshot 7C865C7F 6 Bytes JMP 70DB000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 6 Bytes JMP 70F6000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] ADVAPI32.dll!RegQueryValueExW 77DD6FFF 6 Bytes JMP 70E4000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] ADVAPI32.dll!RegCreateKeyExW 77DD776C 6 Bytes JMP 7108000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] ADVAPI32.dll!RegOpenKeyExA 77DD7852 6 Bytes JMP 70F9000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] ADVAPI32.dll!RegOpenKeyW 77DD7946 6 Bytes JMP 70FC000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] ADVAPI32.dll!OpenProcessToken 77DD798B 6 Bytes JMP 709C000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] ADVAPI32.dll!RegQueryValueExA 77DD7ABB 6 Bytes JMP 70E7000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] ADVAPI32.dll!RegSetValueExW 77DDD767 6 Bytes JMP 70F0000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] ADVAPI32.dll!RegQueryValueW 77DDD87A 6 Bytes JMP 70EA000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 6 Bytes JMP 710B000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] ADVAPI32.dll!RegSetValueExA 77DDEAE7 6 Bytes JMP 70F3000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 6 Bytes JMP 70FF000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] ADVAPI32.dll!AdjustTokenPrivileges 77DDF00C 6 Bytes JMP 7093000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] ADVAPI32.dll!RegDeleteKeyA 77DE42A0 6 Bytes JMP 706F000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] ADVAPI32.dll!RegDeleteKeyW 77DE559B 6 Bytes JMP 706C000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] ADVAPI32.dll!OpenSCManagerW 77DE6F55 6 Bytes JMP 70CC000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] ADVAPI32.dll!OpenSCManagerA 77DF69AE 3 Bytes [FF, 25, 1E] .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] ADVAPI32.dll!OpenSCManagerA + 4 77DF69B2 2 Bytes [CE, 70] .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] ADVAPI32.dll!LookupPrivilegeValueW 77DFB8DF 6 Bytes JMP 7096000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] ADVAPI32.dll!RegCreateKeyW 77DFBA55 6 Bytes JMP 7102000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] ADVAPI32.dll!RegQueryValueA 77DFBB8D 4 Bytes JMP EC001E25 .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] ADVAPI32.dll!RegQueryValueA + 5 77DFBB92 1 Byte [70] .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 6 Bytes JMP 7105000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] ADVAPI32.dll!LookupPrivilegeValueA 77DFC238 6 Bytes JMP 7099000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 7168000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 7120000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] ADVAPI32.dll!CreateServiceW

J, GMER scan continued,post # 3: 77E373A9 6 Bytes JMP 711D000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 7156000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] USER32.dll!SetWindowTextW 7E42960E 6 Bytes JMP 7066000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 7132000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] USER32.dll!GetWindowTextW 7E42A5CD 6 Bytes JMP 70C6000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 712F000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] USER32.dll!ShowWindow 7E42AF56 3 Bytes [FF, 25, 1E] .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] USER32.dll!ShowWindow + 4 7E42AF5A 2 Bytes [C2, 70] .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] USER32.dll!CreateWindowExW 7E42D0A3 6 Bytes JMP 7078000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E] .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [2B, 71] .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] USER32.dll!DrawTextW 7E42D7E2 6 Bytes JMP 707E000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] USER32.dll!CreateWindowExA 7E42E4A9 6 Bytes JMP 707B000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] USER32.dll!SetWindowTextA 7E42F56B 6 Bytes JMP 7069000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 7159000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] USER32.dll!SetWinEventHook 7E4317F7 6 Bytes JMP 711A000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] USER32.dll!GetWindowTextA 7E43216B 6 Bytes JMP 70C9000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] USER32.dll!DrawTextA 7E43C702 6 Bytes JMP 7081000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] USER32.dll!DdeConnect 7E4581C3 6 Bytes JMP 7129000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] USER32.dll!EndTask 7E45A0A5 6 Bytes JMP 713E000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] USER32.dll!RegisterRawInputDevices 7E46CE0E 3 Bytes [FF, 25, 1E] .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] USER32.dll!RegisterRawInputDevices + 4 7E46CE12 2 Bytes [16, 71] .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] SHELL32.dll!ShellExecuteExW 7CA098CB 6 Bytes JMP 7144000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] SHELL32.dll!Shell_NotifyIcon 7CA28BC6 6 Bytes JMP 70B1000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] SHELL32.dll!Shell_NotifyIconW 7CA2A537 6 Bytes JMP 70AE000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] SHELL32.dll!ShellExecuteEx 7CA40E45 6 Bytes JMP 7147000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] SHELL32.dll!ShellExecuteA 7CA41170 6 Bytes JMP 714D000A .text C:\Program Files\AVG\AVG9\avgchsvx.exe[2004] SHELL32.dll!ShellExecuteW 7CAB5D48 6 Bytes JMP 714A000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] ntdll.dll!NtLoadDriver 7C90D46E 3 Bytes [FF, 25, 1E] .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] ntdll.dll!NtLoadDriver + 4 7C90D472 2 Bytes [22, 71] .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] ntdll.dll!NtSuspendProcess 7C90DE2E 3 Bytes [FF, 25, 1E] .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] ntdll.dll!NtSuspendProcess + 4 7C90DE32 2 Bytes [3A, 71] .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!DeviceIoControl 7C801629 6 Bytes JMP 70AB000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!CreateFileA 7C801A28 6 Bytes JMP 70DE000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!VirtualProtectEx 7C801A61 6 Bytes JMP 7126000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!VirtualProtect 7C801AD4 6 Bytes JMP 70D2000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!LoadLibraryExW 7C801AF5 6 Bytes JMP 716B000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!LoadLibraryA 7C801D7B 6 Bytes JMP 715F000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 7165000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 7162000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 7150000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 7153000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!VirtualAlloc 7C809AF1 6 Bytes JMP 70D5000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!MultiByteToWideChar 7C809C98 6 Bytes JMP 7084000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!LoadResource 7C80A055 6 Bytes JMP 70C0000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!WideCharToMultiByte 7C80A174 6 Bytes JMP 7063000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!GetProcAddress 7C80AE40 6 Bytes JMP 7114000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!LoadLibraryW 7C80AEEB 6 Bytes JMP 715C000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!CreateMutexW 7C80E957 6 Bytes JMP 708D000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!CreateMutexA 7C80E9DF 6 Bytes JMP 7090000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!OpenMutexW 7C80EA35 6 Bytes JMP 7087000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!OpenMutexA 7C80EABB 6 Bytes JMP 708A000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!GetVolumeInformationW 7C80FA85 6 Bytes JMP 710E000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E] .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [6D, 71] .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!CreateThread 7C8106D7 6 Bytes JMP 70D8000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!CreateFileW 7C810800 6 Bytes JMP 70E1000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!WriteFile 7C810E27 6 Bytes JMP 70A2000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!TerminateThread 7C81CB3B 6 Bytes JMP 7138000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!MoveFileW 7C821261 6 Bytes JMP 705D000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!CreateDirectoryA 7C8217AC 6 Bytes JMP 70A8000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!GetVolumeInformationA 7C821BA5 6 Bytes JMP 7111000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 70B4000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!CopyFileA 7C8286EE 6 Bytes JMP 70BD000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!CopyFileW 7C82F87B 6 Bytes JMP 70BA000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!OpenProcess 7C8309E9 6 Bytes JMP 7054000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!DeleteFileA 7C831EDD 6 Bytes JMP 7075000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!DeleteFileW 7C831F63 6 Bytes JMP 7072000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!CreateDirectoryW 7C832402 6 Bytes JMP 70A5000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!MoveFileExW 7C83568B 6 Bytes JMP 7057000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!MoveFileA 7C835EBF 6 Bytes JMP 7060000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!DebugActiveProcess 7C85B0FB 6 Bytes JMP 7135000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!MoveFileExA 7C85E49B 6 Bytes JMP 705A000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!CopyFileExA 7C85F39C 6 Bytes JMP 70B7000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!WinExec 7C86250D 6 Bytes JMP 7141000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!SetThreadContext 7C863C09 6 Bytes JMP 709F000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] kernel32.dll!CreateToolhelp32Snapshot 7C865C7F 6 Bytes JMP 70DB000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 6 Bytes JMP 70F6000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] ADVAPI32.dll!RegQueryValueExW 77DD6FFF 6 Bytes JMP 70E4000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] ADVAPI32.dll!RegCreateKeyExW 77DD776C 6 Bytes JMP 7108000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] ADVAPI32.dll!RegOpenKeyExA 77DD7852 6 Bytes JMP 70F9000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] ADVAPI32.dll!RegOpenKeyW 77DD7946 6 Bytes JMP 70FC000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] ADVAPI32.dll!OpenProcessToken 77DD798B 6 Bytes JMP 709C000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] ADVAPI32.dll!RegQueryValueExA 77DD7ABB 6 Bytes JMP 70E7000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] ADVAPI32.dll!RegSetValueExW 77DDD767 6 Bytes JMP 70F0000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] ADVAPI32.dll!RegQueryValueW 77DDD87A 6 Bytes JMP 70EA000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 6 Bytes JMP 710B000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] ADVAPI32.dll!RegSetValueExA 77DDEAE7 6 Bytes JMP 70F3000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 6 Bytes JMP 70FF000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] ADVAPI32.dll!AdjustTokenPrivileges 77DDF00C 6 Bytes JMP 7093000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] ADVAPI32.dll!RegDeleteKeyA 77DE42A0 6 Bytes JMP 706F000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] ADVAPI32.dll!RegDeleteKeyW 77DE559B 6 Bytes JMP 706C000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] ADVAPI32.dll!OpenSCManagerW 77DE6F55 6 Bytes JMP 70CC000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] ADVAPI32.dll!OpenSCManagerA 77DF69AE 3 Bytes [FF, 25, 1E] .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] ADVAPI32.dll!OpenSCManagerA + 4 77DF69B2 2 Bytes [CE, 70] .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] ADVAPI32.dll!LookupPrivilegeValueW 77DFB8DF 6 Bytes JMP 7096000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] ADVAPI32.dll!RegCreateKeyW 77DFBA55 6 Bytes JMP 7102000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] ADVAPI32.dll!RegQueryValueA 77DFBB8D 4 Bytes JMP EC001E25 .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] ADVAPI32.dll!RegQueryValueA + 5 77DFBB92 1 Byte [70] .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 6 Bytes JMP 7105000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] ADVAPI32.dll!LookupPrivilegeValueA 77DFC238 6 Bytes JMP 7099000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 7168000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 7120000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 711D000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 7156000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] USER32.dll!SetWindowTextW 7E42960E 6 Bytes JMP 7066000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 7132000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] USER32.dll!GetWindowTextW 7E42A5CD 6 Bytes JMP 70C6000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 712F000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] USER32.dll!ShowWindow 7E42AF56 3 Bytes [FF, 25, 1E] .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] USER32.dll!ShowWindow + 4 7E42AF5A 2 Bytes [C2, 70] .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] USER32.dll!CreateWindowExW 7E42D0A3 6 Bytes JMP 7078000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E] .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [2B, 71] .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] USER32.dll!DrawTextW 7E42D7E2 6 Bytes JMP 707E000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] USER32.dll!CreateWindowExA 7E42E4A9 6 Bytes JMP 707B000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] USER32.dll!SetWindowTextA 7E42F56B 6 Bytes JMP 7069000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 7159000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] USER32.dll!SetWinEventHook 7E4317F7 6 Bytes JMP 711A000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] USER32.dll!GetWindowTextA 7E43216B 6 Bytes JMP 70C9000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] USER32.dll!DrawTextA 7E43C702 6 Bytes JMP 7081000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] USER32.dll!DdeConnect 7E4581C3 6 Bytes JMP 7129000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] USER32.dll!EndTask 7E45A0A5 6 Bytes JMP 713E000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] USER32.dll!RegisterRawInputDevices 7E46CE0E 3 Bytes [FF, 25, 1E] .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] USER32.dll!RegisterRawInputDevices + 4 7E46CE12 2 Bytes [16, 71] .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] SHELL32.dll!ShellExecuteExW 7CA098CB 6 Bytes JMP 7144000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] SHELL32.dll!Shell_NotifyIcon 7CA28BC6 6 Bytes JMP 70B1000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] SHELL32.dll!Shell_NotifyIconW 7CA2A537 6 Bytes JMP 70AE000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] SHELL32.dll!ShellExecuteEx 7CA40E45 6 Bytes JMP 7147000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] SHELL32.dll!ShellExecuteA 7CA41170 6 Bytes JMP 714D000A .text C:\Program Files\AVG\AVG9\avgrsx.exe[2012] SHELL32.dll!ShellExecuteW 7CAB5D48 6 Bytes JMP 714A000A .text C:\WINDOWS\System32\svchost.exe[2224] ntdll.dll!NtLoadDriver 7C90D46E 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\svchost.exe[2224] ntdll.dll!NtLoadDriver + 4 7C90D472 2 Bytes [23, 71] .text C:\WINDOWS\System32\svchost.exe[2224] ntdll.dll!NtSuspendProcess 7C90DE2E 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\svchost.exe[2224] ntdll.dll!NtSuspendProcess + 4 7C90DE32 2 Bytes [3B, 71] .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!DeviceIoControl 7C801629 6 Bytes JMP 70AC000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!CreateFileA 7C801A28 6 Bytes JMP 70DF000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!VirtualProtectEx 7C801A61 6 Bytes JMP 7127000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!VirtualProtect 7C801AD4 6 Bytes JMP 70D3000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!LoadLibraryExW 7C801AF5 6 Bytes JMP 716C000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!LoadLibraryA 7C801D7B 6 Bytes JMP 7160000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 7166000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 7163000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 7151000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 7154000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!VirtualAlloc 7C809AF1 6 Bytes JMP 70D6000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!MultiByteToWideChar 7C809C98 6 Bytes JMP 7085000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!LoadResource 7C80A055 6 Bytes JMP 70C1000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!WideCharToMultiByte 7C80A174 6 Bytes JMP 7064000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!GetProcAddress 7C80AE40 6 Bytes JMP 7115000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!LoadLibraryW 7C80AEEB 6 Bytes JMP 715D000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!CreateMutexW 7C80E957 6 Bytes JMP 708E000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!CreateMutexA 7C80E9DF 6 Bytes JMP 7091000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!OpenMutexW 7C80EA35 6 Bytes JMP 7088000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!OpenMutexA 7C80EABB 6 Bytes JMP 708B000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!GetVolumeInformationW 7C80FA85 6 Bytes JMP 710F000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [6E, 71] .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!CreateThread 7C8106D7 6 Bytes JMP 70D9000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!CreateFileW 7C810800 6 Bytes JMP 70E2000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!WriteFile 7C810E27 6 Bytes JMP 70A3000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!TerminateThread 7C81CB3B 6 Bytes JMP 7139000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!MoveFileW 7C821261 6 Bytes JMP 705E000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!CreateDirectoryA 7C8217AC 6 Bytes JMP 70A9000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!GetVolumeInformationA 7C821BA5 6 Bytes JMP 7112000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 70B5000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!CopyFileA 7C8286EE 6 Bytes JMP 70BE000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!CopyFileW 7C82F87B 6 Bytes JMP 70BB000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!OpenProcess 7C8309E9 6 Bytes JMP 7055000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!DeleteFileA 7C831EDD 6 Bytes JMP 7076000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!DeleteFileW 7C831F63 6 Bytes JMP 7073000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!CreateDirectoryW 7C832402 6 Bytes JMP 70A6000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!MoveFileExW 7C83568B 6 Bytes JMP 7058000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!MoveFileA 7C835EBF 6 Bytes JMP 7061000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!DebugActiveProcess 7C85B0FB 6 Bytes JMP 7136000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!MoveFileExA 7C85E49B 6 Bytes JMP 705B000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!CopyFileExA 7C85F39C 6 Bytes JMP 70B8000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!WinExec 7C86250D 6 Bytes JMP 7142000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!SetThreadContext 7C863C09 6 Bytes JMP 70A0000A .text C:\WINDOWS\System32\svchost.exe[2224] kernel32.dll!CreateToolhelp32Snapshot 7C865C7F 6 Bytes JMP 70DC000A .text C:\WINDOWS\System32\svchost.exe[2224] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 6 Bytes JMP 70F7000A .text C:\WINDOWS\System32\svchost.exe[2224] ADVAPI32.dll!RegQueryValueExW 77DD6FFF 6 Bytes JMP 70E5000A .text C:\WINDOWS\System32\svchost.exe[2224] ADVAPI32.dll!RegCreateKeyExW 77DD776C 6 Bytes JMP 7109000A .text C:\WINDOWS\System32\svchost.exe[2224] ADVAPI32.dll!RegOpenKeyExA 77DD7852 6 Bytes JMP 70FA000A .text C:\WINDOWS\System32\svchost.exe[2224] ADVAPI32.dll!RegOpenKeyW 77DD7946 6 Bytes JMP 70FD000A .text C:\WINDOWS\System32\svchost.exe[2224] ADVAPI32.dll!OpenProcessToken 77DD798B 6 Bytes JMP 709D000A .text C:\WINDOWS\System32\svchost.exe[2224] ADVAPI32.dll!RegQueryValueExA 77DD7ABB 6 Bytes JMP 70E8000A .text C:\WINDOWS\System32\svchost.exe[2224] ADVAPI32.dll!RegSetValueExW 77DDD767 6 Bytes JMP 70F1000A .text C:\WINDOWS\System32\svchost.exe[2224] ADVAPI32.dll!RegQueryValueW 77DDD87A 6 Bytes JMP 70EB000A .text C:\WINDOWS\System32\svchost.exe[2224] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 6 Bytes JMP 710C000A .text C:\WINDOWS\System32\svchost.exe[2224] ADVAPI32.dll!RegSetValueExA 77DDEAE7 6 Bytes JMP 70F4000A .text C:\WINDOWS\System32\svchost.exe[2224] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 6 Bytes JMP 7100000A .text C:\WINDOWS\System32\svchost.exe[2224] ADVAPI32.dll!AdjustTokenPrivileges 77DDF00C 6 Bytes JMP 7094000A .text C:\WINDOWS\System32\svchost.exe[2224] ADVAPI32.dll!RegDeleteKeyA 77DE42A0 6 Bytes JMP 7070000A .text C:\WINDOWS\System32\svchost.exe[2224] ADVAPI32.dll!RegDeleteKeyW 77DE559B 6 Bytes JMP 706D000A .text C:\WINDOWS\System32\svchost.exe[2224] ADVAPI32.dll!OpenSCManagerW 77DE6F55 6 Bytes JMP 70CD000A .text C:\WINDOWS\System32\svchost.exe[2224] ADVAPI32.dll!OpenSCManagerA 77DF69AE 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\svchost.exe[2224] ADVAPI32.dll!OpenSCManagerA + 4 77DF69B2 2 Bytes [CF, 70] .text C:\WINDOWS\System32\svchost.exe[2224] ADVAPI32.dll!LookupPrivilegeValueW 77DFB8DF 6 Bytes JMP 7097000A .text C:\WINDOWS\System32\svchost.exe[2224] ADVAPI32.dll!RegCreateKeyW 77DFBA55 6 Bytes JMP 7103000A .text C:\WINDOWS\System32\svchost.exe[2224] ADVAPI32.dll!RegQueryValueA 77DFBB8D 6 Bytes JMP 70EE000A .text C:\WINDOWS\System32\svchost.exe[2224] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 6 Bytes JMP 7106000A .text C:\WINDOWS\System32\svchost.exe[2224] ADVAPI32.dll!LookupPrivilegeValueA 77DFC238 6 Bytes JMP 709A000A .text C:\WINDOWS\System32\svchost.exe[2224] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 7169000A .text C:\WINDOWS\System32\svchost.exe[2224] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 7121000A .text C:\WINDOWS\System32\svchost.exe[2224] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 711E000A .text C:\WINDOWS\System32\svchost.exe[2224] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 7157000A .text C:\WINDOWS\System32\svchost.exe[2224] USER32.dll!SetWindowTextW 7E42960E 6 Bytes JMP 7067000A .text C:\WINDOWS\System32\svchost.exe[2224] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 7133000A .text C:\WINDOWS\System32\svchost.exe[2224] USER32.dll!GetWindowTextW 7E42A5CD 6 Bytes JMP 70C7000A .text C:\WINDOWS\System32\svchost.exe[2224] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 7130000A .text C:\WINDOWS\System32\svchost.exe[2224] USER32.dll!ShowWindow 7E42AF56 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\svchost.exe[2224] USER32.dll!ShowWindow + 4 7E42AF5A 2 Bytes [C3, 70] .text C:\WINDOWS\System32\svchost.exe[2224] USER32.dll!CreateWindowExW 7E42D0A3 6 Bytes JMP 7079000A .text C:\WINDOWS\System32\svchost.exe[2224] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\svchost.exe[2224] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [2C, 71] {SUB AL, 0x71} .text C:\WINDOWS\System32\svchost.exe[2224] USER32.dll!DrawTextW 7E42D7E2 6 Bytes JMP 707F000A .text C:\WINDOWS\System32\svchost.exe[2224] USER32.dll!CreateWindowExA 7E42E4A9 6 Bytes JMP 707C000A .text C:\WINDOWS\System32\svchost.exe[2224] USER32.dll!SetWindowTextA 7E42F56B 6 Bytes JMP 706A000A .text C:\WINDOWS\System32\svchost.exe[2224] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 715A000A .text C:\WINDOWS\System32\svchost.exe[2224] USER32.dll!SetWinEventHook 7E4317F7 6 Bytes JMP 711B000A .text C:\WINDOWS\System32\svchost.exe[2224] USER32.dll!GetWindowTextA 7E43216B 6 Bytes JMP 70CA000A .text C:\WINDOWS\System32\svchost.exe[2224] USER32.dll!DrawTextA 7E43C702 6 Bytes JMP 7082000A .text C:\WINDOWS\System32\svchost.exe[2224] USER32.dll!DdeConnect 7E4581C3 6 Bytes JMP 712A000A .text C:\WINDOWS\System32\svchost.exe[2224] USER32.dll!EndTask 7E45A0A5 6 Bytes JMP 713F000A .text C:\WINDOWS\System32\svchost.exe[2224] USER32.dll!RegisterRawInputDevices 7E46CE0E 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\svchost.exe[2224] USER32.dll!RegisterRawInputDevices + 4 7E46CE12 2 Bytes [17, 71] .text C:\WINDOWS\System32\svchost.exe[2224] SHELL32.dll!ShellExecuteExW 7CA098CB 6 Bytes JMP 7145000A .text C:\WINDOWS\System32\svchost.exe[2224] SHELL32.dll!Shell_NotifyIcon 7CA28BC6 6 Bytes JMP 70B2000A .text C:\WINDOWS\System32\svchost.exe[2224] SHELL32.dll!Shell_NotifyIconW 7CA2A537 6 Bytes JMP 70AF000A .text C:\WINDOWS\System32\svchost.exe[2224] SHELL32.dll!ShellExecuteEx 7CA40E45 6 Bytes JMP 7148000A .text C:\WINDOWS\System32\svchost.exe[2224] SHELL32.dll!ShellExecuteA 7CA41170 6 Bytes JMP 714E000A .text C:\WINDOWS\System32\svchost.exe[2224] SHELL32.dll!ShellExecuteW 7CAB5D48 6 Bytes JMP 714B000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] ntdll.dll!NtLoadDriver 7C90D46E 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] ntdll.dll!NtLoadDriver + 4 7C90D472 2 Bytes [23, 71] .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] ntdll.dll!NtSuspendProcess 7C90DE2E 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] ntdll.dll!NtSuspendProcess + 4 7C90DE32 2 Bytes [3B, 71] .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!DeviceIoControl 7C801629 6 Bytes JMP 70AC000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!CreateFileA 7C801A28 6 Bytes JMP 70DF000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!VirtualProtectEx 7C801A61 6 Bytes JMP 7127000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!VirtualProtect 7C801AD4 6 Bytes JMP 70D3000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!LoadLibraryExW 7C801AF5 6 Bytes JMP 716C000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!LoadLibraryA 7C801D7B 6 Bytes JMP 7160000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 7166000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 7163000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 7151000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 7154000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!VirtualAlloc 7C809AF1 6 Bytes JMP 70D6000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!MultiByteToWideChar 7C809C98 6 Bytes JMP 707F000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!LoadResource 7C80A055 6 Bytes JMP 70C1000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!WideCharToMultiByte 7C80A174 6 Bytes JMP 705E000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!GetProcAddress 7C80AE40 6 Bytes JMP 7115000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!LoadLibraryW 7C80AEEB 6 Bytes JMP 715D000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!CreateMutexW 7C80E957 6 Bytes JMP 7088000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!CreateMutexA 7C80E9DF 6 Bytes JMP 708B000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!OpenMutexW 7C80EA35 6 Bytes JMP 7082000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!OpenMutexA 7C80EABB 6 Bytes JMP 7085000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!GetVolumeInformationW 7C80FA85 6 Bytes JMP 710F000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [6E, 71] .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!CreateThread 7C8106D7 6 Bytes JMP 70D9000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!CreateFileW 7C810800 6 Bytes JMP 70E2000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!WriteFile 7C810E27 6 Bytes JMP 709D000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!TerminateThread 7C81CB3B 6 Bytes JMP 7139000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!MoveFileW 7C821261 6 Bytes JMP 7058000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!CreateDirectoryA 7C8217AC 6 Bytes JMP 70A3000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!GetVolumeInformationA 7C821BA5 6 Bytes JMP 7112000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 70B5000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!CopyFileA 7C8286EE 6 Bytes JMP 70BE000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!CopyFileW 7C82F87B 6 Bytes JMP 70BB000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!OpenProcess 7C8309E9 6 Bytes JMP 704F000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!DeleteFileA 7C831EDD 6 Bytes JMP 7070000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!DeleteFileW 7C831F63 6 Bytes JMP 706D000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!CreateDirectoryW 7C832402 6 Bytes JMP 70A0000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!MoveFileExW 7C83568B 6 Bytes JMP 7052000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!MoveFileA 7C835EBF 6 Bytes JMP 705B000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!DebugActiveProcess 7C85B0FB 6 Bytes JMP 7136000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!MoveFileExA 7C85E49B 6 Bytes JMP 7055000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!CopyFileExA 7C85F39C 6 Bytes JMP 70B8000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!WinExec 7C86250D 6 Bytes JMP 7142000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!SetThreadContext 7C863C09 6 Bytes JMP 709A000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] kernel32.dll!CreateToolhelp32Snapshot 7C865C7F 6 Bytes JMP 70DC000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 6 Bytes JMP 70F7000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] ADVAPI32.dll!RegQueryValueExW 77DD6FFF 6 Bytes JMP 70E5000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] ADVAPI32.dll!RegCreateKeyExW 77DD776C 6 Bytes JMP 7109000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] ADVAPI32.dll!RegOpenKeyExA 77DD7852 6 Bytes JMP 70FA000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] ADVAPI32.dll!RegOpenKeyW 77DD7946 6 Bytes JMP 70FD000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] ADVAPI32.dll!OpenProcessToken 77DD798B 6 Bytes JMP 7097000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] ADVAPI32.dll!RegQueryValueExA 77DD7ABB 6 Bytes JMP 70E8000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] ADVAPI32.dll!RegSetValueExW 77DDD767 6 Bytes JMP 70F1000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] ADVAPI32.dll!RegQueryValueW 77DDD87A 6 Bytes JMP 70EB000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 6 Bytes JMP 710C000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] ADVAPI32.dll!RegSetValueExA 77DDEAE7 6 Bytes JMP 70F4000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 6 Bytes JMP 7100000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] ADVAPI32.dll!AdjustTokenPrivileges 77DDF00C 6 Bytes JMP 708E000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] ADVAPI32.dll!RegDeleteKeyA 77DE42A0 6 Bytes JMP 706A000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] ADVAPI32.dll!RegDeleteKeyW 77DE559B 6 Bytes JMP 7067000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] ADVAPI32.dll!OpenSCManagerW 77DE6F55 6 Bytes JMP 70CD000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] ADVAPI32.dll!OpenSCManagerA 77DF69AE 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] ADVAPI32.dll!OpenSCManagerA + 4 77DF69B2 2 Bytes [CF, 70] .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] ADVAPI32.dll!LookupPrivilegeValueW 77DFB8DF 6 Bytes JMP 7091000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] ADVAPI32.dll!RegCreateKeyW 77DFBA55 6 Bytes JMP 7103000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] ADVAPI32.dll!RegQueryValueA 77DFBB8D 6 Bytes JMP 70EE000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 6 Bytes JMP 7106000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] ADVAPI32.dll!LookupPrivilegeValueA 77DFC238 6 Bytes JMP 7094000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 7169000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 7121000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 711E000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 7157000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] USER32.dll!SetWindowTextW 7E42960E 6 Bytes JMP 7061000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 7133000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] USER32.dll!GetWindowTextW 7E42A5CD 6 Bytes JMP 70C7000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 7130000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] USER32.dll!ShowWindow 7E42AF56 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] USER32.dll!ShowWindow + 4 7E42AF5A 2 Bytes [C3, 70] .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] USER32.dll!CreateWindowExW 7E42D0A3 6 Bytes JMP 7073000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [2C, 71] {SUB AL, 0x71} .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] USER32.dll!DrawTextW 7E42D7E2 6 Bytes JMP 7079000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] USER32.dll!CreateWindowExA 7E42E4A9 6 Bytes JMP 7076000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] USER32.dll!SetWindowTextA 7E42F56B 6 Bytes JMP 7064000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 715A000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] USER32.dll!SetWinEventHook 7E4317F7 6 Bytes JMP 711B000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] USER32.dll!GetWindowTextA 7E43216B 6 Bytes JMP 70CA000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] USER32.dll!DrawTextA 7E43C702 6 Bytes JMP 707C000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] USER32.dll!DdeConnect 7E4581C3 6 Bytes JMP 712A000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] USER32.dll!EndTask 7E45A0A5 6 Bytes JMP 713F000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] USER32.dll!RegisterRawInputDevices 7E46CE0E 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] USER32.dll!RegisterRawInputDevices + 4 7E46CE12 2 Bytes [17, 71] .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] WININET.dll!InternetOpenUrlA 3D95F3BC 6 Bytes JMP 70A9000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] WININET.dll!InternetOpenUrlW 3D9A6DFF 6 Bytes JMP 70A6000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] SHELL32.dll!ShellExecuteExW 7CA098CB 6 Bytes JMP 7145000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] SHELL32.dll!Shell_NotifyIcon 7CA28BC6 6 Bytes JMP 70B2000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] SHELL32.dll!Shell_NotifyIconW 7CA2A537 6 Bytes JMP 70AF000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] SHELL32.dll!ShellExecuteEx 7CA40E45 6 Bytes JMP 7148000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] SHELL32.dll!ShellExecuteA 7CA41170 6 Bytes JMP 714E000A .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2308] SHELL32.dll!ShellExecuteW 7CAB5D48 6 Bytes JMP 714B000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] ntdll.dll!NtLoadDriver 7C90D46E 3 Bytes [FF, 25, 1E] .text C:\Program Files\ThreatFire\TFTray.exe[2372] ntdll.dll!NtLoadDriver + 4 7C90D472 2 Bytes [23, 71] .text C:\Program Files\ThreatFire\TFTray.exe[2372] ntdll.dll!NtSuspendProcess 7C90DE2E 3 Bytes [FF, 25, 1E] .text C:\Program Files\ThreatFire\TFTray.exe[2372] ntdll.dll!NtSuspendProcess + 4 7C90DE32 2 Bytes [3B, 71] .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!DeviceIoControl 7C801629 6 Bytes JMP 70AC000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!CreateFileA 7C801A28 6 Bytes JMP 70DF000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!VirtualProtectEx 7C801A61 6 Bytes JMP 7127000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!VirtualProtect 7C801AD4 6 Bytes JMP 70D3000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!LoadLibraryExW 7C801AF5 6 Bytes JMP 716C000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!LoadLibraryA 7C801D7B 6 Bytes JMP 7160000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 7166000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 7163000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 7151000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 7154000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!VirtualAlloc 7C809AF1 6 Bytes JMP 70D6000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!MultiByteToWideChar 7C809C98 6 Bytes JMP 707F000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!LoadResource 7C80A055 6 Bytes JMP 70C1000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!WideCharToMultiByte 7C80A174 6 Bytes JMP 705E000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!GetProcAddress 7C80AE40 6 Bytes JMP 7115000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!LoadLibraryW 7C80AEEB 6 Bytes JMP 715D000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!CreateMutexW 7C80E957 6 Bytes JMP 7088000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!CreateMutexA 7C80E9DF 6 Bytes JMP 708B000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!OpenMutexW 7C80EA35 6 Bytes JMP 7082000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!OpenMutexA 7C80EABB 6 Bytes JMP 7085000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!GetVolumeInformationW 7C80FA85 6 Bytes JMP 710F000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E] .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [6E, 71] .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!CreateThread 7C8106D7 6 Bytes JMP 70D9000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!CreateFileW 7C810800 6 Bytes JMP 70E2000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!WriteFile 7C810E27 6 Bytes JMP 709D000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!TerminateThread 7C81CB3B 6 Bytes JMP 7139000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!MoveFileW 7C821261 6 Bytes JMP 7058000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!CreateDirectoryA 7C8217AC 6 Bytes JMP 70A3000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!GetVolumeInformationA 7C821BA5 6 Bytes JMP 7112000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 70B5000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!CopyFileA 7C8286EE 6 Bytes JMP 70BE000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!CopyFileW 7C82F87B 6 Bytes JMP 70BB000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!OpenProcess 7C8309E9 6 Bytes JMP 704F000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!DeleteFileA 7C831EDD 6 Bytes JMP 7070000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!DeleteFileW 7C831F63 6 Bytes JMP 706D000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!CreateDirectoryW 7C832402 6 Bytes JMP 70A0000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!MoveFileExW 7C83568B 6 Bytes JMP 7052000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!MoveFileA 7C835EBF 6 Bytes JMP 705B000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!DebugActiveProcess 7C85B0FB 6 Bytes JMP 7136000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!MoveFileExA 7C85E49B 6 Bytes JMP 7055000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!CopyFileExA 7C85F39C 6 Bytes JMP 70B8000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!WinExec 7C86250D 6 Bytes JMP 7142000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!SetThreadContext 7C863C09 6 Bytes JMP 709A000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] kernel32.dll!CreateToolhelp32Snapshot 7C865C7F 6 Bytes JMP 70DC000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] WININET.dll!InternetOpenUrlA 3D95F3BC 6 Bytes JMP 70A9000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] WININET.dll!InternetOpenUrlW 3D9A6DFF 6 Bytes JMP 70A6000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 6 Bytes JMP 70F7000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] ADVAPI32.dll!RegQueryValueExW 77DD6FFF 6 Bytes JMP 70E5000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] ADVAPI32.dll!RegCreateKeyExW 77DD776C 6 Bytes JMP 7109000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] ADVAPI32.dll!RegOpenKeyExA 77DD7852 6 Bytes JMP 70FA000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] ADVAPI32.dll!RegOpenKeyW 77DD7946 6 Bytes JMP 70FD000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] ADVAPI32.dll!OpenProcessToken 77DD798B 6 Bytes JMP 7097000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] ADVAPI32.dll!RegQueryValueExA 77DD7ABB 6 Bytes JMP 70E8000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] ADVAPI32.dll!RegSetValueExW 77DDD767 6 Bytes JMP 70F1000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] ADVAPI32.dll!RegQueryValueW 77DDD87A 6 Bytes JMP 70EB000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 6 Bytes JMP 710C000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] ADVAPI32.dll!RegSetValueExA 77DDEAE7 6 Bytes JMP 70F4000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 6 Bytes JMP 7100000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] ADVAPI32.dll!AdjustTokenPrivileges 77DDF00C 6 Bytes JMP 708E000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] ADVAPI32.dll!RegDeleteKeyA 77DE42A0 6 Bytes JMP 706A000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] ADVAPI32.dll!RegDeleteKeyW 77DE559B 6 Bytes JMP 7067000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] ADVAPI32.dll!OpenSCManagerW 77DE6F55 6 Bytes JMP 70CD000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] ADVAPI32.dll!OpenSCManagerA 77DF69AE 3 Bytes [FF, 25, 1E] .text C:\Program Files\ThreatFire\TFTray.exe[2372] ADVAPI32.dll!OpenSCManagerA + 4 77DF69B2 2 Bytes [CF, 70] .text C:\Program Files\ThreatFire\TFTray.exe[2372] ADVAPI32.dll!LookupPrivilegeValueW 77DFB8DF 6 Bytes JMP 7091000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] ADVAPI32.dll!RegCreateKeyW 77DFBA55 6 Bytes JMP 7103000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] ADVAPI32.dll!RegQueryValueA 77DFBB8D 6 Bytes JMP 70EE000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 6 Bytes JMP 7106000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] ADVAPI32.dll!LookupPrivilegeValueA 77DFC238 6 Bytes JMP 7094000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 7169000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 7121000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 711E000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 7157000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] USER32.dll!SetWindowTextW 7E42960E 6 Bytes JMP 7061000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 7133000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] USER32.dll!GetWindowTextW 7E42A5CD 6 Bytes JMP 70C7000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 7130000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] USER32.dll!ShowWindow 7E42AF56 3 Bytes [FF, 25, 1E] .text C:\Program Files\ThreatFire\TFTray.exe[2372] USER32.dll!ShowWindow + 4 7E42AF5A 2 Bytes [C3, 70] .text C:\Program Files\ThreatFire\TFTray.exe[2372] USER32.dll!CreateWindowExW 7E42D0A3 6 Bytes JMP 7073000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E] .text C:\Program Files\ThreatFire\TFTray.exe[2372] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [2C, 71] {SUB AL, 0x71} .text C:\Program Files\ThreatFire\TFTray.exe[2372] USER32.dll!DrawTextW 7E42D7E2 6 Bytes JMP 7079000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] USER32.dll!CreateWindowExA 7E42E4A9 6 Bytes JMP 7076000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] USER32.dll!SetWindowTextA 7E42F56B 6 Bytes JMP 7064000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 715A000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] USER32.dll!SetWinEventHook 7E4317F7 6 Bytes JMP 711B000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] USER32.dll!GetWindowTextA 7E43216B 6 Bytes JMP 70CA000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] USER32.dll!DrawTextA 7E43C702 6 Bytes JMP 707C000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] USER32.dll!DdeConnect 7E4581C3 6 Bytes JMP 712A000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] USER32.dll!EndTask 7E45A0A5 6 Bytes JMP 713F000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] USER32.dll!RegisterRawInputDevices 7E46CE0E 3 Bytes [FF, 25, 1E] .text C:\Program Files\ThreatFire\TFTray.exe[2372] USER32.dll!RegisterRawInputDevices + 4 7E46CE12 2 Bytes [17, 71] .text C:\Program Files\ThreatFire\TFTray.exe[2372] SHELL32.dll!ShellExecuteExW 7CA098CB 6 Bytes JMP 7145000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] SHELL32.dll!Shell_NotifyIcon 7CA28BC6 6 Bytes JMP 70B2000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] SHELL32.dll!Shell_NotifyIconW 7CA2A537 6 Bytes JMP 70AF000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] SHELL32.dll!ShellExecuteEx 7CA40E45 6 Bytes JMP 7148000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] SHELL32.dll!ShellExecuteA 7CA41170 6 Bytes JMP 714E000A .text C:\Program Files\ThreatFire\TFTray.exe[2372] SHELL32.dll!ShellExecuteW 7CAB5D48 6 Bytes JMP 714B000A .text C:\WINDOWS\explorer.exe[2416] ntdll.dll!NtLoadDriver 7C90D46E 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\explorer.exe[2416] ntdll.dll!NtLoadDriver + 4 7C90D472 2 Bytes [23, 71] .text C:\WINDOWS\explorer.exe[2416] ntdll.dll!NtSuspendProcess 7C90DE2E 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\explorer.exe[2416] ntdll.dll!NtSuspendProcess + 4 7C90DE32 2 Bytes [3B, 71] .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!DeviceIoControl 7C801629 6 Bytes JMP 70AC000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!CreateFileA 7C801A28 6 Bytes JMP 70DF000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!VirtualProtectEx 7C801A61 6 Bytes JMP 7127000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!VirtualProtect 7C801AD4 6 Bytes JMP 70D3000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!LoadLibraryExW 7C801AF5 6 Bytes JMP 716C000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!LoadLibraryA 7C801D7B 6 Bytes JMP 7160000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 7166000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 7163000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 7151000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 7154000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!VirtualAlloc 7C809AF1 6 Bytes JMP 70D6000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!MultiByteToWideChar 7C809C98 6 Bytes JMP 707F000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!LoadResource 7C80A055 6 Bytes JMP 70C1000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!WideCharToMultiByte 7C80A174 6 Bytes JMP 705E000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!GetProcAddress 7C80AE40 6 Bytes JMP 7115000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!LoadLibraryW 7C80AEEB 6 Bytes JMP 715D000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!CreateMutexW 7C80E957 6 Bytes JMP 7088000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!CreateMutexA 7C80E9DF 6 Bytes JMP 708B000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!OpenMutexW 7C80EA35 6 Bytes JMP 7082000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!OpenMutexA 7C80EABB 6 Bytes JMP 7085000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!GetVolumeInformationW 7C80FA85 6 Bytes JMP 710F000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [6E, 71] .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!CreateThread 7C8106D7 6 Bytes JMP 70D9000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!CreateFileW 7C810800 6 Bytes JMP 70E2000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!WriteFile 7C810E27 6 Bytes JMP 709D000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!TerminateThread 7C81CB3B 6 Bytes JMP 7139000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!MoveFileW 7C821261 6 Bytes JMP 7058000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!CreateDirectoryA 7C8217AC 6 Bytes JMP 70A3000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!GetVolumeInformationA 7C821BA5 6 Bytes JMP 7112000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 70B5000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!CopyFileA 7C8286EE 6 Bytes JMP 70BE000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!CopyFileW 7C82F87B 6 Bytes JMP 70BB000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!OpenProcess 7C8309E9 6 Bytes JMP 704F000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!DeleteFileA 7C831EDD 6 Bytes JMP 7070000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!DeleteFileW 7C831F63 6 Bytes JMP 706D000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!CreateDirectoryW 7C832402 6 Bytes JMP 70A0000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!MoveFileExW 7C83568B 6 Bytes JMP 7052000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!MoveFileA 7C835EBF 6 Bytes JMP 705B000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!DebugActiveProcess 7C85B0FB 6 Bytes JMP 7136000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!MoveFileExA 7C85E49B 6 Bytes JMP 7055000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!CopyFileExA 7C85F39C 6 Bytes JMP 70B8000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!WinExec 7C86250D 6 Bytes JMP 7142000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!SetThreadContext 7C863C09 6 Bytes JMP 709A000A .text C:\WINDOWS\explorer.exe[2416] kernel32.dll!CreateToolhelp32Snapshot 7C865C7F 6 Bytes JMP 70DC000A .text C:\WINDOWS\explorer.exe[2416] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 6 Bytes JMP 70F7000A .text C:\WINDOWS\explorer.exe[2416] ADVAPI32.dll!RegQueryValueExW 77DD6FFF 6 Bytes JMP 70E5000A .text C:\WINDOWS\explorer.exe[2416] ADVAPI32.dll!RegCreateKeyExW 77DD776C 6 Bytes JMP 7109000A .text C:\WINDOWS\explorer.exe[2416] ADVAPI32.dll!RegOpenKeyExA 77DD7852 6 Bytes JMP 70FA000A .text C:\WINDOWS\explorer.exe[2416] ADVAPI32.dll!RegOpenKeyW 77DD7946 6 Bytes JMP 70FD000A .text C:\WINDOWS\explorer.exe[2416] ADVAPI32.dll!OpenProcessToken 77DD798B 6 Bytes JMP 7097000A .text C:\WINDOWS\explorer.exe[2416] ADVAPI32.dll!RegQueryValueExA 77DD7ABB 6 Bytes JMP 70E8000A .text C:\WINDOWS\explorer.exe[2416] ADVAPI32.dll!RegSetValueExW 77DDD767 6 Bytes JMP 70F1000A .text C:\WINDOWS\explorer.exe[2416] ADVAPI32.dll!RegQueryValueW 77DDD87A 6 Bytes JMP 70EB000A .text C:\WINDOWS\explorer.exe[2416] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 6 Bytes JMP 710C000A .text C:\WINDOWS\explorer.exe[2416] ADVAPI32.dll!RegSetValueExA 77DDEAE7 6 Bytes JMP 70F4000A .text C:\WINDOWS\explorer.exe[2416] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 6 Bytes JMP 7100000A .text C:\WINDOWS\explorer.exe[2416] ADVAPI32.dll!AdjustTokenPrivileges 77DDF00C 6 Bytes JMP 708E000A .text C:\WINDOWS\explorer.exe[2416] ADVAPI32.dll!RegDeleteKeyA 77DE42A0 6 Bytes JMP 706A000A .text C:\WINDOWS\explorer.exe[2416] ADVAPI32.dll!RegDeleteKeyW 77DE559B 6 Bytes JMP 7067000A .text C:\WINDOWS\explorer.exe[2416] ADVAPI32.dll!OpenSCManagerW 77DE6F55 6 Bytes JMP 70CD000A .text C:\WINDOWS\explorer.exe[2416] ADVAPI32.dll!OpenSCManagerA 77DF69AE 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\explorer.exe[2416] ADVAPI32.dll!OpenSCManagerA + 4 77DF69B2 2 Bytes [CF, 70] .text C:\WINDOWS\explorer.exe[2416] ADVAPI32.dll!LookupPrivilegeValueW 77DFB8DF 6 Bytes JMP 7091000A .text C:\WINDOWS\explorer.exe[2416] ADVAPI32.dll!RegCreateKeyW 77DFBA55 6 Bytes JMP 7103000A .text C:\WINDOWS\explorer.exe[2416] ADVAPI32.dll!RegQueryValueA 77DFBB8D 6 Bytes JMP 70EE000A .text C:\WINDOWS\explorer.exe[2416] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 6 Bytes JMP 7106000A .text C:\WINDOWS\explorer.exe[2416] ADVAPI32.dll!LookupPrivilegeValueA 77DFC238 6 Bytes JMP 7094000A .text C:\WINDOWS\explorer.exe[2416] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 7169000A .text C:\WINDOWS\explorer.exe[2416] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 7121000A .text C:\WINDOWS\explorer.exe[2416] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 711E000A .text C:\WINDOWS\explorer.exe[2416] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 7157000A .text C:\WINDOWS\explorer.exe[2416] USER32.dll!SetWindowTextW 7E42960E 6 Bytes JMP 7061000A .text C:\WINDOWS\explorer.exe[2416] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 7133000A .text C:\WINDOWS\explorer.exe[2416] USER32.dll!GetWindowTextW 7E42A5CD 6 Bytes JMP 70C7000A .text C:\WINDOWS\explorer.exe[2416] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 7130000A .text C:\WINDOWS\explorer.exe[2416] USER32.dll!ShowWindow 7E42AF56 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\explorer.exe[2416] USER32.dll!ShowWindow + 4 7E42AF5A 2 Bytes [C3, 70] .text C:\WINDOWS\explorer.exe[2416] USER32.dll!CreateWindowExW 7E42D0A3 6 Bytes JMP 7073000A .text C:\WINDOWS\explorer.exe[2416] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\explorer.exe[2416] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [2C, 71] {SUB AL, 0x71} .text C:\WINDOWS\explorer.exe[2416] USER32.dll!DrawTextW 7E42D7E2 6 Bytes JMP 7079000A .text C:\WINDOWS\explorer.exe[2416] USER32.dll!CreateWindowExA 7E42E4A9 6 Bytes JMP 7076000A .text C:\WINDOWS\explorer.exe[2416] USER32.dll!SetWindowTextA 7E42F56B 6 Bytes JMP 7064000A .text C:\WINDOWS\explorer.exe[2416] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 715A000A .text C:\WINDOWS\explorer.exe[2416] USER32.dll!SetWinEventHook 7E4317F7 6 Bytes JMP 711B000A .text C:\WINDOWS\explorer.exe[2416] USER32.dll!GetWindowTextA 7E43216B 6 Bytes JMP 70CA000A .text C:\WINDOWS\explorer.exe[2416] USER32.dll!DrawTextA 7E43C702 6 Bytes JMP 707C000A .text C:\WINDOWS\explorer.exe[2416] USER32.dll!DdeConnect 7E4581C3 6 Bytes JMP 712A000A .text C:\WINDOWS\explorer.exe[2416] USER32.dll!EndTask 7E45A0A5 6 Bytes JMP 713F000A .text C:\WINDOWS\explorer.exe[2416] USER32.dll!RegisterRawInputDevices 7E46CE0E 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\explorer.exe[2416] USER32.dll!RegisterRawInputDevices + 4 7E46CE12 2 Bytes [17, 71] .text C:\WINDOWS\explorer.exe[2416] WININET.dll!InternetOpenUrlA 3D95F3BC 6 Bytes JMP 70A9000A .text C:\WINDOWS\explorer.exe[2416] WININET.dll!InternetOpenUrlW 3D9A6DFF 6 Bytes JMP 70A6000A .text C:\WINDOWS\explorer.exe[2416] SHELL32.dll!ShellExecuteExW 7CA098CB 6 Bytes JMP 7145000A .text C:\WINDOWS\explorer.exe[2416] SHELL32.dll!Shell_NotifyIcon 7CA28BC6 6 Bytes JMP 70B2000A .text C:\WINDOWS\explorer.exe[2416] SHELL32.dll!Shell_NotifyIconW 7CA2A537 6 Bytes JMP 70AF000A .text C:\WINDOWS\explorer.exe[2416] SHELL32.dll!ShellExecuteEx 7CA40E45 6 Bytes JMP 7148000A .text C:\WINDOWS\explorer.exe[2416] SHELL32.dll!ShellExecuteA 7CA41170 6 Bytes JMP 714E000A .text C:\WINDOWS\explorer.exe[2416] SHELL32.dll!ShellExecuteW 7CAB5D48 6 Bytes JMP 714B000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] ntdll.dll!NtLoadDriver 7C90D46E 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] ntdll.dll!NtLoadDriver + 4 7C90D472 2 Bytes [23, 71] .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] ntdll.dll!NtSuspendProcess 7C90DE2E 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] ntdll.dll!NtSuspendProcess + 4 7C90DE32 2 Bytes [3B, 71] .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!DeviceIoControl 7C801629 6 Bytes JMP 70AC000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!CreateFileA 7C801A28 6 Bytes JMP 70DF000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!VirtualProtectEx 7C801A61 6 Bytes JMP 7127000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!VirtualProtect 7C801AD4 6 Bytes JMP 70D3000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!LoadLibraryExW 7C801AF5 6 Bytes JMP 716C000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!LoadLibraryA 7C801D7B 6 Bytes JMP 7160000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 7166000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 7163000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 7151000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 7154000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!VirtualAlloc 7C809AF1 6 Bytes JMP 70D6000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!MultiByteToWideChar 7C809C98 6 Bytes JMP 707F000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!LoadResource 7C80A055 6 Bytes JMP 70C1000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!WideCharToMultiByte 7C80A174 6 Bytes JMP 705E000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!GetProcAddress 7C80AE40 6 Bytes JMP 7115000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!LoadLibraryW 7C80AEEB 6 Bytes JMP 715D000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!CreateMutexW 7C80E957 6 Bytes JMP 7088000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!CreateMutexA 7C80E9DF 6 Bytes JMP 708B000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!OpenMutexW 7C80EA35 6 Bytes JMP 7082000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!OpenMutexA 7C80EABB 6 Bytes JMP 7085000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!GetVolumeInformationW 7C80FA85 6 Bytes JMP 710F000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [6E, 71] .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!CreateThread 7C8106D7 6 Bytes JMP 70D9000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!CreateFileW 7C810800 6 Bytes JMP 70E2000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!WriteFile 7C810E27 6 Bytes JMP 709D000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!TerminateThread 7C81CB3B 6 Bytes JMP 7139000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!MoveFileW 7C821261 6 Bytes JMP 7058000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!CreateDirectoryA 7C8217AC 6 Bytes JMP 70A3000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!GetVolumeInformationA 7C821BA5 6 Bytes JMP 7112000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 70B5000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!CopyFileA 7C8286EE 6 Bytes JMP 70BE000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!CopyFileW 7C82F87B 6 Bytes JMP 70BB000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!OpenProcess 7C8309E9 6 Bytes JMP 704F000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!DeleteFileA 7C831EDD 6 Bytes JMP 7070000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!DeleteFileW 7C831F63 6 Bytes JMP 706D000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!CreateDirectoryW 7C832402 6 Bytes JMP 70A0000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!MoveFileExW 7C83568B 6 Bytes JMP 7052000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!MoveFileA 7C835EBF 6 Bytes JMP 705B000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!DebugActiveProcess 7C85B0FB 6 Bytes JMP 7136000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!MoveFileExA 7C85E49B 6 Bytes JMP 7055000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!CopyFileExA 7C85F39C 6 Bytes JMP 70B8000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!WinExec 7C86250D 6 Bytes JMP 7142000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!SetThreadContext 7C863C09 6 Bytes JMP 709A000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] kernel32.dll!CreateToolhelp32Snapshot 7C865C7F 6 Bytes JMP 70DC000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 6 Bytes JMP 70F7000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] ADVAPI32.dll!RegQueryValueExW 77DD6FFF 6 Bytes JMP 70E5000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] ADVAPI32.dll!RegCreateKeyExW 77DD776C 6 Bytes JMP 7109000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] ADVAPI32.dll!RegOpenKeyExA 77DD7852 6 Bytes JMP 70FA000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] ADVAPI32.dll!RegOpenKeyW 77DD7946 6 Bytes JMP 70FD000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] ADVAPI32.dll!OpenProcessToken 77DD798B 6 Bytes JMP 7097000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] ADVAPI32.dll!RegQueryValueExA 77DD7ABB 6 Bytes JMP 70E8000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] ADVAPI32.dll!RegSetValueExW 77DDD767 6 Bytes JMP 70F1000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] ADVAPI32.dll!RegQueryValueW 77DDD87A 6 Bytes JMP 70EB000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 6 Bytes JMP 710C000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] ADVAPI32.dll!RegSetValueExA 77DDEAE7 6 Bytes JMP 70F4000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 6 Bytes JMP 7100000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] ADVAPI32.dll!AdjustTokenPrivileges 77DDF00C 6 Bytes JMP 708E000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] ADVAPI32.dll!RegDeleteKeyA 77DE42A0 6 Bytes JMP 706A000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] ADVAPI32.dll!RegDeleteKeyW 77DE559B 6 Bytes JMP 7067000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] ADVAPI32.dll!OpenSCManagerW 77DE6F55 6 Bytes JMP 70CD000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] ADVAPI32.dll!OpenSCManagerA 77DF69AE 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] ADVAPI32.dll!OpenSCManagerA + 4 77DF69B2 2 Bytes [CF, 70] .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] ADVAPI32.dll!LookupPrivilegeValueW 77DFB8DF 6 Bytes JMP 7091000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] ADVAPI32.dll!RegCreateKeyW 77DFBA55 6 Bytes JMP 7103000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] ADVAPI32.dll!RegQueryValueA 77DFBB8D 6 Bytes JMP 70EE000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 6 Bytes JMP 7106000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] ADVAPI32.dll!LookupPrivilegeValueA 77DFC238 6 Bytes JMP 7094000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 7169000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 7121000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 711E000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 7157000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] USER32.dll!SetWindowTextW 7E42960E 6 Bytes JMP 7061000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 7133000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] USER32.dll!GetWindowTextW 7E42A5CD 6 Bytes JMP 70C7000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 7130000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] USER32.dll!ShowWindow 7E42AF56 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] USER32.dll!ShowWindow + 4 7E42AF5A 2 Bytes [C3, 70] .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] USER32.dll!CreateWindowExW 7E42D0A3 6 Bytes JMP 7073000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [2C, 71] {SUB AL, 0x71} .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] USER32.dll!DrawTextW 7E42D7E2 6 Bytes JMP 7079000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] USER32.dll!CreateWindowExA 7E42E4A9 6 Bytes JMP 7076000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] USER32.dll!SetWindowTextA 7E42F56B 6 Bytes JMP 7064000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 715A000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] USER32.dll!SetWinEventHook 7E4317F7 6 Bytes JMP 711B000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] USER32.dll!GetWindowTextA 7E43216B 6 Bytes JMP 70CA000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] USER32.dll!DrawTextA 7E43C702 6 Bytes JMP 707C000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] USER32.dll!DdeConnect 7E4581C3 6 Bytes JMP 712A000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] USER32.dll!EndTask 7E45A0A5 6 Bytes JMP 713F000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] USER32.dll!RegisterRawInputDevices 7E46CE0E 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] USER32.dll!RegisterRawInputDevices + 4 7E46CE12 2 Bytes [17, 71] .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] WININET.dll!InternetOpenUrlA 3D95F3BC 6 Bytes JMP 70A9000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] WININET.dll!InternetOpenUrlW 3D9A6DFF 6 Bytes JMP 70A6000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] SHELL32.dll!ShellExecuteExW 7CA098CB 6 Bytes JMP 7145000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] SHELL32.dll!Shell_NotifyIcon 7CA28BC6 6 Bytes JMP 70B2000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] SHELL32.dll!Shell_NotifyIconW 7CA2A537 6 Bytes JMP 70AF000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] SHELL32.dll!ShellExecuteEx 7CA40E45 6 Bytes JMP 7148000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] SHELL32.dll!ShellExecuteA 7CA41170 6 Bytes JMP 714E000A .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2448] SHELL32.dll!ShellExecuteW 7CAB5D48 6 Bytes JMP 714B000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] ntdll.dll!NtLoadDriver 7C90D46E 3 Bytes [FF, 25, 1E] .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] ntdll.dll!NtLoadDriver + 4 7C90D472 2 Bytes [23, 71] .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] ntdll.dll!NtSuspendProcess 7C90DE2E 3 Bytes [FF, 25, 1E] .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] ntdll.dll!NtSuspendProcess + 4 7C90DE32 2 Bytes [3B, 71] .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!DeviceIoControl 7C801629 6 Bytes JMP 70AC000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!CreateFileA 7C801A28 6 Bytes JMP 70DF000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!VirtualProtectEx 7C801A61 6 Bytes JMP 7127000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!VirtualProtect 7C801AD4 6 Bytes JMP 70D3000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!LoadLibraryExW 7C801AF5 6 Bytes JMP 716C000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!LoadLibraryA 7C801D7B 6 Bytes JMP 7160000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 7166000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 7163000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 7151000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 7154000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!VirtualAlloc 7C809AF1 6 Bytes JMP 70D6000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!MultiByteToWideChar 7C809C98 6 Bytes JMP 7085000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!LoadResource 7C80A055 6 Bytes JMP 70C1000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!WideCharToMultiByte 7C80A174 6 Bytes JMP 7064000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!GetProcAddress 7C80AE40 6 Bytes JMP 7115000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!LoadLibraryW 7C80AEEB 6 Bytes JMP 715D000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!CreateMutexW 7C80E957 6 Bytes JMP 708E000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!CreateMutexA 7C80E9DF 6 Bytes JMP 7091000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!OpenMutexW 7C80EA35 6 Bytes JMP 7088000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!OpenMutexA 7C80EABB 6 Bytes JMP 708B000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!GetVolumeInformationW 7C80FA85 6 Bytes JMP 710F000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E] .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [6E, 71] .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!CreateThread 7C8106D7 6 Bytes JMP 70D9000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!CreateFileW 7C810800 6 Bytes JMP 70E2000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!WriteFile 7C810E27 6 Bytes JMP 70A3000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!TerminateThread 7C81CB3B 6 Bytes JMP 7139000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!MoveFileW 7C821261 6 Bytes JMP 705E000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!CreateDirectoryA 7C8217AC 6 Bytes JMP 70A9000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!GetVolumeInformationA 7C821BA5 6 Bytes JMP 7112000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 70B5000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!CopyFileA 7C8286EE 6 Bytes JMP 70BE000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!CopyFileW 7C82F87B 6 Bytes JMP 70BB000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!OpenProcess 7C8309E9 6 Bytes JMP 7055000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!DeleteFileA 7C831EDD 6 Bytes JMP 7076000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!DeleteFileW 7C831F63 6 Bytes JMP 7073000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!CreateDirectoryW 7C832402 6 Bytes JMP 70A6000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!MoveFileExW 7C83568B 6 Bytes JMP 7058000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!MoveFileA 7C835EBF 6 Bytes JMP 7061000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!DebugActiveProcess 7C85B0FB 6 Bytes JMP 7136000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!MoveFileExA 7C85E49B 6 Bytes JMP 705B000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!CopyFileExA 7C85F39C 6 Bytes JMP 70B8000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!WinExec 7C86250D 6 Bytes JMP 7142000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!SetThreadContext 7C863C09 6 Bytes JMP 70A0000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] kernel32.dll!CreateToolhelp32Snapshot 7C865C7F 6 Bytes JMP 70DC000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 6 Bytes JMP 70F7000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] ADVAPI32.dll!RegQueryValueExW 77DD6FFF 6 Bytes JMP 70E5000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] ADVAPI32.dll!RegCreateKeyExW 77DD776C 6 Bytes JMP 7109000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] ADVAPI32.dll!RegOpenKeyExA 77DD7852 6 Bytes JMP 70FA000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] ADVAPI32.dll!RegOpenKeyW 77DD7946 6 Bytes JMP 70FD000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] ADVAPI32.dll!OpenProcessToken 77DD798B 6 Bytes JMP 709D000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] ADVAPI32.dll!RegQueryValueExA 77DD7ABB 6 Bytes JMP 70E8000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] ADVAPI32.dll!RegSetValueExW 77DDD767 6 Bytes JMP 70F1000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] ADVAPI32.dll!RegQueryValueW 77DDD87A 6 Bytes JMP 70EB000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 6 Bytes JMP 710C000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] ADVAPI32.dll!RegSetValueExA 77DDEAE7 6 Bytes JMP 70F4000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 6 Bytes JMP 7100000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] ADVAPI32.dll!AdjustTokenPrivileges 77DDF00C 6 Bytes JMP 7094000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] ADVAPI32.dll!RegDeleteKeyA 77DE42A0 6 Bytes JMP 7070000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] ADVAPI32.dll!RegDeleteKeyW 77DE559B 6 Bytes JMP 706D000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] ADVAPI32.dll!OpenSCManagerW 77DE6F55 6 Bytes JMP 70CD000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] ADVAPI32.dll!OpenSCManagerA 77DF69AE 3 Bytes [FF, 25, 1E] .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] ADVAPI32.dll!OpenSCManagerA + 4 77DF69B2 2 Bytes [CF, 70] .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] ADVAPI32.dll!LookupPrivilegeValueW 77DFB8DF 6 Bytes JMP 7097000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] ADVAPI32.dll!RegCreateKeyW 77DFBA55 6 Bytes JMP 7103000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] ADVAPI32.dll!RegQueryValueA 77DFBB8D 6 Bytes JMP 70EE000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 6 Bytes JMP 7106000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] ADVAPI32.dll!LookupPrivilegeValueA 77DFC238 6 Bytes JMP 709A000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 7169000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 7121000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 711E000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 7157000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] USER32.dll!SetWindowTextW 7E42960E 6 Bytes JMP 7067000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 7133000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] USER32.dll!GetWindowTextW 7E42A5CD 6 Bytes JMP 70C7000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 7130000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] USER32.dll!ShowWindow 7E42AF56 3 Bytes [FF, 25, 1E] .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] USER32.dll!ShowWindow + 4 7E42AF5A 2 Bytes [C3, 70] .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] USER32.dll!CreateWindowExW 7E42D0A3 6 Bytes JMP 7079000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E] .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [2C, 71] {SUB AL, 0x71} .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] USER32.dll!DrawTextW 7E42D7E2 6 Bytes JMP 707F000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] USER32.dll!CreateWindowExA 7E42E4A9 6 Bytes JMP 707C000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] USER32.dll!SetWindowTextA 7E42F56B 6 Bytes JMP 706A000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 715A000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] USER32.dll!SetWinEventHook 7E4317F7 6 Bytes JMP 711B000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] USER32.dll!GetWindowTextA 7E43216B 6 Bytes JMP 70CA000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] USER32.dll!DrawTextA 7E43C702 6 Bytes JMP 7082000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] USER32.dll!DdeConnect 7E4581C3 6 Bytes JMP 712A000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] USER32.dll!EndTask 7E45A0A5 6 Bytes JMP 713F000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] USER32.dll!RegisterRawInputDevices 7E46CE0E 3 Bytes [FF, 25, 1E] .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] USER32.dll!RegisterRawInputDevices + 4 7E46CE12 2 Bytes [17, 71] .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] SHELL32.dll!ShellExecuteExW 7CA098CB 6 Bytes JMP 7145000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] SHELL32.dll!Shell_NotifyIcon 7CA28BC6 6 Bytes JMP 70B2000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] SHELL32.dll!Shell_NotifyIconW 7CA2A537 6 Bytes JMP 70AF000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] SHELL32.dll!ShellExecuteEx 7CA40E45 6 Bytes JMP 7148000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] SHELL32.dll!ShellExecuteA 7CA41170 6 Bytes JMP 714E000A .text C:\Documents and Settings\User 1\Desktop\mdvc8tng.exe[2752] SHELL32.dll!ShellExecuteW 7CAB5D48 6 Bytes JMP 714B000A

GMER scan continued, post # 4: (yes, the scan took hous) .text C:\WINDOWS\system32\ctfmon.exe[2784] ntdll.dll!NtLoadDriver 7C90D46E 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\ctfmon.exe[2784] ntdll.dll!NtLoadDriver + 4 7C90D472 2 Bytes [23, 71] .text C:\WINDOWS\system32\ctfmon.exe[2784] ntdll.dll!NtSuspendProcess 7C90DE2E 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\ctfmon.exe[2784] ntdll.dll!NtSuspendProcess + 4 7C90DE32 2 Bytes [3B, 71] .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!DeviceIoControl 7C801629 6 Bytes JMP 70AC000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!CreateFileA 7C801A28 6 Bytes JMP 70DF000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!VirtualProtectEx 7C801A61 6 Bytes JMP 7127000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!VirtualProtect 7C801AD4 6 Bytes JMP 70D3000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!LoadLibraryExW 7C801AF5 6 Bytes JMP 716C000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!LoadLibraryA 7C801D7B 6 Bytes JMP 7160000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 7166000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 7163000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 7151000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 7154000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!VirtualAlloc 7C809AF1 6 Bytes JMP 70D6000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!MultiByteToWideChar 7C809C98 6 Bytes JMP 7085000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!LoadResource 7C80A055 6 Bytes JMP 70C1000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!WideCharToMultiByte 7C80A174 6 Bytes JMP 7064000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!GetProcAddress 7C80AE40 6 Bytes JMP 7115000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!LoadLibraryW 7C80AEEB 6 Bytes JMP 715D000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!CreateMutexW 7C80E957 6 Bytes JMP 708E000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!CreateMutexA 7C80E9DF 6 Bytes JMP 7091000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!OpenMutexW 7C80EA35 6 Bytes JMP 7088000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!OpenMutexA 7C80EABB 6 Bytes JMP 708B000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!GetVolumeInformationW 7C80FA85 6 Bytes JMP 710F000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [6E, 71] .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!CreateThread 7C8106D7 6 Bytes JMP 70D9000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!CreateFileW 7C810800 6 Bytes JMP 70E2000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!WriteFile 7C810E27 6 Bytes JMP 70A3000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!TerminateThread 7C81CB3B 6 Bytes JMP 7139000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!MoveFileW 7C821261 6 Bytes JMP 705E000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!CreateDirectoryA 7C8217AC 6 Bytes JMP 70A9000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!GetVolumeInformationA 7C821BA5 6 Bytes JMP 7112000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 70B5000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!CopyFileA 7C8286EE 6 Bytes JMP 70BE000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!CopyFileW 7C82F87B 6 Bytes JMP 70BB000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!OpenProcess 7C8309E9 6 Bytes JMP 7055000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!DeleteFileA 7C831EDD 6 Bytes JMP 7076000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!DeleteFileW 7C831F63 6 Bytes JMP 7073000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!CreateDirectoryW 7C832402 6 Bytes JMP 70A6000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!MoveFileExW 7C83568B 6 Bytes JMP 7058000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!MoveFileA 7C835EBF 6 Bytes JMP 7061000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!DebugActiveProcess 7C85B0FB 6 Bytes JMP 7136000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!MoveFileExA 7C85E49B 6 Bytes JMP 705B000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!CopyFileExA 7C85F39C 6 Bytes JMP 70B8000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!WinExec 7C86250D 6 Bytes JMP 7142000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!SetThreadContext 7C863C09 6 Bytes JMP 70A0000A .text C:\WINDOWS\system32\ctfmon.exe[2784] kernel32.dll!CreateToolhelp32Snapshot 7C865C7F 6 Bytes JMP 70DC000A .text C:\WINDOWS\system32\ctfmon.exe[2784] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 6 Bytes JMP 70F7000A .text C:\WINDOWS\system32\ctfmon.exe[2784] ADVAPI32.dll!RegQueryValueExW 77DD6FFF 6 Bytes JMP 70E5000A .text C:\WINDOWS\system32\ctfmon.exe[2784] ADVAPI32.dll!RegCreateKeyExW 77DD776C 6 Bytes JMP 7109000A .text C:\WINDOWS\system32\ctfmon.exe[2784] ADVAPI32.dll!RegOpenKeyExA 77DD7852 6 Bytes JMP 70FA000A .text C:\WINDOWS\system32\ctfmon.exe[2784] ADVAPI32.dll!RegOpenKeyW 77DD7946 6 Bytes JMP 70FD000A .text C:\WINDOWS\system32\ctfmon.exe[2784] ADVAPI32.dll!OpenProcessToken 77DD798B 6 Bytes JMP 709D000A .text C:\WINDOWS\system32\ctfmon.exe[2784] ADVAPI32.dll!RegQueryValueExA 77DD7ABB 6 Bytes JMP 70E8000A .text C:\WINDOWS\system32\ctfmon.exe[2784] ADVAPI32.dll!RegSetValueExW 77DDD767 6 Bytes JMP 70F1000A .text C:\WINDOWS\system32\ctfmon.exe[2784] ADVAPI32.dll!RegQueryValueW 77DDD87A 6 Bytes JMP 70EB000A .text C:\WINDOWS\system32\ctfmon.exe[2784] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 6 Bytes JMP 710C000A .text C:\WINDOWS\system32\ctfmon.exe[2784] ADVAPI32.dll!RegSetValueExA 77DDEAE7 6 Bytes JMP 70F4000A .text C:\WINDOWS\system32\ctfmon.exe[2784] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 6 Bytes JMP 7100000A .text C:\WINDOWS\system32\ctfmon.exe[2784] ADVAPI32.dll!AdjustTokenPrivileges 77DDF00C 6 Bytes JMP 7094000A .text C:\WINDOWS\system32\ctfmon.exe[2784] ADVAPI32.dll!RegDeleteKeyA 77DE42A0 6 Bytes JMP 7070000A .text C:\WINDOWS\system32\ctfmon.exe[2784] ADVAPI32.dll!RegDeleteKeyW 77DE559B 6 Bytes JMP 706D000A .text C:\WINDOWS\system32\ctfmon.exe[2784] ADVAPI32.dll!OpenSCManagerW 77DE6F55 6 Bytes JMP 70CD000A .text C:\WINDOWS\system32\ctfmon.exe[2784] ADVAPI32.dll!OpenSCManagerA 77DF69AE 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\ctfmon.exe[2784] ADVAPI32.dll!OpenSCManagerA + 4 77DF69B2 2 Bytes [CF, 70] .text C:\WINDOWS\system32\ctfmon.exe[2784] ADVAPI32.dll!LookupPrivilegeValueW 77DFB8DF 6 Bytes JMP 7097000A .text C:\WINDOWS\system32\ctfmon.exe[2784] ADVAPI32.dll!RegCreateKeyW 77DFBA55 6 Bytes JMP 7103000A .text C:\WINDOWS\system32\ctfmon.exe[2784] ADVAPI32.dll!RegQueryValueA 77DFBB8D 6 Bytes JMP 70EE000A .text C:\WINDOWS\system32\ctfmon.exe[2784] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 6 Bytes JMP 7106000A .text C:\WINDOWS\system32\ctfmon.exe[2784] ADVAPI32.dll!LookupPrivilegeValueA 77DFC238 6 Bytes JMP 709A000A .text C:\WINDOWS\system32\ctfmon.exe[2784] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 7169000A .text C:\WINDOWS\system32\ctfmon.exe[2784] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 7121000A .text C:\WINDOWS\system32\ctfmon.exe[2784] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 711E000A .text C:\WINDOWS\system32\ctfmon.exe[2784] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 7157000A .text C:\WINDOWS\system32\ctfmon.exe[2784] USER32.dll!SetWindowTextW 7E42960E 6 Bytes JMP 7067000A .text C:\WINDOWS\system32\ctfmon.exe[2784] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 7133000A .text C:\WINDOWS\system32\ctfmon.exe[2784] USER32.dll!GetWindowTextW 7E42A5CD 6 Bytes JMP 70C7000A .text C:\WINDOWS\system32\ctfmon.exe[2784] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 7130000A .text C:\WINDOWS\system32\ctfmon.exe[2784] USER32.dll!ShowWindow 7E42AF56 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\ctfmon.exe[2784] USER32.dll!ShowWindow + 4 7E42AF5A 2 Bytes [C3, 70] .text C:\WINDOWS\system32\ctfmon.exe[2784] USER32.dll!CreateWindowExW 7E42D0A3 6 Bytes JMP 7079000A .text C:\WINDOWS\system32\ctfmon.exe[2784] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\ctfmon.exe[2784] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [2C, 71] {SUB AL, 0x71} .text C:\WINDOWS\system32\ctfmon.exe[2784] USER32.dll!DrawTextW 7E42D7E2 6 Bytes JMP 707F000A .text C:\WINDOWS\system32\ctfmon.exe[2784] USER32.dll!CreateWindowExA 7E42E4A9 6 Bytes JMP 707C000A .text C:\WINDOWS\system32\ctfmon.exe[2784] USER32.dll!SetWindowTextA 7E42F56B 6 Bytes JMP 706A000A .text C:\WINDOWS\system32\ctfmon.exe[2784] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 715A000A .text C:\WINDOWS\system32\ctfmon.exe[2784] USER32.dll!SetWinEventHook 7E4317F7 6 Bytes JMP 711B000A .text C:\WINDOWS\system32\ctfmon.exe[2784] USER32.dll!GetWindowTextA 7E43216B 6 Bytes JMP 70CA000A .text C:\WINDOWS\system32\ctfmon.exe[2784] USER32.dll!DrawTextA 7E43C702 6 Bytes JMP 7082000A .text C:\WINDOWS\system32\ctfmon.exe[2784] USER32.dll!DdeConnect 7E4581C3 6 Bytes JMP 712A000A .text C:\WINDOWS\system32\ctfmon.exe[2784] USER32.dll!EndTask 7E45A0A5 6 Bytes JMP 713F000A .text C:\WINDOWS\system32\ctfmon.exe[2784] USER32.dll!RegisterRawInputDevices 7E46CE0E 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\ctfmon.exe[2784] USER32.dll!RegisterRawInputDevices + 4 7E46CE12 2 Bytes [17, 71] .text C:\WINDOWS\system32\ctfmon.exe[2784] SHELL32.dll!ShellExecuteExW 7CA098CB 6 Bytes JMP 7145000A .text C:\WINDOWS\system32\ctfmon.exe[2784] SHELL32.dll!Shell_NotifyIcon 7CA28BC6 6 Bytes JMP 70B2000A .text C:\WINDOWS\system32\ctfmon.exe[2784] SHELL32.dll!Shell_NotifyIconW 7CA2A537 6 Bytes JMP 70AF000A .text C:\WINDOWS\system32\ctfmon.exe[2784] SHELL32.dll!ShellExecuteEx 7CA40E45 6 Bytes JMP 7148000A .text C:\WINDOWS\system32\ctfmon.exe[2784] SHELL32.dll!ShellExecuteA 7CA41170 6 Bytes JMP 714E000A .text C:\WINDOWS\system32\ctfmon.exe[2784] SHELL32.dll!ShellExecuteW 7CAB5D48 6 Bytes JMP 714B000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] ntdll.dll!NtLoadDriver 7C90D46E 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] ntdll.dll!NtLoadDriver + 4 7C90D472 2 Bytes [23, 71] .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] ntdll.dll!NtSuspendProcess 7C90DE2E 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] ntdll.dll!NtSuspendProcess + 4 7C90DE32 2 Bytes [3B, 71] .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!DeviceIoControl 7C801629 6 Bytes JMP 70AC000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!CreateFileA 7C801A28 6 Bytes JMP 70DF000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!VirtualProtectEx 7C801A61 6 Bytes JMP 7127000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!VirtualProtect 7C801AD4 6 Bytes JMP 70D3000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!LoadLibraryExW 7C801AF5 6 Bytes JMP 716C000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!LoadLibraryA 7C801D7B 6 Bytes JMP 7160000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 7166000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 7163000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 7151000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 7154000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!VirtualAlloc 7C809AF1 6 Bytes JMP 70D6000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!MultiByteToWideChar 7C809C98 6 Bytes JMP 7085000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!LoadResource 7C80A055 6 Bytes JMP 70C1000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!WideCharToMultiByte 7C80A174 6 Bytes JMP 7064000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!GetProcAddress 7C80AE40 6 Bytes JMP 7115000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!LoadLibraryW 7C80AEEB 6 Bytes JMP 715D000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!CreateMutexW 7C80E957 6 Bytes JMP 708E000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!CreateMutexA 7C80E9DF 6 Bytes JMP 7091000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!OpenMutexW 7C80EA35 6 Bytes JMP 7088000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!OpenMutexA 7C80EABB 6 Bytes JMP 708B000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!GetVolumeInformationW 7C80FA85 6 Bytes JMP 710F000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [6E, 71] .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!CreateThread 7C8106D7 6 Bytes JMP 70D9000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!CreateFileW 7C810800 6 Bytes JMP 70E2000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!WriteFile 7C810E27 6 Bytes JMP 70A3000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!TerminateThread 7C81CB3B 6 Bytes JMP 7139000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!MoveFileW 7C821261 6 Bytes JMP 705E000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!CreateDirectoryA 7C8217AC 6 Bytes JMP 70A9000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!GetVolumeInformationA 7C821BA5 6 Bytes JMP 7112000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 70B5000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!CopyFileA 7C8286EE 6 Bytes JMP 70BE000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!CopyFileW 7C82F87B 6 Bytes JMP 70BB000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!OpenProcess 7C8309E9 6 Bytes JMP 7055000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!DeleteFileA 7C831EDD 6 Bytes JMP 7076000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!DeleteFileW 7C831F63 6 Bytes JMP 7073000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!CreateDirectoryW 7C832402 6 Bytes JMP 70A6000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!MoveFileExW 7C83568B 6 Bytes JMP 7058000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!MoveFileA 7C835EBF 6 Bytes JMP 7061000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!DebugActiveProcess 7C85B0FB 6 Bytes JMP 7136000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!MoveFileExA 7C85E49B 6 Bytes JMP 705B000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!CopyFileExA 7C85F39C 6 Bytes JMP 70B8000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!WinExec 7C86250D 6 Bytes JMP 7142000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!SetThreadContext 7C863C09 6 Bytes JMP 70A0000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] kernel32.dll!CreateToolhelp32Snapshot 7C865C7F 6 Bytes JMP 70DC000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 6 Bytes JMP 70F7000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] ADVAPI32.dll!RegQueryValueExW 77DD6FFF 6 Bytes JMP 70E5000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] ADVAPI32.dll!RegCreateKeyExW 77DD776C 6 Bytes JMP 7109000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] ADVAPI32.dll!RegOpenKeyExA 77DD7852 6 Bytes JMP 70FA000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] ADVAPI32.dll!RegOpenKeyW 77DD7946 6 Bytes JMP 70FD000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] ADVAPI32.dll!OpenProcessToken 77DD798B 6 Bytes JMP 709D000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] ADVAPI32.dll!RegQueryValueExA 77DD7ABB 6 Bytes JMP 70E8000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] ADVAPI32.dll!RegSetValueExW 77DDD767 6 Bytes JMP 70F1000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] ADVAPI32.dll!RegQueryValueW 77DDD87A 6 Bytes JMP 70EB000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 6 Bytes JMP 710C000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] ADVAPI32.dll!RegSetValueExA 77DDEAE7 6 Bytes JMP 70F4000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 6 Bytes JMP 7100000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] ADVAPI32.dll!AdjustTokenPrivileges 77DDF00C 6 Bytes JMP 7094000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] ADVAPI32.dll!RegDeleteKeyA 77DE42A0 6 Bytes JMP 7070000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] ADVAPI32.dll!RegDeleteKeyW 77DE559B 6 Bytes JMP 706D000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] ADVAPI32.dll!OpenSCManagerW 77DE6F55 6 Bytes JMP 70CD000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] ADVAPI32.dll!OpenSCManagerA 77DF69AE 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] ADVAPI32.dll!OpenSCManagerA + 4 77DF69B2 2 Bytes [CF, 70] .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] ADVAPI32.dll!LookupPrivilegeValueW 77DFB8DF 6 Bytes JMP 7097000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] ADVAPI32.dll!RegCreateKeyW 77DFBA55 6 Bytes JMP 7103000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] ADVAPI32.dll!RegQueryValueA 77DFBB8D 6 Bytes JMP 70EE000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 6 Bytes JMP 7106000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] ADVAPI32.dll!LookupPrivilegeValueA 77DFC238 6 Bytes JMP 709A000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 7169000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 7121000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 711E000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 7157000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] USER32.dll!SetWindowTextW 7E42960E 6 Bytes JMP 7067000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 7133000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] USER32.dll!GetWindowTextW 7E42A5CD 6 Bytes JMP 70C7000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 7130000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] USER32.dll!ShowWindow 7E42AF56 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] USER32.dll!ShowWindow + 4 7E42AF5A 2 Bytes [C3, 70] .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] USER32.dll!CreateWindowExW 7E42D0A3 6 Bytes JMP 7079000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [2C, 71] {SUB AL, 0x71} .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] USER32.dll!DrawTextW 7E42D7E2 6 Bytes JMP 707F000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] USER32.dll!CreateWindowExA 7E42E4A9 6 Bytes JMP 707C000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] USER32.dll!SetWindowTextA 7E42F56B 6 Bytes JMP 706A000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 715A000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] USER32.dll!SetWinEventHook 7E4317F7 6 Bytes JMP 711B000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] USER32.dll!GetWindowTextA 7E43216B 6 Bytes JMP 70CA000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] USER32.dll!DrawTextA 7E43C702 6 Bytes JMP 7082000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] USER32.dll!DdeConnect 7E4581C3 6 Bytes JMP 712A000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] USER32.dll!EndTask 7E45A0A5 6 Bytes JMP 713F000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] USER32.dll!RegisterRawInputDevices 7E46CE0E 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] USER32.dll!RegisterRawInputDevices + 4 7E46CE12 2 Bytes [17, 71] .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] SHELL32.dll!ShellExecuteExW 7CA098CB 6 Bytes JMP 7145000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] SHELL32.dll!Shell_NotifyIcon 7CA28BC6 6 Bytes JMP 70B2000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] SHELL32.dll!Shell_NotifyIconW 7CA2A537 6 Bytes JMP 70AF000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] SHELL32.dll!ShellExecuteEx 7CA40E45 6 Bytes JMP 7148000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] SHELL32.dll!ShellExecuteA 7CA41170 6 Bytes JMP 714E000A .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2788] SHELL32.dll!ShellExecuteW 7CAB5D48 6 Bytes JMP 714B000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] ntdll.dll!NtLoadDriver 7C90D46E 3 Bytes [FF, 25, 1E] .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] ntdll.dll!NtLoadDriver + 4 7C90D472 2 Bytes [23, 71] .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] ntdll.dll!NtSuspendProcess 7C90DE2E 3 Bytes [FF, 25, 1E] .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] ntdll.dll!NtSuspendProcess + 4 7C90DE32 2 Bytes [3B, 71] .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!DeviceIoControl 7C801629 6 Bytes JMP 70AC000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!CreateFileA 7C801A28 6 Bytes JMP 70DF000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!VirtualProtectEx 7C801A61 6 Bytes JMP 7127000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!VirtualProtect 7C801AD4 6 Bytes JMP 70D3000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!LoadLibraryExW 7C801AF5 6 Bytes JMP 716C000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!LoadLibraryA 7C801D7B 6 Bytes JMP 7160000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 7166000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 7163000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 7151000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 7154000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!VirtualAlloc 7C809AF1 6 Bytes JMP 70D6000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!MultiByteToWideChar 7C809C98 6 Bytes JMP 7085000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!LoadResource 7C80A055 6 Bytes JMP 70C1000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!WideCharToMultiByte 7C80A174 6 Bytes JMP 7064000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!GetProcAddress 7C80AE40 6 Bytes JMP 7115000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!LoadLibraryW 7C80AEEB 6 Bytes JMP 715D000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!CreateMutexW 7C80E957 6 Bytes JMP 708E000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!CreateMutexA 7C80E9DF 6 Bytes JMP 7091000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!OpenMutexW 7C80EA35 6 Bytes JMP 7088000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!OpenMutexA 7C80EABB 6 Bytes JMP 708B000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!GetVolumeInformationW 7C80FA85 6 Bytes JMP 710F000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E] .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [6E, 71] .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!CreateThread 7C8106D7 6 Bytes JMP 70D9000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!CreateFileW 7C810800 6 Bytes JMP 70E2000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!WriteFile 7C810E27 6 Bytes JMP 70A3000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!TerminateThread 7C81CB3B 6 Bytes JMP 7139000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!MoveFileW 7C821261 6 Bytes JMP 705E000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!CreateDirectoryA 7C8217AC 6 Bytes JMP 70A9000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!GetVolumeInformationA 7C821BA5 6 Bytes JMP 7112000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 70B5000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!CopyFileA 7C8286EE 6 Bytes JMP 70BE000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!CopyFileW 7C82F87B 6 Bytes JMP 70BB000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!OpenProcess 7C8309E9 6 Bytes JMP 7055000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!DeleteFileA 7C831EDD 6 Bytes JMP 7076000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!DeleteFileW 7C831F63 6 Bytes JMP 7073000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!CreateDirectoryW 7C832402 6 Bytes JMP 70A6000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!MoveFileExW 7C83568B 6 Bytes JMP 7058000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!MoveFileA 7C835EBF 6 Bytes JMP 7061000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!DebugActiveProcess 7C85B0FB 6 Bytes JMP 7136000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!MoveFileExA 7C85E49B 6 Bytes JMP 705B000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!CopyFileExA 7C85F39C 6 Bytes JMP 70B8000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!WinExec 7C86250D 6 Bytes JMP 7142000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!SetThreadContext 7C863C09 6 Bytes JMP 70A0000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] kernel32.dll!CreateToolhelp32Snapshot 7C865C7F 6 Bytes JMP 70DC000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 7157000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] USER32.dll!SetWindowTextW 7E42960E 6 Bytes JMP 7067000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 7133000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] USER32.dll!GetWindowTextW 7E42A5CD 6 Bytes JMP 70C7000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 7130000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] USER32.dll!ShowWindow 7E42AF56 3 Bytes [FF, 25, 1E] .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] USER32.dll!ShowWindow + 4 7E42AF5A 2 Bytes [C3, 70] .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] USER32.dll!CreateWindowExW 7E42D0A3 6 Bytes JMP 7079000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E] .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [2C, 71] {SUB AL, 0x71} .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] USER32.dll!DrawTextW 7E42D7E2 6 Bytes JMP 707F000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] USER32.dll!CreateWindowExA 7E42E4A9 6 Bytes JMP 707C000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] USER32.dll!SetWindowTextA 7E42F56B 6 Bytes JMP 706A000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 715A000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] USER32.dll!SetWinEventHook 7E4317F7 6 Bytes JMP 711B000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] USER32.dll!GetWindowTextA 7E43216B 6 Bytes JMP 70CA000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] USER32.dll!DrawTextA 7E43C702 6 Bytes JMP 7082000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] USER32.dll!DdeConnect 7E4581C3 6 Bytes JMP 712A000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] USER32.dll!EndTask 7E45A0A5 6 Bytes JMP 713F000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] USER32.dll!RegisterRawInputDevices 7E46CE0E 3 Bytes [FF, 25, 1E] .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] USER32.dll!RegisterRawInputDevices + 4 7E46CE12 2 Bytes [17, 71] .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 6 Bytes JMP 70F7000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] ADVAPI32.dll!RegQueryValueExW 77DD6FFF 6 Bytes JMP 70E5000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] ADVAPI32.dll!RegCreateKeyExW 77DD776C 6 Bytes JMP 7109000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] ADVAPI32.dll!RegOpenKeyExA 77DD7852 6 Bytes JMP 70FA000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] ADVAPI32.dll!RegOpenKeyW 77DD7946 6 Bytes JMP 70FD000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] ADVAPI32.dll!OpenProcessToken 77DD798B 6 Bytes JMP 709D000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] ADVAPI32.dll!RegQueryValueExA 77DD7ABB 6 Bytes JMP 70E8000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] ADVAPI32.dll!RegSetValueExW 77DDD767 6 Bytes JMP 70F1000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] ADVAPI32.dll!RegQueryValueW 77DDD87A 6 Bytes JMP 70EB000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 6 Bytes JMP 710C000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] ADVAPI32.dll!RegSetValueExA 77DDEAE7 6 Bytes JMP 70F4000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 6 Bytes JMP 7100000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] ADVAPI32.dll!AdjustTokenPrivileges 77DDF00C 6 Bytes JMP 7094000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] ADVAPI32.dll!RegDeleteKeyA 77DE42A0 6 Bytes JMP 7070000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] ADVAPI32.dll!RegDeleteKeyW 77DE559B 6 Bytes JMP 706D000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] ADVAPI32.dll!OpenSCManagerW 77DE6F55 6 Bytes JMP 70CD000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] ADVAPI32.dll!OpenSCManagerA 77DF69AE 3 Bytes [FF, 25, 1E] .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] ADVAPI32.dll!OpenSCManagerA + 4 77DF69B2 2 Bytes [CF, 70] .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] ADVAPI32.dll!LookupPrivilegeValueW 77DFB8DF 6 Bytes JMP 7097000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] ADVAPI32.dll!RegCreateKeyW 77DFBA55 6 Bytes JMP 7103000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] ADVAPI32.dll!RegQueryValueA 77DFBB8D 6 Bytes JMP 70EE000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 6 Bytes JMP 7106000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] ADVAPI32.dll!LookupPrivilegeValueA 77DFC238 6 Bytes JMP 709A000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 7169000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 7121000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 711E000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] SHELL32.dll!ShellExecuteExW 7CA098CB 6 Bytes JMP 7145000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] SHELL32.dll!Shell_NotifyIcon 7CA28BC6 6 Bytes JMP 70B2000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] SHELL32.dll!Shell_NotifyIconW 7CA2A537 6 Bytes JMP 70AF000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] SHELL32.dll!ShellExecuteEx 7CA40E45 6 Bytes JMP 7148000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] SHELL32.dll!ShellExecuteA 7CA41170 6 Bytes JMP 714E000A .text C:\PROGRA~1\AVG\AVG9\avgtray.exe[2908] SHELL32.dll!ShellExecuteW 7CAB5D48 6 Bytes JMP 714B000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] ntdll.dll!NtLoadDriver 7C90D46E 3 Bytes [FF, 25, 1E] .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] ntdll.dll!NtLoadDriver + 4 7C90D472 2 Bytes [22, 71] .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] ntdll.dll!NtSuspendProcess 7C90DE2E 3 Bytes [FF, 25, 1E] .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] ntdll.dll!NtSuspendProcess + 4 7C90DE32 2 Bytes [3A, 71] .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!DeviceIoControl 7C801629 6 Bytes JMP 70AB000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!CreateFileA 7C801A28 6 Bytes JMP 70DE000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!VirtualProtectEx 7C801A61 6 Bytes JMP 7126000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!VirtualProtect 7C801AD4 6 Bytes JMP 70D2000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!LoadLibraryExW 7C801AF5 6 Bytes JMP 716B000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!LoadLibraryA 7C801D7B 6 Bytes JMP 715F000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 7165000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 7162000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 7150000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 7153000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!VirtualAlloc 7C809AF1 6 Bytes JMP 70D5000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!MultiByteToWideChar 7C809C98 6 Bytes JMP 7084000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!LoadResource 7C80A055 6 Bytes JMP 70C0000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!WideCharToMultiByte 7C80A174 6 Bytes JMP 7063000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!GetProcAddress 7C80AE40 6 Bytes JMP 7114000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!LoadLibraryW 7C80AEEB 6 Bytes JMP 715C000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!CreateMutexW 7C80E957 6 Bytes JMP 708D000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!CreateMutexA 7C80E9DF 6 Bytes JMP 7090000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!OpenMutexW 7C80EA35 6 Bytes JMP 7087000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!OpenMutexA 7C80EABB 6 Bytes JMP 708A000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!GetVolumeInformationW 7C80FA85 6 Bytes JMP 710E000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E] .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [6D, 71] .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!CreateThread 7C8106D7 6 Bytes JMP 70D8000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!CreateFileW 7C810800 6 Bytes JMP 70E1000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!WriteFile 7C810E27 6 Bytes JMP 70A2000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!TerminateThread 7C81CB3B 6 Bytes JMP 7138000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!MoveFileW 7C821261 6 Bytes JMP 705D000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!CreateDirectoryA 7C8217AC 6 Bytes JMP 70A8000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!GetVolumeInformationA 7C821BA5 6 Bytes JMP 7111000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 70B4000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!CopyFileA 7C8286EE 6 Bytes JMP 70BD000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!CopyFileW 7C82F87B 6 Bytes JMP 70BA000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!OpenProcess 7C8309E9 6 Bytes JMP 7054000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!DeleteFileA 7C831EDD 6 Bytes JMP 7075000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!DeleteFileW 7C831F63 6 Bytes JMP 7072000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!CreateDirectoryW 7C832402 6 Bytes JMP 70A5000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!MoveFileExW 7C83568B 6 Bytes JMP 7057000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!MoveFileA 7C835EBF 6 Bytes JMP 7060000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!DebugActiveProcess 7C85B0FB 6 Bytes JMP 7135000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!MoveFileExA 7C85E49B 6 Bytes JMP 705A000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!CopyFileExA 7C85F39C 6 Bytes JMP 70B7000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!WinExec 7C86250D 6 Bytes JMP 7141000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!SetThreadContext 7C863C09 6 Bytes JMP 709F000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] kernel32.dll!CreateToolhelp32Snapshot 7C865C7F 6 Bytes JMP 70DB000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 6 Bytes JMP 70F6000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] ADVAPI32.dll!RegQueryValueExW 77DD6FFF 6 Bytes JMP 70E4000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] ADVAPI32.dll!RegCreateKeyExW 77DD776C 6 Bytes JMP 7108000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] ADVAPI32.dll!RegOpenKeyExA 77DD7852 6 Bytes JMP 70F9000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] ADVAPI32.dll!RegOpenKeyW 77DD7946 6 Bytes JMP 70FC000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] ADVAPI32.dll!OpenProcessToken 77DD798B 6 Bytes JMP 709C000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] ADVAPI32.dll!RegQueryValueExA 77DD7ABB 6 Bytes JMP 70E7000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] ADVAPI32.dll!RegSetValueExW 77DDD767 6 Bytes JMP 70F0000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] ADVAPI32.dll!RegQueryValueW 77DDD87A 6 Bytes JMP 70EA000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 6 Bytes JMP 710B000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] ADVAPI32.dll!RegSetValueExA 77DDEAE7 6 Bytes JMP 70F3000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 6 Bytes JMP 70FF000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] ADVAPI32.dll!AdjustTokenPrivileges 77DDF00C 6 Bytes JMP 7093000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] ADVAPI32.dll!RegDeleteKeyA 77DE42A0 6 Bytes JMP 706F000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] ADVAPI32.dll!RegDeleteKeyW 77DE559B 6 Bytes JMP 706C000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] ADVAPI32.dll!OpenSCManagerW 77DE6F55 6 Bytes JMP 70CC000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] ADVAPI32.dll!OpenSCManagerA 77DF69AE 3 Bytes [FF, 25, 1E] .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] ADVAPI32.dll!OpenSCManagerA + 4 77DF69B2 2 Bytes [CE, 70] .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] ADVAPI32.dll!LookupPrivilegeValueW 77DFB8DF 6 Bytes JMP 7096000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] ADVAPI32.dll!RegCreateKeyW 77DFBA55 6 Bytes JMP 7102000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] ADVAPI32.dll!RegQueryValueA 77DFBB8D 4 Bytes JMP EC001E25 .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] ADVAPI32.dll!RegQueryValueA + 5 77DFBB92 1 Byte [70] .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 6 Bytes JMP 7105000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] ADVAPI32.dll!LookupPrivilegeValueA 77DFC238 6 Bytes JMP 7099000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 7168000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 7120000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 711D000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 7156000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] USER32.dll!SetWindowTextW 7E42960E 6 Bytes JMP 7066000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 7132000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] USER32.dll!GetWindowTextW 7E42A5CD 6 Bytes JMP 70C6000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 712F000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] USER32.dll!ShowWindow 7E42AF56 3 Bytes [FF, 25, 1E] .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] USER32.dll!ShowWindow + 4 7E42AF5A 2 Bytes [C2, 70] .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] USER32.dll!CreateWindowExW 7E42D0A3 6 Bytes JMP 7078000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E] .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [2B, 71] .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] USER32.dll!DrawTextW 7E42D7E2 6 Bytes JMP 707E000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] USER32.dll!CreateWindowExA 7E42E4A9 6 Bytes JMP 707B000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] USER32.dll!SetWindowTextA 7E42F56B 6 Bytes JMP 7069000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 7159000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] USER32.dll!SetWinEventHook 7E4317F7 6 Bytes JMP 711A000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] USER32.dll!GetWindowTextA 7E43216B 6 Bytes JMP 70C9000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] USER32.dll!DrawTextA 7E43C702 6 Bytes JMP 7081000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] USER32.dll!DdeConnect 7E4581C3 6 Bytes JMP 7129000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] USER32.dll!EndTask 7E45A0A5 6 Bytes JMP 713E000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] USER32.dll!RegisterRawInputDevices 7E46CE0E 3 Bytes [FF, 25, 1E] .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] USER32.dll!RegisterRawInputDevices + 4 7E46CE12 2 Bytes [16, 71] .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] SHELL32.dll!ShellExecuteExW 7CA098CB 6 Bytes JMP 7144000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] SHELL32.dll!Shell_NotifyIcon 7CA28BC6 6 Bytes JMP 70B1000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] SHELL32.dll!Shell_NotifyIconW 7CA2A537 6 Bytes JMP 70AE000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] SHELL32.dll!ShellExecuteEx 7CA40E45 6 Bytes JMP 7147000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] SHELL32.dll!ShellExecuteA 7CA41170 6 Bytes JMP 714D000A .text C:\Program Files\Canon\CAL\CALMAIN.exe[2936] SHELL32.dll!ShellExecuteW 7CAB5D48 6 Bytes JMP 714A000A .text C:\WINDOWS\system32\wscntfy.exe[3008] ntdll.dll!NtLoadDriver 7C90D46E 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\wscntfy.exe[3008] ntdll.dll!NtLoadDriver + 4 7C90D472 2 Bytes [23, 71] .text C:\WINDOWS\system32\wscntfy.exe[3008] ntdll.dll!NtSuspendProcess 7C90DE2E 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\wscntfy.exe[3008] ntdll.dll!NtSuspendProcess + 4 7C90DE32 2 Bytes [3B, 71] .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!DeviceIoControl 7C801629 6 Bytes JMP 70AC000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!CreateFileA 7C801A28 6 Bytes JMP 70DF000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!VirtualProtectEx 7C801A61 6 Bytes JMP 7127000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!VirtualProtect 7C801AD4 6 Bytes JMP 70D3000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!LoadLibraryExW 7C801AF5 6 Bytes JMP 716C000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!LoadLibraryA 7C801D7B 6 Bytes JMP 7160000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 7166000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 7163000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 7151000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 7154000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!VirtualAlloc 7C809AF1 6 Bytes JMP 70D6000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!MultiByteToWideChar 7C809C98 6 Bytes JMP 7085000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!LoadResource 7C80A055 6 Bytes JMP 70C1000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!WideCharToMultiByte 7C80A174 6 Bytes JMP 7064000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!GetProcAddress 7C80AE40 6 Bytes JMP 7115000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!LoadLibraryW 7C80AEEB 6 Bytes JMP 715D000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!CreateMutexW 7C80E957 6 Bytes JMP 708E000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!CreateMutexA 7C80E9DF 6 Bytes JMP 7091000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!OpenMutexW 7C80EA35 6 Bytes JMP 7088000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!OpenMutexA 7C80EABB 6 Bytes JMP 708B000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!GetVolumeInformationW 7C80FA85 6 Bytes JMP 710F000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [6E, 71] .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!CreateThread 7C8106D7 6 Bytes JMP 70D9000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!CreateFileW 7C810800 6 Bytes JMP 70E2000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!WriteFile 7C810E27 6 Bytes JMP 70A3000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!TerminateThread 7C81CB3B 6 Bytes JMP 7139000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!MoveFileW 7C821261 6 Bytes JMP 705E000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!CreateDirectoryA 7C8217AC 6 Bytes JMP 70A9000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!GetVolumeInformationA 7C821BA5 6 Bytes JMP 7112000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 70B5000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!CopyFileA 7C8286EE 6 Bytes JMP 70BE000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!CopyFileW 7C82F87B 6 Bytes JMP 70BB000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!OpenProcess 7C8309E9 6 Bytes JMP 7055000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!DeleteFileA 7C831EDD 6 Bytes JMP 7076000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!DeleteFileW 7C831F63 6 Bytes JMP 7073000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!CreateDirectoryW 7C832402 6 Bytes JMP 70A6000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!MoveFileExW 7C83568B 6 Bytes JMP 7058000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!MoveFileA 7C835EBF 6 Bytes JMP 7061000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!DebugActiveProcess 7C85B0FB 6 Bytes JMP 7136000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!MoveFileExA 7C85E49B 6 Bytes JMP 705B000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!CopyFileExA 7C85F39C 6 Bytes JMP 70B8000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!WinExec 7C86250D 6 Bytes JMP 7142000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!SetThreadContext 7C863C09 6 Bytes JMP 70A0000A .text C:\WINDOWS\system32\wscntfy.exe[3008] kernel32.dll!CreateToolhelp32Snapshot 7C865C7F 6 Bytes JMP 70DC000A .text C:\WINDOWS\system32\wscntfy.exe[3008] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 7157000A .text C:\WINDOWS\system32\wscntfy.exe[3008] USER32.dll!SetWindowTextW 7E42960E 6 Bytes JMP 7067000A .text C:\WINDOWS\system32\wscntfy.exe[3008] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 7133000A .text C:\WINDOWS\system32\wscntfy.exe[3008] USER32.dll!GetWindowTextW 7E42A5CD 6 Bytes JMP 70C7000A .text C:\WINDOWS\system32\wscntfy.exe[3008] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 7130000A .text C:\WINDOWS\system32\wscntfy.exe[3008] USER32.dll!ShowWindow 7E42AF56 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\wscntfy.exe[3008] USER32.dll!ShowWindow + 4 7E42AF5A 2 Bytes [C3, 70] .text C:\WINDOWS\system32\wscntfy.exe[3008] USER32.dll!CreateWindowExW 7E42D0A3 6 Bytes JMP 7079000A .text C:\WINDOWS\system32\wscntfy.exe[3008] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\wscntfy.exe[3008] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [2C, 71] {SUB AL, 0x71} .text C:\WINDOWS\system32\wscntfy.exe[3008] USER32.dll!DrawTextW 7E42D7E2 6 Bytes JMP 707F000A .text C:\WINDOWS\system32\wscntfy.exe[3008] USER32.dll!CreateWindowExA 7E42E4A9 6 Bytes JMP 707C000A .text C:\WINDOWS\system32\wscntfy.exe[3008] USER32.dll!SetWindowTextA 7E42F56B 6 Bytes JMP 706A000A .text C:\WINDOWS\system32\wscntfy.exe[3008] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 715A000A .text C:\WINDOWS\system32\wscntfy.exe[3008] USER32.dll!SetWinEventHook 7E4317F7 6 Bytes JMP 711B000A .text C:\WINDOWS\system32\wscntfy.exe[3008] USER32.dll!GetWindowTextA 7E43216B 6 Bytes JMP 70CA000A .text C:\WINDOWS\system32\wscntfy.exe[3008] USER32.dll!DrawTextA 7E43C702 6 Bytes JMP 7082000A .text C:\WINDOWS\system32\wscntfy.exe[3008] USER32.dll!DdeConnect 7E4581C3 6 Bytes JMP 712A000A .text C:\WINDOWS\system32\wscntfy.exe[3008] USER32.dll!EndTask 7E45A0A5 6 Bytes JMP 713F000A .text C:\WINDOWS\system32\wscntfy.exe[3008] USER32.dll!RegisterRawInputDevices 7E46CE0E 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\wscntfy.exe[3008] USER32.dll!RegisterRawInputDevices + 4 7E46CE12 2 Bytes [17, 71] .text C:\WINDOWS\system32\wscntfy.exe[3008] SHELL32.dll!ShellExecuteExW 7CA098CB 6 Bytes JMP 7145000A .text C:\WINDOWS\system32\wscntfy.exe[3008] SHELL32.dll!Shell_NotifyIcon 7CA28BC6 6 Bytes JMP 70B2000A .text C:\WINDOWS\system32\wscntfy.exe[3008] SHELL32.dll!Shell_NotifyIconW 7CA2A537 6 Bytes JMP 70AF000A .text C:\WINDOWS\system32\wscntfy.exe[3008] SHELL32.dll!ShellExecuteEx 7CA40E45 6 Bytes JMP 7148000A .text C:\WINDOWS\system32\wscntfy.exe[3008] SHELL32.dll!ShellExecuteA 7CA41170 6 Bytes JMP 714E000A .text C:\WINDOWS\system32\wscntfy.exe[3008] SHELL32.dll!ShellExecuteW 7CAB5D48 6 Bytes JMP 714B000A .text C:\WINDOWS\system32\wscntfy.exe[3008] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 6 Bytes JMP 70F7000A .text C:\WINDOWS\system32\wscntfy.exe[3008] ADVAPI32.dll!RegQueryValueExW 77DD6FFF 6 Bytes JMP 70E5000A .text C:\WINDOWS\system32\wscntfy.exe[3008] ADVAPI32.dll!RegCreateKeyExW 77DD776C 6 Bytes JMP 7109000A .text C:\WINDOWS\system32\wscntfy.exe[3008] ADVAPI32.dll!RegOpenKeyExA 77DD7852 6 Bytes JMP 70FA000A .text C:\WINDOWS\system32\wscntfy.exe[3008] ADVAPI32.dll!RegOpenKeyW 77DD7946 6 Bytes JMP 70FD000A .text C:\WINDOWS\system32\wscntfy.exe[3008] ADVAPI32.dll!OpenProcessToken 77DD798B 6 Bytes JMP 709D000A .text C:\WINDOWS\system32\wscntfy.exe[3008] ADVAPI32.dll!RegQueryValueExA 77DD7ABB 6 Bytes JMP 70E8000A .text C:\WINDOWS\system32\wscntfy.exe[3008] ADVAPI32.dll!RegSetValueExW 77DDD767 6 Bytes JMP 70F1000A .text C:\WINDOWS\system32\wscntfy.exe[3008] ADVAPI32.dll!RegQueryValueW 77DDD87A 6 Bytes JMP 70EB000A .text C:\WINDOWS\system32\wscntfy.exe[3008] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 6 Bytes JMP 710C000A .text C:\WINDOWS\system32\wscntfy.exe[3008] ADVAPI32.dll!RegSetValueExA 77DDEAE7 6 Bytes JMP 70F4000A .text C:\WINDOWS\system32\wscntfy.exe[3008] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 6 Bytes JMP 7100000A .text C:\WINDOWS\system32\wscntfy.exe[3008] ADVAPI32.dll!AdjustTokenPrivileges 77DDF00C 6 Bytes JMP 7094000A .text C:\WINDOWS\system32\wscntfy.exe[3008] ADVAPI32.dll!RegDeleteKeyA 77DE42A0 6 Bytes JMP 7070000A .text C:\WINDOWS\system32\wscntfy.exe[3008] ADVAPI32.dll!RegDeleteKeyW 77DE559B 6 Bytes JMP 706D000A .text C:\WINDOWS\system32\wscntfy.exe[3008] ADVAPI32.dll!OpenSCManagerW 77DE6F55 6 Bytes JMP 70CD000A .text C:\WINDOWS\system32\wscntfy.exe[3008] ADVAPI32.dll!OpenSCManagerA 77DF69AE 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\wscntfy.exe[3008] ADVAPI32.dll!OpenSCManagerA + 4 77DF69B2 2 Bytes [CF, 70] .text C:\WINDOWS\system32\wscntfy.exe[3008] ADVAPI32.dll!LookupPrivilegeValueW 77DFB8DF 6 Bytes JMP 7097000A .text C:\WINDOWS\system32\wscntfy.exe[3008] ADVAPI32.dll!RegCreateKeyW 77DFBA55 6 Bytes JMP 7103000A .text C:\WINDOWS\system32\wscntfy.exe[3008] ADVAPI32.dll!RegQueryValueA 77DFBB8D 6 Bytes JMP 70EE000A .text C:\WINDOWS\system32\wscntfy.exe[3008] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 6 Bytes JMP 7106000A .text C:\WINDOWS\system32\wscntfy.exe[3008] ADVAPI32.dll!LookupPrivilegeValueA 77DFC238 6 Bytes JMP 709A000A .text C:\WINDOWS\system32\wscntfy.exe[3008] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 7169000A .text C:\WINDOWS\system32\wscntfy.exe[3008] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 7121000A .text C:\WINDOWS\system32\wscntfy.exe[3008] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 711E000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] ntdll.dll!NtLoadDriver 7C90D46E 3 Bytes [FF, 25, 1E] .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] ntdll.dll!NtLoadDriver + 4 7C90D472 2 Bytes [1B, 71] .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] ntdll.dll!NtSuspendProcess 7C90DE2E 3 Bytes [FF, 25, 1E] .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] ntdll.dll!NtSuspendProcess + 4 7C90DE32 2 Bytes [33, 71] .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!DeviceIoControl 7C801629 6 Bytes JMP 70A4000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!CreateFileA 7C801A28 6 Bytes JMP 70D7000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!VirtualProtectEx 7C801A61 6 Bytes JMP 711F000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!VirtualProtect 7C801AD4 6 Bytes JMP 70CB000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!LoadLibraryExW 7C801AF5 6 Bytes JMP 716C000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!LoadLibraryA 7C801D7B 6 Bytes JMP 7158000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 7166000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!WriteProcessMemory 7C802213 6 Bytes JMP 7163000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 7149000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 714C000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!VirtualAlloc 7C809AF1 6 Bytes JMP 70CE000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!MultiByteToWideChar 7C809C98 6 Bytes JMP 707D000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!LoadResource 7C80A055 6 Bytes JMP 70B9000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!WideCharToMultiByte 7C80A174 6 Bytes JMP 705C000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!GetProcAddress 7C80AE40 6 Bytes JMP 710D000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!LoadLibraryW 7C80AEEB 6 Bytes JMP 7155000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!CreateMutexW 7C80E957 6 Bytes JMP 7086000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!CreateMutexA 7C80E9DF 6 Bytes JMP 7089000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!OpenMutexW 7C80EA35 6 Bytes JMP 7080000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!OpenMutexA 7C80EABB 6 Bytes JMP 7083000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!GetVolumeInformationW 7C80FA85 6 Bytes JMP 7107000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E] .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [6E, 71] .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!CreateThread 7C8106D7 6 Bytes JMP 70D1000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!CreateFileW 7C810800 6 Bytes JMP 70DA000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!WriteFile 7C810E27 6 Bytes JMP 709B000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!TerminateThread 7C81CB3B 6 Bytes JMP 7131000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!MoveFileW 7C821261 6 Bytes JMP 7056000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!CreateDirectoryA 7C8217AC 6 Bytes JMP 70A1000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!GetVolumeInformationA 7C821BA5 6 Bytes JMP 710A000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 70AD000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!CopyFileA 7C8286EE 6 Bytes JMP 70B6000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!CopyFileW 7C82F87B 6 Bytes JMP 70B3000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!OpenProcess 7C8309E9 6 Bytes JMP 704D000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!DeleteFileA 7C831EDD 6 Bytes JMP 706E000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!DeleteFileW 7C831F63 6 Bytes JMP 706B000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!CreateDirectoryW 7C832402 6 Bytes JMP 709E000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!MoveFileExW 7C83568B 6 Bytes JMP 7050000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!MoveFileA 7C835EBF 6 Bytes JMP 7059000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!DebugActiveProcess 7C85B0FB 6 Bytes JMP 712E000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!MoveFileExA 7C85E49B 6 Bytes JMP 7053000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!CopyFileExA 7C85F39C 6 Bytes JMP 70B0000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!WinExec 7C86250D 6 Bytes JMP 713A000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!SetThreadContext 7C863C09 6 Bytes JMP 7098000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] kernel32.dll!CreateToolhelp32Snapshot 7C865C7F 6 Bytes JMP 70D4000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 6 Bytes JMP 70EF000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] ADVAPI32.dll!RegQueryValueExW 77DD6FFF 6 Bytes JMP 70DD000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] ADVAPI32.dll!RegCreateKeyExW 77DD776C 6 Bytes JMP 7101000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] ADVAPI32.dll!RegOpenKeyExA 77DD7852 6 Bytes JMP 70F2000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] ADVAPI32.dll!RegOpenKeyW 77DD7946 6 Bytes JMP 70F5000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] ADVAPI32.dll!OpenProcessToken 77DD798B 6 Bytes JMP 7095000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] ADVAPI32.dll!RegQueryValueExA 77DD7ABB 6 Bytes JMP 70E0000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] ADVAPI32.dll!RegSetValueExW 77DDD767 6 Bytes JMP 70E9000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] ADVAPI32.dll!RegQueryValueW 77DDD87A 6 Bytes JMP 70E3000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 6 Bytes JMP 7104000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] ADVAPI32.dll!RegSetValueExA 77DDEAE7 6 Bytes JMP 70EC000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 6 Bytes JMP 70F8000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] ADVAPI32.dll!AdjustTokenPrivileges 77DDF00C 6 Bytes JMP 708C000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] ADVAPI32.dll!RegDeleteKeyA 77DE42A0 6 Bytes JMP 7068000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] ADVAPI32.dll!RegDeleteKeyW 77DE559B 6 Bytes JMP 7065000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] ADVAPI32.dll!OpenSCManagerW 77DE6F55 6 Bytes JMP 70C5000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] ADVAPI32.dll!OpenSCManagerA 77DF69AE 3 Bytes [FF, 25, 1E] .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] ADVAPI32.dll!OpenSCManagerA + 4 77DF69B2 2 Bytes [C7, 70] .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] ADVAPI32.dll!LookupPrivilegeValueW 77DFB8DF 6 Bytes JMP 708F000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] ADVAPI32.dll!RegCreateKeyW 77DFBA55 6 Bytes JMP 70FB000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] ADVAPI32.dll!RegQueryValueA 77DFBB8D 6 Bytes JMP 70E6000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 6 Bytes JMP 70FE000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] ADVAPI32.dll!LookupPrivilegeValueA 77DFC238 6 Bytes JMP 7092000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] ADVAPI32.dll!LsaRemoveAccountRights 77E1AC91 6 Bytes JMP 7169000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 7119000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 7116000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E2154D5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] USER32.dll!SetWindowsHookExW 7E42820F 6 Bytes JMP 714F000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] USER32.dll!SetWindowTextW 7E42960E 6 Bytes JMP 705F000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] USER32.dll!GetKeyState 7E429ED9 6 Bytes JMP 712B000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] USER32.dll!GetWindowTextW 7E42A5CD 6 Bytes JMP 70BF000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 7128000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] USER32.dll!ShowWindow 7E42AF56 3 Bytes [FF, 25, 1E] .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] USER32.dll!ShowWindow + 4 7E42AF5A 2 Bytes [BB, 70] .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] USER32.dll!CallNextHookEx 7E42B3C6 5 Bytes JMP 3E2DD125 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] USER32.dll!CreateWindowExW 7E42D0A3 6 Bytes JMP 7071000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E] .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [24, 71] {AND AL, 0x71} .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 3E25467E C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] USER32.dll!DrawTextW 7E42D7E2 6 Bytes JMP 7077000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] USER32.dll!CreateWindowExA 7E42E4A9 6 Bytes JMP 7074000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] USER32.dll!SetWindowTextA 7E42F56B 6 Bytes JMP 7062000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] USER32.dll!SetWindowsHookExA 7E431211 6 Bytes JMP 7152000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] USER32.dll!SetWinEventHook 7E4317F7 6 Bytes JMP 7113000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E53C7 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] USER32.dll!GetWindowTextA 7E43216B 6 Bytes JMP 70C2000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E52F9 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E5364 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] USER32.dll!DrawTextA 7E43C702 6 Bytes JMP 707A000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E51CA C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E522C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E542A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] USER32.dll!DdeConnect 7E4581C3 6 Bytes JMP 7122000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] USER32.dll!EndTask 7E45A0A5 6 Bytes JMP 7137000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E528E C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] USER32.dll!RegisterRawInputDevices 7E46CE0E 3 Bytes [FF, 25, 1E] .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] USER32.dll!RegisterRawInputDevices + 4 7E46CE12 2 Bytes [0F, 71] .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] SHELL32.dll!ShellExecuteExW 7CA098CB 6 Bytes JMP 713D000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] SHELL32.dll!Shell_NotifyIcon 7CA28BC6 6 Bytes JMP 70AA000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] SHELL32.dll!Shell_NotifyIconW 7CA2A537 6 Bytes JMP 70A7000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] SHELL32.dll!ShellExecuteEx 7CA40E45 6 Bytes JMP 7140000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] SHELL32.dll!ShellExecuteA 7CA41170 6 Bytes JMP 7146000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] SHELL32.dll!ShellExecuteW 7CAB5D48 6 Bytes JMP 7143000A .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] ole32.dll!CoCreateInstance 774FF1BC 5 Bytes JMP 3E2EDBB8 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[3184] ole32.dll!OleLoadFromStream 7752983B 5 Bytes JMP 3E3E572F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

ASWmbr scan below. Note the thumb/flash drives were not connected. I'll scan again with them in so there will be TWO log files of results, maybe you will see some difference. aswMBR version 0.9.9.1124 Copyright© 2011 AVAST Software Run date: 2012-01-01 07:45:19 —————————– 07:45:19.843 OS Version: Windows 5.1.2600 Service Pack 3 07:45:19.843 Number of processors: 1 586 0x209 07:45:19.843 ComputerName: - UserName: 07:45:39.343 Initialize success 07:46:20.953 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 07:46:20.953 Disk 0 Vendor: FUJITSU_MHS2040AT__D 3005 Size: 38154MB BusType: 3 07:46:20.984 Disk 0 MBR read successfully 07:46:21.000 Disk 0 MBR scan 07:46:21.000 Disk 0 unknown MBR code 07:46:21.015 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 38146 MB offset 63 07:46:21.046 Disk 0 scanning sectors +78124095 07:46:21.187 Disk 0 scanning C:\WINDOWS\system32\drivers 07:46:50.312 Service scanning 07:46:54.406 Modules scanning 07:47:40.062 Disk 0 trace - called modules: 07:47:40.109 ntoskrnl.exe CLASSPNP.SYS disk.sys iomdisk.sys hal.dll ACPI.sys atapi.sys pciide.sys 07:47:40.125 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x88b2cab8] 07:47:40.140 3 CLASSPNP.SYS[ba108fd7] -> nt!IofCallDriver -> [0x88bcdd78] 07:47:40.703 5 iomdisk.sys[ba340bc3] -> nt!IofCallDriver -> \Device\00000085[0x88bcf9e8] 07:47:40.718 7 ACPI.sys[ba05f620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x88b74940] 07:47:40.734 Scan finished successfully 07:48:12.968 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\User 1\Desktop\MBR.dat" 07:48:13.093 The log file has been saved successfully to "C:\Documents and Settings\User 1\Desktop\aswMBR.txt" aswMBR version 0.9.9.1124 Copyright© 2011 AVAST Software Run date: 2012-01-01 07:50:27 —————————– 07:50:27.750 OS Version: Windows 5.1.2600 Service Pack 3 07:50:27.750 Number of processors: 1 586 0x209 07:50:27.750 ComputerName: - UserName: 07:50:28.671 Initialize success 07:50:51.187 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 07:50:51.203 Disk 0 Vendor: FUJITSU_MHS2040AT__D 3005 Size: 38154MB BusType: 3 07:50:51.218 Disk 0 MBR read successfully 07:50:51.218 Disk 0 MBR scan 07:50:51.234 Disk 0 unknown MBR code 07:50:51.234 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 38146 MB offset 63 07:50:51.265 Disk 0 scanning sectors +78124095 07:50:51.421 Disk 0 scanning C:\WINDOWS\system32\drivers 07:51:38.640 Service scanning 07:51:43.015 Modules scanning 07:52:30.578 Disk 0 trace - called modules: 07:52:30.640 ntoskrnl.exe CLASSPNP.SYS disk.sys iomdisk.sys hal.dll ACPI.sys atapi.sys pciide.sys 07:52:30.656 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x88b2cab8] 07:52:30.671 3 CLASSPNP.SYS[ba108fd7] -> nt!IofCallDriver -> [0x88bcdd78] 07:52:31.203 5 iomdisk.sys[ba340bc3] -> nt!IofCallDriver -> \Device\00000085[0x88bcf9e8] 07:52:31.218 7 ACPI.sys[ba05f620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x88b74940] 07:52:31.234 Scan finished successfully 07:52:42.500 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\User 1\Desktop\MBR.dat" 07:52:42.531 The log file has been saved successfully to "C:\Documents and Settings\User 1\Desktop\aswMBR2.txt"

Jintan, To acknowledge your last point, yes, we can uninstall the older version of AVG and any other apps/files you suggest. Am glad to recover the hard drive space. Am also looking to replace AVG with Avast! or some other free anti-virus. Since Malwarebytes did not detect any of this activity despite multiple scan every week (3-4), should we look to replace Malwarebytes too? paultpa