[Closed] Your Computer Is In Danger Virus.

Hi! Welcome to the WTT forums.
I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research.
Please be patient and I'd be grateful if you would note the following:

• I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for this issue on this machine.
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• It's often worth reading through these instructions and printing them for ease of reference.
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
• Please reply to this thread. Do not start a new topic.

Please make a uninstall list using HijackThis
To access the Uninstall Manager you would do the following:

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.
5. Click on the Save list… button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here in a reply.

Download and Run ComboFix

• Download this file from below:
  
  Here
  
• Disconnect from the Internet, than disable your anti-virus and any real-time anti-spyware monitors that are running.
• Then double click combofix.exe & follow the prompts.
• When finished, it shall produce a log for you. Post that log in your next reply with a new HijackThis log.

Note 1: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
Note 2:Remember to re-enable your anti-virus and anti-spyware before reconnecting to the Internet.

Scotty, I very much appreciate you taking your time and helping me.I think I might've made this topic a bit to quick. I checked the pinned topics and downloaded Adware and Spybot, Spybot fixed by wallpaper problem. If you can, though, Can you still check my logs? ComboFix 07-09-08.8 - "Donald" 2007-09-08 4:37:43.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.243 [GMT -7:00] * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\DOCUME~1\Donald\APPLIC~1\CURITY~1 C:\DOCUME~1\Donald\APPLIC~1\Sskdmns.dll C:\Documents and Settings\All Users.\documents\settings C:\Documents and Settings\All Users.\documents\settings\desktop.ini C:\Program Files\Common Files\{30346~1 C:\Program Files\Common Files\{50346~1 C:\Program Files\Common Files\{50346~1\directordll.lzma C:\Program Files\Common Files\{50346~1\directorexe.lzma C:\Program Files\Common Files\{50346~2 C:\Program Files\curity~1 C:\Program Files\curity~1\??curity\ C:\Program Files\sstem~1 C:\WINDOWS\cfg32.exe C:\WINDOWS\cfg32a.exe C:\WINDOWS\keyboard1.dat C:\WINDOWS\mirarsetup_876075.exe C:\WINDOWS\system32\a.exe C:\WINDOWS\system32\dd.exe C:\WINDOWS\system32\mstsdsc.exe C:\WINDOWS\system32\systen32.exe C:\WINDOWS\system32\unsvchosts.lzma C:\WINDOWS\system32\v6.exe C:\WINDOWS\system32\wapicc.exe C:\WINDOWS\uni_e6h.exe ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) ——-\LEGACY_NPF ——-\LEGACY_NTMLSVC ——-\LEGACY_WINDOWS_OVERLAY_COMPONENTS ——-\NtmlSvc ((((((((((((((((((((((((( Files Created from 2007-08-08 to 2007-09-08 ))))))))))))))))))))))))))))))) . 2007-09-08 04:33 51,200 –a—— C:\WINDOWS\NirCmd.exe 2007-09-08 03:03 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy 2007-09-08 02:42 d——– C:\Program Files\Lavasoft 2007-09-08 02:42 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft 2007-09-08 02:41 d——– C:\Program Files\Common Files\Wise Installation Wizard . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-09-08 00:18 ——— d——– C:\Program Files\Warcraft III 2007-08-31 18:08 ——— d——– C:\Program Files\LimeWire 2007-08-29 19:08 ——— d——– C:\Program Files\Starcraft 2007-08-07 22:42 ——— d——– C:\Program Files\Microsoft Games 2007-08-07 13:58 8320 –a—— C:\WINDOWS\system32\drivers\AWRTRD.sys 2007-08-07 13:56 9344 –a—— C:\WINDOWS\system32\drivers\NSDriver.sys 2007-08-06 16:35 ——— d——– C:\Program Files\Opera Ad-Aware 2007 Adobe Flash Player 9 ActiveX Backup Dell-Installed Programs CA Anti-Virus ComcastSUPPORT ConnectionServices Counter-Strike: Source Hijackthis 1.99.1 HijackThis 1.99.1 Hotfix for Windows XP (KB926239) J2SE Runtime Environment 5.0 Update 3 LimeWire PRO 4.12.15 Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Halo Trial Microsoft User-Mode Driver Framework Feature Pack 1.0 Mozilla Firefox (2.0.0.6) MSXML 4.0 SP2 Parser and SDK Santa Cruz Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player 9 (KB911565) Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893066) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896422) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB896688) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899591) Security Update for Windows XP (KB900725) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB901214) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB904706) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905749) Security Update for Windows XP (KB905915) Security Update for Windows XP (KB908519) Security Update for Windows XP (KB911567) Security Update for Windows XP (KB911927) Security Update for Windows XP (KB912919) Security Update for Windows XP (KB913446) Spybot - Search & Destroy 1.4 Starcraft Steam Update for Windows XP (KB894391) Update for Windows XP (KB898461) Update for Windows XP (KB910437) USB Dual Vibration Joystick Windows Installer 3.1 (KB893803) Windows Media Format 11 runtime Windows Media Format 11 runtime Windows Media Player 11 Windows Media Player 11 Windows XP Hotfix - KB873339 Windows XP Hotfix - KB885250 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB886185 Windows XP Hotfix - KB887472 Windows XP Hotfix - KB887742 Windows XP Hotfix - KB888113 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB891781 Windows XP Service Pack 2 WinRAR archiver

Hi I need the whole of the Combofix log and a new HijackThis log.

Hi Scotty I tried to copy paste it all, But it said my post was too long. Ack, I tried to upload it but it also said the second file (gmerrk) was to big. I cant upload any of the logs, before I can post it says there are too many words. Sorry for the problems, ill keep trying though.

You can split the GMER report over different posts or attachments. Im looking for some new bedtime reading.

.text C:\WINDOWS\System32\svchost.exe[228] kernel32.dll!Process32First + 2 7C863A8F 9 Bytes JMP 2A06B371 .text C:\WINDOWS\System32\svchost.exe[228] kernel32.dll!Process32NextW + 2 7C863B61 6 Bytes JMP 2A06D6F2 .text C:\WINDOWS\System32\svchost.exe[228] kernel32.dll!Process32Next + 2 7C863C02 9 Bytes JMP 2A06FE03 .text C:\WINDOWS\System32\svchost.exe[228] kernel32.dll!Thread32First + 2 7C863CD4 6 Bytes JMP 2A07198F .text C:\WINDOWS\System32\svchost.exe[228] kernel32.dll!Thread32Next + 2 7C863D88 6 Bytes JMP 2A06CD26 .text C:\WINDOWS\System32\svchost.exe[228] kernel32.dll!Module32FirstW + 2 7C863E21 6 Bytes JMP 2A06CE4E .text C:\WINDOWS\System32\svchost.exe[228] kernel32.dll!Module32First + 2 7C863EDA 9 Bytes JMP 2A0717BB .text C:\WINDOWS\System32\svchost.exe[228] kernel32.dll!Module32NextW + 2 7C863FBE 6 Bytes JMP 2A06EB42 .text C:\WINDOWS\System32\svchost.exe[228] kernel32.dll!Module32Next + 2 7C86405F 9 Bytes JMP 2A070928 .text C:\WINDOWS\System32\svchost.exe[228] kernel32.dll!GetBinaryTypeW 7C86783C 5 Bytes JMP 2A06E8F2 .text C:\WINDOWS\System32\svchost.exe[228] kernel32.dll!GetBinaryType + 2 7C867C9D 6 Bytes JMP 2A06B30C .text C:\WINDOWS\System32\svchost.exe[228] ADVAPI32.dll!RegOpenKeyExW + 2 77DD6A7A 6 Bytes JMP 2A06DBF0 .text C:\WINDOWS\System32\svchost.exe[228] ADVAPI32.dll!RegCloseKey + 2 77DD6BF2 6 Bytes JMP 2A06FA92 .text C:\WINDOWS\System32\svchost.exe[228] ADVAPI32.dll!RegQueryValueExW + 2 77DD6FCA 6 Bytes JMP 2A07133B .text C:\WINDOWS\System32\svchost.exe[228] ADVAPI32.dll!RegCreateKeyExW + 2 77DD7537 6 Bytes JMP 2A06E09C .text C:\WINDOWS\System32\svchost.exe[228] ADVAPI32.dll!RegOpenKeyExA + 2 77DD761D 6 Bytes JMP 2A06AD1F .text C:\WINDOWS\System32\svchost.exe[228] ADVAPI32.dll!RegQueryValueExA + 2 77DD7885 6 Bytes JMP 2A06FF4D .text C:\WINDOWS\System32\svchost.exe[228] ADVAPI32.dll!RegEnumValueW + 2 77DD8083 6 Bytes JMP 2A06FBDE .text C:\WINDOWS\System32\svchost.exe[228] ADVAPI32.dll!RegSetValueExW 77DDD7CC 7 Bytes JMP 2A06BB37 .text C:\WINDOWS\System32\svchost.exe[228] ADVAPI32.dll!RegQueryValueW + 2 77DDD8E4 6 Bytes JMP 2A06D047 .text C:\WINDOWS\System32\svchost.exe[228] ADVAPI32.dll!RegCreateKeyExA + 2 77DDEAF6 6 Bytes JMP 2A06EC4F .text C:\WINDOWS\System32\svchost.exe[228] ADVAPI32.dll!RegSetValueExA 77DDEBE7 7 Bytes JMP 2A06E1B0 .text C:\WINDOWS\System32\svchost.exe[228] ADVAPI32.dll!RegDeleteValueA + 2 77DDEDE7 6 Bytes JMP 2A06CE2B .text C:\WINDOWS\System32\svchost.exe[228] ADVAPI32.dll!RegDeleteValueW + 2 77DDEEF3 6 Bytes JMP 2A06B4CF .text C:\WINDOWS\System32\svchost.exe[228] ADVAPI32.dll!RegSetValueA + 2 77DE6F4B 5 Bytes JMP 2A071742 .text C:\WINDOWS\System32\svchost.exe[228] ADVAPI32.dll!SetFileSecurityW + 2 77DEAA6B 6 Bytes JMP 2A06C166 .text C:\WINDOWS\System32\svchost.exe[228] ADVAPI32.dll!RegEnumValueA + 2 77DECF4C 6 Bytes JMP 2A06F819 .text C:\WINDOWS\System32\svchost.exe[228] ADVAPI32.dll!SetNamedSecurityInfoW + 2 77DF1287 6 Bytes JMP 2A070675 .text C:\WINDOWS\System32\svchost.exe[228] ADVAPI32.dll!CreateProcessAsUserW + 2 77DF7777 6 Bytes JMP 2A06916A .text C:\WINDOWS\System32\svchost.exe[228] ADVAPI32.dll!RegDeleteKeyW + 2 77DF9886 6 Bytes JMP 2A06C217 .text C:\WINDOWS\System32\svchost.exe[228] ADVAPI32.dll!GetFileSecurityW + 2 77DFBCE0 6 Bytes JMP 2A06AAAE .text C:\WINDOWS\System32\svchost.exe[228] ADVAPI32.dll!RegDeleteKeyA + 2 77DFC125 6 Bytes JMP 2A06F92F .text C:\WINDOWS\System32\svchost.exe[228] ADVAPI32.dll!RegQueryInfoKeyA + 2 77DFC1B7 6 Bytes JMP 2A06BFBB .text C:\WINDOWS\System32\svchost.exe[228] ADVAPI32.dll!RegOpenKeyA + 2 77DFC41D 6 Bytes JMP 2A06EBE5 .text C:\WINDOWS\System32\svchost.exe[228] ADVAPI32.dll!RegQueryValueA + 2 77DFCC12 6 Bytes JMP 2A06CE1E .text C:\WINDOWS\System32\svchost.exe[228] ADVAPI32.dll!RegQueryInfoKeyW + 2 77DFCCF1 6 Bytes JMP 2A070653 .text C:\WINDOWS\System32\svchost.exe[228] ADVAPI32.dll!GetNamedSecurityInfoW + 2 77DFD07A 7 Bytes JMP 2A06E77A .text C:\WINDOWS\System32\svchost.exe[228] ADVAPI32.dll!RegCreateKeyA + 2 77DFD5BD 6 Bytes JMP 2A06CB64 .text C:\WINDOWS\System32\svchost.exe[228] ADVAPI32.dll!SetFileSecurityA + 2 77E0D2FF 5 Bytes JMP 2A06D68C .text C:\WINDOWS\System32\svchost.exe[228] ADVAPI32.dll!GetFileSecurityA + 2 77E0D365 5 Bytes JMP 2A070262 .text C:\WINDOWS\System32\svchost.exe[228] ADVAPI32.dll!CreateProcessAsUserA + 2 77E1095A 6 Bytes JMP 2A069FF5 .text C:\WINDOWS\System32\svchost.exe[228] ADVAPI32.dll!CreateProcessWithLogonW 77E15C9D 5 Bytes JMP 2A069783 .text C:\WINDOWS\System32\svchost.exe[228] ADVAPI32.dll!GetNamedSecurityInfoA + 2 77E21546 7 Bytes JMP 2A071697 .text C:\WINDOWS\System32\svchost.exe[228] ADVAPI32.dll!SetNamedSecurityInfoA + 2 77E21592 7 Bytes JMP 2A071978 .text C:\WINDOWS\System32\svchost.exe[228] ADVAPI32.dll!RegQueryMultipleValuesA + 2 77E3553D 6 Bytes JMP 2A06EEEE .text C:\WINDOWS\System32\svchost.exe[228] ADVAPI32.dll!RegQueryMultipleValuesW + 2 77E3589F 6 Bytes JMP 2A06C056 .text C:\WINDOWS\System32\svchost.exe[228] ADVAPI32.dll!RegSetValueW + 2 77E35FC4 5 Bytes JMP 2A070B68 .text C:\WINDOWS\System32\svchost.exe[228] USER32.dll!ExitWindowsEx + 2 77D89E2F 6 Bytes JMP 2A0699C2 .text C:\WINDOWS\System32\svchost.exe[228] WS2_32.dll!connect + 2 71AB406C 6 Bytes JMP 2A06A915 .text C:\WINDOWS\System32\svchost.exe[228] WS2_32.dll!gethostbyname + 2 71AB4FD6 9 Bytes JMP 2A06A665 .text C:\WINDOWS\System32\svchost.exe[228] WS2_32.dll!WSAAsyncGetHostByName + 2 71ABE987 13 Bytes [ 9F, 4A, 48, FC, 90, FC, 37, … ] .text C:\WINDOWS\System32\svchost.exe[228] WS2_32.dll!WSAConnect + 2 71AC0C6B 14 Bytes [ 49, 4A, 3F, 99, 91, 2F, 37, … ] .text C:\WINDOWS\System32\svchost.exe[564] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 2A06FA41 .text C:\WINDOWS\System32\svchost.exe[564] ntdll.dll!NtQueryInformationFile 7C90DFDC 5 Bytes JMP 2A06CC56 .text C:\WINDOWS\System32\svchost.exe[564] ntdll.dll!NtQuerySystemInformation 7C90E1AA 5 Bytes JMP 2A070C70 .text C:\WINDOWS\System32\svchost.exe[564] ntdll.dll!NtReadVirtualMemory 7C90E2BB 5 Bytes JMP 2A06C25F .text C:\WINDOWS\System32\svchost.exe[564] ntdll.dll!NtVdmControl 7C90E975 5 Bytes JMP 2A06BEBE .text C:\WINDOWS\System32\svchost.exe[564] ntdll.dll!NtWriteVirtualMemory 7C90EA32 5 Bytes JMP 2A06AC45 .text C:\WINDOWS\System32\svchost.exe[564] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 2A0687F2 .text C:\WINDOWS\System32\svchost.exe[564] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 2A06A0D0 .text C:\WINDOWS\System32\svchost.exe[564] ntdll.dll!RtlQueryProcessDebugInformation + 2 7C9538ED 6 Bytes JMP 2A06B483 .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!CreateFileA + 2 7C801A26 6 Bytes JMP 2A06C5DF .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!LoadLibraryExW 7C801AF1 7 Bytes JMP 2A0689C9 .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!LoadLibraryExA + 2 7C801D51 6 Bytes JMP 2A067CDE .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!LoadLibraryA + 2 7C801D79 7 Bytes JMP 2A06863A .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!ReadProcessMemory + 2 7C8021CE 6 Bytes JMP 2A06FD37 .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!WriteProcessMemory + 2 7C802211 5 Bytes JMP 2A06E8FF .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!CreateProcessW + 2 7C802334 5 Bytes JMP 2A068E75 .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!CreateProcessA + 2 7C802369 5 Bytes JMP 2A06803F .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!FreeLibrary + 2 7C80AA68 7 Bytes JMP 2A069DE4 .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!GetProcAddress + 2 7C80AC2A 5 Bytes JMP 2A069C47 .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!LoadLibraryW + 2 7C80ACD5 5 Bytes JMP 2A06A1E2 .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!GetFileAttributesW + 2 7C80B5D6 6 Bytes JMP 2A06C14F .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!FreeLibraryAndExitThread + 2 7C80CEA3 6 Bytes JMP 2A069E7D .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!FindFirstFileExW + 2 7C80EC7F 9 Bytes JMP 2A06FA2C .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!FindFirstFileW + 2 7C80F0E3 5 Bytes JMP 2A070FD3 .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!FindNextFileW 7C80F13A 7 Bytes JMP 2A0702C9 .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!CreateFileW + 2 7C810978 6 Bytes JMP 2A06BE72 .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!GetFileAttributesExW + 2 7C81130F 6 Bytes JMP 2A06EAE3 .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!GetFileAttributesA + 2 7C81174E 6 Bytes JMP 2A06EBC4 .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!GetFileAttributesExA + 2 7C813533 6 Bytes JMP 2A07158F .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!FindFirstFileA + 2 7C81355B 9 Bytes JMP 2A06EDFD .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!ExitProcess + 2 7C81CAA4 5 Bytes JMP 2A068826 .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!OpenProcess + 2 7C81E07B 6 Bytes JMP 2A070AC2 .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!DeleteFileA + 2 7C81E85E 6 Bytes JMP 2A06B2D3 .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!DeleteFileW + 2 7C81F73F 6 Bytes JMP 2A06BA7B .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!SetFileAttributesA + 2 7C81FB46 6 Bytes JMP 2A06B184 .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!SetFileAttributesW + 2 7C81FC07 6 Bytes JMP 2A06EAC6 .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!MoveFileWithProgressW 7C821565 5 Bytes JMP 2A06D603 .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!MoveFileWithProgressA + 2 7C8222B5 6 Bytes JMP 2A06FECF .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!OpenFile 7C826B99 5 Bytes JMP 2A06D4C6 .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!FindNextFileA + 2 7C83901B 9 Bytes JMP 2A06F24F .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!MoveFileExW + 2 7C839921 6 Bytes JMP 2A06FC93 .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!FindFirstFileExA + 2 7C85C2F4 9 Bytes JMP 2A06EF85 .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!MoveFileExA + 2 7C85D2A5 6 Bytes JMP 2A070BDD .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!_lopen + 2 7C85E612 6 Bytes JMP 2A06C856 .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!WinExec + 2 7C86114F 6 Bytes JMP 2A069341 .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!Process32FirstW + 2 7C8639D6 6 Bytes JMP 2A06CB00 .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!Process32First + 2 7C863A8F 9 Bytes JMP 2A06B371 .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!Process32NextW + 2 7C863B61 6 Bytes JMP 2A06D6F2 .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!Process32Next + 2 7C863C02 9 Bytes JMP 2A06FE03 .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!Thread32First + 2 7C863CD4 6 Bytes JMP 2A07198F .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!Thread32Next + 2 7C863D88 6 Bytes JMP 2A06CD26 .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!Module32FirstW + 2 7C863E21 6 Bytes JMP 2A06CE4E .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!Module32First + 2 7C863EDA 9 Bytes JMP 2A0717BB .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!Module32NextW + 2 7C863FBE 6 Bytes JMP 2A06EB42 .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!Module32Next + 2 7C86405F 9 Bytes JMP 2A070928 .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!GetBinaryTypeW 7C86783C 5 Bytes JMP 2A06E8F2 .text C:\WINDOWS\System32\svchost.exe[564] kernel32.dll!GetBinaryType + 2 7C867C9D 6 Bytes JMP 2A06B30C .text C:\WINDOWS\System32\svchost.exe[564] ADVAPI32.dll!RegOpenKeyExW + 2 77DD6A7A 6 Bytes JMP 2A06DBF0 .text C:\WINDOWS\System32\svchost.exe[564] ADVAPI32.dll!RegCloseKey + 2 77DD6BF2 6 Bytes JMP 2A06FA92 .text C:\WINDOWS\System32\svchost.exe[564] ADVAPI32.dll!RegQueryValueExW + 2 77DD6FCA 6 Bytes JMP 2A07133B .text C:\WINDOWS\System32\svchost.exe[564] ADVAPI32.dll!RegCreateKeyExW + 2 77DD7537 6 Bytes JMP 2A06E09C .text C:\WINDOWS\System32\svchost.exe[564] ADVAPI32.dll!RegOpenKeyExA + 2 77DD761D 6 Bytes JMP 2A06AD1F .text C:\WINDOWS\System32\svchost.exe[564] ADVAPI32.dll!RegQueryValueExA + 2 77DD7885 6 Bytes JMP 2A06FF4D .text C:\WINDOWS\System32\svchost.exe[564] ADVAPI32.dll!RegEnumValueW + 2 77DD8083 6 Bytes JMP 2A06FBDE .text C:\WINDOWS\System32\svchost.exe[564] ADVAPI32.dll!RegSetValueExW 77DDD7CC 7 Bytes JMP 2A06BB37 .text C:\WINDOWS\System32\svchost.exe[564] ADVAPI32.dll!RegQueryValueW + 2 77DDD8E4 6 Bytes JMP 2A06D047 .text C:\WINDOWS\System32\svchost.exe[564] ADVAPI32.dll!RegCreateKeyExA + 2 77DDEAF6 6 Bytes JMP 2A06EC4F .text C:\WINDOWS\System32\svchost.exe[564] ADVAPI32.dll!RegSetValueExA 77DDEBE7 7 Bytes JMP 2A06E1B0 .text C:\WINDOWS\System32\svchost.exe[564] ADVAPI32.dll!RegDeleteValueA + 2 77DDEDE7 6 Bytes JMP 2A06CE2B .text C:\WINDOWS\System32\svchost.exe[564] ADVAPI32.dll!RegDeleteValueW + 2 77DDEEF3 6 Bytes JMP 2A06B4CF .text C:\WINDOWS\System32\svchost.exe[564] ADVAPI32.dll!RegSetValueA + 2 77DE6F4B 5 Bytes JMP 2A071742 .text C:\WINDOWS\System32\svchost.exe[564] ADVAPI32.dll!SetFileSecurityW + 2 77DEAA6B 6 Bytes JMP 2A06C166 .text C:\WINDOWS\System32\svchost.exe[564] ADVAPI32.dll!RegEnumValueA + 2 77DECF4C 6 Bytes JMP 2A06F819 .text C:\WINDOWS\System32\svchost.exe[564] ADVAPI32.dll!SetNamedSecurityInfoW + 2 77DF1287 6 Bytes JMP 2A070675 .text C:\WINDOWS\System32\svchost.exe[564] ADVAPI32.dll!CreateProcessAsUserW + 2 77DF7777 6 Bytes JMP 2A06916A .text C:\WINDOWS\System32\svchost.exe[564] ADVAPI32.dll!RegDeleteKeyW + 2 77DF9886 6 Bytes JMP 2A06C217 .text C:\WINDOWS\System32\svchost.exe[564] ADVAPI32.dll!GetFileSecurityW + 2 77DFBCE0 6 Bytes JMP 2A06AAAE .text C:\WINDOWS\System32\svchost.exe[564] ADVAPI32.dll!RegDeleteKeyA + 2 77DFC125 6 Bytes JMP 2A06F92F .text C:\WINDOWS\System32\svchost.exe[564] ADVAPI32.dll!RegQueryInfoKeyA + 2 77DFC1B7 6 Bytes JMP 2A06BFBB .text C:\WINDOWS\System32\svchost.exe[564] ADVAPI32.dll!RegOpenKeyA + 2 77DFC41D 6 Bytes JMP 2A06EBE5 .text C:\WINDOWS\System32\svchost.exe[564] ADVAPI32.dll!RegQueryValueA + 2 77DFCC12 6 Bytes JMP 2A06CE1E .text C:\WINDOWS\System32\svchost.exe[564] ADVAPI32.dll!RegQueryInfoKeyW + 2 77DFCCF1 6 Bytes JMP 2A070653 .text C:\WINDOWS\System32\svchost.exe[564] ADVAPI32.dll!GetNamedSecurityInfoW + 2 77DFD07A 7 Bytes JMP 2A06E77A .text C:\WINDOWS\System32\svchost.exe[564] ADVAPI32.dll!RegCreateKeyA + 2 77DFD5BD 6 Bytes JMP 2A06CB64 .text C:\WINDOWS\System32\svchost.exe[564] ADVAPI32.dll!SetFileSecurityA + 2 77E0D2FF 5 Bytes JMP 2A06D68C .text C:\WINDOWS\System32\svchost.exe[564] ADVAPI32.dll!GetFileSecurityA + 2 77E0D365 5 Bytes JMP 2A070262 .text C:\WINDOWS\System32\svchost.exe[564] ADVAPI32.dll!CreateProcessAsUserA + 2 77E1095A 6 Bytes JMP 2A069FF5 .text C:\WINDOWS\System32\svchost.exe[564] ADVAPI32.dll!CreateProcessWithLogonW 77E15C9D 5 Bytes JMP 2A069783 .text C:\WINDOWS\System32\svchost.exe[564] ADVAPI32.dll!GetNamedSecurityInfoA + 2 77E21546 7 Bytes JMP 2A071697 .text C:\WINDOWS\System32\svchost.exe[564] ADVAPI32.dll!SetNamedSecurityInfoA + 2 77E21592 7 Bytes JMP 2A071978 .text C:\WINDOWS\System32\svchost.exe[564] ADVAPI32.dll!RegQueryMultipleValuesA + 2 77E3553D 6 Bytes JMP 2A06EEEE .text C:\WINDOWS\System32\svchost.exe[564] ADVAPI32.dll!RegQueryMultipleValuesW + 2 77E3589F 6 Bytes JMP 2A06C056 .text C:\WINDOWS\System32\svchost.exe[564] ADVAPI32.dll!RegSetValueW + 2 77E35FC4 5 Bytes JMP 2A070B68 .text C:\WINDOWS\System32\svchost.exe[564] USER32.dll!ExitWindowsEx + 2 77D89E2F 6 Bytes JMP 2A0699C2 .text C:\WINDOWS\System32\svchost.exe[564] WS2_32.dll!connect + 2 71AB406C 6 Bytes JMP 2A06A915 .text C:\WINDOWS\System32\svchost.exe[564] WS2_32.dll!gethostbyname + 2 71AB4FD6 9 Bytes JMP 2A06A665 .text C:\WINDOWS\System32\svchost.exe[564] WS2_32.dll!WSAAsyncGetHostByName + 2 71ABE987 13 Bytes [ 9F, F8, F2, 92, 91, 42, 91, … ] .text C:\WINDOWS\System32\svchost.exe[564] WS2_32.dll!WSAConnect + 2 71AC0C6B 14 Bytes [ 37, 49, 41, 40, 49, 41, 9F, … ] .text C:\WINDOWS\system32\winlogon.exe[696] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 2A06FA41 .text C:\WINDOWS\system32\winlogon.exe[696] ntdll.dll!NtQueryInformationFile 7C90DFDC 5 Bytes JMP 2A06CC56 .text C:\WINDOWS\system32\winlogon.exe[696] ntdll.dll!NtQuerySystemInformation 7C90E1AA 5 Bytes JMP 2A070C70 .text C:\WINDOWS\system32\winlogon.exe[696] ntdll.dll!NtReadVirtualMemory 7C90E2BB 5 Bytes JMP 2A06C25F .text C:\WINDOWS\system32\winlogon.exe[696] ntdll.dll!NtVdmControl 7C90E975 5 Bytes JMP 2A06BEBE .text C:\WINDOWS\system32\winlogon.exe[696] ntdll.dll!NtWriteVirtualMemory 7C90EA32 5 Bytes JMP 2A06AC45 .text C:\WINDOWS\system32\winlogon.exe[696] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 2A0687F2 .text C:\WINDOWS\system32\winlogon.exe[696] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 2A06A0D0 .text C:\WINDOWS\system32\winlogon.exe[696] ntdll.dll!RtlQueryProcessDebugInformation + 2 7C9538ED 6 Bytes JMP 2A06B483 .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!CreateFileA + 2 7C801A26 6 Bytes JMP 2A06C5DF .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!LoadLibraryExW 7C801AF1 7 Bytes JMP 2A0689C9 .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!LoadLibraryExA + 2 7C801D51 6 Bytes JMP 2A067CDE .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!LoadLibraryA + 2 7C801D79 7 Bytes JMP 2A06863A .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!ReadProcessMemory + 2 7C8021CE 6 Bytes JMP 2A06FD37 .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!WriteProcessMemory + 2 7C802211 5 Bytes JMP 2A06E8FF .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!CreateProcessW + 2 7C802334 5 Bytes JMP 2A068E75 .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!CreateProcessA + 2 7C802369 5 Bytes JMP 2A06803F .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!FreeLibrary + 2 7C80AA68 7 Bytes JMP 2A069DE4 .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!GetProcAddress + 2 7C80AC2A 5 Bytes JMP 2A069C47 .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!LoadLibraryW + 2 7C80ACD5 5 Bytes JMP 2A06A1E2 .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!GetFileAttributesW + 2 7C80B5D6 6 Bytes JMP 2A06C14F .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!FreeLibraryAndExitThread + 2 7C80CEA3 6 Bytes JMP 2A069E7D .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!FindFirstFileExW + 2 7C80EC7F 9 Bytes JMP 2A06FA2C .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!FindFirstFileW + 2 7C80F0E3 5 Bytes JMP 2A070FD3 .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!FindNextFileW 7C80F13A 7 Bytes JMP 2A0702C9 .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!CreateFileW + 2 7C810978 6 Bytes JMP 2A06BE72 .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!GetFileAttributesExW + 2 7C81130F 6 Bytes JMP 2A06EAE3 .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!GetFileAttributesA + 2 7C81174E 6 Bytes JMP 2A06EBC4 .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!GetFileAttributesExA + 2 7C813533 6 Bytes JMP 2A07158F .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!FindFirstFileA + 2 7C81355B 9 Bytes JMP 2A06EDFD .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!ExitProcess + 2 7C81CAA4 5 Bytes JMP 2A068826 .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!OpenProcess + 2 7C81E07B 6 Bytes JMP 2A070AC2 .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!DeleteFileA + 2 7C81E85E 6 Bytes JMP 2A06B2D3 .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!DeleteFileW + 2 7C81F73F 6 Bytes JMP 2A06BA7B .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!SetFileAttributesA + 2 7C81FB46 6 Bytes JMP 2A06B184 .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!SetFileAttributesW + 2 7C81FC07 6 Bytes JMP 2A06EAC6 .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!MoveFileWithProgressW 7C821565 5 Bytes JMP 2A06D603 .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!MoveFileWithProgressA + 2 7C8222B5 6 Bytes JMP 2A06FECF .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!OpenFile 7C826B99 5 Bytes JMP 2A06D4C6 .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!FindNextFileA + 2 7C83901B 9 Bytes JMP 2A06F24F .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!MoveFileExW + 2 7C839921 6 Bytes JMP 2A06FC93 .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!FindFirstFileExA + 2 7C85C2F4 9 Bytes JMP 2A06EF85 .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!MoveFileExA + 2 7C85D2A5 6 Bytes JMP 2A070BDD .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!_lopen + 2 7C85E612 6 Bytes JMP 2A06C856 .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!WinExec + 2 7C86114F 6 Bytes JMP 2A069341 .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!Process32FirstW + 2 7C8639D6 6 Bytes JMP 2A06CB00 .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!Process32First + 2 7C863A8F 9 Bytes JMP 2A06B371 .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!Process32NextW + 2 7C863B61 6 Bytes JMP 2A06D6F2 .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!Process32Next + 2 7C863C02 9 Bytes JMP 2A06FE03 .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!Thread32First + 2 7C863CD4 6 Bytes JMP 2A07198F .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!Thread32Next + 2 7C863D88 6 Bytes JMP 2A06CD26 .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!Module32FirstW + 2 7C863E21 6 Bytes JMP 2A06CE4E .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!Module32First + 2 7C863EDA 9 Bytes JMP 2A0717BB .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!Module32NextW + 2 7C863FBE 6 Bytes JMP 2A06EB42 .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!Module32Next + 2 7C86405F 9 Bytes JMP 2A070928 .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!GetBinaryTypeW 7C86783C 5 Bytes JMP 2A06E8F2 .text C:\WINDOWS\system32\winlogon.exe[696] kernel32.dll!GetBinaryType + 2 7C867C9D 6 Bytes JMP 2A06B30C .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!RegOpenKeyExW + 2 77DD6A7A 6 Bytes JMP 2A06DBF0 .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!RegCloseKey + 2 77DD6BF2 6 Bytes JMP 2A06FA92 .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!RegQueryValueExW + 2 77DD6FCA 6 Bytes JMP 2A07133B .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!RegCreateKeyExW + 2 77DD7537 6 Bytes JMP 2A06E09C .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!RegOpenKeyExA + 2 77DD761D 6 Bytes JMP 2A06AD1F .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!RegQueryValueExA + 2 77DD7885 6 Bytes JMP 2A06FF4D .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!RegEnumValueW + 2 77DD8083 6 Bytes JMP 2A06FBDE .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!RegSetValueExW 77DDD7CC 7 Bytes JMP 2A06BB37 .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!RegQueryValueW + 2 77DDD8E4 6 Bytes JMP 2A06D047 .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!RegCreateKeyExA + 2 77DDEAF6 6 Bytes JMP 2A06EC4F .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!RegSetValueExA 77DDEBE7 7 Bytes JMP 2A06E1B0 .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!RegDeleteValueA + 2 77DDEDE7 6 Bytes JMP 2A06CE2B .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!RegDeleteValueW + 2 77DDEEF3 6 Bytes JMP 2A06B4CF .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!RegSetValueA + 2 77DE6F4B 5 Bytes JMP 2A071742 .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!SetFileSecurityW + 2 77DEAA6B 6 Bytes JMP 2A06C166 .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!RegEnumValueA + 2 77DECF4C 6 Bytes JMP 2A06F819 .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!SetNamedSecurityInfoW + 2 77DF1287 6 Bytes JMP 2A070675 .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!CreateProcessAsUserW + 2 77DF7777 6 Bytes JMP 2A06916A .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!RegDeleteKeyW + 2 77DF9886 6 Bytes JMP 2A06C217 .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!GetFileSecurityW + 2 77DFBCE0 6 Bytes JMP 2A06AAAE .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!RegDeleteKeyA + 2 77DFC125 6 Bytes JMP 2A06F92F .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!RegQueryInfoKeyA + 2 77DFC1B7 6 Bytes JMP 2A06BFBB .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!RegOpenKeyA + 2 77DFC41D 6 Bytes JMP 2A06EBE5 .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!RegQueryValueA + 2 77DFCC12 6 Bytes JMP 2A06CE1E .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!RegQueryInfoKeyW + 2 77DFCCF1 6 Bytes JMP 2A070653 .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!GetNamedSecurityInfoW + 2 77DFD07A 7 Bytes JMP 2A06E77A .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!RegCreateKeyA + 2 77DFD5BD 6 Bytes JMP 2A06CB64 .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!SetFileSecurityA + 2 77E0D2FF 5 Bytes JMP 2A06D68C .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!GetFileSecurityA + 2 77E0D365 5 Bytes JMP 2A070262 .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!CreateProcessAsUserA + 2 77E1095A 6 Bytes JMP 2A069FF5 .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!CreateProcessWithLogonW 77E15C9D 5 Bytes JMP 2A069783 .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!GetNamedSecurityInfoA + 2 77E21546 7 Bytes JMP 2A071697 .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!SetNamedSecurityInfoA + 2 77E21592 7 Bytes JMP 2A071978 .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!RegQueryMultipleValuesA + 2 77E3553D 6 Bytes JMP 2A06EEEE .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!RegQueryMultipleValuesW + 2 77E3589F 6 Bytes JMP 2A06C056 .text C:\WINDOWS\system32\winlogon.exe[696] ADVAPI32.dll!RegSetValueW + 2 77E35FC4 5 Bytes JMP 2A070B68 .text C:\WINDOWS\system32\winlogon.exe[696] USER32.dll!ExitWindowsEx + 2 77D89E2F 6 Bytes JMP 2A0699C2 .text C:\WINDOWS\system32\winlogon.exe[696] PSAPI.DLL!EnumProcessModules 76BF1F1C 5 Bytes JMP 2A06F354 .text C:\WINDOWS\system32\winlogon.exe[696] WS2_32.dll!connect + 2 71AB406C 6 Bytes JMP 2A06A915 .text C:\WINDOWS\system32\winlogon.exe[696] WS2_32.dll!gethostbyname + 2 71AB4FD6 9 Bytes JMP 2A06A665 .text C:\WINDOWS\system32\winlogon.exe[696] WS2_32.dll!WSAAsyncGetHostByName + 2 71ABE987 13 Bytes [ 40, 9F, 49, 91, FC, F2, 48, … ] .text C:\WINDOWS\system32\winlogon.exe[696] WS2_32.dll!WSAConnect + 2 71AC0C6B 14 Bytes [ 9F, 42, 40, 99, F8, 40, 4A, … ] .text C:\WINDOWS\system32\services.exe[860] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 2A06FA41 .text C:\WINDOWS\system32\services.exe[860] ntdll.dll!NtQueryInformationFile 7C90DFDC 5 Bytes JMP 2A06CC56 .text C:\WINDOWS\system32\services.exe[860] ntdll.dll!NtQuerySystemInformation 7C90E1AA 5 Bytes JMP 2A070C70 .text C:\WINDOWS\system32\services.exe[860] ntdll.dll!NtReadVirtualMemory 7C90E2BB 5 Bytes JMP 2A06C25F .text C:\WINDOWS\system32\services.exe[860] ntdll.dll!NtVdmControl 7C90E975 5 Bytes JMP 2A06BEBE .text C:\WINDOWS\system32\services.exe[860] ntdll.dll!NtWriteVirtualMemory 7C90EA32 5 Bytes JMP 2A06AC45 .text C:\WINDOWS\system32\services.exe[860] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 2A0687F2 .text C:\WINDOWS\system32\services.exe[860] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 2A06A0D0 .text C:\WINDOWS\system32\services.exe[860] ntdll.dll!RtlQueryProcessDebugInformation + 2 7C9538ED 6 Bytes JMP 2A06B483 .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!CreateFileA + 2 7C801A26 6 Bytes JMP 2A06C5DF .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!LoadLibraryExW 7C801AF1 7 Bytes JMP 2A0689C9 .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!LoadLibraryExA + 2 7C801D51 6 Bytes JMP 2A067CDE .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!LoadLibraryA + 2 7C801D79 7 Bytes JMP 2A06863A .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!ReadProcessMemory + 2 7C8021CE 6 Bytes JMP 2A06FD37 .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!WriteProcessMemory + 2 7C802211 5 Bytes JMP 2A06E8FF .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!CreateProcessW + 2 7C802334 5 Bytes JMP 2A068E75 .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!CreateProcessA + 2 7C802369 5 Bytes JMP 2A06803F .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!FreeLibrary + 2 7C80AA68 7 Bytes JMP 2A069DE4 .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!GetProcAddress + 2 7C80AC2A 5 Bytes JMP 2A069C47 .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!LoadLibraryW + 2 7C80ACD5 5 Bytes JMP 2A06A1E2 .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!GetFileAttributesW + 2 7C80B5D6 6 Bytes JMP 2A06C14F .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!FreeLibraryAndExitThread + 2 7C80CEA3 6 Bytes JMP 2A069E7D .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!FindFirstFileExW + 2 7C80EC7F 9 Bytes JMP 2A06FA2C .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!FindFirstFileW + 2 7C80F0E3 5 Bytes JMP 2A070FD3 .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!FindNextFileW 7C80F13A 7 Bytes JMP 2A0702C9 .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!CreateFileW + 2 7C810978 6 Bytes JMP 2A06BE72 .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!GetFileAttributesExW + 2 7C81130F 6 Bytes JMP 2A06EAE3 .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!GetFileAttributesA + 2 7C81174E 6 Bytes JMP 2A06EBC4 .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!GetFileAttributesExA + 2 7C813533 6 Bytes JMP 2A07158F .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!FindFirstFileA + 2 7C81355B 9 Bytes JMP 2A06EDFD .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!ExitProcess + 2 7C81CAA4 5 Bytes JMP 2A068826 .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!OpenProcess + 2 7C81E07B 6 Bytes JMP 2A070AC2 .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!DeleteFileA + 2 7C81E85E 6 Bytes JMP 2A06B2D3 .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!DeleteFileW + 2 7C81F73F 6 Bytes JMP 2A06BA7B .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!SetFileAttributesA + 2 7C81FB46 6 Bytes JMP 2A06B184 .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!SetFileAttributesW + 2 7C81FC07 6 Bytes JMP 2A06EAC6 .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!MoveFileWithProgressW 7C821565 5 Bytes JMP 2A06D603 .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!MoveFileWithProgressA + 2 7C8222B5 6 Bytes JMP 2A06FECF .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!OpenFile 7C826B99 5 Bytes JMP 2A06D4C6 .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!FindNextFileA + 2 7C83901B 9 Bytes JMP 2A06F24F .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!MoveFileExW + 2 7C839921 6 Bytes JMP 2A06FC93 .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!FindFirstFileExA + 2 7C85C2F4 9 Bytes JMP 2A06EF85 .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!MoveFileExA + 2 7C85D2A5 6 Bytes JMP 2A070BDD .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!_lopen + 2 7C85E612 6 Bytes JMP 2A06C856 .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!WinExec + 2 7C86114F 6 Bytes JMP 2A069341 .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!Process32FirstW + 2 7C8639D6 6 Bytes JMP 2A06CB00 .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!Process32First + 2 7C863A8F 9 Bytes JMP 2A06B371 .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!Process32NextW + 2 7C863B61 6 Bytes JMP 2A06D6F2 .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!Process32Next + 2 7C863C02 9 Bytes JMP 2A06FE03 .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!Thread32First + 2 7C863CD4 6 Bytes JMP 2A07198F .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!Thread32Next + 2 7C863D88 6 Bytes JMP 2A06CD26 .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!Module32FirstW + 2 7C863E21 6 Bytes JMP 2A06CE4E .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!Module32First + 2 7C863EDA 9 Bytes JMP 2A0717BB .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!Module32NextW + 2 7C863FBE 6 Bytes JMP 2A06EB42 .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!Module32Next + 2 7C86405F 9 Bytes JMP 2A070928 .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!GetBinaryTypeW 7C86783C 5 Bytes JMP 2A06E8F2 .text C:\WINDOWS\system32\services.exe[860] kernel32.dll!GetBinaryType + 2 7C867C9D 6 Bytes JMP 2A06B30C .text C:\WINDOWS\system32\services.exe[860] ADVAPI32.dll!RegOpenKeyExW + 2 77DD6A7A 6 Bytes JMP 2A06DBF0 .text C:\WINDOWS\system32\services.exe[860] ADVAPI32.dll!RegCloseKey + 2 77DD6BF2 6 Bytes JMP 2A06FA92 .text C:\WINDOWS\system32\services.exe[860] ADVAPI32.dll!RegQueryValueExW + 2 77DD6FCA 6 Bytes JMP 2A07133B .text C:\WINDOWS\system32\services.exe[860] ADVAPI32.dll!RegCreateKeyExW + 2 77DD7537 6 Bytes JMP 2A06E09C .text C:\WINDOWS\system32\services.exe[860] ADVAPI32.dll!RegOpenKeyExA + 2 77DD761D 6 Bytes JMP 2A06AD1F .text C:\WINDOWS\system32\services.exe[860] ADVAPI32.dll!RegQueryValueExA + 2 77DD7885 6 Bytes JMP 2A06FF4D .text C:\WINDOWS\system32\services.exe[860] ADVAPI32.dll!RegEnumValueW + 2 77DD8083 6 Bytes JMP 2A06FBDE .text C:\WINDOWS\system32\services.exe[860] ADVAPI32.dll!RegSetValueExW 77DDD7CC 7 Bytes JMP 2A06BB37 .text C:\WINDOWS\system32\services.exe[860] ADVAPI32.dll!RegQueryValueW + 2 77DDD8E4 6 Bytes JMP 2A06D047 .text C:\WINDOWS\system32\services.exe[860] ADVAPI32.dll!RegCreateKeyExA + 2 77DDEAF6 6 Bytes JMP 2A06EC4F .text C:\WINDOWS\system32\services.exe[860] ADVAPI32.dll!RegSetValueExA 77DDEBE7 7 Bytes JMP 2A06E1B0 .text C:\WINDOWS\system32\services.exe[860] ADVAPI32.dll!RegDeleteValueA + 2 77DDEDE7 6 Bytes JMP 2A06CE2B .text C:\WINDOWS\system32\services.exe[860] ADVAPI32.dll!RegDeleteValueW + 2 77DDEEF3 6 Bytes JMP 2A06B4CF .text C:\WINDOWS\system32\services.exe[860] ADVAPI32.dll!RegSetValueA + 2 77DE6F4B 5 Bytes JMP 2A071742 .text C:\WINDOWS\system32\services.exe[860] ADVAPI32.dll!SetFileSecurityW + 2 77DEAA6B 6 Bytes JMP 2A06C166 .text C:\WINDOWS\system32\services.exe[860] ADVAPI32.dll!RegEnumValueA + 2 77DECF4C 6 Bytes JMP 2A06F819 .text C:\WINDOWS\system32\services.exe[860] ADVAPI32.dll!SetNamedSecurityInfoW + 2 77DF1287 6 Bytes JMP 2A070675 .text C:\WINDOWS\system32\services.exe[860] ADVAPI32.dll!CreateProcessAsUserW + 2 77DF7777 6 Bytes JMP 2A06916A .text C:\WINDOWS\system32\services.exe[860] ADVAPI32.dll!RegDeleteKeyW + 2 77DF9886 6 Bytes JMP 2A06C217 .text C:\WINDOWS\system32\services.exe[860] ADVAPI32.dll!GetFileSecurityW + 2 77DFBCE0 6 Bytes JMP 2A06AAAE .text C:\WINDOWS\system32\services.exe[860] ADVAPI32.dll!RegDeleteKeyA + 2 77DFC125 6 Bytes JMP 2A06F92F .text C:\WINDOWS\system32\services.exe[860] ADVAPI32.dll!RegQueryInfoKeyA + 2 77DFC1B7 6 Bytes JMP 2A06BFBB .text C:\WINDOWS\system32\services.exe[860] ADVAPI32.dll!RegOpenKeyA + 2 77DFC41D 6 Bytes JMP 2A06EBE5 .text C:\WINDOWS\system32\services.exe[860] ADVAPI32.dll!RegQueryValueA + 2 77DFCC12 6 Bytes JMP 2A06CE1E .text C:\WINDOWS\system32\services.exe[860] ADVAPI32.dll!RegQueryInfoKeyW + 2 77DFCCF1 6 Bytes JMP 2A070653 .text C:\WINDOWS\system32\services.exe[860] ADVAPI32.dll!GetNamedSecurityInfoW + 2 77DFD07A 7 Bytes JMP 2A06E77A .text C:\WINDOWS\system32\services.exe[860] ADVAPI32.dll!RegCreateKeyA + 2 77DFD5BD 6 Bytes JMP 2A06CB64 .text C:\WINDOWS\system32\services.exe[860] ADVAPI32.dll!SetFileSecurityA + 2 77E0D2FF 5 Bytes JMP 2A06D68C .text C:\WINDOWS\system32\services.exe[860] ADVAPI32.dll!GetFileSecurityA + 2 77E0D365 5 Bytes JMP 2A070262 .text C:\WINDOWS\system32\services.exe[860] ADVAPI32.dll!CreateProcessAsUserA + 2 77E1095A 6 Bytes JMP 2A069FF5 .text C:\WINDOWS\system32\services.exe[860] ADVAPI32.dll!CreateProcessWithLogonW 77E15C9D 5 Bytes JMP 2A069783 .text C:\WINDOWS\system32\services.exe[860] ADVAPI32.dll!GetNamedSecurityInfoA + 2 77E21546 7 Bytes JMP 2A071697 .text C:\WINDOWS\system32\services.exe[860] ADVAPI32.dll!SetNamedSecurityInfoA + 2 77E21592 7 Bytes JMP 2A071978 .text C:\WINDOWS\system32\services.exe[860] ADVAPI32.dll!RegQueryMultipleValuesA + 2 77E3553D 6 Bytes JMP 2A06EEEE .text C:\WINDOWS\system32\services.exe[860] ADVAPI32.dll!RegQueryMultipleValuesW + 2 77E3589F 6 Bytes JMP 2A06C056 .text C:\WINDOWS\system32\services.exe[860] ADVAPI32.dll!RegSetValueW + 2 77E35FC4 5 Bytes JMP 2A070B68 .text C:\WINDOWS\system32\services.exe[860] USER32.dll!ExitWindowsEx + 2 77D89E2F 6 Bytes JMP 2A0699C2 .text C:\WINDOWS\system32\services.exe[860] WS2_32.dll!connect + 2 71AB406C 6 Bytes JMP 2A06A915 .text C:\WINDOWS\system32\services.exe[860] WS2_32.dll!gethostbyname + 2 71AB4FD6 9 Bytes JMP 2A06A665 .text C:\WINDOWS\system32\services.exe[860] WS2_32.dll!WSAAsyncGetHostByName + 2 71ABE987 13 Bytes [ F9, F2, 92, 42, F3, 4A, 4A, … ] .text C:\WINDOWS\system32\services.exe[860] WS2_32.dll!WSAConnect + 2 71AC0C6B 14 Bytes [ F2, 48, 40, 9F, 42, F8, 4A, … ] .text C:\WINDOWS\system32\services.exe[860] PSAPI.DLL!EnumProcessModules 76BF1F1C 5 Bytes JMP 2A06F354 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 2A06FA41 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ntdll.dll!NtQueryInformationFile 7C90DFDC 5 Bytes JMP 2A06CC56 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ntdll.dll!NtQuerySystemInformation 7C90E1AA 5 Bytes JMP 2A070C70 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ntdll.dll!NtReadVirtualMemory 7C90E2BB 5 Bytes JMP 2A06C25F .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ntdll.dll!NtVdmControl 7C90E975 5 Bytes JMP 2A06BEBE .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ntdll.dll!NtWriteVirtualMemory 7C90EA32 5 Bytes JMP 2A06AC45 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 2A0687F2 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 2A06A0D0 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ntdll.dll!RtlQueryProcessDebugInformation + 2 7C9538ED 6 Bytes JMP 2A06B483 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!CreateFileA + 2 7C801A26 6 Bytes JMP 2A06C5DF .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!LoadLibraryExW 7C801AF1 7 Bytes JMP 2A0689C9 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!LoadLibraryExA + 2 7C801D51 6 Bytes JMP 2A067CDE .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!LoadLibraryA + 2 7C801D79 7 Bytes JMP 2A06863A .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!ReadProcessMemory + 2 7C8021CE 6 Bytes JMP 2A06FD37 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!WriteProcessMemory + 2 7C802211 5 Bytes JMP 2A06E8FF .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!CreateProcessW + 2 7C802334 5 Bytes JMP 2A068E75 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!CreateProcessA + 2 7C802369 5 Bytes JMP 2A06803F .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!FreeLibrary + 2 7C80AA68 7 Bytes JMP 2A069DE4 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!GetProcAddress + 2 7C80AC2A 5 Bytes JMP 2A069C47 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!LoadLibraryW + 2 7C80ACD5 5 Bytes JMP 2A06A1E2 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!GetFileAttributesW + 2 7C80B5D6 6 Bytes JMP 2A06C14F .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!FreeLibraryAndExitThread + 2 7C80CEA3 6 Bytes JMP 2A069E7D .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!FindFirstFileExW + 2 7C80EC7F 9 Bytes JMP 2A06FA2C .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!FindFirstFileW + 2 7C80F0E3 5 Bytes JMP 2A070FD3 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!FindNextFileW 7C80F13A 7 Bytes JMP 2A0702C9 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!CreateFileW + 2 7C810978 6 Bytes JMP 2A06BE72 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!GetFileAttributesExW + 2 7C81130F 6 Bytes JMP 2A06EAE3 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!GetFileAttributesA + 2 7C81174E 6 Bytes JMP 2A06EBC4 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!GetFileAttributesExA + 2 7C813533 6 Bytes JMP 2A07158F .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!FindFirstFileA + 2 7C81355B 9 Bytes JMP 2A06EDFD .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!ExitProcess + 2 7C81CAA4 5 Bytes JMP 2A068826 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!OpenProcess + 2 7C81E07B 6 Bytes JMP 2A070AC2 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!DeleteFileA + 2 7C81E85E 6 Bytes JMP 2A06B2D3 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!DeleteFileW + 2 7C81F73F 6 Bytes JMP 2A06BA7B .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!SetFileAttributesA + 2 7C81FB46 6 Bytes JMP 2A06B184 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!SetFileAttributesW + 2 7C81FC07 6 Bytes JMP 2A06EAC6 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!MoveFileWithProgressW 7C821565 5 Bytes JMP 2A06D603 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!MoveFileWithProgressA + 2 7C8222B5 6 Bytes JMP 2A06FECF .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!OpenFile 7C826B99 5 Bytes JMP 2A06D4C6 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!FindNextFileA + 2 7C83901B 9 Bytes JMP 2A06F24F .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!MoveFileExW + 2 7C839921 6 Bytes JMP 2A06FC93 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!FindFirstFileExA + 2 7C85C2F4 9 Bytes JMP 2A06EF85 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!MoveFileExA + 2 7C85D2A5 6 Bytes JMP 2A070BDD .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!_lopen + 2 7C85E612 6 Bytes JMP 2A06C856 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!WinExec + 2 7C86114F 6 Bytes JMP 2A069341 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!Process32FirstW + 2 7C8639D6 6 Bytes JMP 2A06CB00 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!Process32First + 2 7C863A8F 9 Bytes JMP 2A06B371 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!Process32NextW + 2 7C863B61 6 Bytes JMP 2A06D6F2 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!Process32Next + 2 7C863C02 9 Bytes JMP 2A06FE03 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!Thread32First + 2 7C863CD4 6 Bytes JMP 2A07198F .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!Thread32Next + 2 7C863D88 6 Bytes JMP 2A06CD26 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!Module32FirstW + 2 7C863E21 6 Bytes JMP 2A06CE4E .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!Module32First + 2 7C863EDA 9 Bytes JMP 2A0717BB .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!Module32NextW + 2 7C863FBE 6 Bytes JMP 2A06EB42 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!Module32Next + 2 7C86405F 9 Bytes JMP 2A070928 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!GetBinaryTypeW 7C86783C 5 Bytes JMP 2A06E8F2 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] kernel32.dll!GetBinaryType + 2 7C867C9D 6 Bytes JMP 2A06B30C .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] USER32.dll!ExitWindowsEx + 2 77D89E2F 6 Bytes JMP 2A0699C2 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ADVAPI32.dll!RegOpenKeyExW + 2 77DD6A7A 6 Bytes JMP 2A06DBF0 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ADVAPI32.dll!RegCloseKey + 2 77DD6BF2 6 Bytes JMP 2A06FA92 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ADVAPI32.dll!RegQueryValueExW + 2 77DD6FCA 6 Bytes JMP 2A07133B .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ADVAPI32.dll!RegCreateKeyExW + 2 77DD7537 6 Bytes JMP 2A06E09C .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ADVAPI32.dll!RegOpenKeyExA + 2 77DD761D 6 Bytes JMP 2A06AD1F .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ADVAPI32.dll!RegQueryValueExA + 2 77DD7885 6 Bytes JMP 2A06FF4D .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ADVAPI32.dll!RegEnumValueW + 2 77DD8083 6 Bytes JMP 2A06FBDE .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ADVAPI32.dll!RegSetValueExW 77DDD7CC 7 Bytes JMP 2A06BB37 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ADVAPI32.dll!RegQueryValueW + 2 77DDD8E4 6 Bytes JMP 2A06D047 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ADVAPI32.dll!RegCreateKeyExA + 2 77DDEAF6 6 Bytes JMP 2A06EC4F .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ADVAPI32.dll!RegSetValueExA 77DDEBE7 7 Bytes JMP 2A06E1B0 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ADVAPI32.dll!RegDeleteValueA + 2 77DDEDE7 6 Bytes JMP 2A06CE2B .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ADVAPI32.dll!RegDeleteValueW + 2 77DDEEF3 6 Bytes JMP 2A06B4CF .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ADVAPI32.dll!RegSetValueA + 2 77DE6F4B 5 Bytes JMP 2A071742 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ADVAPI32.dll!SetFileSecurityW + 2 77DEAA6B 6 Bytes JMP 2A06C166 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ADVAPI32.dll!RegEnumValueA + 2 77DECF4C 6 Bytes JMP 2A06F819 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ADVAPI32.dll!SetNamedSecurityInfoW + 2 77DF1287 6 Bytes JMP 2A070675 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ADVAPI32.dll!CreateProcessAsUserW + 2 77DF7777 6 Bytes JMP 2A06916A .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ADVAPI32.dll!RegDeleteKeyW + 2 77DF9886 6 Bytes JMP 2A06C217 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ADVAPI32.dll!GetFileSecurityW + 2 77DFBCE0 6 Bytes JMP 2A06AAAE .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ADVAPI32.dll!RegDeleteKeyA + 2 77DFC125 6 Bytes JMP 2A06F92F .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ADVAPI32.dll!RegQueryInfoKeyA + 2 77DFC1B7 6 Bytes JMP 2A06BFBB .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ADVAPI32.dll!RegOpenKeyA + 2 77DFC41D 6 Bytes JMP 2A06EBE5 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ADVAPI32.dll!RegQueryValueA + 2 77DFCC12 6 Bytes JMP 2A06CE1E .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ADVAPI32.dll!RegQueryInfoKeyW + 2 77DFCCF1 6 Bytes JMP 2A070653 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ADVAPI32.dll!GetNamedSecurityInfoW + 2 77DFD07A 7 Bytes JMP 2A06E77A .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ADVAPI32.dll!RegCreateKeyA + 2 77DFD5BD 6 Bytes JMP 2A06CB64 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ADVAPI32.dll!SetFileSecurityA + 2 77E0D2FF 5 Bytes JMP 2A06D68C .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ADVAPI32.dll!GetFileSecurityA + 2 77E0D365 5 Bytes JMP 2A070262 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ADVAPI32.dll!CreateProcessAsUserA + 2 77E1095A 6 Bytes JMP 2A069FF5 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ADVAPI32.dll!CreateProcessWithLogonW 77E15C9D 5 Bytes JMP 2A069783 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ADVAPI32.dll!GetNamedSecurityInfoA + 2 77E21546 7 Bytes JMP 2A071697 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ADVAPI32.dll!SetNamedSecurityInfoA + 2 77E21592 7 Bytes JMP 2A071978 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ADVAPI32.dll!RegQueryMultipleValuesA + 2 77E3553D 6 Bytes JMP 2A06EEEE .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ADVAPI32.dll!RegQueryMultipleValuesW + 2 77E3589F 6 Bytes JMP 2A06C056 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] ADVAPI32.dll!RegSetValueW + 2 77E35FC4 5 Bytes JMP 2A070B68 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] PSAPI.DLL!EnumProcessModules 76BF1F1C 5 Bytes JMP 2A06F354 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] WS2_32.dll!connect + 2 71AB406C 6 Bytes JMP 2A06A915 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] WS2_32.dll!gethostbyname + 2 71AB4FD6 9 Bytes JMP 2A06A665 .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] WS2_32.dll!WSAAsyncGetHostByName + 2 71ABE987 13 Bytes [ 4A, 92, F8, 41, 90, 92, 48, … ] .text C:\Program Files\Comodo\Firewall\cmdagent.exe[984] WS2_32.dll!WSAConnect + 2 71AC0C6B 14 Bytes [ 40, F8, 90, 40, FC, 37, 98, … ] .text C:\WINDOWS\Explorer.EXE[1012] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 2A06FA41 .text C:\WINDOWS\Explorer.EXE[1012] ntdll.dll!NtQueryInformationFile 7C90DFDC 5 Bytes JMP 2A06CC56 .text C:\WINDOWS\Explorer.EXE[1012] ntdll.dll!NtQuerySystemInformation 7C90E1AA 5 Bytes JMP 2A070C70 .text C:\WINDOWS\Explorer.EXE[1012] ntdll.dll!NtReadVirtualMemory 7C90E2BB 5 Bytes JMP 2A06C25F .text C:\WINDOWS\Explorer.EXE[1012] ntdll.dll!NtVdmControl 7C90E975 5 Bytes JMP 2A06BEBE .text C:\WINDOWS\Explorer.EXE[1012] ntdll.dll!NtWriteVirtualMemory 7C90EA32 5 Bytes JMP 2A06AC45 .text C:\WINDOWS\Explorer.EXE[1012] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 2A0687F2 .text C:\WINDOWS\Explorer.EXE[1012] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 2A06A0D0 .text C:\WINDOWS\Explorer.EXE[1012] ntdll.dll!RtlQueryProcessDebugInformation + 2 7C9538ED 6 Bytes JMP 2A06B483 .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!CreateFileA + 2 7C801A26 6 Bytes JMP 2A06C5DF .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!LoadLibraryExW 7C801AF1 7 Bytes JMP 2A0689C9 .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!LoadLibraryExA + 2 7C801D51 6 Bytes JMP 2A067CDE .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!LoadLibraryA + 2 7C801D79 7 Bytes JMP 2A06863A .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!ReadProcessMemory + 2 7C8021CE 6 Bytes JMP 2A06FD37 .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!WriteProcessMemory + 2 7C802211 5 Bytes JMP 2A06E8FF .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!CreateProcessW + 2 7C802334 5 Bytes JMP 2A068E75 .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!CreateProcessA + 2 7C802369 5 Bytes JMP 2A06803F .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!FreeLibrary + 2 7C80AA68 7 Bytes JMP 2A069DE4 .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!GetProcAddress + 2 7C80AC2A 5 Bytes JMP 2A069C47 .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!LoadLibraryW + 2 7C80ACD5 5 Bytes JMP 2A06A1E2 .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!GetFileAttributesW + 2 7C80B5D6 6 Bytes JMP 2A06C14F .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!FreeLibraryAndExitThread + 2 7C80CEA3 6 Bytes JMP 2A069E7D .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!FindFirstFileExW + 2 7C80EC7F 9 Bytes JMP 2A06FA2C .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!FindFirstFileW + 2 7C80F0E3 5 Bytes JMP 2A070FD3 .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!FindNextFileW 7C80F13A 7 Bytes JMP 2A0702C9 .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!CreateFileW + 2 7C810978 6 Bytes JMP 2A06BE72 .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!GetFileAttributesExW + 2 7C81130F 6 Bytes JMP 2A06EAE3 .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!GetFileAttributesA + 2 7C81174E 6 Bytes JMP 2A06EBC4 .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!GetFileAttributesExA + 2 7C813533 6 Bytes JMP 2A07158F .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!FindFirstFileA + 2 7C81355B 9 Bytes JMP 2A06EDFD .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!ExitProcess + 2 7C81CAA4 5 Bytes JMP 2A068826 .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!OpenProcess + 2 7C81E07B 6 Bytes JMP 2A070AC2 .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!DeleteFileA + 2 7C81E85E 6 Bytes JMP 2A06B2D3 .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!DeleteFileW + 2 7C81F73F 6 Bytes JMP 2A06BA7B .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!SetFileAttributesA + 2 7C81FB46 6 Bytes JMP 2A06B184 .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!SetFileAttributesW + 2 7C81FC07 6 Bytes JMP 2A06EAC6 .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!MoveFileWithProgressW 7C821565 5 Bytes JMP 2A06D603 .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!MoveFileWithProgressA + 2 7C8222B5 6 Bytes JMP 2A06FECF .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!OpenFile 7C826B99 5 Bytes JMP 2A06D4C6 .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!FindNextFileA + 2 7C83901B 9 Bytes JMP 2A06F24F .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!MoveFileExW + 2 7C839921 6 Bytes JMP 2A06FC93 .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!FindFirstFileExA + 2 7C85C2F4 9 Bytes JMP 2A06EF85 .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!MoveFileExA + 2 7C85D2A5 6 Bytes JMP 2A070BDD .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!_lopen + 2 7C85E612 6 Bytes JMP 2A06C856 .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!WinExec + 2 7C86114F 6 Bytes JMP 2A069341 .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!Process32FirstW + 2 7C8639D6 6 Bytes JMP 2A06CB00 .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!Process32First + 2 7C863A8F 9 Bytes JMP 2A06B371 .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!Process32NextW + 2 7C863B61 6 Bytes JMP 2A06D6F2 .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!Process32Next + 2 7C863C02 9 Bytes JMP 2A06FE03 .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!Thread32First + 2 7C863CD4 6 Bytes JMP 2A07198F .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!Thread32Next + 2 7C863D88 6 Bytes JMP 2A06CD26 .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!Module32FirstW + 2 7C863E21 6 Bytes JMP 2A06CE4E .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!Module32First + 2 7C863EDA 9 Bytes JMP 2A0717BB .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!Module32NextW + 2 7C863FBE 6 Bytes JMP 2A06EB42

.text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!Module32Next + 2 7C86405F 9 Bytes JMP 2A070928 .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!GetBinaryTypeW 7C86783C 5 Bytes JMP 2A06E8F2 .text C:\WINDOWS\Explorer.EXE[1012] kernel32.dll!GetBinaryType + 2 7C867C9D 6 Bytes JMP 2A06B30C .text C:\WINDOWS\Explorer.EXE[1012] ADVAPI32.dll!RegOpenKeyExW + 2 77DD6A7A 6 Bytes JMP 2A06DBF0 .text C:\WINDOWS\Explorer.EXE[1012] ADVAPI32.dll!RegCloseKey + 2 77DD6BF2 6 Bytes JMP 2A06FA92 .text C:\WINDOWS\Explorer.EXE[1012] ADVAPI32.dll!RegQueryValueExW + 2 77DD6FCA 6 Bytes JMP 2A07133B .text C:\WINDOWS\Explorer.EXE[1012] ADVAPI32.dll!RegCreateKeyExW + 2 77DD7537 6 Bytes JMP 2A06E09C .text C:\WINDOWS\Explorer.EXE[1012] ADVAPI32.dll!RegOpenKeyExA + 2 77DD761D 6 Bytes JMP 2A06AD1F .text C:\WINDOWS\Explorer.EXE[1012] ADVAPI32.dll!RegQueryValueExA + 2 77DD7885 6 Bytes JMP 2A06FF4D .text C:\WINDOWS\Explorer.EXE[1012] ADVAPI32.dll!RegEnumValueW + 2 77DD8083 6 Bytes JMP 2A06FBDE .text C:\WINDOWS\Explorer.EXE[1012] ADVAPI32.dll!RegSetValueExW 77DDD7CC 7 Bytes JMP 2A06BB37 .text C:\WINDOWS\Explorer.EXE[1012] ADVAPI32.dll!RegQueryValueW + 2 77DDD8E4 6 Bytes JMP 2A06D047 .text C:\WINDOWS\Explorer.EXE[1012] ADVAPI32.dll!RegCreateKeyExA + 2 77DDEAF6 6 Bytes JMP 2A06EC4F .text C:\WINDOWS\Explorer.EXE[1012] ADVAPI32.dll!RegSetValueExA 77DDEBE7 7 Bytes JMP 2A06E1B0 .text C:\WINDOWS\Explorer.EXE[1012] ADVAPI32.dll!RegDeleteValueA + 2 77DDEDE7 6 Bytes JMP 2A06CE2B .text C:\WINDOWS\Explorer.EXE[1012] ADVAPI32.dll!RegDeleteValueW + 2 77DDEEF3 6 Bytes JMP 2A06B4CF .text C:\WINDOWS\Explorer.EXE[1012] ADVAPI32.dll!RegSetValueA + 2 77DE6F4B 5 Bytes JMP 2A071742 .text C:\WINDOWS\Explorer.EXE[1012] ADVAPI32.dll!SetFileSecurityW + 2 77DEAA6B 6 Bytes JMP 2A06C166 .text C:\WINDOWS\Explorer.EXE[1012] ADVAPI32.dll!RegEnumValueA + 2 77DECF4C 6 Bytes JMP 2A06F819 .text C:\WINDOWS\Explorer.EXE[1012] ADVAPI32.dll!SetNamedSecurityInfoW + 2 77DF1287 6 Bytes JMP 2A070675 .text C:\WINDOWS\Explorer.EXE[1012] ADVAPI32.dll!CreateProcessAsUserW + 2 77DF7777 6 Bytes JMP 2A06916A .text C:\WINDOWS\Explorer.EXE[1012] ADVAPI32.dll!RegDeleteKeyW + 2 77DF9886 6 Bytes JMP 2A06C217 .text C:\WINDOWS\Explorer.EXE[1012] ADVAPI32.dll!GetFileSecurityW + 2 77DFBCE0 6 Bytes JMP 2A06AAAE .text C:\WINDOWS\Explorer.EXE[1012] ADVAPI32.dll!RegDeleteKeyA + 2 77DFC125 6 Bytes JMP 2A06F92F .text C:\WINDOWS\Explorer.EXE[1012] ADVAPI32.dll!RegQueryInfoKeyA + 2 77DFC1B7 6 Bytes JMP 2A06BFBB .text C:\WINDOWS\Explorer.EXE[1012] ADVAPI32.dll!RegOpenKeyA + 2 77DFC41D 6 Bytes JMP 2A06EBE5 .text C:\WINDOWS\Explorer.EXE[1012] ADVAPI32.dll!RegQueryValueA + 2 77DFCC12 6 Bytes JMP 2A06CE1E .text C:\WINDOWS\Explorer.EXE[1012] ADVAPI32.dll!RegQueryInfoKeyW + 2 77DFCCF1 6 Bytes JMP 2A070653 .text C:\WINDOWS\Explorer.EXE[1012] ADVAPI32.dll!GetNamedSecurityInfoW + 2 77DFD07A 7 Bytes JMP 2A06E77A .text C:\WINDOWS\Explorer.EXE[1012] ADVAPI32.dll!RegCreateKeyA + 2 77DFD5BD 6 Bytes JMP 2A06CB64 .text C:\WINDOWS\Explorer.EXE[1012] ADVAPI32.dll!SetFileSecurityA + 2 77E0D2FF 5 Bytes JMP 2A06D68C .text C:\WINDOWS\Explorer.EXE[1012] ADVAPI32.dll!GetFileSecurityA + 2 77E0D365 5 Bytes JMP 2A070262 .text C:\WINDOWS\Explorer.EXE[1012] ADVAPI32.dll!CreateProcessAsUserA + 2 77E1095A 6 Bytes JMP 2A069FF5 .text C:\WINDOWS\Explorer.EXE[1012] ADVAPI32.dll!CreateProcessWithLogonW 77E15C9D 5 Bytes JMP 2A069783 .text C:\WINDOWS\Explorer.EXE[1012] ADVAPI32.dll!GetNamedSecurityInfoA + 2 77E21546 7 Bytes JMP 2A071697 .text C:\WINDOWS\Explorer.EXE[1012] ADVAPI32.dll!SetNamedSecurityInfoA + 2 77E21592 7 Bytes JMP 2A071978 .text C:\WINDOWS\Explorer.EXE[1012] ADVAPI32.dll!RegQueryMultipleValuesA + 2 77E3553D 6 Bytes JMP 2A06EEEE .text C:\WINDOWS\Explorer.EXE[1012] ADVAPI32.dll!RegQueryMultipleValuesW + 2 77E3589F 6 Bytes JMP 2A06C056 .text C:\WINDOWS\Explorer.EXE[1012] ADVAPI32.dll!RegSetValueW + 2 77E35FC4 5 Bytes JMP 2A070B68 .text C:\WINDOWS\Explorer.EXE[1012] USER32.dll!ExitWindowsEx + 2 77D89E2F 6 Bytes JMP 2A0699C2 .text C:\WINDOWS\Explorer.EXE[1012] WS2_32.dll!connect + 2 71AB406C 6 Bytes JMP 2A06A915 .text C:\WINDOWS\Explorer.EXE[1012] WS2_32.dll!gethostbyname + 2 71AB4FD6 9 Bytes JMP 2A06A665 .text C:\WINDOWS\Explorer.EXE[1012] WS2_32.dll!WSAAsyncGetHostByName + 2 71ABE987 13 Bytes [ F3, 42, FC, 48, 99, 37, 41, … ] .text C:\WINDOWS\Explorer.EXE[1012] WS2_32.dll!WSAConnect + 2 71AC0C6B 14 Bytes [ 92, 41, 90, F8, F9, 90, 2F, … ] .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 2A06FA41 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ntdll.dll!NtQueryInformationFile 7C90DFDC 5 Bytes JMP 2A06CC56 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ntdll.dll!NtQuerySystemInformation 7C90E1AA 5 Bytes JMP 2A070C70 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ntdll.dll!NtReadVirtualMemory 7C90E2BB 5 Bytes JMP 2A06C25F .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ntdll.dll!NtVdmControl 7C90E975 5 Bytes JMP 2A06BEBE .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ntdll.dll!NtWriteVirtualMemory 7C90EA32 5 Bytes JMP 2A06AC45 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 2A0687F2 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 2A06A0D0 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ntdll.dll!RtlQueryProcessDebugInformation + 2 7C9538ED 6 Bytes JMP 2A06B483 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!CreateFileA + 2 7C801A26 6 Bytes JMP 2A06C5DF .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!LoadLibraryExW 7C801AF1 7 Bytes JMP 2A0689C9 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!LoadLibraryExA + 2 7C801D51 6 Bytes JMP 2A067CDE .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!LoadLibraryA + 2 7C801D79 7 Bytes JMP 2A06863A .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!ReadProcessMemory + 2 7C8021CE 6 Bytes JMP 2A06FD37 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!WriteProcessMemory + 2 7C802211 5 Bytes JMP 2A06E8FF .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!CreateProcessW + 2 7C802334 5 Bytes JMP 2A068E75 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!CreateProcessA + 2 7C802369 5 Bytes JMP 2A06803F .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!FreeLibrary + 2 7C80AA68 7 Bytes JMP 2A069DE4 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!GetProcAddress + 2 7C80AC2A 5 Bytes JMP 2A069C47 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!LoadLibraryW + 2 7C80ACD5 5 Bytes JMP 2A06A1E2 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!GetFileAttributesW + 2 7C80B5D6 6 Bytes JMP 2A06C14F .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!FreeLibraryAndExitThread + 2 7C80CEA3 6 Bytes JMP 2A069E7D .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!FindFirstFileExW + 2 7C80EC7F 9 Bytes JMP 2A06FA2C .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!FindFirstFileW + 2 7C80F0E3 5 Bytes JMP 2A070FD3 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!FindNextFileW 7C80F13A 7 Bytes JMP 2A0702C9 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!CreateFileW + 2 7C810978 6 Bytes JMP 2A06BE72 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!GetFileAttributesExW + 2 7C81130F 6 Bytes JMP 2A06EAE3 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!GetFileAttributesA + 2 7C81174E 6 Bytes JMP 2A06EBC4 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!GetFileAttributesExA + 2 7C813533 6 Bytes JMP 2A07158F .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!FindFirstFileA + 2 7C81355B 9 Bytes JMP 2A06EDFD .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!ExitProcess + 2 7C81CAA4 5 Bytes JMP 2A068826 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!OpenProcess + 2 7C81E07B 6 Bytes JMP 2A070AC2 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!DeleteFileA + 2 7C81E85E 6 Bytes JMP 2A06B2D3 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!DeleteFileW + 2 7C81F73F 6 Bytes JMP 2A06BA7B .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!SetFileAttributesA + 2 7C81FB46 6 Bytes JMP 2A06B184 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!SetFileAttributesW + 2 7C81FC07 6 Bytes JMP 2A06EAC6 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!MoveFileWithProgressW 7C821565 5 Bytes JMP 2A06D603 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!MoveFileWithProgressA + 2 7C8222B5 6 Bytes JMP 2A06FECF .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!OpenFile 7C826B99 5 Bytes JMP 2A06D4C6 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!FindNextFileA + 2 7C83901B 9 Bytes JMP 2A06F24F .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!MoveFileExW + 2 7C839921 6 Bytes JMP 2A06FC93 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!FindFirstFileExA + 2 7C85C2F4 9 Bytes JMP 2A06EF85 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!MoveFileExA + 2 7C85D2A5 6 Bytes JMP 2A070BDD .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!_lopen + 2 7C85E612 6 Bytes JMP 2A06C856 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!WinExec + 2 7C86114F 6 Bytes JMP 2A069341 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!Process32FirstW + 2 7C8639D6 6 Bytes JMP 2A06CB00 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!Process32First + 2 7C863A8F 9 Bytes JMP 2A06B371 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!Process32NextW + 2 7C863B61 6 Bytes JMP 2A06D6F2 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!Process32Next + 2 7C863C02 9 Bytes JMP 2A06FE03 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!Thread32First + 2 7C863CD4 6 Bytes JMP 2A07198F .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!Thread32Next + 2 7C863D88 6 Bytes JMP 2A06CD26 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!Module32FirstW + 2 7C863E21 6 Bytes JMP 2A06CE4E .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!Module32First + 2 7C863EDA 9 Bytes JMP 2A0717BB .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!Module32NextW + 2 7C863FBE 6 Bytes JMP 2A06EB42 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!Module32Next + 2 7C86405F 9 Bytes JMP 2A070928 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!GetBinaryTypeW 7C86783C 5 Bytes JMP 2A06E8F2 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] kernel32.dll!GetBinaryType + 2 7C867C9D 6 Bytes JMP 2A06B30C .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] USER32.dll!ExitWindowsEx + 2 77D89E2F 6 Bytes JMP 2A0699C2 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ADVAPI32.dll!RegOpenKeyExW + 2 77DD6A7A 6 Bytes JMP 2A06DBF0 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ADVAPI32.dll!RegCloseKey + 2 77DD6BF2 6 Bytes JMP 2A06FA92 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ADVAPI32.dll!RegQueryValueExW + 2 77DD6FCA 6 Bytes JMP 2A07133B .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ADVAPI32.dll!RegCreateKeyExW + 2 77DD7537 6 Bytes JMP 2A06E09C .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ADVAPI32.dll!RegOpenKeyExA + 2 77DD761D 6 Bytes JMP 2A06AD1F .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ADVAPI32.dll!RegQueryValueExA + 2 77DD7885 6 Bytes JMP 2A06FF4D .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ADVAPI32.dll!RegEnumValueW + 2 77DD8083 6 Bytes JMP 2A06FBDE .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ADVAPI32.dll!RegSetValueExW 77DDD7CC 7 Bytes JMP 2A06BB37 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ADVAPI32.dll!RegQueryValueW + 2 77DDD8E4 6 Bytes JMP 2A06D047 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ADVAPI32.dll!RegCreateKeyExA + 2 77DDEAF6 6 Bytes JMP 2A06EC4F .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ADVAPI32.dll!RegSetValueExA 77DDEBE7 7 Bytes JMP 2A06E1B0 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ADVAPI32.dll!RegDeleteValueA + 2 77DDEDE7 6 Bytes JMP 2A06CE2B .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ADVAPI32.dll!RegDeleteValueW + 2 77DDEEF3 6 Bytes JMP 2A06B4CF .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ADVAPI32.dll!RegSetValueA + 2 77DE6F4B 5 Bytes JMP 2A071742 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ADVAPI32.dll!SetFileSecurityW + 2 77DEAA6B 6 Bytes JMP 2A06C166 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ADVAPI32.dll!RegEnumValueA + 2 77DECF4C 6 Bytes JMP 2A06F819 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ADVAPI32.dll!SetNamedSecurityInfoW + 2 77DF1287 6 Bytes JMP 2A070675 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ADVAPI32.dll!CreateProcessAsUserW + 2 77DF7777 6 Bytes JMP 2A06916A .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ADVAPI32.dll!RegDeleteKeyW + 2 77DF9886 6 Bytes JMP 2A06C217 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ADVAPI32.dll!GetFileSecurityW + 2 77DFBCE0 6 Bytes JMP 2A06AAAE .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ADVAPI32.dll!RegDeleteKeyA + 2 77DFC125 6 Bytes JMP 2A06F92F .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ADVAPI32.dll!RegQueryInfoKeyA + 2 77DFC1B7 6 Bytes JMP 2A06BFBB .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ADVAPI32.dll!RegOpenKeyA + 2 77DFC41D 6 Bytes JMP 2A06EBE5 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ADVAPI32.dll!RegQueryValueA + 2 77DFCC12 6 Bytes JMP 2A06CE1E .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ADVAPI32.dll!RegQueryInfoKeyW + 2 77DFCCF1 6 Bytes JMP 2A070653 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ADVAPI32.dll!GetNamedSecurityInfoW + 2 77DFD07A 7 Bytes JMP 2A06E77A .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ADVAPI32.dll!RegCreateKeyA + 2 77DFD5BD 6 Bytes JMP 2A06CB64 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ADVAPI32.dll!SetFileSecurityA + 2 77E0D2FF 5 Bytes JMP 2A06D68C .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ADVAPI32.dll!GetFileSecurityA + 2 77E0D365 5 Bytes JMP 2A070262 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ADVAPI32.dll!CreateProcessAsUserA + 2 77E1095A 6 Bytes JMP 2A069FF5 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ADVAPI32.dll!CreateProcessWithLogonW 77E15C9D 5 Bytes JMP 2A069783 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ADVAPI32.dll!GetNamedSecurityInfoA + 2 77E21546 7 Bytes JMP 2A071697 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ADVAPI32.dll!SetNamedSecurityInfoA + 2 77E21592 7 Bytes JMP 2A071978 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ADVAPI32.dll!RegQueryMultipleValuesA + 2 77E3553D 6 Bytes JMP 2A06EEEE .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ADVAPI32.dll!RegQueryMultipleValuesW + 2 77E3589F 6 Bytes JMP 2A06C056 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] ADVAPI32.dll!RegSetValueW + 2 77E35FC4 5 Bytes JMP 2A070B68 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] WS2_32.dll!connect + 2 71AB406C 6 Bytes JMP 2A06A915 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] WS2_32.dll!gethostbyname + 2 71AB4FD6 9 Bytes JMP 2A06A665 .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] WS2_32.dll!WSAAsyncGetHostByName + 2 71ABE987 13 Bytes [ 99, 2F, 37, 49, F2, D6, 90, … ] .text C:\Program Files\Comodo\Firewall\CPF.exe[1288] WS2_32.dll!WSAConnect + 2 71AC0C6B 14 Bytes [ F8, 2F, F3, 41, 37, D6, F2, … ] .text C:\WINDOWS\system32\svchost.exe[1304] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 2A06FA41 .text C:\WINDOWS\system32\svchost.exe[1304] ntdll.dll!NtQueryInformationFile 7C90DFDC 5 Bytes JMP 2A06CC56 .text C:\WINDOWS\system32\svchost.exe[1304] ntdll.dll!NtQuerySystemInformation 7C90E1AA 5 Bytes JMP 2A070C70 .text C:\WINDOWS\system32\svchost.exe[1304] ntdll.dll!NtReadVirtualMemory 7C90E2BB 5 Bytes JMP 2A06C25F .text C:\WINDOWS\system32\svchost.exe[1304] ntdll.dll!NtVdmControl 7C90E975 5 Bytes JMP 2A06BEBE .text C:\WINDOWS\system32\svchost.exe[1304] ntdll.dll!NtWriteVirtualMemory 7C90EA32 5 Bytes JMP 2A06AC45 .text C:\WINDOWS\system32\svchost.exe[1304] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 2A0687F2 .text C:\WINDOWS\system32\svchost.exe[1304] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 2A06A0D0 .text C:\WINDOWS\system32\svchost.exe[1304] ntdll.dll!RtlQueryProcessDebugInformation + 2 7C9538ED 6 Bytes JMP 2A06B483 .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!CreateFileA + 2 7C801A26 6 Bytes JMP 2A06C5DF .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!LoadLibraryExW 7C801AF1 7 Bytes JMP 2A0689C9 .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!LoadLibraryExA + 2 7C801D51 6 Bytes JMP 2A067CDE .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!LoadLibraryA + 2 7C801D79 7 Bytes JMP 2A06863A .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!ReadProcessMemory + 2 7C8021CE 6 Bytes JMP 2A06FD37 .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!WriteProcessMemory + 2 7C802211 5 Bytes JMP 2A06E8FF .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!CreateProcessW + 2 7C802334 5 Bytes JMP 2A068E75 .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!CreateProcessA + 2 7C802369 5 Bytes JMP 2A06803F .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!FreeLibrary + 2 7C80AA68 7 Bytes JMP 2A069DE4 .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!GetProcAddress + 2 7C80AC2A 5 Bytes JMP 2A069C47 .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!LoadLibraryW + 2 7C80ACD5 5 Bytes JMP 2A06A1E2 .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!GetFileAttributesW + 2 7C80B5D6 6 Bytes JMP 2A06C14F .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!FreeLibraryAndExitThread + 2 7C80CEA3 6 Bytes JMP 2A069E7D .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!FindFirstFileExW + 2 7C80EC7F 9 Bytes JMP 2A06FA2C .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!FindFirstFileW + 2 7C80F0E3 5 Bytes JMP 2A070FD3 .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!FindNextFileW 7C80F13A 7 Bytes JMP 2A0702C9 .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!CreateFileW + 2 7C810978 6 Bytes JMP 2A06BE72 .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!GetFileAttributesExW + 2 7C81130F 6 Bytes JMP 2A06EAE3 .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!GetFileAttributesA + 2 7C81174E 6 Bytes JMP 2A06EBC4 .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!GetFileAttributesExA + 2 7C813533 6 Bytes JMP 2A07158F .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!FindFirstFileA + 2 7C81355B 9 Bytes JMP 2A06EDFD .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!ExitProcess + 2 7C81CAA4 5 Bytes JMP 2A068826 .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!OpenProcess + 2 7C81E07B 6 Bytes JMP 2A070AC2 .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!DeleteFileA + 2 7C81E85E 6 Bytes JMP 2A06B2D3 .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!DeleteFileW + 2 7C81F73F 6 Bytes JMP 2A06BA7B .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!SetFileAttributesA + 2 7C81FB46 6 Bytes JMP 2A06B184 .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!SetFileAttributesW + 2 7C81FC07 6 Bytes JMP 2A06EAC6 .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!MoveFileWithProgressW 7C821565 5 Bytes JMP 2A06D603 .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!MoveFileWithProgressA + 2 7C8222B5 6 Bytes JMP 2A06FECF .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!OpenFile 7C826B99 5 Bytes JMP 2A06D4C6 .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!FindNextFileA + 2 7C83901B 9 Bytes JMP 2A06F24F .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!MoveFileExW + 2 7C839921 6 Bytes JMP 2A06FC93 .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!FindFirstFileExA + 2 7C85C2F4 9 Bytes JMP 2A06EF85 .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!MoveFileExA + 2 7C85D2A5 6 Bytes JMP 2A070BDD .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!_lopen + 2 7C85E612 6 Bytes JMP 2A06C856 .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!WinExec + 2 7C86114F 6 Bytes JMP 2A069341 .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!Process32FirstW + 2 7C8639D6 6 Bytes JMP 2A06CB00 .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!Process32First + 2 7C863A8F 9 Bytes JMP 2A06B371 .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!Process32NextW + 2 7C863B61 6 Bytes JMP 2A06D6F2 .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!Process32Next + 2 7C863C02 9 Bytes JMP 2A06FE03 .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!Thread32First + 2 7C863CD4 6 Bytes JMP 2A07198F .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!Thread32Next + 2 7C863D88 6 Bytes JMP 2A06CD26 .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!Module32FirstW + 2 7C863E21 6 Bytes JMP 2A06CE4E .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!Module32First + 2 7C863EDA 9 Bytes JMP 2A0717BB .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!Module32NextW + 2 7C863FBE 6 Bytes JMP 2A06EB42 .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!Module32Next + 2 7C86405F 9 Bytes JMP 2A070928 .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!GetBinaryTypeW 7C86783C 5 Bytes JMP 2A06E8F2 .text C:\WINDOWS\system32\svchost.exe[1304] kernel32.dll!GetBinaryType + 2 7C867C9D 6 Bytes JMP 2A06B30C .text C:\WINDOWS\system32\svchost.exe[1304] ADVAPI32.dll!RegOpenKeyExW + 2 77DD6A7A 6 Bytes JMP 2A06DBF0 .text C:\WINDOWS\system32\svchost.exe[1304] ADVAPI32.dll!RegCloseKey + 2 77DD6BF2 6 Bytes JMP 2A06FA92 .text C:\WINDOWS\system32\svchost.exe[1304] ADVAPI32.dll!RegQueryValueExW + 2 77DD6FCA 6 Bytes JMP 2A07133B .text C:\WINDOWS\system32\svchost.exe[1304] ADVAPI32.dll!RegCreateKeyExW + 2 77DD7537 6 Bytes JMP 2A06E09C .text C:\WINDOWS\system32\svchost.exe[1304] ADVAPI32.dll!RegOpenKeyExA + 2 77DD761D 6 Bytes JMP 2A06AD1F .text C:\WINDOWS\system32\svchost.exe[1304] ADVAPI32.dll!RegQueryValueExA + 2 77DD7885 6 Bytes JMP 2A06FF4D .text C:\WINDOWS\system32\svchost.exe[1304] ADVAPI32.dll!RegEnumValueW + 2 77DD8083 6 Bytes JMP 2A06FBDE .text C:\WINDOWS\system32\svchost.exe[1304] ADVAPI32.dll!RegSetValueExW 77DDD7CC 7 Bytes JMP 2A06BB37 .text C:\WINDOWS\system32\svchost.exe[1304] ADVAPI32.dll!RegQueryValueW + 2 77DDD8E4 6 Bytes JMP 2A06D047 .text C:\WINDOWS\system32\svchost.exe[1304] ADVAPI32.dll!RegCreateKeyExA + 2 77DDEAF6 6 Bytes JMP 2A06EC4F .text C:\WINDOWS\system32\svchost.exe[1304] ADVAPI32.dll!RegSetValueExA 77DDEBE7 7 Bytes JMP 2A06E1B0 .text C:\WINDOWS\system32\svchost.exe[1304] ADVAPI32.dll!RegDeleteValueA + 2 77DDEDE7 6 Bytes JMP 2A06CE2B .text C:\WINDOWS\system32\svchost.exe[1304] ADVAPI32.dll!RegDeleteValueW + 2 77DDEEF3 6 Bytes JMP 2A06B4CF .text C:\WINDOWS\system32\svchost.exe[1304] ADVAPI32.dll!RegSetValueA + 2 77DE6F4B 5 Bytes JMP 2A071742 .text C:\WINDOWS\system32\svchost.exe[1304] ADVAPI32.dll!SetFileSecurityW + 2 77DEAA6B 6 Bytes JMP 2A06C166 .text C:\WINDOWS\system32\svchost.exe[1304] ADVAPI32.dll!RegEnumValueA + 2 77DECF4C 6 Bytes JMP 2A06F819 .text C:\WINDOWS\system32\svchost.exe[1304] ADVAPI32.dll!SetNamedSecurityInfoW + 2 77DF1287 6 Bytes JMP 2A070675 .text C:\WINDOWS\system32\svchost.exe[1304] ADVAPI32.dll!CreateProcessAsUserW + 2 77DF7777 6 Bytes JMP 2A06916A .text C:\WINDOWS\system32\svchost.exe[1304] ADVAPI32.dll!RegDeleteKeyW + 2 77DF9886 6 Bytes JMP 2A06C217 .text C:\WINDOWS\system32\svchost.exe[1304] ADVAPI32.dll!GetFileSecurityW + 2 77DFBCE0 6 Bytes JMP 2A06AAAE .text C:\WINDOWS\system32\svchost.exe[1304] ADVAPI32.dll!RegDeleteKeyA + 2 77DFC125 6 Bytes JMP 2A06F92F .text C:\WINDOWS\system32\svchost.exe[1304] ADVAPI32.dll!RegQueryInfoKeyA + 2 77DFC1B7 6 Bytes JMP 2A06BFBB .text C:\WINDOWS\system32\svchost.exe[1304] ADVAPI32.dll!RegOpenKeyA + 2 77DFC41D 6 Bytes JMP 2A06EBE5 .text C:\WINDOWS\system32\svchost.exe[1304] ADVAPI32.dll!RegQueryValueA + 2 77DFCC12 6 Bytes JMP 2A06CE1E .text C:\WINDOWS\system32\svchost.exe[1304] ADVAPI32.dll!RegQueryInfoKeyW + 2 77DFCCF1 6 Bytes JMP 2A070653 .text C:\WINDOWS\system32\svchost.exe[1304] ADVAPI32.dll!GetNamedSecurityInfoW + 2 77DFD07A 7 Bytes JMP 2A06E77A .text C:\WINDOWS\system32\svchost.exe[1304] ADVAPI32.dll!RegCreateKeyA + 2 77DFD5BD 6 Bytes JMP 2A06CB64 .text C:\WINDOWS\system32\svchost.exe[1304] ADVAPI32.dll!SetFileSecurityA + 2 77E0D2FF 5 Bytes JMP 2A06D68C .text C:\WINDOWS\system32\svchost.exe[1304] ADVAPI32.dll!GetFileSecurityA + 2 77E0D365 5 Bytes JMP 2A070262 .text C:\WINDOWS\system32\svchost.exe[1304] ADVAPI32.dll!CreateProcessAsUserA + 2 77E1095A 6 Bytes JMP 2A069FF5 .text C:\WINDOWS\system32\svchost.exe[1304] ADVAPI32.dll!CreateProcessWithLogonW 77E15C9D 5 Bytes JMP 2A069783 .text C:\WINDOWS\system32\svchost.exe[1304] ADVAPI32.dll!GetNamedSecurityInfoA + 2 77E21546 7 Bytes JMP 2A071697 .text C:\WINDOWS\system32\svchost.exe[1304] ADVAPI32.dll!SetNamedSecurityInfoA + 2 77E21592 7 Bytes JMP 2A071978 .text C:\WINDOWS\system32\svchost.exe[1304] ADVAPI32.dll!RegQueryMultipleValuesA + 2 77E3553D 6 Bytes JMP 2A06EEEE .text C:\WINDOWS\system32\svchost.exe[1304] ADVAPI32.dll!RegQueryMultipleValuesW + 2 77E3589F 6 Bytes JMP 2A06C056 .text C:\WINDOWS\system32\svchost.exe[1304] ADVAPI32.dll!RegSetValueW + 2 77E35FC4 5 Bytes JMP 2A070B68 .text C:\WINDOWS\system32\svchost.exe[1304] USER32.dll!ExitWindowsEx + 2 77D89E2F 6 Bytes JMP 2A0699C2 .text C:\WINDOWS\system32\svchost.exe[1304] WS2_32.dll!connect + 2 71AB406C 6 Bytes JMP 2A06A915 .text C:\WINDOWS\system32\svchost.exe[1304] WS2_32.dll!gethostbyname + 2 71AB4FD6 9 Bytes JMP 2A06A665 .text C:\WINDOWS\system32\svchost.exe[1304] WS2_32.dll!WSAAsyncGetHostByName + 2 71ABE987 13 Bytes [ 2F, F5, 48, F2, F9, 90, 42, … ] .text C:\WINDOWS\system32\svchost.exe[1304] WS2_32.dll!WSAConnect + 2 71AC0C6B 14 Bytes [ 37, 99, F9, 98, 37, F8, 98, … ] .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 2A06FA41 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ntdll.dll!NtQueryInformationFile 7C90DFDC 5 Bytes JMP 2A06CC56 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ntdll.dll!NtQuerySystemInformation 7C90E1AA 5 Bytes JMP 2A070C70 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ntdll.dll!NtReadVirtualMemory 7C90E2BB 5 Bytes JMP 2A06C25F .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ntdll.dll!NtVdmControl 7C90E975 5 Bytes JMP 2A06BEBE .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ntdll.dll!NtWriteVirtualMemory 7C90EA32 5 Bytes JMP 2A06AC45 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 2A0687F2 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 2A06A0D0 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ntdll.dll!RtlQueryProcessDebugInformation + 2 7C9538ED 6 Bytes JMP 2A06B483 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!CreateFileA + 2 7C801A26 6 Bytes JMP 2A06C5DF .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!LoadLibraryExW 7C801AF1 7 Bytes JMP 2A0689C9 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!LoadLibraryExA + 2 7C801D51 6 Bytes JMP 2A067CDE .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!LoadLibraryA + 2 7C801D79 7 Bytes JMP 2A06863A .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!ReadProcessMemory + 2 7C8021CE 6 Bytes JMP 2A06FD37 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!WriteProcessMemory + 2 7C802211 5 Bytes JMP 2A06E8FF .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!CreateProcessW + 2 7C802334 5 Bytes JMP 2A068E75 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!CreateProcessA + 2 7C802369 5 Bytes JMP 2A06803F .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!FreeLibrary + 2 7C80AA68 7 Bytes JMP 2A069DE4 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!GetProcAddress + 2 7C80AC2A 5 Bytes JMP 2A069C47 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!LoadLibraryW + 2 7C80ACD5 5 Bytes JMP 2A06A1E2 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!GetFileAttributesW + 2 7C80B5D6 6 Bytes JMP 2A06C14F .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!FreeLibraryAndExitThread + 2 7C80CEA3 6 Bytes JMP 2A069E7D .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!FindFirstFileExW + 2 7C80EC7F 9 Bytes JMP 2A06FA2C .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!FindFirstFileW + 2 7C80F0E3 5 Bytes JMP 2A070FD3 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!FindNextFileW 7C80F13A 7 Bytes JMP 2A0702C9 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!CreateFileW + 2 7C810978 6 Bytes JMP 2A06BE72 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!GetFileAttributesExW + 2 7C81130F 6 Bytes JMP 2A06EAE3 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!GetFileAttributesA + 2 7C81174E 6 Bytes JMP 2A06EBC4 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!GetFileAttributesExA + 2 7C813533 6 Bytes JMP 2A07158F .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!FindFirstFileA + 2 7C81355B 9 Bytes JMP 2A06EDFD .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!ExitProcess + 2 7C81CAA4 5 Bytes JMP 2A068826 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!OpenProcess + 2 7C81E07B 6 Bytes JMP 2A070AC2 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!DeleteFileA + 2 7C81E85E 6 Bytes JMP 2A06B2D3 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!DeleteFileW + 2 7C81F73F 6 Bytes JMP 2A06BA7B .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!SetFileAttributesA + 2 7C81FB46 6 Bytes JMP 2A06B184 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!SetFileAttributesW + 2 7C81FC07 6 Bytes JMP 2A06EAC6 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!MoveFileWithProgressW 7C821565 5 Bytes JMP 2A06D603 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!MoveFileWithProgressA + 2 7C8222B5 6 Bytes JMP 2A06FECF .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!OpenFile 7C826B99 5 Bytes JMP 2A06D4C6 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!FindNextFileA + 2 7C83901B 9 Bytes JMP 2A06F24F .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!MoveFileExW + 2 7C839921 6 Bytes JMP 2A06FC93 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!FindFirstFileExA + 2 7C85C2F4 9 Bytes JMP 2A06EF85 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!MoveFileExA + 2 7C85D2A5 6 Bytes JMP 2A070BDD .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!_lopen + 2 7C85E612 6 Bytes JMP 2A06C856 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!WinExec + 2 7C86114F 6 Bytes JMP 2A069341 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!Process32FirstW + 2 7C8639D6 6 Bytes JMP 2A06CB00 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!Process32First + 2 7C863A8F 9 Bytes JMP 2A06B371 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!Process32NextW + 2 7C863B61 6 Bytes JMP 2A06D6F2 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!Process32Next + 2 7C863C02 9 Bytes JMP 2A06FE03 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!Thread32First + 2 7C863CD4 6 Bytes JMP 2A07198F .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!Thread32Next + 2 7C863D88 6 Bytes JMP 2A06CD26 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!Module32FirstW + 2 7C863E21 6 Bytes JMP 2A06CE4E .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!Module32First + 2 7C863EDA 9 Bytes JMP 2A0717BB .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!Module32NextW + 2 7C863FBE 6 Bytes JMP 2A06EB42 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!Module32Next + 2 7C86405F 9 Bytes JMP 2A070928 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!GetBinaryTypeW 7C86783C 5 Bytes JMP 2A06E8F2 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] kernel32.dll!GetBinaryType + 2 7C867C9D 6 Bytes JMP 2A06B30C .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] USER32.dll!ExitWindowsEx + 2 77D89E2F 6 Bytes JMP 2A0699C2 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ADVAPI32.dll!RegOpenKeyExW + 2 77DD6A7A 6 Bytes JMP 2A06DBF0 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ADVAPI32.dll!RegCloseKey + 2 77DD6BF2 6 Bytes JMP 2A06FA92 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ADVAPI32.dll!RegQueryValueExW + 2 77DD6FCA 6 Bytes JMP 2A07133B .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ADVAPI32.dll!RegCreateKeyExW + 2 77DD7537 6 Bytes JMP 2A06E09C .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ADVAPI32.dll!RegOpenKeyExA + 2 77DD761D 6 Bytes JMP 2A06AD1F .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ADVAPI32.dll!RegQueryValueExA + 2 77DD7885 6 Bytes JMP 2A06FF4D .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ADVAPI32.dll!RegEnumValueW + 2 77DD8083 6 Bytes JMP 2A06FBDE .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ADVAPI32.dll!RegSetValueExW 77DDD7CC 7 Bytes JMP 2A06BB37 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ADVAPI32.dll!RegQueryValueW + 2 77DDD8E4 6 Bytes JMP 2A06D047 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ADVAPI32.dll!RegCreateKeyExA + 2 77DDEAF6 6 Bytes JMP 2A06EC4F .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ADVAPI32.dll!RegSetValueExA 77DDEBE7 7 Bytes JMP 2A06E1B0 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ADVAPI32.dll!RegDeleteValueA + 2 77DDEDE7 6 Bytes JMP 2A06CE2B .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ADVAPI32.dll!RegDeleteValueW + 2 77DDEEF3 6 Bytes JMP 2A06B4CF .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ADVAPI32.dll!RegSetValueA + 2 77DE6F4B 5 Bytes JMP 2A071742 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ADVAPI32.dll!SetFileSecurityW + 2 77DEAA6B 6 Bytes JMP 2A06C166 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ADVAPI32.dll!RegEnumValueA + 2 77DECF4C 6 Bytes JMP 2A06F819 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ADVAPI32.dll!SetNamedSecurityInfoW + 2 77DF1287 6 Bytes JMP 2A070675 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ADVAPI32.dll!CreateProcessAsUserW + 2 77DF7777 6 Bytes JMP 2A06916A .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ADVAPI32.dll!RegDeleteKeyW + 2 77DF9886 6 Bytes JMP 2A06C217 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ADVAPI32.dll!GetFileSecurityW + 2 77DFBCE0 6 Bytes JMP 2A06AAAE .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ADVAPI32.dll!RegDeleteKeyA + 2 77DFC125 6 Bytes JMP 2A06F92F .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ADVAPI32.dll!RegQueryInfoKeyA + 2 77DFC1B7 6 Bytes JMP 2A06BFBB .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ADVAPI32.dll!RegOpenKeyA + 2 77DFC41D 6 Bytes JMP 2A06EBE5 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ADVAPI32.dll!RegQueryValueA + 2 77DFCC12 6 Bytes JMP 2A06CE1E .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ADVAPI32.dll!RegQueryInfoKeyW + 2 77DFCCF1 6 Bytes JMP 2A070653 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ADVAPI32.dll!GetNamedSecurityInfoW + 2 77DFD07A 7 Bytes JMP 2A06E77A .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ADVAPI32.dll!RegCreateKeyA + 2 77DFD5BD 6 Bytes JMP 2A06CB64 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ADVAPI32.dll!SetFileSecurityA + 2 77E0D2FF 5 Bytes JMP 2A06D68C .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ADVAPI32.dll!GetFileSecurityA + 2 77E0D365 5 Bytes JMP 2A070262 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ADVAPI32.dll!CreateProcessAsUserA + 2 77E1095A 6 Bytes JMP 2A069FF5 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ADVAPI32.dll!CreateProcessWithLogonW 77E15C9D 5 Bytes JMP 2A069783 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ADVAPI32.dll!GetNamedSecurityInfoA + 2 77E21546 7 Bytes JMP 2A071697 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ADVAPI32.dll!SetNamedSecurityInfoA + 2 77E21592 7 Bytes JMP 2A071978 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ADVAPI32.dll!RegQueryMultipleValuesA + 2 77E3553D 6 Bytes JMP 2A06EEEE .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ADVAPI32.dll!RegQueryMultipleValuesW + 2 77E3589F 6 Bytes JMP 2A06C056 .text C:\Documents and Settings\Donald\Desktop\gmer\gmer.exe[1392] ADVAPI32.dll!RegSetValueW + 2 77E35FC4 5 Bytes JMP 2A070B68 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 2A06FA41 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] ntdll.dll!NtQueryInformationFile 7C90DFDC 5 Bytes JMP 2A06CC56 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] ntdll.dll!NtQuerySystemInformation 7C90E1AA 5 Bytes JMP 2A070C70 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] ntdll.dll!NtReadVirtualMemory 7C90E2BB 5 Bytes JMP 2A06C25F .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] ntdll.dll!NtVdmControl 7C90E975 5 Bytes JMP 2A06BEBE .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] ntdll.dll!NtWriteVirtualMemory 7C90EA32 5 Bytes JMP 2A06AC45 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 2A0687F2 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 2A06A0D0 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] ntdll.dll!RtlQueryProcessDebugInformation + 2 7C9538ED 6 Bytes JMP 2A06B483 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!CreateFileA + 2 7C801A26 6 Bytes JMP 2A06C5DF .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!LoadLibraryExW 7C801AF1 7 Bytes JMP 2A0689C9 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!LoadLibraryExA + 2 7C801D51 6 Bytes JMP 2A067CDE .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!LoadLibraryA + 2 7C801D79 7 Bytes JMP 2A06863A .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!ReadProcessMemory + 2 7C8021CE 6 Bytes JMP 2A06FD37 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!WriteProcessMemory + 2 7C802211 5 Bytes JMP 2A06E8FF .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!CreateProcessW + 2 7C802334 5 Bytes JMP 2A068E75 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!CreateProcessA + 2 7C802369 5 Bytes JMP 2A06803F .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!FreeLibrary + 2 7C80AA68 7 Bytes JMP 2A069DE4 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!GetProcAddress + 2 7C80AC2A 5 Bytes JMP 2A069C47 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!LoadLibraryW + 2 7C80ACD5 5 Bytes JMP 2A06A1E2 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!GetFileAttributesW + 2 7C80B5D6 6 Bytes JMP 2A06C14F .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!FreeLibraryAndExitThread + 2 7C80CEA3 6 Bytes JMP 2A069E7D .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!FindFirstFileExW + 2 7C80EC7F 9 Bytes JMP 2A06FA2C .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!FindFirstFileW + 2 7C80F0E3 5 Bytes JMP 2A070FD3 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!FindNextFileW 7C80F13A 7 Bytes JMP 2A0702C9 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!CreateFileW + 2 7C810978 6 Bytes JMP 2A06BE72 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!GetFileAttributesExW + 2 7C81130F 6 Bytes JMP 2A06EAE3 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!GetFileAttributesA + 2 7C81174E 6 Bytes JMP 2A06EBC4 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!GetFileAttributesExA + 2 7C813533 6 Bytes JMP 2A07158F .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!FindFirstFileA + 2 7C81355B 9 Bytes JMP 2A06EDFD .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!ExitProcess + 2 7C81CAA4 5 Bytes JMP 2A068826 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!OpenProcess + 2 7C81E07B 6 Bytes JMP 2A070AC2 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!DeleteFileA + 2 7C81E85E 6 Bytes JMP 2A06B2D3 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!DeleteFileW + 2 7C81F73F 6 Bytes JMP 2A06BA7B .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!SetFileAttributesA + 2 7C81FB46 6 Bytes JMP 2A06B184 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!SetFileAttributesW + 2 7C81FC07 6 Bytes JMP 2A06EAC6 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!MoveFileWithProgressW 7C821565 5 Bytes JMP 2A06D603 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!MoveFileWithProgressA + 2 7C8222B5 6 Bytes JMP 2A06FECF .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!OpenFile 7C826B99 5 Bytes JMP 2A06D4C6 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!FindNextFileA + 2 7C83901B 9 Bytes JMP 2A06F24F .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!MoveFileExW + 2 7C839921 6 Bytes JMP 2A06FC93 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!FindFirstFileExA + 2 7C85C2F4 9 Bytes JMP 2A06EF85 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!MoveFileExA + 2 7C85D2A5 6 Bytes JMP 2A070BDD .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!_lopen + 2 7C85E612 6 Bytes JMP 2A06C856 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!WinExec + 2 7C86114F 6 Bytes JMP 2A069341 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!Process32FirstW + 2 7C8639D6 6 Bytes JMP 2A06CB00 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!Process32First + 2 7C863A8F 9 Bytes JMP 2A06B371 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!Process32NextW + 2 7C863B61 6 Bytes JMP 2A06D6F2 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!Process32Next + 2 7C863C02 9 Bytes JMP 2A06FE03 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!Thread32First + 2 7C863CD4 6 Bytes JMP 2A07198F .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!Thread32Next + 2 7C863D88 6 Bytes JMP 2A06CD26 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!Module32FirstW + 2 7C863E21 6 Bytes JMP 2A06CE4E .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!Module32First + 2 7C863EDA 9 Bytes JMP 2A0717BB .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!Module32NextW + 2 7C863FBE 6 Bytes JMP 2A06EB42 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!Module32Next + 2 7C86405F 9 Bytes JMP 2A070928 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!GetBinaryTypeW 7C86783C 5 Bytes JMP 2A06E8F2 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] kernel32.dll!GetBinaryType + 2 7C867C9D 6 Bytes JMP 2A06B30C .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] ADVAPI32.dll!RegOpenKeyExW + 2 77DD6A7A 6 Bytes JMP 2A06DBF0 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] ADVAPI32.dll!RegCloseKey + 2 77DD6BF2 6 Bytes JMP 2A06FA92 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] ADVAPI32.dll!RegQueryValueExW + 2 77DD6FCA 6 Bytes JMP 2A07133B .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] ADVAPI32.dll!RegCreateKeyExW + 2 77DD7537 6 Bytes JMP 2A06E09C .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] ADVAPI32.dll!RegOpenKeyExA + 2 77DD761D 6 Bytes JMP 2A06AD1F .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] ADVAPI32.dll!RegQueryValueExA + 2 77DD7885 6 Bytes JMP 2A06FF4D .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] ADVAPI32.dll!RegEnumValueW + 2 77DD8083 6 Bytes JMP 2A06FBDE .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] ADVAPI32.dll!RegSetValueExW 77DDD7CC 7 Bytes JMP 2A06BB37 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] ADVAPI32.dll!RegQueryValueW + 2 77DDD8E4 6 Bytes JMP 2A06D047 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] ADVAPI32.dll!RegCreateKeyExA + 2 77DDEAF6 6 Bytes JMP 2A06EC4F .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] ADVAPI32.dll!RegSetValueExA 77DDEBE7 7 Bytes JMP 2A06E1B0 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] ADVAPI32.dll!RegDeleteValueA + 2 77DDEDE7 6 Bytes JMP 2A06CE2B .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] ADVAPI32.dll!RegDeleteValueW + 2 77DDEEF3 6 Bytes JMP 2A06B4CF .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] ADVAPI32.dll!RegSetValueA + 2 77DE6F4B 5 Bytes JMP 2A071742 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] ADVAPI32.dll!SetFileSecurityW + 2 77DEAA6B 6 Bytes JMP 2A06C166 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] ADVAPI32.dll!RegEnumValueA + 2 77DECF4C 6 Bytes JMP 2A06F819 .text C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe[1544] ADVAPI32.dll!SetNamedSecurityInfoW + 2 77DF1287 6 Bytes JMP 2A070675

Hi

To enable the viewing of Hidden files follow these steps:

• Close all programs so that you are at your desktop.
• Double-click on the My Computer icon (or click Start, then select My Computer)
• Select the Tools menu and click Folder Options.
• After the new window appears select the View tab.
• Put a checkmark in the checkbox labeled Display the contents of system folders.
• Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
• Remove the checkmark from the checkbox labeled Hide file extensions for known file types.
• Remove the checkmark from the checkbox labeled Hide protected operating system files.
• Press the Apply button and then the OK button and shutdown My Computer.
  Now your computer is configured to show all hidden files.

Upload a File to Virustotal
Please visit Virustotal

• Click the Browse… button
• Navigate to the file C:\WINDOWS\okgnq1.dll
• Click the Open button
• Click the Send button
• Copy and paste the results back here please.

Do the same for this file too C:\WINDOWS\system32\lpt2.dub and this one C:\WINDOWS\okgnq1.del

Hi Scotty, I had a problem with C:\WINDOWS\okgnq1.dll and C:\WINDOWS\okgnq1.del It said I don't have permission I need permission from the Admin, but Im the Administrator I am very sorry for problems. I could only find one of the folders and my results are 0 bytes size received / Se ha recibido un archivo vacio