[RESOLVED] Couple of issues

Think I have some sort of virus because I keep getting SSL untrusted certificate messages when trying to access all my usual sites. I keep getting re-directed also when I click Google links and also keep getting some pop ups.

My Firewall keeps blocking a TCP/IP Command and my comp in general seems to be running slow so thought i'd head on over here and see if I can find some help!

Just running Malware bytes now so all logs should be posted up soon.

e2a; Ran McAfee a few days ago and didn't find anything.

Malwarebytes Anti-Malware (Trial) 1.61.0.1400
www.malwarebytes.org

Database version: v2012.06.08.03

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 8.0.6001.19222
Alex :: LESLEY [administrator]

Protection: Enabled

08/06/2012 13:15:51
mbam-log-2012-06-08 (13-15-51).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 248918
Time elapsed: 14 minute(s), 20 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 26
HKCR\AppID\{D2083641-E57F-4eab-BB85-0582424F4A29} (Adware.HotBar.CP) -> Quarantined and deleted successfully.
HKCR\Typelib\{B035BA6B-57CD-4F72-B545-65BE465FCAF6} (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKCR\Typelib\{D44FD6F0-9746-484E-B5C4-C66688393872} (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKCR\Interface\{0EB3F101-224A-4B2B-9E5B-DF720857529C} (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{BDEA95CF-F0E6-41E0-BD3D-B00F39A4E939} (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{BDEA95CF-F0E6-41E0-BD3D-B00F39A4E939} (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{BDEA95CF-F0E6-41E0-BD3D-B00F39A4E939} (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{B58926D6-CFB0-45D2-9C28-4B5A0F0368AE} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{B58926D6-CFB0-45D2-9C28-4B5A0F0368AE} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{B58926D6-CFB0-45D2-9C28-4B5A0F0368AE} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B58926D6-CFB0-45D2-9C28-4B5A0F0368AE} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{DB38E21A-0133-419D-92AD-ECDFD5244D6D} (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{DB38E21A-0133-419D-92AD-ECDFD5244D6D} (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{DB38E21A-0133-419D-92AD-ECDFD5244D6D} (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{EB620C54-E229-4942-87CE-E717109FC8C6} (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{EB620C54-E229-4942-87CE-E717109FC8C6} (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EB620C54-E229-4942-87CE-E717109FC8C6} (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A078F691-9C07-4AF2-BF43-35E79EECF8B7} (Adware.Softomate) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{1602F07D-8BF3-4c08-BDD6-DDDB1C48AEDC} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{69725738-CD68-4f36-8D02-8C43722EE5DA} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{AC6D819E-AA8F-4418-A3BB-D165C1B18BB5} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKCR\AppID\MenuButtonIE.DLL (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKCU\Software\clickpotatolitesa (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\ClickPotatoLite (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\ScanQuery (Adware.ScanQuery) -> Quarantined and deleted successfully.
HKLM\SYSTEM\CurrentControlSet\Services\ScanQuery Service (Adware.ScanQuery) -> Quarantined and deleted successfully.

Registry Values Detected: 1
HKLM\SOFTWARE\Mozilla\Firefox\extensions|[email protected] (Adware.ClickPotato) -> Data: C:\Program Files\ClickPotatoLite\bin\10.0.668.0\firefox\extensions -> Quarantined and deleted successfully.

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 16
C:\ProgramData\2ACA5CC3-0F83-453D-A079-1076FE1A8B65 (Adware.Seekmo) -> Quarantined and deleted successfully.
C:\ProgramData\ClickPotatoLiteSA (Adware.ClickPotato) -> Quarantined and deleted successfully.
C:\Users\Alex\AppData\Roaming\ClickPotatoLite (Adware.ClickPotato) -> Quarantined and deleted successfully.
C:\Program Files\ClickPotatoLite (Adware.ClickPotato) -> Quarantined and deleted successfully.
C:\Program Files\ClickPotatoLite\bin (Adware.ClickPotato) -> Quarantined and deleted successfully.
C:\Program Files\ClickPotatoLite\bin\10.0.668.0 (Adware.ClickPotato) -> Quarantined and deleted successfully.
C:\Program Files\ClickPotatoLite\bin\10.0.668.0\firefox (Adware.ClickPotato) -> Quarantined and deleted successfully.
C:\Program Files\ClickPotatoLite\bin\10.0.668.0\firefox\extensions (Adware.ClickPotato) -> Quarantined and deleted successfully.
C:\Program Files\ClickPotatoLite\bin\10.0.668.0\firefox\extensions\plugins (Adware.ClickPotato) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ClickPotato (Adware.ClickPotato) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{DE9265D8-D55D-4286-9DC4-F8D8A0CA2F64} (Adware.ScanQuery) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{DE9265D8-D55D-4286-9DC4-F8D8A0CA2F64}\chrome (Adware.ScanQuery) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{DE9265D8-D55D-4286-9DC4-F8D8A0CA2F64}\defaults (Adware.ScanQuery) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{DE9265D8-D55D-4286-9DC4-F8D8A0CA2F64}\defaults\preferences (Adware.ScanQuery) -> Quarantined and deleted successfully.
C:\Program Files\ScanQuery (Adware.ScanQuery) -> Quarantined and deleted successfully.
C:\ProgramData\ScanQuery (Adware.ScanQuery) -> Quarantined and deleted successfully.

Files Detected: 13
C:\ProgramData\ClickPotatoLiteSA\ClickPotatoLiteSA.dat (Adware.ClickPotato) -> Quarantined and deleted successfully.
C:\ProgramData\ClickPotatoLiteSA\ClickPotatoLiteSAAbout.mht (Adware.ClickPotato) -> Quarantined and deleted successfully.
C:\ProgramData\ClickPotatoLiteSA\ClickPotatoLiteSAau.dat (Adware.ClickPotato) -> Quarantined and deleted successfully.
C:\ProgramData\ClickPotatoLiteSA\ClickPotatoLiteSAEULA.mht (Adware.ClickPotato) -> Quarantined and deleted successfully.
C:\ProgramData\ClickPotatoLiteSA\ClickPotatoLiteSA_kyf.dat (Adware.ClickPotato) -> Quarantined and deleted successfully.
C:\Program Files\ClickPotatoLite\bin\10.0.668.0\firefox\extensions\install.rdf (Adware.ClickPotato) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ClickPotato\About Us.lnk (Adware.ClickPotato) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ClickPotato\ClickPotato Customer Support.lnk (Adware.ClickPotato) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ClickPotato\ClickPotato Uninstall Instructions.lnk (Adware.ClickPotato) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{DE9265D8-D55D-4286-9DC4-F8D8A0CA2F64}\chrome.manifest (Adware.ScanQuery) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{DE9265D8-D55D-4286-9DC4-F8D8A0CA2F64}\install.rdf (Adware.ScanQuery) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{DE9265D8-D55D-4286-9DC4-F8D8A0CA2F64}\chrome\scanquery.jar (Adware.ScanQuery) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{DE9265D8-D55D-4286-9DC4-F8D8A0CA2F64}\defaults\preferences\prefs.js (Adware.ScanQuery) -> Quarantined and deleted successfully.

(end)

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-06-08 15:30:20
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP4T0L0-7 Hitachi_HDT721032SLA380 rev.ST2OA31B
Running: z9p8io2i.exe; Driver: C:\Users\Alex\AppData\Local\Temp\kwtdapod.sys


---- System - GMER 1.0.15 ----

INT 0x62 ? 86ECBBF8
INT 0x72 ? 86ECBBF8
INT 0x82 ? 86ECBBF8
INT 0x92 ? 85F90BF8
INT 0x92 ? 85F90BF8
INT 0x92 ? 85F90BF8
INT 0x92 ? 85F90BF8
INT 0x92 ? 85F90BF8
INT 0x92 ? 85F90BF8
INT 0x92 ? 86ECBBF8
INT 0x92 ? 85F90BF8
INT 0xA2 ? 85F90BF8
INT 0xB1 ? 85F90BF8
INT 0xB1 ? 85596BF8
INT 0xB2 ? 85F90BF8

Code \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwMapViewOfSection [0x8AD955A8]
Code \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwTerminateProcess [0x8AD955D2]
Code \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0x8AD955BE]
Code \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwYieldExecution [0x8AD95594]
Code \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.) NtMapViewOfSection

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!ZwYieldExecution 82A2B992 5 Bytes JMP 8AD95598 \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
? System32\drivers\yoohohh.sys The system cannot find the path specified. !
? System32\Drivers\spqy.sys The system cannot find the path specified. !
.text a07k40yf.SYS 8F001000 22 Bytes [82, 13, DC, 82, 6C, 12, DC, ...]
.text a07k40yf.SYS 8F001017 145 Bytes [00, 32, 37, 71, 80, 3D, 35, ...]
.text a07k40yf.SYS 8F0010A9 35 Bytes [62, A4, 82, A0, 59, A4, 82, ...]
.text a07k40yf.SYS 8F0010CE 10 Bytes [00, 00, 00, 00, 00, 00, C9, ...] {ADD [EAX], AL; ADD [EAX], AL; ADD [EAX], AL; LEAVE ; HLT ; POP ESP; DEC EDX}
.text a07k40yf.SYS 8F0010DA 12 Bytes [00, 00, 02, 00, 00, 00, 24, ...]
.text ...
.text USBPORT.SYS!DllUnload 8F0D341B 5 Bytes JMP 86ECB1D8
.text C:\Windows\system32\DRIVERS\atikmdag.sys section is writeable [0x8F60A000, 0x3C12C5, 0xE8000020]
.text C:\Windows\system32\DRIVERS\smb.sys section is writeable [0x905B9000, 0x13C06, 0xEA000020]
.edata C:\Windows\system32\DRIVERS\smb.sys unknown last section [0x905CD000, 0x10A, 0x48000040]
? C:\Windows\system32\DRIVERS\smb.sys suspicious PE modification

---- User code sections - GMER 1.0.15 ----

.text C:\Windows\system32\svchost.exe[324] ntdll.dll!NtCreateFile 77D14244 5 Bytes JMP 00790000
.text C:\Windows\system32\svchost.exe[324] ntdll.dll!NtCreateProcess 77D14304 5 Bytes JMP 00790011
.text C:\Windows\system32\svchost.exe[324] ntdll.dll!NtProtectVirtualMemory 77D14BA4 5 Bytes JMP 00790FE5
.text C:\Windows\system32\svchost.exe[324] kernel32.dll!GetStartupInfoW 77A31929 5 Bytes JMP 00090057
.text C:\Windows\system32\svchost.exe[324] kernel32.dll!GetStartupInfoA 77A319C9 5 Bytes JMP 00090046
.text C:\Windows\system32\svchost.exe[324] kernel32.dll!CreateProcessW 77A31BF3 5 Bytes JMP 00090EEC
.text C:\Windows\system32\svchost.exe[324] kernel32.dll!CreateProcessA 77A31C28 5 Bytes JMP 00090083
.text C:\Windows\system32\svchost.exe[324] kernel32.dll!VirtualProtect 77A31DC3 5 Bytes JMP 00090F33
.text C:\Windows\system32\svchost.exe[324] kernel32.dll!CreateNamedPipeA 77A32EF5 5 Bytes JMP 00090FC3
.text C:\Windows\system32\svchost.exe[324] kernel32.dll!CreateNamedPipeW 77A35C0C 5 Bytes JMP 00090FB2
.text C:\Windows\system32\svchost.exe[324] kernel32.dll!CreatePipe 77A58F06 5 Bytes JMP 00090F11
.text C:\Windows\system32\svchost.exe[324] kernel32.dll!LoadLibraryExW 77A5927C 5 Bytes JMP 00090F44
.text C:\Windows\system32\svchost.exe[324] kernel32.dll!LoadLibraryW 77A59400 5 Bytes JMP 00090F7C
.text C:\Windows\system32\svchost.exe[324] kernel32.dll!LoadLibraryExA 77A59554 5 Bytes JMP 00090F61
.text C:\Windows\system32\svchost.exe[324] kernel32.dll!LoadLibraryA 77A5957C 5 Bytes JMP 00090F97
.text C:\Windows\system32\svchost.exe[324] kernel32.dll!VirtualProtectEx 77A5DC52 5 Bytes JMP 00090F22
.text C:\Windows\system32\svchost.exe[324] kernel32.dll!GetProcAddress 77A7925B 5 Bytes JMP 00090EDB
.text C:\Windows\system32\svchost.exe[324] kernel32.dll!CreateFileW 77A7B0EB 5 Bytes JMP 00090FD4
.text C:\Windows\system32\svchost.exe[324] kernel32.dll!CreateFileA 77A7D07F 5 Bytes JMP 00090FE5
.text C:\Windows\system32\svchost.exe[324] kernel32.dll!WinExec 77AC60CF 5 Bytes JMP 00090072
.text C:\Windows\system32\svchost.exe[324] msvcrt.dll!_wsystem 77897F3F 5 Bytes JMP 00080FA1
.text C:\Windows\system32\svchost.exe[324] msvcrt.dll!system 7789805B 5 Bytes JMP 00080036
.text C:\Windows\system32\svchost.exe[324] msvcrt.dll!_creat 7789BBF1 5 Bytes JMP 00080011
.text C:\Windows\system32\svchost.exe[324] msvcrt.dll!_open 7789D116 5 Bytes JMP 00080FE3
.text C:\Windows\system32\svchost.exe[324] msvcrt.dll!_wcreat 7789D336 5 Bytes JMP 00080FBC
.text C:\Windows\system32\svchost.exe[324] msvcrt.dll!_wopen 7789D511 5 Bytes JMP 00080000
.text C:\Windows\system32\svchost.exe[324] ADVAPI32.dll!RegCreateKeyExA 77B339AB 5 Bytes JMP 00740F68
.text C:\Windows\system32\svchost.exe[324] ADVAPI32.dll!RegCreateKeyA 77B33BA9 5 Bytes JMP 00740F9E
.text C:\Windows\system32\svchost.exe[324] ADVAPI32.dll!RegOpenKeyA 77B389C7 5 Bytes JMP 00740FE5
.text C:\Windows\system32\svchost.exe[324] ADVAPI32.dll!RegCreateKeyW 77B4391E 5 Bytes JMP 00740F8D
.text C:\Windows\system32\svchost.exe[324] ADVAPI32.dll!RegCreateKeyExW 77B441F1 5 Bytes JMP 00740025
.text C:\Windows\system32\svchost.exe[324] ADVAPI32.dll!RegOpenKeyExA 77B47C42 5 Bytes JMP 00740FD4
.text C:\Windows\system32\svchost.exe[324] ADVAPI32.dll!RegOpenKeyW 77B4E2B5 5 Bytes JMP 00740000
.text C:\Windows\system32\svchost.exe[324] ADVAPI32.dll!RegOpenKeyExW 77B57BA1 5 Bytes JMP 00740FC3
.text C:\Windows\system32\svchost.exe[324] WS2_32.dll!socket 77E036D1 5 Bytes JMP 00870FEF
.text C:\Windows\system32\svchost.exe[332] ntdll.dll!NtCreateFile 77D14244 5 Bytes JMP 00740FEF
.text C:\Windows\system32\svchost.exe[332] ntdll.dll!NtCreateProcess 77D14304 5 Bytes JMP 00740FD4
.text C:\Windows\system32\svchost.exe[332] ntdll.dll!NtProtectVirtualMemory

77D14BA4 5 Bytes JMP 0074000A
.text C:\Windows\system32\svchost.exe[332] kernel32.dll!GetStartupInfoW 77A31929 5 Bytes JMP 00670F37
.text C:\Windows\system32\svchost.exe[332] kernel32.dll!GetStartupInfoA 77A319C9 5 Bytes JMP 00670F48
.text C:\Windows\system32\svchost.exe[332] kernel32.dll!CreateProcessW 77A31BF3 5 Bytes JMP 00670F1C
.text C:\Windows\system32\svchost.exe[332] kernel32.dll!CreateProcessA 77A31C28 5 Bytes JMP 006700B3
.text C:\Windows\system32\svchost.exe[332] kernel32.dll!VirtualProtect 77A31DC3 5 Bytes JMP 00670F6D
.text C:\Windows\system32\svchost.exe[332] kernel32.dll!CreateNamedPipeA 77A32EF5 5 Bytes JMP 00670FC0
.text C:\Windows\system32\svchost.exe[332] kernel32.dll!CreateNamedPipeW 77A35C0C 5 Bytes JMP 00670FAF
.text C:\Windows\system32\svchost.exe[332] kernel32.dll!CreatePipe 77A58F06 5 Bytes JMP 0067007D
.text C:\Windows\system32\svchost.exe[332] kernel32.dll!LoadLibraryExW 77A5927C 5 Bytes JMP 00670047
.text C:\Windows\system32\svchost.exe[332] kernel32.dll!LoadLibraryW 77A59400 5 Bytes JMP 0067002C
.text C:\Windows\system32\svchost.exe[332] kernel32.dll!LoadLibraryExA 77A59554 5 Bytes JMP 00670F8A
.text C:\Windows\system32\svchost.exe[332] kernel32.dll!LoadLibraryA 77A5957C 5 Bytes JMP 0067001B
.text C:\Windows\system32\svchost.exe[332] kernel32.dll!VirtualProtectEx 77A5DC52 5 Bytes JMP 0067006C
.text C:\Windows\system32\svchost.exe[332] kernel32.dll!GetProcAddress 77A7925B 5 Bytes JMP 00670F0B
.text C:\Windows\system32\svchost.exe[332] kernel32.dll!CreateFileW 77A7B0EB 5 Bytes JMP 00670FDB
.text C:\Windows\system32\svchost.exe[332] kernel32.dll!CreateFileA 77A7D07F 5 Bytes JMP 00670000
.text C:\Windows\system32\svchost.exe[332] kernel32.dll!WinExec 77AC60CF 5 Bytes JMP 006700A2
.text C:\Windows\system32\svchost.exe[332] msvcrt.dll!_wsystem 77897F3F 5 Bytes JMP 00750FC8
.text C:\Windows\system32\svchost.exe[332] msvcrt.dll!system 7789805B 5 Bytes JMP 00750053
.text C:\Windows\system32\svchost.exe[332] msvcrt.dll!_creat 7789BBF1 5 Bytes JMP 00750FE3
.text C:\Windows\system32\svchost.exe[332] msvcrt.dll!_open 7789D116 5 Bytes JMP 00750000
.text C:\Windows\system32\svchost.exe[332] msvcrt.dll!_wcreat 7789D336 5 Bytes JMP 00750038
.text C:\Windows\system32\svchost.exe[332] msvcrt.dll!_wopen 7789D511 5 Bytes JMP 0075001D
.text C:\Windows\system32\svchost.exe[332] ADVAPI32.dll!RegCreateKeyExA 77B339AB 5 Bytes JMP 00760051
.text C:\Windows\system32\svchost.exe[332] ADVAPI32.dll!RegCreateKeyA 77B33BA9 5 Bytes JMP 00760FAF
.text C:\Windows\system32\svchost.exe[332] ADVAPI32.dll!RegOpenKeyA 77B389C7 5 Bytes JMP 0076000A
.text C:\Windows\system32\svchost.exe[332] ADVAPI32.dll!RegCreateKeyW 77B4391E 5 Bytes JMP 00760040
.text C:\Windows\system32\svchost.exe[332] ADVAPI32.dll!RegCreateKeyExW 77B441F1 5 Bytes JMP 00760F94
.text C:\Windows\system32\svchost.exe[332] ADVAPI32.dll!RegOpenKeyExA 77B47C42 5 Bytes JMP 00760FCA
.text C:\Windows\system32\svchost.exe[332] ADVAPI32.dll!RegOpenKeyW 77B4E2B5 5 Bytes JMP 00760FEF
.text C:\Windows\system32\svchost.exe[332] ADVAPI32.dll!RegOpenKeyExW 77B57BA1 5 Bytes JMP 0076001B
.text C:\Windows\system32\svchost.exe[332] WS2_32.dll!socket 77E036D1 5 Bytes JMP 00770000
.text C:\Windows\System32\svchost.exe[372] ntdll.dll!NtCreateFile 77D14244 5 Bytes JMP 00EB0000
.text C:\Windows\System32\svchost.exe[372] ntdll.dll!NtCreateProcess 77D14304 5 Bytes JMP 00EB001B
.text C:\Windows\System32\svchost.exe[372] ntdll.dll!NtProtectVirtualMemory 77D14BA4 5 Bytes JMP 00EB0FE5
.text C:\Windows\System32\svchost.exe[372] kernel32.dll!GetStartupInfoW 77A31929 5 Bytes JMP 00980F21
.text C:\Windows\System32\svchost.exe[372] kernel32.dll!GetStartupInfoA 77A319C9 5 Bytes JMP 00980067
.text C:\Windows\System32\svchost.exe[372] kernel32.dll!CreateProcessW 77A31BF3 5 Bytes JMP 00980096
.text C:\Windows\System32\svchost.exe[372] kernel32.dll!CreateProcessA 77A31C28 5 Bytes JMP 00980EFF
.text C:\Windows\System32\svchost.exe[372] kernel32.dll!VirtualProtect 77A31DC3 5 Bytes JMP 0098004C
.text C:\Windows\System32\svchost.exe[372] kernel32.dll!CreateNamedPipeA 77A32EF5 5 Bytes JMP 00980FB9
.text C:\Windows\System32\svchost.exe[372] kernel32.dll!CreateNamedPipeW 77A35C0C 5 Bytes JMP 00980FA8
.text C:\Windows\System32\svchost.exe[372] kernel32.dll!CreatePipe 77A58F06 5 Bytes JMP 00980F46
.text C:\Windows\System32\svchost.exe[372] kernel32.dll!LoadLibraryExW 77A5927C 5 Bytes JMP 0098002F
.text C:\Windows\System32\svchost.exe[372] kernel32.dll!LoadLibraryW 77A59400 5 Bytes JMP 00980F72
.text C:\Windows\System32\svchost.exe[372] kernel32.dll!LoadLibraryExA 77A59554 5 Bytes JMP 0098001E
.text C:\Windows\System32\svchost.exe[372] kernel32.dll!LoadLibraryA 77A5957C 5 Bytes JMP 00980F8D
.text C:\Windows\System32\svchost.exe[372] kernel32.dll!VirtualProtectEx 77A5DC52 5 Bytes JMP 00980F57
.text C:\Windows\System32\svchost.exe[372] kernel32.dll!GetProcAddress 77A7925B 5 Bytes JMP 00980EE4
.text C:\Windows\System32\svchost.exe[372] kernel32.dll!CreateFileW 77A7B0EB 5 Bytes JMP 00980FCA
.text C:\Windows\System32\svchost.exe[372] kernel32.dll!CreateFileA 77A7D07F 5 Bytes JMP 00980FEF
.text C:\Windows\System32\svchost.exe[372] kernel32.dll!WinExec 77AC60CF 5 Bytes JMP 00980F10
.text C:\Windows\System32\svchost.exe[372] msvcrt.dll!_wsystem 77897F3F 5 Bytes JMP 00F20031
.text C:\Windows\System32\svchost.exe[372] msvcrt.dll!system 7789805B 5 Bytes JMP 00F20F9C
.text C:\Windows\System32\svchost.exe[372] msvcrt.dll!_creat 7789BBF1 5 Bytes JMP 00F2000C
.text C:\Windows\System32\svchost.exe[372] msvcrt.dll!_open 7789D116 5 Bytes JMP 00F20FEF
.text C:\Windows\System32\svchost.exe[372] msvcrt.dll!_wcreat 7789D336 5 Bytes JMP 00F20FB7
.text C:\Windows\System32\svchost.exe[372] msvcrt.dll!_wopen 7789D511 5 Bytes JMP 00F20FDE
.text C:\Windows\System32\svchost.exe[372] ADVAPI32.dll!RegCreateKeyExA 77B339AB 5 Bytes JMP 00B00FA5
.text C:\Windows\System32\svchost.exe[372] ADVAPI32.dll!RegCreateKeyA 77B33BA9 5 Bytes JMP 00B00036
.text C:\Windows\System32\svchost.exe[372] ADVAPI32.dll!RegOpenKeyA 77B389C7 5 Bytes JMP 00B00FEF
.text C:\Windows\System32\svchost.exe[372] ADVAPI32.dll!RegCreateKeyW 77B4391E 5 Bytes JMP 00B00047
.text C:\Windows\System32\svchost.exe[372] ADVAPI32.dll!RegCreateKeyExW 77B441F1 5 Bytes JMP 00B00062
.text C:\Windows\System32\svchost.exe[372] ADVAPI32.dll!RegOpenKeyExA 77B47C42 5 Bytes JMP 00B0000A
.text C:\Windows\System32\svchost.exe[372] ADVAPI32.dll!RegOpenKeyW 77B4E2B5 5 Bytes JMP 00B00FD4
.text C:\Windows\System32\svchost.exe[372] ADVAPI32.dll!RegOpenKeyExW 77B57BA1 5 Bytes JMP 00B0001B
.text C:\Windows\System32\svchost.exe[372] WS2_32.dll!socket 77E036D1 5 Bytes JMP 00FF0FEF
.text C:\Windows\System32\svchost.exe[372] WININET.dll!InternetOpenA 7791D6A8 5 Bytes JMP 0097000A
.text C:\Windows\System32\svchost.exe[372] WININET.dll!InternetOpenW 7791DB21 5 Bytes JMP 00970FEF
.text C:\Windows\System32\svchost.exe[372] WININET.dll!InternetOpenUrlA 7791F3BC 5 Bytes JMP 00970025
.text C:\Windows\System32\svchost.exe[372] WININET.dll!InternetOpenUrlW 77966DFF 5 Bytes JMP 00970FDE
.text C:\Windows\Explorer.EXE[524] ntdll.dll!NtCreateFile 77D14244 5 Bytes JMP 03760FEF
.text C:\Windows\Explorer.EXE[524] ntdll.dll!NtCreateProcess 77D14304 5 Bytes JMP 0376001E
.text C:\Windows\Explorer.EXE[524] ntdll.dll!NtProtectVirtualMemory 77D14BA4 5 Bytes JMP 03760FDE
.text C:\Windows\Explorer.EXE[524] kernel32.dll!GetStartupInfoW 77A31929 5 Bytes JMP 018800BF
.text C:\Windows\Explorer.EXE[524] kernel32.dll!GetStartupInfoA 77A319C9 5 Bytes JMP 01880F6F
.text C:\Windows\Explorer.EXE[524] kernel32.dll!CreateProcessW 77A31BF3 5 Bytes JMP 018800F2
.text C:\Windows\Explorer.EXE[524] kernel32.dll!CreateProcessA 77A31C28 5 Bytes JMP 018800E1
.text C:\Windows\Explorer.EXE[524] kernel32.dll!VirtualProtect 77A31DC3 5 Bytes JMP 01880FA5
.text C:\Windows\Explorer.EXE[524] kernel32.dll!CreateNamedPipeA 77A32EF5 5 Bytes JMP 0188001B
.text C:\Windows\Explorer.EXE[524] kernel32.dll!CreateNamedPipeW 77A35C0C 5 Bytes JMP 0188002C
.text C:\Windows\Explorer.EXE[524] kernel32.dll!CreatePipe 77A58F06 5 Bytes JMP 0188009A
.text C:\Windows\Explorer.EXE[524] kernel32.dll!LoadLibraryExW 77A5927C 5 Bytes JMP 01880073
.text C:\Windows\Explorer.EXE[524] kernel32.dll!LoadLibraryW 77A59400 5 Bytes JMP 01880058
.text C:\Windows\Explorer.EXE[524] kernel32.dll!LoadLibraryExA 77A59554 5 Bytes JMP 01880FC0
.text C:\Windows\Explorer.EXE[524] kernel32.dll!LoadLibraryA 77A5957C 5 Bytes JMP 01880047
.text C:\Windows\Explorer.EXE[524] kernel32.dll!VirtualProtectEx 77A5DC52 5 Bytes JMP 01880F8A
.text C:\Windows\Explorer.EXE[524] kernel32.dll!GetProcAddress 77A7925B 5 Bytes JMP 01880103
.text C:\Windows\Explorer.EXE[524] kernel32.dll!CreateFileW 77A7B0EB 5 Bytes JMP 01880000
.text C:\Windows\Explorer.EXE[524] kernel32.dll!CreateFileA 77A7D07F 5 Bytes JMP 01880FEF
.text C:\Windows\Explorer.EXE[524] kernel32.dll!WinExec 77AC60CF 5 Bytes JMP 018800D0
.text C:\Windows\Explorer.EXE[524] ADVAPI32.dll!RegCreateKeyExA 77B339AB 5 Bytes JMP 01890F97
.text C:\Windows\Explorer.EXE[524] ADVAPI32.dll!RegCreateKeyA 77B33BA9 5 Bytes JMP 01890FC3
.text C:\Windows\Explorer.EXE[524] ADVAPI32.dll!RegOpenKeyA 77B389C7 5 Bytes JMP 01890000
.text C:\Windows\Explorer.EXE[524] ADVAPI32.dll!RegCreateKeyW 77B4391E 5 Bytes JMP 01890FA8
.text C:\Windows\Explorer.EXE[524] ADVAPI32.dll!RegCreateKeyExW 77B441F1 5 Bytes JMP 01890054
.text C:\Windows\Explorer.EXE[524] ADVAPI32.dll!RegOpenKeyExA 77B47C42 5 Bytes JMP 01890FEF
.text C:\Windows\Explorer.EXE[524] ADVAPI32.dll!RegOpenKeyW 77B4E2B5 5 Bytes JMP 0189001B
.text C:\Windows\Explorer.EXE[524] ADVAPI32.dll!RegOpenKeyExW 77B57BA1 5 Bytes JMP 01890FD4
.text C:\Windows\Explorer.EXE[524] msvcrt.dll!_wsystem 77897F3F 5 Bytes JMP 01860038
.text C:\Windows\Explorer.EXE[524] msvcrt.dll!system 7789805B 5 Bytes JMP 01860FAD
.text C:\Windows\Explorer.EXE[524] msvcrt.dll!_creat 7789BBF1 5 Bytes JMP 0186000C
.text C:\Windows\Explorer.EXE[524] msvcrt.dll!_open 7789D116 5 Bytes JMP 01860FEF
.text C:\Windows\Explorer.EXE[524] msvcrt.dll!_wcreat 7789D336 5 Bytes JMP 0186001D
.text C:\Windows\Explorer.EXE[524] msvcrt.dll!_wopen 7789D511 5 Bytes JMP 01860FD2
.text C:\Windows\Explorer.EXE[524] SHELL32.dll!SHGetFolderPathAndSubDirW + 81C5

76A6B37C 4 Bytes [00, 26, 00, 10] {ADD [ESI], AH; ADD [EAX], DL}
.text C:\Windows\Explorer.EXE[524] SHELL32.dll!ShellExecuteExW + 18B7 76A9DA0C 4 Bytes [10, 1B, 00, 10] {ADC [EBX], BL; ADD [EAX], DL}
.text C:\Windows\Explorer.EXE[524] WININET.dll!InternetOpenA 7791D6A8 5 Bytes JMP 01870FEF
.text C:\Windows\Explorer.EXE[524] WININET.dll!InternetOpenW 7791DB21 5 Bytes JMP 01870FD4
.text C:\Windows\Explorer.EXE[524] WININET.dll!InternetOpenUrlA 7791F3BC 5 Bytes JMP 0187000A
.text C:\Windows\Explorer.EXE[524] WININET.dll!InternetOpenUrlW 77966DFF 5 Bytes JMP 01870025
.text C:\Windows\Explorer.EXE[524] ws2_32.dll!socket 77E036D1 5 Bytes JMP 03770FEF
.text C:\Windows\system32\svchost.exe[576] ntdll.dll!NtCreateFile 77D14244 5 Bytes JMP 000B0000
.text C:\Windows\system32\svchost.exe[576] ntdll.dll!NtCreateProcess 77D14304 5 Bytes JMP 000B001B
.text C:\Windows\system32\svchost.exe[576] ntdll.dll!NtProtectVirtualMemory 77D14BA4 5 Bytes JMP 000B0FE5
.text C:\Windows\system32\svchost.exe[576] kernel32.dll!GetStartupInfoW 77A31929 5 Bytes JMP 00090F4D
.text C:\Windows\system32\svchost.exe[576] kernel32.dll!GetStartupInfoA 77A319C9 5 Bytes JMP 00090093
.text C:\Windows\system32\svchost.exe[576] kernel32.dll!CreateProcessW 77A31BF3 5 Bytes JMP 000900BF
.text C:\Windows\system32\svchost.exe[576] kernel32.dll!CreateProcessA 77A31C28 5 Bytes JMP 000900AE
.text C:\Windows\system32\svchost.exe[576] kernel32.dll!VirtualProtect 77A31DC3 5 Bytes JMP 00090F72
.text C:\Windows\system32\svchost.exe[576] kernel32.dll!CreateNamedPipeA 77A32EF5 5 Bytes JMP 00090FD4
.text C:\Windows\system32\svchost.exe[576] kernel32.dll!CreateNamedPipeW 77A35C0C 5 Bytes JMP 00090FB9
.text C:\Windows\system32\svchost.exe[576] kernel32.dll!CreatePipe 77A58F06 5 Bytes JMP 00090078
.text C:\Windows\system32\svchost.exe[576] kernel32.dll!LoadLibraryExW 77A5927C 5 Bytes JMP 0009004C
.text C:\Windows\system32\svchost.exe[576] kernel32.dll!LoadLibraryW 77A59400 5 Bytes JMP 0009002F
.text C:\Windows\system32\svchost.exe[576] kernel32.dll!LoadLibraryExA 77A59554 5 Bytes JMP 00090F83
.text C:\Windows\system32\svchost.exe[576] kernel32.dll!LoadLibraryA 77A5957C 5 Bytes JMP 00090FA8
.text C:\Windows\system32\svchost.exe[576] kernel32.dll!VirtualProtectEx 77A5DC52 5 Bytes JMP 00090067
.text C:\Windows\system32\svchost.exe[576] kernel32.dll!GetProcAddress 77A7925B 5 Bytes JMP 00090F0D
.text C:\Windows\system32\svchost.exe[576] kernel32.dll!CreateFileW 77A7B0EB 5 Bytes JMP 00090FE5
.text C:\Windows\system32\svchost.exe[576] kernel32.dll!CreateFileA 77A7D07F 5 Bytes JMP 00090000
.text C:\Windows\system32\svchost.exe[576] kernel32.dll!WinExec 77AC60CF 5 Bytes JMP 00090F32
.text C:\Windows\system32\svchost.exe[576] msvcrt.dll!_wsystem 77897F3F 5 Bytes JMP 00080069
.text C:\Windows\system32\svchost.exe[576] msvcrt.dll!system 7789805B 5 Bytes JMP 0008004E
.text C:\Windows\system32\svchost.exe[576] msvcrt.dll!_creat 7789BBF1 5 Bytes JMP 00080029
.text C:\Windows\system32\svchost.exe[576] msvcrt.dll!_open 7789D116 5 Bytes JMP 00080FEF
.text C:\Windows\system32\svchost.exe[576] msvcrt.dll!_wcreat 7789D336 5 Bytes JMP 00080FD4
.text C:\Windows\system32\svchost.exe[576] msvcrt.dll!_wopen 7789D511 5 Bytes JMP 00080018
.text C:\Windows\system32\svchost.exe[576] ADVAPI32.dll!RegCreateKeyExA 77B339AB 5 Bytes JMP 000A0FB9
.text C:\Windows\system32\svchost.exe[576] ADVAPI32.dll!RegCreateKeyA 77B33BA9 5 Bytes JMP 000A0FD4
.text C:\Windows\system32\svchost.exe[576] ADVAPI32.dll!RegOpenKeyA 77B389C7 5 Bytes JMP 000A000A
.text C:\Windows\system32\svchost.exe[576] ADVAPI32.dll!RegCreateKeyW 77B4391E 5 Bytes JMP 000A005B
.text C:\Windows\system32\svchost.exe[576] ADVAPI32.dll!RegCreateKeyExW 77B441F1 5 Bytes JMP 000A0F9E
.text C:\Windows\system32\svchost.exe[576] ADVAPI32.dll!RegOpenKeyExA 77B47C42 5 Bytes JMP 000A0025
.text C:\Windows\system32\svchost.exe[576] ADVAPI32.dll!RegOpenKeyW 77B4E2B5 5 Bytes JMP 000A0FEF
.text C:\Windows\system32\svchost.exe[576] ADVAPI32.dll!RegOpenKeyExW 77B57BA1 5 Bytes JMP 000A0036
.text C:\Windows\system32\svchost.exe[576] WS2_32.dll!socket 77E036D1 5 Bytes JMP 00100000
.text C:\Windows\System32\svchost.exe[1084] ntdll.dll!NtCreateFile 77D14244 5 Bytes JMP 00600000
.text C:\Windows\System32\svchost.exe[1084] ntdll.dll!NtCreateProcess 77D14304 5 Bytes JMP 0060001B
.text C:\Windows\System32\svchost.exe[1084] ntdll.dll!NtProtectVirtualMemory 77D14BA4 5 Bytes JMP 00600FE5
.text C:\Windows\System32\svchost.exe[1084] kernel32.dll!GetStartupInfoW 77A31929 5 Bytes JMP 005E0F54
.text C:\Windows\System32\svchost.exe[1084] kernel32.dll!GetStartupInfoA 77A319C9 5 Bytes JMP 005E0F65
.text C:\Windows\System32\svchost.exe[1084] kernel32.dll!CreateProcessW 77A31BF3 5 Bytes JMP 005E0F28
.text C:\Windows\System32\svchost.exe[1084] kernel32.dll!CreateProcessA 77A31C28 5 Bytes JMP 005E0F39
.text C:\Windows\System32\svchost.exe[1084] kernel32.dll!VirtualProtect 77A31DC3 5 Bytes JMP 005E006E
.text C:\Windows\System32\svchost.exe[1084] kernel32.dll!CreateNamedPipeA 77A32EF5 5 Bytes JMP 005E0014
.text C:\Windows\System32\svchost.exe[1084] kernel32.dll!CreateNamedPipeW 77A35C0C 5 Bytes JMP 005E0FC3
.text C:\Windows\System32\svchost.exe[1084] kernel32.dll!CreatePipe 77A58F06 5 Bytes JMP 005E009A
.text C:\Windows\System32\svchost.exe[1084] kernel32.dll!LoadLibraryExW 77A5927C 5 Bytes JMP 005E0051
.text C:\Windows\System32\svchost.exe[1084] kernel32.dll!LoadLibraryW 77A59400 5 Bytes JMP 005E0FA8
.text C:\Windows\System32\svchost.exe[1084] kernel32.dll!LoadLibraryExA 77A59554 5 Bytes JMP 005E0040
.text C:\Windows\System32\svchost.exe[1084] kernel32.dll!LoadLibraryA 77A5957C 5 Bytes JMP 005E002F
.text C:\Windows\System32\svchost.exe[1084] kernel32.dll!VirtualProtectEx 77A5DC52 5 Bytes JMP 005E007F
.text C:\Windows\System32\svchost.exe[1084] kernel32.dll!GetProcAddress 77A7925B 5 Bytes JMP 005E0F0D
.text C:\Windows\System32\svchost.exe[1084] kernel32.dll!CreateFileW 77A7B0EB 5 Bytes JMP 005E0FDE
.text C:\Windows\System32\svchost.exe[1084] kernel32.dll!CreateFileA 77A7D07F 5 Bytes JMP 005E0FEF
.text C:\Windows\System32\svchost.exe[1084] kernel32.dll!WinExec 77AC60CF 5 Bytes JMP 005E00B5
.text C:\Windows\System32\svchost.exe[1084] msvcrt.dll!_wsystem 77897F3F 5 Bytes JMP 005D0064
.text C:\Windows\System32\svchost.exe[1084] msvcrt.dll!system 7789805B 5 Bytes JMP 005D003F
.text C:\Windows\System32\svchost.exe[1084] msvcrt.dll!_creat 7789BBF1 5 Bytes JMP 005D002E
.text C:\Windows\System32\svchost.exe[1084] msvcrt.dll!_open 7789D116 5 Bytes JMP 005D000C
.text C:\Windows\System32\svchost.exe[1084] msvcrt.dll!_wcreat 7789D336 5 Bytes JMP 005D0FD9
.text C:\Windows\System32\svchost.exe[1084] msvcrt.dll!_wopen 7789D511 5 Bytes JMP 005D001D
.text C:\Windows\System32\svchost.exe[1084] ADVAPI32.dll!RegCreateKeyExA 77B339AB 5 Bytes JMP 005F0FA8
.text C:\Windows\System32\svchost.exe[1084] ADVAPI32.dll!RegCreateKeyA 77B33BA9 5 Bytes JMP 005F0025
.text C:\Windows\System32\svchost.exe[1084] ADVAPI32.dll!RegOpenKeyA 77B389C7 5 Bytes JMP 005F0FE5
.text C:\Windows\System32\svchost.exe[1084] ADVAPI32.dll!RegCreateKeyW 77B4391E 5 Bytes JMP 005F0040
.text C:\Windows\System32\svchost.exe[1084] ADVAPI32.dll!RegCreateKeyExW 77B441F1 5 Bytes JMP 005F0F8D
.text C:\Windows\System32\svchost.exe[1084] ADVAPI32.dll!RegOpenKeyExA 77B47C42 5 Bytes JMP 005F0FB9
.text C:\Windows\System32\svchost.exe[1084] ADVAPI32.dll!RegOpenKeyW 77B4E2B5 5 Bytes JMP 005F0FCA
.text C:\Windows\System32\svchost.exe[1084] ADVAPI32.dll!RegOpenKeyExW 77B57BA1 5 Bytes JMP 005F000A
.text C:\Windows\System32\svchost.exe[1084] WS2_32.dll!socket 77E036D1 5 Bytes JMP 00720000
.text C:\Windows\System32\svchost.exe[1084] WININET.dll!InternetOpenA 7791D6A8 5 Bytes JMP 00730000
.text C:\Windows\System32\svchost.exe[1084] WININET.dll!InternetOpenW 7791DB21 5 Bytes JMP 00730FE5
.text C:\Windows\System32\svchost.exe[1084] WININET.dll!InternetOpenUrlA 7791F3BC 5 Bytes JMP 00730025
.text C:\Windows\System32\svchost.exe[1084] WININET.dll!InternetOpenUrlW 77966DFF 5 Bytes JMP 00730036
.text C:\Windows\System32\svchost.exe[1128] ntdll.dll!NtCreateFile 77D14244 5 Bytes JMP 007E0FEF
.text C:\Windows\System32\svchost.exe[1128] ntdll.dll!NtCreateProcess 77D14304 5 Bytes JMP 007E002F
.text C:\Windows\System32\svchost.exe[1128] ntdll.dll!NtProtectVirtualMemory 77D14BA4 5 Bytes JMP 007E000A
.text C:\Windows\System32\svchost.exe[1128] kernel32.dll!GetStartupInfoW 77A31929 5 Bytes JMP 007C0F2B
.text C:\Windows\System32\svchost.exe[1128] kernel32.dll!GetStartupInfoA 77A319C9 5 Bytes JMP 007C0F46
.text C:\Windows\System32\svchost.exe[1128] kernel32.dll!CreateProcessW 77A31BF3 5 Bytes JMP 007C00A7
.text C:\Windows\System32\svchost.exe[1128] kernel32.dll!CreateProcessA 77A31C28 5 Bytes JMP 007C0096
.text C:\Windows\System32\svchost.exe[1128] kernel32.dll!VirtualProtect 77A31DC3 5 Bytes JMP 007C0F72
.text C:\Windows\System32\svchost.exe[1128] kernel32.dll!CreateNamedPipeA 77A32EF5 5 Bytes JMP 007C0025
.text C:\Windows\System32\svchost.exe[1128] kernel32.dll!CreateNamedPipeW 77A35C0C 5 Bytes JMP 007C0036
.text C:\Windows\System32\svchost.exe[1128] kernel32.dll!CreatePipe 77A58F06 5 Bytes JMP 007C0F61
.text C:\Windows\System32\svchost.exe[1128] kernel32.dll!LoadLibraryExW 77A5927C 5 Bytes JMP 007C0F83
.text C:\Windows\System32\svchost.exe[1128] kernel32.dll!LoadLibraryW 77A59400 5 Bytes JMP 007C0FAF
.text C:\Windows\System32\svchost.exe[1128] kernel32.dll!LoadLibraryExA 77A59554 5 Bytes JMP 007C0F9E
.text C:\Windows\System32\svchost.exe[1128] kernel32.dll!LoadLibraryA 77A5957C 5 Bytes JMP 007C0FCA
.text C:\Windows\System32\svchost.exe[1128] kernel32.dll!VirtualProtectEx 77A5DC52 5 Bytes JMP 007C0071
.text C:\Windows\System32\svchost.exe[1128] kernel32.dll!GetProcAddress 77A7925B 5 Bytes JMP 007C0EEB
.text C:\Windows\System32\svchost.exe[1128] kernel32.dll!CreateFileW 77A7B0EB 1 Byte [E9]
.text C:\Windows\System32\svchost.exe[1128] kernel32.dll!CreateFileW 77A7B0EB 5 Bytes JMP 007C0FEF
.text C:\Windows\System32\svchost.exe[1128] kernel32.dll!CreateFileA 77A7D07F 5 Bytes JMP 007C000A
.text C:\Windows\System32\svchost.exe[1128] kernel32.dll!WinExec 77AC60CF 5 Bytes JMP 007C0F1A
.text C:\Windows\System32\svchost.exe[1128] msvcrt.dll!_wsystem 77897F3F 5 Bytes JMP 00790FA1
.text C:\Windows\System32\svchost.exe[1128] msvcrt.dll!system 7789805B 5 Bytes JMP 00790036
.text C:\Windows\System32\svchost.exe[1128] msvcrt.dll!_creat 7789BBF1 5 Bytes JMP 00790FCD
.text C:\Windows\System32\svchost.exe[1128] msvcrt.dll!_open 7789D116 5 Bytes JMP 00790FEF
.text C:\Windows\System32\svchost.exe[1128] msvcrt.dll!_wcreat 7789D336 5 Bytes JMP 00790FBC
.text C:\Windows\System32\svchost.exe[1128] msvcrt.dll!_wopen 7789D511 5 Bytes JMP 00790FDE
.text C:\Windows\System32\svchost.exe[1128] ADVAPI32.dll!RegCreateKeyExA 77B339AB 5 Bytes JMP 007D0F86
.text C:\Windows\System32\svchost.exe[1128] ADVAPI32.dll!RegCreateKeyA 77B33BA9 5 Bytes JMP 007D0F97
.text C:\Windows\System32\svchost.exe[1128] ADVAPI32.dll!RegOpenKeyA 77B389C7 5 Bytes JMP 007D0FEF
.text C:\Windows\System32\svchost.exe[1128] ADVAPI32.dll!RegCreateKeyW 77B4391E 5 Bytes JMP 007D0028
.text C:\Windows\System32\svchost.exe[1128] ADVAPI32.dll!RegCreateKeyExW 77B441F1 5 Bytes JMP 007D0043
.text C:\Windows\System32\svchost.exe[1128]

ADVAPI32.dll!RegOpenKeyExA 77B47C42 5 Bytes JMP 007D0FC3
.text C:\Windows\System32\svchost.exe[1128] ADVAPI32.dll!RegOpenKeyW 77B4E2B5 5 Bytes JMP 007D0FD4
.text C:\Windows\System32\svchost.exe[1128] ADVAPI32.dll!RegOpenKeyExW 77B57BA1 5 Bytes JMP 007D0FA8
.text C:\Windows\system32\svchost.exe[1324] ntdll.dll!NtCreateFile 77D14244 5 Bytes JMP 00230000
.text C:\Windows\system32\svchost.exe[1324] ntdll.dll!NtCreateProcess 77D14304 5 Bytes JMP 00230FD4
.text C:\Windows\system32\svchost.exe[1324] ntdll.dll!NtProtectVirtualMemory 77D14BA4 5 Bytes JMP 00230FE5
.text C:\Windows\system32\svchost.exe[1324] kernel32.dll!GetStartupInfoW 77A31929 5 Bytes JMP 002100A2
.text C:\Windows\system32\svchost.exe[1324] kernel32.dll!GetStartupInfoA 77A319C9 5 Bytes JMP 00210087
.text C:\Windows\system32\svchost.exe[1324] kernel32.dll!CreateProcessW 77A31BF3 5 Bytes JMP 00210F0B
.text C:\Windows\system32\svchost.exe[1324] kernel32.dll!CreateProcessA 77A31C28 5 Bytes JMP 00210F26
.text C:\Windows\system32\svchost.exe[1324] kernel32.dll!VirtualProtect 77A31DC3 5 Bytes JMP 00210051
.text C:\Windows\system32\svchost.exe[1324] kernel32.dll!CreateNamedPipeA 77A32EF5 5 Bytes JMP 00210FD4
.text C:\Windows\system32\svchost.exe[1324] kernel32.dll!CreateNamedPipeW 77A35C0C 5 Bytes JMP 00210FC3
.text C:\Windows\system32\svchost.exe[1324] kernel32.dll!CreatePipe 77A58F06 5 Bytes JMP 0021006C
.text C:\Windows\system32\svchost.exe[1324] kernel32.dll!LoadLibraryExW 77A5927C 5 Bytes JMP 00210F83
.text C:\Windows\system32\svchost.exe[1324] kernel32.dll!LoadLibraryW 77A59400 5 Bytes JMP 0021002F
.text C:\Windows\system32\svchost.exe[1324] kernel32.dll!LoadLibraryExA 77A59554 5 Bytes JMP 00210040
.text C:\Windows\system32\svchost.exe[1324] kernel32.dll!LoadLibraryA 77A5957C 5 Bytes JMP 00210FB2
.text C:\Windows\system32\svchost.exe[1324] kernel32.dll!VirtualProtectEx 77A5DC52 5 Bytes JMP 00210F52
.text C:\Windows\system32\svchost.exe[1324] kernel32.dll!GetProcAddress 77A7925B 5 Bytes JMP 002100BD
.text C:\Windows\system32\svchost.exe[1324] kernel32.dll!CreateFileW 77A7B0EB 1 Byte [E9]
.text C:\Windows\system32\svchost.exe[1324] kernel32.dll!CreateFileW 77A7B0EB 5 Bytes JMP 00210FEF
.text C:\Windows\system32\svchost.exe[1324] kernel32.dll!CreateFileA 77A7D07F 5 Bytes JMP 00210000
.text C:\Windows\system32\svchost.exe[1324] kernel32.dll!WinExec 77AC60CF 5 Bytes JMP 00210F37
.text C:\Windows\system32\svchost.exe[1324] msvcrt.dll!_wsystem 77897F3F 5 Bytes JMP 000F0064
.text C:\Windows\system32\svchost.exe[1324] msvcrt.dll!system 7789805B 5 Bytes JMP 000F0049
.text C:\Windows\system32\svchost.exe[1324] msvcrt.dll!_creat 7789BBF1 5 Bytes JMP 000F0FE3
.text C:\Windows\system32\svchost.exe[1324] msvcrt.dll!_open 7789D116 5 Bytes JMP 000F0000
.text C:\Windows\system32\svchost.exe[1324] msvcrt.dll!_wcreat 7789D336 5 Bytes JMP 000F002E
.text C:\Windows\system32\svchost.exe[1324] msvcrt.dll!_wopen 7789D511 5 Bytes JMP 000F001D
.text C:\Windows\system32\svchost.exe[1324] ADVAPI32.dll!RegCreateKeyExA 77B339AB 5 Bytes JMP 0022005B
.text C:\Windows\system32\svchost.exe[1324] ADVAPI32.dll!RegCreateKeyA 77B33BA9 5 Bytes JMP 00220FC3
.text C:\Windows\system32\svchost.exe[1324] ADVAPI32.dll!RegOpenKeyA 77B389C7 5 Bytes JMP 0022000A
.text C:\Windows\system32\svchost.exe[1324] ADVAPI32.dll!RegCreateKeyW 77B4391E 5 Bytes JMP 0022004A
.text C:\Windows\system32\svchost.exe[1324] ADVAPI32.dll!RegCreateKeyExW 77B441F1 5 Bytes JMP 00220FA8
.text C:\Windows\system32\svchost.exe[1324] ADVAPI32.dll!RegOpenKeyExA 77B47C42 5 Bytes JMP 00220025
.text C:\Windows\system32\svchost.exe[1324] ADVAPI32.dll!RegOpenKeyW 77B4E2B5 5 Bytes JMP 00220FEF
.text C:\Windows\system32\svchost.exe[1324] ADVAPI32.dll!RegOpenKeyExW 77B57BA1 5 Bytes JMP 00220FDE
.text C:\Windows\system32\svchost.exe[1324] WS2_32.dll!socket 77E036D1 5 Bytes JMP 00240FEF
.text C:\Program Files\Google\Chrome\Application\chrome.exe[1336] ntdll.dll!NtCreateFile + 6 77D1424A 4 Bytes [28, 00, 17, 00]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[1336] ntdll.dll!NtCreateFile + B 77D1424F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[1336] ntdll.dll!NtMapViewOfSection + 6 77D1499A 1 Byte [28]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[1336] ntdll.dll!NtMapViewOfSection + 6 77D1499A 4 Bytes [28, 03, 17, 00]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[1336] ntdll.dll!NtMapViewOfSection + B 77D1499F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[1336] ntdll.dll!NtOpenFile + 6 77D14A2A 4 Bytes [68, 00, 17, 00]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[1336] ntdll.dll!NtOpenFile + B 77D14A2F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[1336] ntdll.dll!NtOpenProcess + 6 77D14AAA 4 Bytes [A8, 01, 17, 00]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[1336] ntdll.dll!NtOpenProcess + B 77D14AAF 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[1336] ntdll.dll!NtOpenProcessToken + 6 77D14ABA 4 Bytes CALL 76D161C0 C:\Windows\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\Program Files\Google\Chrome\Application\chrome.exe[1336] ntdll.dll!NtOpenProcessToken + B 77D14ABF 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[1336] ntdll.dll!NtOpenProcessTokenEx + 6 77D14ACA 4 Bytes [A8, 02, 17, 00]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[1336] ntdll.dll!NtOpenProcessTokenEx + B 77D14ACF 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[1336] ntdll.dll!NtOpenThread + 6 77D14B1A 4 Bytes [68, 01, 17, 00]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[1336] ntdll.dll!NtOpenThread + B 77D14B1F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[1336] ntdll.dll!NtOpenThreadToken + 6 77D14B2A 4 Bytes [68, 02, 17, 00]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[1336] ntdll.dll!NtOpenThreadToken + B 77D14B2F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[1336] ntdll.dll!NtOpenThreadTokenEx + 6 77D14B3A 4 Bytes CALL 76D16241 C:\Windows\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\Program Files\Google\Chrome\Application\chrome.exe[1336] ntdll.dll!NtOpenThreadTokenEx + B 77D14B3F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[1336] ntdll.dll!NtQueryAttributesFile + 6 77D14BCA 4 Bytes [A8, 00, 17, 00]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[1336] ntdll.dll!NtQueryAttributesFile + B 77D14BCF 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[1336] ntdll.dll!NtQueryFullAttributesFile + 6 77D14C7A 4 Bytes CALL 76D1637F C:\Windows\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\Program Files\Google\Chrome\Application\chrome.exe[1336] ntdll.dll!NtQueryFullAttributesFile + B 77D14C7F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[1336] ntdll.dll!NtSetInformationFile + 6 77D1515A 4 Bytes [28, 01, 17, 00]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[1336] ntdll.dll!NtSetInformationFile + B 77D1515F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[1336] ntdll.dll!NtSetInformationThread + 6 77D151AA 4 Bytes [28, 02, 17, 00]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[1336] ntdll.dll!NtSetInformationThread + B 77D151AF 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[1336] ntdll.dll!NtUnmapViewOfSection + 6 77D1544A 1 Byte [68]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[1336] ntdll.dll!NtUnmapViewOfSection + 6 77D1544A 4 Bytes [68, 03, 17, 00]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[1336] ntdll.dll!NtUnmapViewOfSection + B 77D1544F 1 Byte [E2]
.text C:\Windows\system32\services.exe[1416] ntdll.dll!NtCreateFile 77D14244 5 Bytes JMP 000A0000
.text C:\Windows\system32\services.exe[1416] ntdll.dll!NtCreateProcess 77D14304 5 Bytes JMP 000A0FC0
.text C:\Windows\system32\services.exe[1416] ntdll.dll!NtProtectVirtualMemory
77D14BA4 5 Bytes JMP 000A0FE5
.text C:\Windows\system32\services.exe[1416] kernel32.dll!GetStartupInfoW 77A31929 5 Bytes JMP 00090093
.text C:\Windows\system32\services.exe[1416] kernel32.dll!GetStartupInfoA 77A319C9 5 Bytes JMP 00090F4D
.text C:\Windows\system32\services.exe[1416] kernel32.dll!CreateProcessW 77A31BF3 5 Bytes JMP 00090F06
.text C:\Windows\system32\services.exe[1416] kernel32.dll!CreateProcessA 77A31C28 5 Bytes JMP 00090F17
.text C:\Windows\system32\services.exe[1416] kernel32.dll!VirtualProtect 77A31DC3 5 Bytes JMP 00090F6F
.text C:\Windows\system32\services.exe[1416] kernel32.dll!CreateNamedPipeA 77A32EF5 5 Bytes JMP 00090FDB
.text C:\Windows\system32\services.exe[1416] kernel32.dll!CreateNamedPipeW 77A35C0C 5 Bytes JMP 00090FC0
.text C:\Windows\system32\services.exe[1416] kernel32.dll!CreatePipe 77A58F06 5 Bytes JMP 00090F5E
.text C:\Windows\system32\services.exe[1416] kernel32.dll!LoadLibraryExW 77A5927C 5 Bytes JMP 0009003D
.text C:\Windows\system32\services.exe[1416] kernel32.dll!LoadLibraryW 77A59400 5 Bytes JMP 0009002C
.text C:\Windows\system32\services.exe[1416] kernel32.dll!LoadLibraryExA 77A59554 5 Bytes JMP 00090F80
.text C:\Windows\system32\services.exe[1416] kernel32.dll!LoadLibraryA 77A5957C 5 Bytes JMP 00090FA5
.text C:\Windows\system32\services.exe[1416] kernel32.dll!VirtualProtectEx 77A5DC52 5 Bytes JMP 00090064
.text C:\Windows\system32\services.exe[1416] kernel32.dll!GetProcAddress 77A7925B 5 Bytes JMP 000900AE
.text C:\Windows\system32\services.exe[1416] kernel32.dll!CreateFileW 77A7B0EB 5 Bytes JMP 00090011
.text C:\Windows\system32\services.exe[1416] kernel32.dll!CreateFileA 77A7D07F 5 Bytes JMP 00090000
.text C:\Windows\system32\services.exe[1416] kernel32.dll!WinExec 77AC60CF 5 Bytes JMP 00090F28
.text C:\Windows\system32\services.exe[1416] ADVAPI32.dll!RegCreateKeyExA 77B339AB 5 Bytes JMP 00850033
.text C:\Windows\system32\services.exe[1416] ADVAPI32.dll!RegCreateKeyA 77B33BA9 5 Bytes JMP 00850022
.text C:\Windows\system32\services.exe[1416] ADVAPI32.dll!RegOpenKeyA 77B389C7 5 Bytes JMP 00850FEF
.text C:\Windows\system32\services.exe[1416] ADVAPI32.dll!RegCreateKeyW 77B4391E 5 Bytes JMP 00850F9B
.text C:\Windows\system32\services.exe[1416] ADVAPI32.dll!RegCreateKeyExW 77B441F1 5 Bytes JMP 00850F76
.text C:\Windows\system32\services.exe[1416] ADVAPI32.dll!RegOpenKeyExA 77B47C42 5 Bytes JMP 00850000
.text C:\Windows\system32\services.exe[1416] ADVAPI32.dll!RegOpenKeyW 77B4E2B5 5 Bytes JMP 00850FCA
.text C:\Windows\system32\services.exe[1416] ADVAPI32.dll!RegOpenKeyExW 77B57BA1 5 Bytes JMP 00850011
.text C:\Windows\system32\services.exe[1416] msvcrt.dll!_wsystem 77897F3F 5 Bytes JMP 000B0047
.text C:\Windows\system32\services.exe[1416] msvcrt.dll!system 7789805B 5 Bytes JMP 000B0036
.text C:\Windows\system32\services.exe[1416] msvcrt.dll!_creat 7789BBF1 5 Bytes JMP 000B0FCD
.text C:\Windows\system32\services.exe[1416] msvcrt.dll!_open 7789D116 5 Bytes JMP 000B0FEF
.text C:\Windows\system32\services.exe[1416] msvcrt.dll!_wcreat 7789D336 5 Bytes JMP 000B0FBC
.text C:\Windows\system32\services.exe[1416] msvcrt.dll!_wopen 7789D511 5 Bytes JMP 000B0FDE
.text C:\Windows\system32\services.exe[1416] WS2_32.dll!socket 77E036D1 5 Bytes JMP 00860FEF
.text C:\Windows\system32\services.exe[1416] WININET.dll!InternetOpenA 7791D6A8 5 Bytes JMP 000C0000
.text C:\Windows\system32\services.exe[1416] WININET.dll!InternetOpenW 7791DB21 5 Bytes JMP 000C0FDB
.text C:\Windows\system32\services.exe[1416] WININET.dll!InternetOpenUrlA 7791F3BC 5 Bytes JMP 000C0011
.text C:\Windows\system32\services.exe[1416] WININET.dll!InternetOpenUrlW 77966DFF 5 Bytes JMP 000C0FC0
.text C:\Windows\system32\svchost.exe[1436] ntdll.dll!NtCreateFile 77D14244 5 Bytes JMP 0111000A
.text C:\Windows\system32\svchost.exe[1436] ntdll.dll!NtCreateProcess 77D14304 5 Bytes JMP 01110FDE
.text C:\Windows\system32\svchost.exe[1436] ntdll.dll!NtProtectVirtualMemory 77D14BA4 5 Bytes JMP 01110FEF
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!GetStartupInfoW 77A31929 5 Bytes JMP 010F0082
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!GetStartupInfoA 77A319C9 5 Bytes JMP 010F0F3C
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!CreateProcessW 77A31BF3 5 Bytes JMP 010F0F06
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!CreateProcessA 77A31C28 5 Bytes JMP 010F009D
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!VirtualProtect 77A31DC3 5 Bytes JMP 010F0F79
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!CreateNamedPipeA 77A32EF5 5 Bytes JMP 010F000A
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!CreateNamedPipeW 77A35C0C 5 Bytes JMP 010F0FB9
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!CreatePipe 77A58F06 5 Bytes JMP 010F0F4D
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!LoadLibraryExW 77A5927C 5 Bytes JMP 010F0053
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!LoadLibraryW 77A59400 5 Bytes JMP 010F0036
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!LoadLibraryExA 77A59554 5 Bytes JMP 010F0F8A
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!LoadLibraryA 77A5957C 5 Bytes JMP 010F001B
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!VirtualProtectEx 77A5DC52 5 Bytes JMP 010F0F5E
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!GetProcAddress 77A7925B 5 Bytes JMP 010F00C2

.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!CreateFileW 77A7B0EB 5 Bytes JMP 010F0FD4
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!CreateFileA 77A7D07F 5 Bytes JMP 010F0FEF
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!WinExec 77AC60CF 5 Bytes JMP 010F0F21
.text C:\Windows\system32\svchost.exe[1436] msvcrt.dll!_wsystem 77897F3F 5 Bytes JMP 01090FAF
.text C:\Windows\system32\svchost.exe[1436] msvcrt.dll!system 7789805B 5 Bytes JMP 01090044
.text C:\Windows\system32\svchost.exe[1436] msvcrt.dll!_creat 7789BBF1 5 Bytes JMP 01090029
.text C:\Windows\system32\svchost.exe[1436] msvcrt.dll!_open 7789D116 5 Bytes JMP 01090FEF
.text C:\Windows\system32\svchost.exe[1436] msvcrt.dll!_wcreat 7789D336 5 Bytes JMP 01090FD4
.text C:\Windows\system32\svchost.exe[1436] msvcrt.dll!_wopen 7789D511 5 Bytes JMP 0109000C
.text C:\Windows\system32\svchost.exe[1436] ADVAPI32.dll!RegCreateKeyExA 77B339AB 5 Bytes JMP 01100F97
.text C:\Windows\system32\svchost.exe[1436] ADVAPI32.dll!RegCreateKeyA 77B33BA9 5 Bytes JMP 01100FB9
.text C:\Windows\system32\svchost.exe[1436] ADVAPI32.dll!RegOpenKeyA 77B389C7 5 Bytes JMP 0110000A
.text C:\Windows\system32\svchost.exe[1436] ADVAPI32.dll!RegCreateKeyW 77B4391E 5 Bytes JMP 01100FA8
.text C:\Windows\system32\svchost.exe[1436] ADVAPI32.dll!RegCreateKeyExW 77B441F1 5 Bytes JMP 01100F7C
.text C:\Windows\system32\svchost.exe[1436] ADVAPI32.dll!RegOpenKeyExA 77B47C42 5 Bytes JMP 0110002F
.text C:\Windows\system32\svchost.exe[1436] ADVAPI32.dll!RegOpenKeyW 77B4E2B5 5 Bytes JMP 01100FEF
.text C:\Windows\system32\svchost.exe[1436] ADVAPI32.dll!RegOpenKeyExW 77B57BA1 5 Bytes JMP 01100FDE
.text C:\Windows\system32\svchost.exe[1436] WS2_32.dll!socket 77E036D1 5 Bytes JMP 01C80FE5
.text C:\Windows\system32\svchost.exe[1436] WININET.dll!InternetOpenA 7791D6A8 5 Bytes JMP 010E000A
.text C:\Windows\system32\svchost.exe[1436] WININET.dll!InternetOpenW 7791DB21 1 Byte [E9]
.text C:\Windows\system32\svchost.exe[1436] WININET.dll!InternetOpenW 7791DB21 5 Bytes JMP 010E0025
.text C:\Windows\system32\svchost.exe[1436] WININET.dll!InternetOpenUrlA 7791F3BC 5 Bytes JMP 010E0FE5
.text C:\Windows\system32\svchost.exe[1436] WININET.dll!InternetOpenUrlW 77966DFF 5 Bytes JMP 010E0FD4
.text C:\Windows\system32\lsass.exe[1444] ntdll.dll!NtCreateFile 77D14244 5 Bytes JMP 003D0FE5
.text C:\Windows\system32\lsass.exe[1444] ntdll.dll!NtCreateProcess 77D14304 5 Bytes JMP 003D0011
.text C:\Windows\system32\lsass.exe[1444] ntdll.dll!NtProtectVirtualMemory 77D14BA4 5 Bytes JMP 003D0000
.text C:\Windows\system32\lsass.exe[1444] kernel32.dll!GetStartupInfoW 77A31929 5 Bytes JMP 003C0089
.text C:\Windows\system32\lsass.exe[1444] kernel32.dll!GetStartupInfoA 77A319C9 5 Bytes JMP 003C0078
.text C:\Windows\system32\lsass.exe[1444] kernel32.dll!CreateProcessW 77A31BF3 5 Bytes JMP 003C00AB
.text C:\Windows\system32\lsass.exe[1444] kernel32.dll!CreateProcessA 77A31C28 5 Bytes JMP 003C009A
.text C:\Windows\system32\lsass.exe[1444] kernel32.dll!VirtualProtect 77A31DC3 5 Bytes JMP 003C0F72
.text C:\Windows\system32\lsass.exe[1444] kernel32.dll!CreateNamedPipeA 77A32EF5 5 Bytes JMP 003C000A
.text C:\Windows\system32\lsass.exe[1444] kernel32.dll!CreateNamedPipeW 77A35C0C 5 Bytes JMP 003C0025
.text C:\Windows\system32\lsass.exe[1444] kernel32.dll!CreatePipe 77A58F06 5 Bytes JMP 003C0F57
.text C:\Windows\system32\lsass.exe[1444] kernel32.dll!LoadLibraryExW 77A5927C 5 Bytes JMP 003C0F83
.text C:\Windows\system32\lsass.exe[1444] kernel32.dll!LoadLibraryW 77A59400 5 Bytes JMP 003C0F9E
.text C:\Windows\system32\lsass.exe[1444] kernel32.dll!LoadLibraryExA 77A59554 5 Bytes JMP 003C0036
.text C:\Windows\system32\lsass.exe[1444] kernel32.dll!LoadLibraryA 77A5957C 5 Bytes JMP 003C0FB9
.text C:\Windows\system32\lsass.exe[1444] kernel32.dll!VirtualProtectEx 77A5DC52 5 Bytes JMP 003C0067
.text C:\Windows\system32\lsass.exe[1444] kernel32.dll!GetProcAddress 77A7925B 5 Bytes JMP 003C00BC
.text C:\Windows\system32\lsass.exe[1444] kernel32.dll!CreateFileW 77A7B0EB 5 Bytes JMP 003C0FDE
.text C:\Windows\system32\lsass.exe[1444] kernel32.dll!CreateFileA 77A7D07F 5 Bytes JMP 003C0FEF
.text C:\Windows\system32\lsass.exe[1444] kernel32.dll!WinExec 77AC60CF 5 Bytes JMP 003C0F1E
.text C:\Windows\system32\lsass.exe[1444] ADVAPI32.dll!RegCreateKeyExA 77B339AB 5 Bytes JMP 00A80F80
.text C:\Windows\system32\lsass.exe[1444] ADVAPI32.dll!RegCreateKeyA 77B33BA9 5 Bytes JMP 00A80022
.text C:\Windows\system32\lsass.exe[1444] ADVAPI32.dll!RegOpenKeyA 77B389C7 5 Bytes JMP 00A80000
.text C:\Windows\system32\lsass.exe[1444] ADVAPI32.dll!RegCreateKeyW 77B4391E 5 Bytes JMP 00A80F9B
.text C:\Windows\system32\lsass.exe[1444] ADVAPI32.dll!RegCreateKeyExW 77B441F1 5 Bytes JMP 00A8003D
.text C:\Windows\system32\lsass.exe[1444] ADVAPI32.dll!RegOpenKeyExA 77B47C42 5 Bytes JMP 00A80FDB
.text C:\Windows\system32\lsass.exe[1444] ADVAPI32.dll!RegOpenKeyW 77B4E2B5 5 Bytes JMP 00A80011
.text C:\Windows\system32\lsass.exe[1444] ADVAPI32.dll!RegOpenKeyExW 77B57BA1 5 Bytes JMP 00A80FC0
.text C:\Windows\system32\lsass.exe[1444] msvcrt.dll!_wsystem 77897F3F 5 Bytes JMP 003E0FB9
.text C:\Windows\system32\lsass.exe[1444] msvcrt.dll!system 7789805B 5 Bytes JMP 003E0044
.text C:\Windows\system32\lsass.exe[1444] msvcrt.dll!_creat 7789BBF1 5 Bytes JMP 003E0018
.text C:\Windows\system32\lsass.exe[1444] msvcrt.dll!_open 7789D116 5 Bytes JMP 003E0FEF
.text C:\Windows\system32\lsass.exe[1444] msvcrt.dll!_wcreat 7789D336 5 Bytes JMP 003E0029
.text C:\Windows\system32\lsass.exe[1444] msvcrt.dll!_wopen 7789D511 5 Bytes JMP 003E0FDE
.text C:\Windows\system32\lsass.exe[1444] WS2_32.dll!socket 77E036D1 5 Bytes JMP 00AD0000
.text C:\Windows\system32\lsass.exe[1444] WININET.dll!InternetOpenA 7791D6A8 5 Bytes JMP 003F0000
.text C:\Windows\system32\lsass.exe[1444] WININET.dll!InternetOpenW 7791DB21 5 Bytes JMP 003F0FE5
.text C:\Windows\system32\lsass.exe[1444] WININET.dll!InternetOpenUrlA 7791F3BC 5 Bytes JMP 003F001B
.text C:\Windows\system32\lsass.exe[1444] WININET.dll!InternetOpenUrlW 77966DFF 5 Bytes JMP 003F002C
.text C:\Windows\system32\svchost.exe[1468] ntdll.dll!NtCreateFile 77D14244 5 Bytes JMP 013E0FEF
.text C:\Windows\system32\svchost.exe[1468] ntdll.dll!NtCreateProcess 77D14304 5 Bytes JMP 013E0FDE
.text C:\Windows\system32\svchost.exe[1468] ntdll.dll!NtProtectVirtualMemory 77D14BA4 5 Bytes JMP 013E0014
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!GetStartupInfoW 77A31929 5 Bytes JMP 013C0F6F
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!GetStartupInfoA 77A319C9 5 Bytes JMP 013C00AB
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!CreateProcessW 77A31BF3 5 Bytes JMP 013C00E1
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!CreateProcessA 77A31C28 5 Bytes JMP 013C0F54
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!VirtualProtect 77A31DC3 5 Bytes JMP 013C0F94
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!CreateNamedPipeA 77A32EF5 5 Bytes JMP 013C002F
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!CreateNamedPipeW 77A35C0C 5 Bytes JMP 013C0040
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!CreatePipe 77A58F06 5 Bytes JMP 013C009A
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!LoadLibraryExW 77A5927C 5 Bytes JMP 013C0078
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!LoadLibraryW 77A59400 5 Bytes JMP 013C0FD4
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!LoadLibraryExA 77A59554 5 Bytes JMP 013C0FAF
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!LoadLibraryA 77A5957C 5 Bytes JMP 013C005B
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!VirtualProtectEx 77A5DC52 5 Bytes JMP 013C0089
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!GetProcAddress 77A7925B 5 Bytes JMP 013C0F39
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!CreateFileW 77A7B0EB 5 Bytes JMP 013C0014
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!CreateFileA 77A7D07F 5 Bytes JMP 013C0FEF
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!WinExec 77AC60CF 5 Bytes JMP 013C00D0
.text C:\Windows\system32\svchost.exe[1468] msvcrt.dll!_wsystem 77897F3F 5 Bytes JMP 01340F90
.text C:\Windows\system32\svchost.exe[1468] msvcrt.dll!system 7789805B 5 Bytes JMP 01340FAB
.text C:\Windows\system32\svchost.exe[1468] msvcrt.dll!_creat 7789BBF1 5 Bytes JMP 01340FC6
.text C:\Windows\system32\svchost.exe[1468] msvcrt.dll!_open 7789D116 5 Bytes JMP 01340FE3
.text C:\Windows\system32\svchost.exe[1468] msvcrt.dll!_wcreat 7789D336 5 Bytes JMP 0134001B
.text C:\Windows\system32\svchost.exe[1468] msvcrt.dll!_wopen 7789D511 5 Bytes JMP 01340000
.text C:\Windows\system32\svchost.exe[1468] ADVAPI32.dll!RegCreateKeyExA 77B339AB 5 Bytes JMP 013D0FA5
.text C:\Windows\system32\svchost.exe[1468] ADVAPI32.dll!RegCreateKeyA 77B33BA9 5 Bytes JMP 013D0FC0
.text C:\Windows\system32\svchost.exe[1468] ADVAPI32.dll!RegOpenKeyA 77B389C7 5 Bytes JMP 013D000A
.text C:\Windows\system32\svchost.exe[1468] ADVAPI32.dll!RegCreateKeyW 77B4391E 5 Bytes JMP 013D0051
.text C:\Windows\system32\svchost.exe[1468] ADVAPI32.dll!RegCreateKeyExW 77B441F1 5 Bytes JMP 013D0F94
.text C:\Windows\system32\svchost.exe[1468] ADVAPI32.dll!RegOpenKeyExA 77B47C42 5 Bytes JMP 013D0FE5
.text C:\Windows\system32\svchost.exe[1468] ADVAPI32.dll!RegOpenKeyW 77B4E2B5 5 Bytes JMP 013D001B
.text C:\Windows\system32\svchost.exe[1468] ADVAPI32.dll!RegOpenKeyExW 77B57BA1 5 Bytes JMP 013D002C
.text C:\Windows\system32\svchost.exe[1468] WS2_32.dll!socket 77E036D1 5 Bytes JMP 01430FE5
.text C:\Windows\system32\svchost.exe[1468] WININET.dll!InternetOpenA 7791D6A8 5 Bytes JMP 013B0FE5
.text C:\Windows\system32\svchost.exe[1468] WININET.dll!InternetOpenW 7791DB21 5 Bytes JMP 013B000A
.text C:\Windows\system32\svchost.exe[1468] WININET.dll!InternetOpenUrlA 7791F3BC 5 Bytes JMP 013B001B
.text C:\Windows\system32\svchost.exe[1468] WININET.dll!InternetOpenUrlW 77966DFF 5 Bytes JMP 013B0FC0
.text C:\Windows\system32\svchost.exe[1608] ntdll.dll!NtCreateFile 77D14244 5 Bytes JMP 00720FE5
.text C:\Windows\system32\svchost.exe[1608] ntdll.dll!NtCreateProcess 77D14304 5 Bytes JMP 00720FB9
.text C:\Windows\system32\svchost.exe[1608] ntdll.dll!NtProtectVirtualMemory 77D14BA4 5 Bytes JMP 00720FCA
.text C:\Windows\system32\svchost.exe[1608] kernel32.dll!GetStartupInfoW 77A31929 5 Bytes JMP 006E00BF
.text C:\Windows\system32\svchost.exe[1608] kernel32.dll!GetStartupInfoA 77A319C9 5 Bytes JMP 006E00AE
.text C:\Windows\system32\svchost.exe[1608] kernel32.dll!CreateProcessW 77A31BF3 5 Bytes JMP 006E0F43
.text C:\Windows\system32\svchost.exe[1608] kernel32.dll!CreateProcessA 77A31C28 5 Bytes JMP 006E0F68
.text C:\Windows\system32\svchost.exe[1608] kernel32.dll!VirtualProtect 77A31DC3 5 Bytes JMP 006E0F9E
.text C:\Windows\system32\svchost.exe[1608] kernel32.dll!CreateNamedPipeA 77A32EF5 5 Bytes JMP 006E0025
.text C:\Windows\system32\svchost.exe[1608] kernel32.dll!CreateNamedPipeW 77A35C0C 5 Bytes JMP 006E0036
.text C:\Windows\system32\svchost.exe[1608] kernel32.dll!CreatePipe 77A58F06 5 Bytes JMP 006E0093
.text C:\Windows\system32\svchost.exe[1608] kernel32.dll!LoadLibraryExW 77A5927C 5 Bytes JMP 006E0FAF
.text C:\Windows\system32\svchost.exe[1608] kernel32.dll!LoadLibraryW 77A59400 5 Bytes JMP 006E005B
.text C:\Windows\system32\svchost.exe[1608] kernel32.dll!LoadLibraryExA 77A59554 5 Bytes JMP 006E006C
.text C:\Windows\system32\svchost.exe[1608] kernel32.dll!LoadLibraryA 77A5957C 5 Bytes JMP 006E0FD4
.text C:\Windows\system32\svchost.exe[1608] kernel32.dll!VirtualProtectEx 77A5DC52 5 Bytes JMP 006E0F83
.text C:\Windows\system32\svchost.exe[1608] kernel32.dll!GetProcAddress 77A7925B 5 Bytes JMP 006E00F5
.text C:\Windows\system32\svchost.exe[1608] kernel32.dll!CreateFileW 77A7B0EB 1 Byte [E9]
.text C:\Windows\system32\svchost.exe[1608] kernel32.dll!CreateFileW 77A7B0EB 5 Bytes JMP 006E0FEF
.text C:\Windows\system32\svchost.exe[1608] kernel32.dll!CreateFileA 77A7D07F 5 Bytes JMP 006E000A
.text C:\Windows\system32\svchost.exe[1608] kernel32.dll!WinExec 77AC60CF 5 Bytes JMP 006E00DA
.text C:\Windows\system32\svchost.exe[1608] msvcrt.dll!_wsystem 77897F3F 5 Bytes JMP 00770053
.text C:\Windows\system32\svchost.exe[1608] msvcrt.dll!system 7789805B 5 Bytes JMP 00770038
.text C:\Windows\system32\svchost.exe[1608] msvcrt.dll!_creat 7789BBF1 5 Bytes JMP 00770FE3
.text C:\Windows\system32\svchost.exe[1608] msvcrt.dll!_open 7789D116 5 Bytes JMP 0077000C
.text C:\Windows\system32\svchost.exe[1608] msvcrt.dll!_wcreat 7789D336 5 Bytes JMP 00770FC8
.text C:\Windows\system32\svchost.exe[1608] msvcrt.dll!_wopen 7789D511 5 Bytes JMP 0077001D
.text C:\Windows\system32\svchost.exe[1608] ADVAPI32.dll!RegCreateKeyExA

.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!CreateFileW 77A7B0EB 5 Bytes JMP 010F0FD4
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!CreateFileA 77A7D07F 5 Bytes JMP 010F0FEF
.text C:\Windows\system32\svchost.exe[1436] kernel32.dll!WinExec 77AC60CF 5 Bytes JMP 010F0F21
.text C:\Windows\system32\svchost.exe[1436] msvcrt.dll!_wsystem 77897F3F 5 Bytes JMP 01090FAF
.text C:\Windows\system32\svchost.exe[1436] msvcrt.dll!system 7789805B 5 Bytes JMP 01090044
.text C:\Windows\system32\svchost.exe[1436] msvcrt.dll!_creat 7789BBF1 5 Bytes JMP 01090029
.text C:\Windows\system32\svchost.exe[1436] msvcrt.dll!_open 7789D116 5 Bytes JMP 01090FEF
.text C:\Windows\system32\svchost.exe[1436] msvcrt.dll!_wcreat 7789D336 5 Bytes JMP 01090FD4
.text C:\Windows\system32\svchost.exe[1436] msvcrt.dll!_wopen 7789D511 5 Bytes JMP 0109000C
.text C:\Windows\system32\svchost.exe[1436] ADVAPI32.dll!RegCreateKeyExA 77B339AB 5 Bytes JMP 01100F97
.text C:\Windows\system32\svchost.exe[1436] ADVAPI32.dll!RegCreateKeyA 77B33BA9 5 Bytes JMP 01100FB9
.text C:\Windows\system32\svchost.exe[1436] ADVAPI32.dll!RegOpenKeyA 77B389C7 5 Bytes JMP 0110000A
.text C:\Windows\system32\svchost.exe[1436] ADVAPI32.dll!RegCreateKeyW 77B4391E 5 Bytes JMP 01100FA8
.text C:\Windows\system32\svchost.exe[1436] ADVAPI32.dll!RegCreateKeyExW 77B441F1 5 Bytes JMP 01100F7C
.text C:\Windows\system32\svchost.exe[1436] ADVAPI32.dll!RegOpenKeyExA 77B47C42 5 Bytes JMP 0110002F
.text C:\Windows\system32\svchost.exe[1436] ADVAPI32.dll!RegOpenKeyW 77B4E2B5 5 Bytes JMP 01100FEF
.text C:\Windows\system32\svchost.exe[1436] ADVAPI32.dll!RegOpenKeyExW 77B57BA1 5 Bytes JMP 01100FDE
.text C:\Windows\system32\svchost.exe[1436] WS2_32.dll!socket 77E036D1 5 Bytes JMP 01C80FE5
.text C:\Windows\system32\svchost.exe[1436] WININET.dll!InternetOpenA 7791D6A8 5 Bytes JMP 010E000A
.text C:\Windows\system32\svchost.exe[1436] WININET.dll!InternetOpenW 7791DB21 1 Byte [E9]
.text C:\Windows\system32\svchost.exe[1436] WININET.dll!InternetOpenW 7791DB21 5 Bytes JMP 010E0025
.text C:\Windows\system32\svchost.exe[1436] WININET.dll!InternetOpenUrlA 7791F3BC 5 Bytes JMP 010E0FE5
.text C:\Windows\system32\svchost.exe[1436] WININET.dll!InternetOpenUrlW 77966DFF 5 Bytes JMP 010E0FD4
.text C:\Windows\system32\lsass.exe[1444] ntdll.dll!NtCreateFile 77D14244 5 Bytes JMP 003D0FE5
.text C:\Windows\system32\lsass.exe[1444] ntdll.dll!NtCreateProcess 77D14304 5 Bytes JMP 003D0011
.text C:\Windows\system32\lsass.exe[1444] ntdll.dll!NtProtectVirtualMemory 77D14BA4 5 Bytes JMP 003D0000
.text C:\Windows\system32\lsass.exe[1444] kernel32.dll!GetStartupInfoW 77A31929 5 Bytes JMP 003C0089
.text C:\Windows\system32\lsass.exe[1444] kernel32.dll!GetStartupInfoA 77A319C9 5 Bytes JMP 003C0078
.text C:\Windows\system32\lsass.exe[1444] kernel32.dll!CreateProcessW 77A31BF3 5 Bytes JMP 003C00AB
.text C:\Windows\system32\lsass.exe[1444] kernel32.dll!CreateProcessA 77A31C28 5 Bytes JMP 003C009A
.text C:\Windows\system32\lsass.exe[1444] kernel32.dll!VirtualProtect 77A31DC3 5 Bytes JMP 003C0F72
.text C:\Windows\system32\lsass.exe[1444] kernel32.dll!CreateNamedPipeA 77A32EF5 5 Bytes JMP 003C000A
.text C:\Windows\system32\lsass.exe[1444] kernel32.dll!CreateNamedPipeW 77A35C0C 5 Bytes JMP 003C0025
.text C:\Windows\system32\lsass.exe[1444] kernel32.dll!CreatePipe 77A58F06 5 Bytes JMP 003C0F57
.text C:\Windows\system32\lsass.exe[1444] kernel32.dll!LoadLibraryExW 77A5927C 5 Bytes JMP 003C0F83
.text C:\Windows\system32\lsass.exe[1444] kernel32.dll!LoadLibraryW 77A59400 5 Bytes JMP 003C0F9E
.text C:\Windows\system32\lsass.exe[1444] kernel32.dll!LoadLibraryExA 77A59554 5 Bytes JMP 003C0036
.text C:\Windows\system32\lsass.exe[1444] kernel32.dll!LoadLibraryA 77A5957C 5 Bytes JMP 003C0FB9
.text C:\Windows\system32\lsass.exe[1444] kernel32.dll!VirtualProtectEx 77A5DC52 5 Bytes JMP 003C0067
.text C:\Windows\system32\lsass.exe[1444] kernel32.dll!GetProcAddress 77A7925B 5 Bytes JMP 003C00BC
.text C:\Windows\system32\lsass.exe[1444] kernel32.dll!CreateFileW 77A7B0EB 5 Bytes JMP 003C0FDE
.text C:\Windows\system32\lsass.exe[1444] kernel32.dll!CreateFileA 77A7D07F 5 Bytes JMP 003C0FEF
.text C:\Windows\system32\lsass.exe[1444] kernel32.dll!WinExec 77AC60CF 5 Bytes JMP 003C0F1E
.text C:\Windows\system32\lsass.exe[1444] ADVAPI32.dll!RegCreateKeyExA 77B339AB 5 Bytes JMP 00A80F80
.text C:\Windows\system32\lsass.exe[1444] ADVAPI32.dll!RegCreateKeyA 77B33BA9 5 Bytes JMP 00A80022
.text C:\Windows\system32\lsass.exe[1444] ADVAPI32.dll!RegOpenKeyA 77B389C7 5 Bytes JMP 00A80000
.text C:\Windows\system32\lsass.exe[1444] ADVAPI32.dll!RegCreateKeyW 77B4391E 5 Bytes JMP 00A80F9B
.text C:\Windows\system32\lsass.exe[1444] ADVAPI32.dll!RegCreateKeyExW 77B441F1 5 Bytes JMP 00A8003D
.text C:\Windows\system32\lsass.exe[1444] ADVAPI32.dll!RegOpenKeyExA 77B47C42 5 Bytes JMP 00A80FDB
.text C:\Windows\system32\lsass.exe[1444] ADVAPI32.dll!RegOpenKeyW 77B4E2B5 5 Bytes JMP 00A80011
.text C:\Windows\system32\lsass.exe[1444] ADVAPI32.dll!RegOpenKeyExW 77B57BA1 5 Bytes JMP 00A80FC0
.text C:\Windows\system32\lsass.exe[1444] msvcrt.dll!_wsystem 77897F3F 5 Bytes JMP 003E0FB9
.text C:\Windows\system32\lsass.exe[1444] msvcrt.dll!system 7789805B 5 Bytes JMP 003E0044
.text C:\Windows\system32\lsass.exe[1444] msvcrt.dll!_creat 7789BBF1 5 Bytes JMP 003E0018
.text C:\Windows\system32\lsass.exe[1444] msvcrt.dll!_open 7789D116 5 Bytes JMP 003E0FEF
.text C:\Windows\system32\lsass.exe[1444] msvcrt.dll!_wcreat 7789D336 5 Bytes JMP 003E0029
.text C:\Windows\system32\lsass.exe[1444] msvcrt.dll!_wopen 7789D511 5 Bytes JMP 003E0FDE
.text C:\Windows\system32\lsass.exe[1444] WS2_32.dll!socket 77E036D1 5 Bytes JMP 00AD0000
.text C:\Windows\system32\lsass.exe[1444] WININET.dll!InternetOpenA 7791D6A8 5 Bytes JMP 003F0000
.text C:\Windows\system32\lsass.exe[1444] WININET.dll!InternetOpenW 7791DB21 5 Bytes JMP 003F0FE5
.text C:\Windows\system32\lsass.exe[1444] WININET.dll!InternetOpenUrlA 7791F3BC 5 Bytes JMP 003F001B
.text C:\Windows\system32\lsass.exe[1444] WININET.dll!InternetOpenUrlW 77966DFF 5 Bytes JMP 003F002C
.text C:\Windows\system32\svchost.exe[1468] ntdll.dll!NtCreateFile 77D14244 5 Bytes JMP 013E0FEF
.text C:\Windows\system32\svchost.exe[1468] ntdll.dll!NtCreateProcess 77D14304 5 Bytes JMP 013E0FDE
.text C:\Windows\system32\svchost.exe[1468] ntdll.dll!NtProtectVirtualMemory 77D14BA4 5 Bytes JMP 013E0014
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!GetStartupInfoW 77A31929 5 Bytes JMP 013C0F6F
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!GetStartupInfoA 77A319C9 5 Bytes JMP 013C00AB
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!CreateProcessW 77A31BF3 5 Bytes JMP 013C00E1
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!CreateProcessA 77A31C28 5 Bytes JMP 013C0F54
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!VirtualProtect 77A31DC3 5 Bytes JMP 013C0F94
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!CreateNamedPipeA 77A32EF5 5 Bytes JMP 013C002F
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!CreateNamedPipeW 77A35C0C 5 Bytes JMP 013C0040
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!CreatePipe 77A58F06 5 Bytes JMP 013C009A
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!LoadLibraryExW 77A5927C 5 Bytes JMP 013C0078
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!LoadLibraryW 77A59400 5 Bytes JMP 013C0FD4
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!LoadLibraryExA 77A59554 5 Bytes JMP 013C0FAF
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!LoadLibraryA 77A5957C 5 Bytes JMP 013C005B
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!VirtualProtectEx 77A5DC52 5 Bytes JMP 013C0089
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!GetProcAddress 77A7925B 5 Bytes JMP 013C0F39
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!CreateFileW 77A7B0EB 5 Bytes JMP 013C0014
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!CreateFileA 77A7D07F 5 Bytes JMP 013C0FEF
.text C:\Windows\system32\svchost.exe[1468] kernel32.dll!WinExec 77AC60CF 5 Bytes JMP 013C00D0
.text C:\Windows\system32\svchost.exe[1468] msvcrt.dll!_wsystem 77897F3F 5 Bytes JMP 01340F90
.text C:\Windows\system32\svchost.exe[1468] msvcrt.dll!system 7789805B 5 Bytes JMP 01340FAB
.text C:\Windows\system32\svchost.exe[1468] msvcrt.dll!_creat 7789BBF1 5 Bytes JMP 01340FC6
.text C:\Windows\system32\svchost.exe[1468] msvcrt.dll!_open 7789D116 5 Bytes JMP 01340FE3
.text C:\Windows\system32\svchost.exe[1468] msvcrt.dll!_wcreat 7789D336 5 Bytes JMP 0134001B
.text C:\Windows\system32\svchost.exe[1468] msvcrt.dll!_wopen 7789D511 5 Bytes JMP 01340000
.text C:\Windows\system32\svchost.exe[1468] ADVAPI32.dll!RegCreateKeyExA 77B339AB 5 Bytes JMP 013D0FA5
.text C:\Windows\system32\svchost.exe[1468] ADVAPI32.dll!RegCreateKeyA 77B33BA9 5 Bytes JMP 013D0FC0
.text C:\Windows\system32\svchost.exe[1468] ADVAPI32.dll!RegOpenKeyA 77B389C7 5 Bytes JMP 013D000A
.text C:\Windows\system32\svchost.exe[1468] ADVAPI32.dll!RegCreateKeyW 77B4391E 5 Bytes JMP 013D0051
.text C:\Windows\system32\svchost.exe[1468] ADVAPI32.dll!RegCreateKeyExW 77B441F1 5 Bytes JMP 013D0F94
.text C:\Windows\system32\svchost.exe[1468] ADVAPI32.dll!RegOpenKeyExA 77B47C42 5 Bytes JMP 013D0FE5
.text C:\Windows\system32\svchost.exe[1468] ADVAPI32.dll!RegOpenKeyW 77B4E2B5 5 Bytes JMP 013D001B
.text C:\Windows\system32\svchost.exe[1468] ADVAPI32.dll!RegOpenKeyExW 77B57BA1 5 Bytes JMP 013D002C
.text C:\Windows\system32\svchost.exe[1468] WS2_32.dll!socket 77E036D1 5 Bytes JMP 01430FE5
.text C:\Windows\system32\svchost.exe[1468] WININET.dll!InternetOpenA 7791D6A8 5 Bytes JMP 013B0FE5
.text C:\Windows\system32\svchost.exe[1468] WININET.dll!InternetOpenW 7791DB21 5 Bytes JMP 013B000A
.text C:\Windows\system32\svchost.exe[1468] WININET.dll!InternetOpenUrlA 7791F3BC 5 Bytes JMP 013B001B
.text C:\Windows\system32\svchost.exe[1468] WININET.dll!InternetOpenUrlW 77966DFF 5 Bytes JMP 013B0FC0
.text C:\Windows\system32\svchost.exe[1608] ntdll.dll!NtCreateFile 77D14244 5 Bytes JMP 00720FE5
.text C:\Windows\system32\svchost.exe[1608] ntdll.dll!NtCreateProcess 77D14304 5 Bytes JMP 00720FB9
.text C:\Windows\system32\svchost.exe[1608] ntdll.dll!NtProtectVirtualMemory 77D14BA4 5 Bytes JMP 00720FCA
.text C:\Windows\system32\svchost.exe[1608] kernel32.dll!GetStartupInfoW 77A31929 5 Bytes JMP 006E00BF
.text C:\Windows\system32\svchost.exe[1608] kernel32.dll!GetStartupInfoA 77A319C9 5 Bytes JMP 006E00AE
.text C:\Windows\system32\svchost.exe[1608] kernel32.dll!CreateProcessW 77A31BF3 5 Bytes JMP 006E0F43
.text C:\Windows\system32\svchost.exe[1608] kernel32.dll!CreateProcessA 77A31C28 5 Bytes JMP 006E0F68
.text C:\Windows\system32\svchost.exe[1608] kernel32.dll!VirtualProtect 77A31DC3 5 Bytes JMP 006E0F9E
.text C:\Windows\system32\svchost.exe[1608] kernel32.dll!CreateNamedPipeA 77A32EF5 5 Bytes JMP 006E0025
.text C:\Windows\system32\svchost.exe[1608] kernel32.dll!CreateNamedPipeW 77A35C0C 5 Bytes JMP 006E0036
.text C:\Windows\system32\svchost.exe[1608] kernel32.dll!CreatePipe 77A58F06 5 Bytes JMP 006E0093
.text C:\Windows\system32\svchost.exe[1608] kernel32.dll!LoadLibraryExW 77A5927C 5 Bytes JMP 006E0FAF
.text C:\Windows\system32\svchost.exe[1608] kernel32.dll!LoadLibraryW 77A59400 5 Bytes JMP 006E005B
.text C:\Windows\system32\svchost.exe[1608] kernel32.dll!LoadLibraryExA 77A59554 5 Bytes JMP 006E006C
.text C:\Windows\system32\svchost.exe[1608] kernel32.dll!LoadLibraryA 77A5957C 5 Bytes JMP 006E0FD4
.text C:\Windows\system32\svchost.exe[1608] kernel32.dll!VirtualProtectEx 77A5DC52 5 Bytes JMP 006E0F83
.text C:\Windows\system32\svchost.exe[1608] kernel32.dll!GetProcAddress 77A7925B 5 Bytes JMP 006E00F5
.text C:\Windows\system32\svchost.exe[1608] kernel32.dll!CreateFileW 77A7B0EB 1 Byte [E9]
.text C:\Windows\system32\svchost.exe[1608] kernel32.dll!CreateFileW 77A7B0EB 5 Bytes JMP 006E0FEF
.text C:\Windows\system32\svchost.exe[1608] kernel32.dll!CreateFileA 77A7D07F 5 Bytes JMP 006E000A
.text C:\Windows\system32\svchost.exe[1608] kernel32.dll!WinExec 77AC60CF 5 Bytes JMP 006E00DA
.text C:\Windows\system32\svchost.exe[1608] msvcrt.dll!_wsystem 77897F3F 5 Bytes JMP 00770053
.text C:\Windows\system32\svchost.exe[1608] msvcrt.dll!system 7789805B 5 Bytes JMP 00770038
.text C:\Windows\system32\svchost.exe[1608] msvcrt.dll!_creat 7789BBF1 5 Bytes JMP 00770FE3
.text C:\Windows\system32\svchost.exe[1608] msvcrt.dll!_open 7789D116 5 Bytes JMP 0077000C
.text C:\Windows\system32\svchost.exe[1608] msvcrt.dll!_wcreat 7789D336 5 Bytes JMP 00770FC8
.text C:\Windows\system32\svchost.exe[1608] msvcrt.dll!_wopen 7789D511 5 Bytes JMP 0077001D
.text C:\Windows\system32\svchost.exe[1608] ADVAPI32.dll!RegCreateKeyExA

77B339AB 5 Bytes JMP 00790F83
.text C:\Windows\system32\svchost.exe[1608] ADVAPI32.dll!RegCreateKeyA 77B33BA9 5 Bytes JMP 00790FAF
.text C:\Windows\system32\svchost.exe[1608] ADVAPI32.dll!RegOpenKeyA 77B389C7 5 Bytes JMP 0079000A
.text C:\Windows\system32\svchost.exe[1608] ADVAPI32.dll!RegCreateKeyW 77B4391E 5 Bytes JMP 00790F94
.text C:\Windows\system32\svchost.exe[1608] ADVAPI32.dll!RegCreateKeyExW 77B441F1 5 Bytes JMP 00790040
.text C:\Windows\system32\svchost.exe[1608] ADVAPI32.dll!RegOpenKeyExA 77B47C42 5 Bytes JMP 00790FE5
.text C:\Windows\system32\svchost.exe[1608] ADVAPI32.dll!RegOpenKeyW 77B4E2B5 5 Bytes JMP 0079001B
.text C:\Windows\system32\svchost.exe[1608] ADVAPI32.dll!RegOpenKeyExW 77B57BA1 5 Bytes JMP 00790FCA
.text C:\Windows\system32\svchost.exe[1608] WS2_32.dll!socket 77E036D1 5 Bytes JMP 00EB0000
.text C:\Windows\system32\svchost.exe[1608] WININET.dll!InternetOpenA 7791D6A8 5 Bytes JMP 00780000
.text C:\Windows\system32\svchost.exe[1608] WININET.dll!InternetOpenW 7791DB21 5 Bytes JMP 00780011
.text C:\Windows\system32\svchost.exe[1608] WININET.dll!InternetOpenUrlA 7791F3BC 5 Bytes JMP 00780FDB
.text C:\Windows\system32\svchost.exe[1608] WININET.dll!InternetOpenUrlW 77966DFF 5 Bytes JMP 00780022
.text C:\Windows\system32\svchost.exe[1900] ntdll.dll!NtCreateFile 77D14244 5 Bytes JMP 00DB0FEF
.text C:\Windows\system32\svchost.exe[1900] ntdll.dll!NtCreateProcess 77D14304 5 Bytes JMP 00DB0FCD
.text C:\Windows\system32\svchost.exe[1900] ntdll.dll!NtProtectVirtualMemory 77D14BA4 5 Bytes JMP 00DB0FDE
.text C:\Windows\system32\svchost.exe[1900] kernel32.dll!GetStartupInfoW 77A31929 5 Bytes JMP 009800D0
.text C:\Windows\system32\svchost.exe[1900] kernel32.dll!GetStartupInfoA 77A319C9 5 Bytes JMP 00980F8A
.text C:\Windows\system32\svchost.exe[1900] kernel32.dll!CreateProcessW 77A31BF3 5 Bytes JMP 0098010D
.text C:\Windows\system32\svchost.exe[1900] kernel32.dll!CreateProcessA 77A31C28 5 Bytes JMP 009800FC
.text C:\Windows\system32\svchost.exe[1900] kernel32.dll!VirtualProtect 77A31DC3 5 Bytes JMP 00980F9B
.text C:\Windows\system32\svchost.exe[1900] kernel32.dll!CreateNamedPipeA 77A32EF5 5 Bytes JMP 00980022
.text C:\Windows\system32\svchost.exe[1900] kernel32.dll!CreateNamedPipeW 77A35C0C 5 Bytes JMP 00980033
.text C:\Windows\system32\svchost.exe[1900] kernel32.dll!CreatePipe 77A58F06 5 Bytes JMP 009800B5
.text C:\Windows\system32\svchost.exe[1900] kernel32.dll!LoadLibraryExW 77A5927C 5 Bytes JMP 00980FAC
.text C:\Windows\system32\svchost.exe[1900] kernel32.dll!LoadLibraryW 77A59400 5 Bytes JMP 00980044
.text C:\Windows\system32\svchost.exe[1900] kernel32.dll!LoadLibraryExA 77A59554 5 Bytes JMP 0098005F
.text C:\Windows\system32\svchost.exe[1900] kernel32.dll!LoadLibraryA 77A5957C 5 Bytes JMP 00980FBD
.text C:\Windows\system32\svchost.exe[1900] kernel32.dll!VirtualProtectEx 77A5DC52 5 Bytes JMP 0098009A
.text C:\Windows\system32\svchost.exe[1900] kernel32.dll!GetProcAddress 77A7925B 5 Bytes JMP 00980F51
.text C:\Windows\system32\svchost.exe[1900] kernel32.dll!CreateFileW 77A7B0EB 5 Bytes JMP 00980011
.text C:\Windows\system32\svchost.exe[1900] kernel32.dll!CreateFileA 77A7D07F 5 Bytes JMP 00980000
.text C:\Windows\system32\svchost.exe[1900] kernel32.dll!WinExec 77AC60CF 5 Bytes JMP 009800E1
.text C:\Windows\system32\svchost.exe[1900] msvcrt.dll!_wsystem 77897F3F 5 Bytes JMP 00960042
.text C:\Windows\system32\svchost.exe[1900] msvcrt.dll!system 7789805B 5 Bytes JMP 00960FB7
.text C:\Windows\system32\svchost.exe[1900] msvcrt.dll!_creat 7789BBF1 5 Bytes JMP 0096000C
.text C:\Windows\system32\svchost.exe[1900] msvcrt.dll!_open 7789D116 5 Bytes JMP 00960FE3
.text C:\Windows\system32\svchost.exe[1900] msvcrt.dll!_wcreat 7789D336 5 Bytes JMP 0096001D
.text C:\Windows\system32\svchost.exe[1900] msvcrt.dll!_wopen 7789D511 5 Bytes JMP 00960FD2
.text C:\Windows\system32\svchost.exe[1900] ADVAPI32.dll!RegCreateKeyExA 77B339AB 5 Bytes JMP 009D0051
.text C:\Windows\system32\svchost.exe[1900] ADVAPI32.dll!RegCreateKeyA 77B33BA9 5 Bytes JMP 009D0FB9
.text C:\Windows\system32\svchost.exe[1900] ADVAPI32.dll!RegOpenKeyA 77B389C7 5 Bytes JMP 009D0000
.text C:\Windows\system32\svchost.exe[1900] ADVAPI32.dll!RegCreateKeyW 77B4391E 5 Bytes JMP 009D0040
.text C:\Windows\system32\svchost.exe[1900] ADVAPI32.dll!RegCreateKeyExW 77B441F1 5 Bytes JMP 009D0F94
.text C:\Windows\system32\svchost.exe[1900] ADVAPI32.dll!RegOpenKeyExA 77B47C42 5 Bytes JMP 009D0FDB
.text C:\Windows\system32\svchost.exe[1900] ADVAPI32.dll!RegOpenKeyW 77B4E2B5 5 Bytes JMP 009D001B
.text C:\Windows\system32\svchost.exe[1900] ADVAPI32.dll!RegOpenKeyExW 77B57BA1 5 Bytes JMP 009D0FCA
.text C:\Windows\system32\svchost.exe[1900] WS2_32.dll!socket 77E036D1 5 Bytes JMP 01400000
.text C:\Windows\system32\svchost.exe[1900] WinInet.dll!InternetOpenA 7791D6A8 5 Bytes JMP 00970FEF
.text C:\Windows\system32\svchost.exe[1900] WinInet.dll!InternetOpenW 7791DB21 5 Bytes JMP 00970FDE
.text C:\Windows\system32\svchost.exe[1900] WinInet.dll!InternetOpenUrlA 7791F3BC 5 Bytes JMP 00970FCD
.text C:\Windows\system32\svchost.exe[1900] WinInet.dll!InternetOpenUrlW 77966DFF 5 Bytes JMP 00970FB2
.text C:\Windows\system32\svchost.exe[2460] ntdll.dll!NtCreateFile 77D14244 5 Bytes JMP 008E0000
.text C:\Windows\system32\svchost.exe[2460] ntdll.dll!NtCreateProcess 77D14304 5 Bytes JMP 008E0FCA
.text C:\Windows\system32\svchost.exe[2460] ntdll.dll!NtProtectVirtualMemory 77D14BA4 5 Bytes JMP 008E0FE5
.text C:\Windows\system32\svchost.exe[2460] kernel32.dll!GetStartupInfoW 77A31929 5 Bytes JMP 008C00A9
.text C:\Windows\system32\svchost.exe[2460] kernel32.dll!GetStartupInfoA 77A319C9 5 Bytes JMP 008C008E
.text C:\Windows\system32\svchost.exe[2460] kernel32.dll!CreateProcessW 77A31BF3 5 Bytes JMP 008C00D8
.text C:\Windows\system32\svchost.exe[2460] kernel32.dll!CreateProcessA 77A31C28 5 Bytes JMP 008C0F41
.text C:\Windows\system32\svchost.exe[2460] kernel32.dll!VirtualProtect 77A31DC3 5 Bytes JMP 008C0062
.text C:\Windows\system32\svchost.exe[2460] kernel32.dll!CreateNamedPipeA 77A32EF5 5 Bytes JMP 008C001B
.text C:\Windows\system32\svchost.exe[2460] kernel32.dll!CreateNamedPipeW 77A35C0C 5 Bytes JMP 008C002C
.text C:\Windows\system32\svchost.exe[2460] kernel32.dll!CreatePipe 77A58F06 5 Bytes JMP 008C0F63
.text C:\Windows\system32\svchost.exe[2460] kernel32.dll!LoadLibraryExW 77A5927C 5 Bytes JMP 008C0F7E
.text C:\Windows\system32\svchost.exe[2460] kernel32.dll!LoadLibraryW 77A59400 5 Bytes JMP 008C0FB6
.text C:\Windows\system32\svchost.exe[2460] kernel32.dll!LoadLibraryExA 77A59554 5 Bytes JMP 008C0F9B
.text C:\Windows\system32\svchost.exe[2460] kernel32.dll!LoadLibraryA 77A5957C 5 Bytes JMP 008C003D
.text C:\Windows\system32\svchost.exe[2460] kernel32.dll!VirtualProtectEx 77A5DC52 5 Bytes JMP 008C0073
.text C:\Windows\system32\svchost.exe[2460] kernel32.dll!GetProcAddress 77A7925B 5 Bytes JMP 008C00F3
.text C:\Windows\system32\svchost.exe[2460] kernel32.dll!CreateFileW 77A7B0EB 5 Bytes JMP 008C0000
.text C:\Windows\system32\svchost.exe[2460] kernel32.dll!CreateFileA 77A7D07F 5 Bytes JMP 008C0FE5
.text C:\Windows\system32\svchost.exe[2460] kernel32.dll!WinExec 77AC60CF 5 Bytes JMP 008C0F52
.text C:\Windows\system32\svchost.exe[2460] msvcrt.dll!_wsystem 77897F3F 5 Bytes JMP 00790018
.text C:\Windows\system32\svchost.exe[2460] msvcrt.dll!system 7789805B 5 Bytes JMP 00790F97
.text C:\Windows\system32\svchost.exe[2460] msvcrt.dll!_creat 7789BBF1 5 Bytes JMP 00790FC3
.text C:\Windows\system32\svchost.exe[2460] msvcrt.dll!_open 7789D116 5 Bytes JMP 00790FEF
.text C:\Windows\system32\svchost.exe[2460] msvcrt.dll!_wcreat 7789D336 5 Bytes JMP 00790FA8
.text C:\Windows\system32\svchost.exe[2460] msvcrt.dll!_wopen 7789D511 5 Bytes JMP 00790FDE
.text C:\Windows\system32\svchost.exe[2460] ADVAPI32.dll!RegCreateKeyExA 77B339AB 1 Byte [E9]
.text C:\Windows\system32\svchost.exe[2460] ADVAPI32.dll!RegCreateKeyExA 77B339AB 5 Bytes JMP 008D0FAF
.text C:\Windows\system32\svchost.exe[2460] ADVAPI32.dll!RegCreateKeyA 77B33BA9 5 Bytes JMP 008D0040
.text C:\Windows\system32\svchost.exe[2460] ADVAPI32.dll!RegOpenKeyA 77B389C7 5 Bytes JMP 008D0FEF
.text C:\Windows\system32\svchost.exe[2460] ADVAPI32.dll!RegCreateKeyW 77B4391E 5 Bytes JMP 008D0051
.text C:\Windows\system32\svchost.exe[2460] ADVAPI32.dll!RegCreateKeyExW 77B441F1 5 Bytes JMP 008D0F94
.text C:\Windows\system32\svchost.exe[2460] ADVAPI32.dll!RegOpenKeyExA 77B47C42 5 Bytes JMP 008D0FD4
.text C:\Windows\system32\svchost.exe[2460] ADVAPI32.dll!RegOpenKeyW 77B4E2B5 5 Bytes JMP 008D000A
.text C:\Windows\system32\svchost.exe[2460] ADVAPI32.dll!RegOpenKeyExW 77B57BA1 5 Bytes JMP 008D0025
.text C:\Windows\system32\svchost.exe[2460] WS2_32.dll!socket 77E036D1 5 Bytes JMP 008F0FE5
.text C:\Windows\System32\svchost.exe[2972] ntdll.dll!NtCreateFile 77D14244 5 Bytes JMP 0009000A
.text C:\Windows\System32\svchost.exe[2972] ntdll.dll!NtCreateProcess 77D14304 5 Bytes JMP 0009001B
.text C:\Windows\System32\svchost.exe[2972] ntdll.dll!NtProtectVirtualMemory 77D14BA4 5 Bytes JMP 00090FE5
.text C:\Windows\System32\svchost.exe[2972] kernel32.dll!GetStartupInfoW 77A31929 5 Bytes JMP 00060F8A
.text C:\Windows\System32\svchost.exe[2972] kernel32.dll!GetStartupInfoA 77A319C9 5 Bytes JMP 000600D0
.text C:\Windows\System32\svchost.exe[2972] kernel32.dll!CreateProcessW 77A31BF3 5 Bytes JMP 00060F54
.text C:\Windows\System32\svchost.exe[2972] kernel32.dll!CreateProcessA 77A31C28 5 Bytes JMP 00060F65
.text C:\Windows\System32\svchost.exe[2972] kernel32.dll!VirtualProtect 77A31DC3 5 Bytes JMP 00060FC0
.text C:\Windows\System32\svchost.exe[2972] kernel32.dll!CreateNamedPipeA 77A32EF5 5 Bytes JMP 00060036
.text C:\Windows\System32\svchost.exe[2972] kernel32.dll!CreateNamedPipeW 77A35C0C 5 Bytes JMP 00060FE5
.text C:\Windows\System32\svchost.exe[2972] kernel32.dll!CreatePipe 77A58F06 5 Bytes JMP 000600BF
.text C:\Windows\System32\svchost.exe[2972] kernel32.dll!LoadLibraryExW 77A5927C 5 Bytes JMP 00060098
.text C:\Windows\System32\svchost.exe[2972] kernel32.dll!LoadLibraryW 77A59400 5 Bytes JMP 0006006C
.text C:\Windows\System32\svchost.exe[2972] kernel32.dll!LoadLibraryExA 77A59554 5 Bytes JMP 0006007D
.text C:\Windows\System32\svchost.exe[2972] kernel32.dll!LoadLibraryA 77A5957C 5 Bytes JMP 00060047
.text C:\Windows\System32\svchost.exe[2972] kernel32.dll!VirtualProtectEx 77A5DC52 5 Bytes JMP 00060FAF
.text C:\Windows\System32\svchost.exe[2972] kernel32.dll!GetProcAddress 77A7925B 5 Bytes JMP 00060106
.text C:\Windows\System32\svchost.exe[2972] kernel32.dll!CreateFileW 77A7B0EB 5 Bytes JMP 00060025
.text C:\Windows\System32\svchost.exe[2972] kernel32.dll!CreateFileA 77A7D07F 5 Bytes JMP 00060000
.text C:\Windows\System32\svchost.exe[2972] kernel32.dll!WinExec 77AC60CF 5 Bytes JMP 000600EB
.text C:\Windows\System32\svchost.exe[2972] msvcrt.dll!_wsystem 77897F3F 5 Bytes JMP 00050FBC
.text C:\Windows\System32\svchost.exe[2972] msvcrt.dll!system 7789805B 5 Bytes JMP 00050FCD
.text C:\Windows\System32\svchost.exe[2972] msvcrt.dll!_creat 7789BBF1 5 Bytes JMP 00050022
.text C:\Windows\System32\svchost.exe[2972] msvcrt.dll!_open 7789D116 5 Bytes JMP 00050FEF
.text C:\Windows\System32\svchost.exe[2972] msvcrt.dll!_wcreat 7789D336 5 Bytes JMP 00050033
.text C:\Windows\System32\svchost.exe[2972] msvcrt.dll!_wopen 7789D511 5 Bytes JMP 00050FDE
.text C:\Windows\System32\svchost.exe[2972] ADVAPI32.dll!RegCreateKeyExA 77B339AB 5 Bytes JMP 00070036
.text C:\Windows\System32\svchost.exe[2972] ADVAPI32.dll!RegCreateKeyA 77B33BA9 5 Bytes JMP 00070FAF
.text C:\Windows\System32\svchost.exe[2972] ADVAPI32.dll!RegOpenKeyA 77B389C7 5 Bytes JMP 0007000A
.text C:\Windows\System32\svchost.exe[2972] ADVAPI32.dll!RegCreateKeyW 77B4391E 5 Bytes JMP 00070F9E
.text C:\Windows\System32\svchost.exe[2972] ADVAPI32.dll!RegCreateKeyExW 77B441F1 5 Bytes JMP 00070F79
.text C:\Windows\System32\svchost.exe[2972] ADVAPI32.dll!RegOpenKeyExA 77B47C42 5 Bytes JMP 00070FEF
.text C:\Windows\System32\svchost.exe[2972] ADVAPI32.dll!RegOpenKeyW 77B4E2B5 5 Bytes JMP 00070025
.text C:\Windows\System32\svchost.exe[2972] ADVAPI32.dll!RegOpenKeyExW 77B57BA1 5 Bytes JMP 00070FCA

77B47C42 5 Bytes JMP 00680036
.text C:\Windows\system32\svchost.exe[3068] ADVAPI32.dll!RegOpenKeyW 77B4E2B5 5 Bytes JMP 00680011
.text C:\Windows\system32\svchost.exe[3068] ADVAPI32.dll!RegOpenKeyExW 77B57BA1 5 Bytes JMP 00680047
.text C:\Windows\system32\svchost.exe[3068] WS2_32.dll!socket 77E036D1 5 Bytes JMP 006A0FE5
.text C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe[3268] kernel32.dll!LoadLibraryW 77A59400 5 Bytes JMP 705A9A63 C:\Program Files\Common Files\McAfee\McProxy\mcproxy.dll (McAfee Proxy Service Module/McAfee, Inc.)
.text C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe[3268] kernel32.dll!LoadLibraryA 77A5957C 5 Bytes JMP 705A99A1 C:\Program Files\Common Files\McAfee\McProxy\mcproxy.dll (McAfee Proxy Service Module/McAfee, Inc.)
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5312] ntdll.dll!NtCreateFile + 6 77D1424A 4 Bytes [28, 00, 14, 00] {SUB [EAX], AL; ADC AL, 0x0}
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5312] ntdll.dll!NtCreateFile + B 77D1424F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5312] ntdll.dll!NtMapViewOfSection + 6 77D1499A 1 Byte [28]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5312] ntdll.dll!NtMapViewOfSection + 6 77D1499A 4 Bytes [28, 03, 14, 00] {SUB [EBX], AL; ADC AL, 0x0}
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5312] ntdll.dll!NtMapViewOfSection + B 77D1499F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5312] ntdll.dll!NtOpenFile + 6 77D14A2A 4 Bytes [68, 00, 14, 00]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5312] ntdll.dll!NtOpenFile + B 77D14A2F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5312] ntdll.dll!NtOpenProcess + 6 77D14AAA 4 Bytes [A8, 01, 14, 00] {TEST AL, 0x1; ADC AL, 0x0}
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5312] ntdll.dll!NtOpenProcess + B 77D14AAF 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5312] ntdll.dll!NtOpenProcessToken + 6 77D14ABA 4 Bytes CALL 76D15EC0 C:\Windows\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5312] ntdll.dll!NtOpenProcessToken + B 77D14ABF 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5312] ntdll.dll!NtOpenProcessTokenEx + 6 77D14ACA 4 Bytes [A8, 02, 14, 00] {TEST AL, 0x2; ADC AL, 0x0}
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5312] ntdll.dll!NtOpenProcessTokenEx + B 77D14ACF 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5312] ntdll.dll!NtOpenThread + 6 77D14B1A 4 Bytes [68, 01, 14, 00]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5312] ntdll.dll!NtOpenThread + B 77D14B1F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5312] ntdll.dll!NtOpenThreadToken + 6 77D14B2A 4 Bytes [68, 02, 14, 00]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5312] ntdll.dll!NtOpenThreadToken + B 77D14B2F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5312] ntdll.dll!NtOpenThreadTokenEx + 6 77D14B3A 4 Bytes CALL 76D15F41 C:\Windows\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5312] ntdll.dll!NtOpenThreadTokenEx + B 77D14B3F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5312] ntdll.dll!NtQueryAttributesFile + 6 77D14BCA 4 Bytes [A8, 00, 14, 00] {TEST AL, 0x0; ADC AL, 0x0}
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5312] ntdll.dll!NtQueryAttributesFile + B 77D14BCF 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5312] ntdll.dll!NtQueryFullAttributesFile + 6 77D14C7A 4 Bytes CALL 76D1607F C:\Windows\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5312] ntdll.dll!NtQueryFullAttributesFile + B 77D14C7F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5312] ntdll.dll!NtSetInformationFile + 6 77D1515A 4 Bytes [28, 01, 14, 00] {SUB [ECX], AL; ADC AL, 0x0}
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5312] ntdll.dll!NtSetInformationFile + B 77D1515F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5312] ntdll.dll!NtSetInformationThread + 6 77D151AA 4 Bytes [28, 02, 14, 00] {SUB [EDX], AL; ADC AL, 0x0}
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5312] ntdll.dll!NtSetInformationThread + B 77D151AF 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5312] ntdll.dll!NtUnmapViewOfSection + 6 77D1544A 1 Byte [68]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5312] ntdll.dll!NtUnmapViewOfSection + 6 77D1544A 4 Bytes [68, 03, 14, 00]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5312] ntdll.dll!NtUnmapViewOfSection + B 77D1544F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5412] CRYPT32.dll!CertDuplicateCRLContext + 5A 75C689ED 7 Bytes JMP 00C3EC90
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5412] CRYPT32.dll!I_CryptFreeLruCache + 1E1 75C6DC4F 7 Bytes JMP 00C3EC70
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5608] ntdll.dll!NtCreateFile + 6 77D1424A 4 Bytes [28, 00, 1C, 00] {SUB [EAX], AL; SBB AL, 0x0}
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5608] ntdll.dll!NtCreateFile + B 77D1424F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5608] ntdll.dll!NtMapViewOfSection + 6 77D1499A 1 Byte [28]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5608] ntdll.dll!NtMapViewOfSection + 6 77D1499A 4 Bytes [28, 03, 1C, 00] {SUB [EBX], AL; SBB AL, 0x0}
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5608] ntdll.dll!NtMapViewOfSection + B 77D1499F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5608] ntdll.dll!NtOpenFile + 6 77D14A2A 4 Bytes [68, 00, 1C, 00]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5608] ntdll.dll!NtOpenFile + B 77D14A2F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5608] ntdll.dll!NtOpenProcess + 6 77D14AAA 4 Bytes [A8, 01, 1C, 00] {TEST AL, 0x1; SBB AL, 0x0}
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5608] ntdll.dll!NtOpenProcess + B 77D14AAF 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5608] ntdll.dll!NtOpenProcessToken + 6 77D14ABA 4 Bytes CALL 76D166C0 C:\Windows\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5608] ntdll.dll!NtOpenProcessToken + B 77D14ABF 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5608] ntdll.dll!NtOpenProcessTokenEx + 6 77D14ACA 4 Bytes [A8, 02, 1C, 00] {TEST AL, 0x2; SBB AL, 0x0}
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5608] ntdll.dll!NtOpenProcessTokenEx + B 77D14ACF 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5608] ntdll.dll!NtOpenThread + 6 77D14B1A 4 Bytes [68, 01, 1C, 00]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5608] ntdll.dll!NtOpenThread + B 77D14B1F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5608] ntdll.dll!NtOpenThreadToken + 6 77D14B2A 4 Bytes [68, 02, 1C, 00]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5608] ntdll.dll!NtOpenThreadToken + B 77D14B2F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5608] ntdll.dll!NtOpenThreadTokenEx + 6 77D14B3A 4 Bytes CALL 76D16741 C:\Windows\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5608] ntdll.dll!NtOpenThreadTokenEx + B 77D14B3F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5608] ntdll.dll!NtQueryAttributesFile + 6 77D14BCA 4 Bytes [A8, 00, 1C, 00] {TEST AL, 0x0; SBB AL, 0x0}
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5608] ntdll.dll!NtQueryAttributesFile + B 77D14BCF 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5608] ntdll.dll!NtQueryFullAttributesFile + 6 77D14C7A 4 Bytes CALL 76D1687F C:\Windows\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5608] ntdll.dll!NtQueryFullAttributesFile + B 77D14C7F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5608] ntdll.dll!NtSetInformationFile + 6 77D1515A 4 Bytes [28, 01, 1C, 00] {SUB [ECX], AL; SBB AL, 0x0}
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5608] ntdll.dll!NtSetInformationFile + B 77D1515F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5608] ntdll.dll!NtSetInformationThread + 6 77D151AA 4 Bytes [28, 02, 1C, 00] {SUB [EDX], AL; SBB AL, 0x0}
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5608] ntdll.dll!NtSetInformationThread + B 77D151AF 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5608] ntdll.dll!NtUnmapViewOfSection + 6 77D1544A 1 Byte [68]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5608] ntdll.dll!NtUnmapViewOfSection + 6 77D1544A 4 Bytes [68, 03, 1C, 00]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[5608] ntdll.dll!NtUnmapViewOfSection + B 77D1544F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6076] ntdll.dll!NtCreateFile + 6 77D1424A 4 Bytes [28, 00, 40, 00]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6076] ntdll.dll!NtCreateFile + B 77D1424F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6076] ntdll.dll!NtMapViewOfSection + 6 77D1499A 1 Byte [28]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6076] ntdll.dll!NtMapViewOfSection + 6 77D1499A 4 Bytes [28, 03, 40, 00]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6076] ntdll.dll!NtMapViewOfSection + B 77D1499F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6076] ntdll.dll!NtOpenFile + 6 77D14A2A 4 Bytes [68, 00, 40, 00]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6076] ntdll.dll!NtOpenFile + B 77D14A2F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6076] ntdll.dll!NtOpenProcess + 6 77D14AAA 4 Bytes [A8, 01, 40, 00]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6076] ntdll.dll!NtOpenProcess + B 77D14AAF 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6076] ntdll.dll!NtOpenProcessToken + 6 77D14ABA 4 Bytes CALL 76D18AC0 C:\Windows\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6076] ntdll.dll!NtOpenProcessToken + B 77D14ABF 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6076] ntdll.dll!NtOpenProcessTokenEx + 6 77D14ACA 4 Bytes [A8, 02, 40, 00]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6076] ntdll.dll!NtOpenProcessTokenEx + B 77D14ACF 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6076] ntdll.dll!NtOpenThread + 6 77D14B1A 4 Bytes [68, 01, 40, 00]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6076] ntdll.dll!NtOpenThread + B 77D14B1F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6076] ntdll.dll!NtOpenThreadToken + 6 77D14B2A 4 Bytes [68, 02, 40, 00]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6076] ntdll.dll!NtOpenThreadToken + B 77D14B2F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6076] ntdll.dll!NtOpenThreadTokenEx + 6 77D14B3A 4 Bytes CALL 76D18B41 C:\Windows\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6076] ntdll.dll!NtOpenThreadTokenEx + B 77D14B3F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6076] ntdll.dll!NtQueryAttributesFile + 6 77D14BCA 4 Bytes [A8, 00, 40, 00]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6076] ntdll.dll!NtQueryAttributesFile + B 77D14BCF 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6076] ntdll.dll!NtQueryFullAttributesFile + 6 77D14C7A 4 Bytes CALL 76D18C7F C:\Windows\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6076] ntdll.dll!NtQueryFullAttributesFile + B 77D14C7F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6076] ntdll.dll!NtSetInformationFile + 6 77D1515A 4 Bytes [28, 01, 40, 00]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6076] ntdll.dll!NtSetInformationFile + B 77D1515F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6076] ntdll.dll!NtSetInformationThread + 6 77D151AA 4 Bytes [28, 02, 40, 00]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6076] ntdll.dll!NtSetInformationThread + B 77D151AF 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6076] ntdll.dll!NtUnmapViewOfSection + 6 77D1544A 1 Byte [68]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6076] ntdll.dll!NtUnmapViewOfSection + 6 77D1544A 4 Bytes [68, 03, 40, 00]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6076] ntdll.dll!NtUnmapViewOfSection + B 77D1544F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6080] ntdll.dll!NtCreateFile + 6 77D1424A 4 Bytes [28, 00, 25, 00]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6080] ntdll.dll!NtCreateFile + B 77D1424F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6080] ntdll.dll!NtMapViewOfSection + 6 77D1499A 1 Byte [28]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6080] ntdll.dll!NtMapViewOfSection + 6 77D1499A 4 Bytes [28, 03, 25, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[6080] ntdll.dll!NtMapViewOfSection + B 77D1499F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6080] ntdll.dll!NtOpenFile + 6 77D14A2A 4 Bytes [68, 00, 25, 00]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6080] ntdll.dll!NtOpenFile + B 77D14A2F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6080] ntdll.dll!NtOpenProcess + 6 77D14AAA 4 Bytes [A8, 01, 25, 00]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6080] ntdll.dll!NtOpenProcess + B 77D14AAF 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6080] ntdll.dll!NtOpenProcessToken + 6 77D14ABA 4 Bytes CALL 76D16FC0 C:\Windows\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6080] ntdll.dll!NtOpenProcessToken + B 77D14ABF 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6080] ntdll.dll!NtOpenProcessTokenEx + 6 77D14ACA 4 Bytes [A8, 02, 25, 00]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6080] ntdll.dll!NtOpenProcessTokenEx + B 77D14ACF 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6080] ntdll.dll!NtOpenThread + 6 77D14B1A 4 Bytes [68, 01, 25, 00]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6080] ntdll.dll!NtOpenThread + B 77D14B1F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6080] ntdll.dll!NtOpenThreadToken + 6 77D14B2A 4 Bytes [68, 02, 25, 00]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6080] ntdll.dll!NtOpenThreadToken + B 77D14B2F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6080] ntdll.dll!NtOpenThreadTokenEx + 6 77D14B3A 4 Bytes CALL 76D17041 C:\Windows\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6080] ntdll.dll!NtOpenThreadTokenEx + B 77D14B3F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6080] ntdll.dll!NtQueryAttributesFile + 6 77D14BCA 4 Bytes [A8, 00, 25, 00]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6080] ntdll.dll!NtQueryAttributesFile + B 77D14BCF 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6080] ntdll.dll!NtQueryFullAttributesFile + 6 77D14C7A 4 Bytes CALL 76D1717F C:\Windows\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation)
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6080] ntdll.dll!NtQueryFullAttributesFile + B 77D14C7F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6080] ntdll.dll!NtSetInformationFile + 6 77D1515A 4 Bytes [28, 01, 25, 00]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6080] ntdll.dll!NtSetInformationFile + B 77D1515F 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6080] ntdll.dll!NtSetInformationThread + 6 77D151AA 4 Bytes [28, 02, 25, 00]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6080] ntdll.dll!NtSetInformationThread + B 77D151AF 1 Byte [E2]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6080] ntdll.dll!NtUnmapViewOfSection + 6 77D1544A 1 Byte [68]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6080] ntdll.dll!NtUnmapViewOfSection + 6 77D1544A 4 Bytes [68, 03, 25, 00]
.text C:\Program Files\Google\Chrome\Application\chrome.exe[6080] ntdll.dll!NtUnmapViewOfSection + B 77D1544F 1 Byte [E2]

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortUchar] [806096D6] \SystemRoot\System32\Drivers\spqy.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUchar] [80609042] \SystemRoot\System32\Drivers\spqy.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortBufferUshort] [80609800] \SystemRoot\System32\Drivers\spqy.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUshort] [806090C0] \SystemRoot\System32\Drivers\spqy.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortBufferUshort] [8060913E] \SystemRoot\System32\Drivers\spqy.sys
IAT \SystemRoot\System32\Drivers\a07k40yf.SYS[ataport.SYS!AtaPortNotification] CC358B04
IAT \SystemRoot\System32\Drivers\a07k40yf.SYS[ataport.SYS!AtaPortWritePortUchar] 838F027F
IAT \SystemRoot\System32\Drivers\a07k40yf.SYS[ataport.SYS!AtaPortWritePortUlong] 458B38C6
IAT \SystemRoot\System32\Drivers\a07k40yf.SYS[ataport.SYS!AtaPortGetPhysicalAddress] A5A5A514
IAT \SystemRoot\System32\Drivers\a07k40yf.SYS[ataport.SYS!AtaPortConvertPhysicalAddressToUlong] 100D8BA5
IAT \SystemRoot\System32\Drivers\a07k40yf.SYS[ataport.SYS!AtaPortGetScatterGatherList] 5F8F0250
IAT \SystemRoot\System32\Drivers\a07k40yf.SYS[ataport.SYS!AtaPortReadPortUchar] 30810889
IAT \SystemRoot\System32\Drivers\a07k40yf.SYS[ataport.SYS!AtaPortStallExecution] 54771129
IAT \SystemRoot\System32\Drivers\a07k40yf.SYS[ataport.SYS!AtaPortGetParentBusType] 10C25D5E
IAT \SystemRoot\System32\Drivers\a07k40yf.SYS[ataport.SYS!AtaPortRequestCallback] 8B55CC00
IAT \SystemRoot\System32\Drivers\a07k40yf.SYS[ataport.SYS!AtaPortWritePortBufferUshort] 084D8BEC
IAT \SystemRoot\System32\Drivers\a07k40yf.SYS[ataport.SYS!AtaPortGetUnCachedExtension] 0CF0918B
IAT \SystemRoot\System32\Drivers\a07k40yf.SYS[ataport.SYS!AtaPortCompleteRequest] 458B0000
IAT \SystemRoot\System32\Drivers\a07k40yf.SYS[ataport.SYS!AtaPortMoveMemory] [8B108910] \SystemRoot\System32\Drivers\Ntfs.sys (NT File System Driver/Microsoft Corporation)
IAT \SystemRoot\System32\Drivers\a07k40yf.SYS[ataport.SYS!AtaPortCompleteAllActiveRequests] 000CF491
IAT \SystemRoot\System32\Drivers\a07k40yf.SYS[ataport.SYS!AtaPortReleaseRequestSenseIrb] 04508900
IAT \SystemRoot\System32\Drivers\a07k40yf.SYS[ataport.SYS!AtaPortBuildRequestSenseIrb] 053C7980
IAT \SystemRoot\System32\Drivers\a07k40yf.SYS[ataport.SYS!AtaPortReadPortUshort] 560C558B
IAT \SystemRoot\System32\Drivers\a07k40yf.SYS[ataport.SYS!AtaPortReadPortBufferUshort] C6127557
IAT \SystemRoot\System32\Drivers\a07k40yf.SYS[ataport.SYS!AtaPortInitialize] B18D0502
IAT \SystemRoot\System32\Drivers\a07k40yf.SYS[ataport.SYS!AtaPortGetDeviceBase] 00000CF8
IAT \SystemRoot\System32\Drivers\a07k40yf.SYS[ataport.SYS!AtaPortDeviceStateChange] A508788D
IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [80618E9C] \SystemRoot\System32\Drivers\spqy.sys

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Windows\Explorer.EXE[524] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [74AB7817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[524] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [74AFB4E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[524] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [74ABBB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[524] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [74AAF695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[524] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [74AB75E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[524] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [74AAE7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[524] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM] [74AE73F5] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[524] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream] [74ABDA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[524] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [74AAFFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[524] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [74AAFF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[524] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [74AA71CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[524] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM] [74B3CAE2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[524] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile] [74ADC8D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[524] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics]

[74AAD968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[524] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [74AA6853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[524] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [74AA687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[524] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [74AB2AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[524] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!CreateThread] [100027E0] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll (Egis Inc. PSD DragDrop Protection/Egis Inc.)
IAT C:\Windows\Explorer.EXE[524] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FreeLibraryAndExitThread] [10001D90] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll (Egis Inc. PSD DragDrop Protection/Egis Inc.)
IAT C:\Windows\Explorer.EXE[524] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [10002B30] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll (Egis Inc. PSD DragDrop Protection/Egis Inc.)
IAT C:\Windows\Explorer.EXE[524] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [100011D0] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll (Egis Inc. PSD DragDrop Protection/Egis Inc.)
IAT C:\Windows\system32\mfevtps.exe[760] @ C:\Windows\system32\CRYPT32.dll [ADVAPI32.dll!RegQueryValueExW] [0132A4D0] C:\Windows\system32\mfevtps.exe (McAfee Process Validation Service/McAfee, Inc.)
IAT C:\Windows\system32\mfevtps.exe[760] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryA] [0132A530] C:\Windows\system32\mfevtps.exe (McAfee Process Validation Service/McAfee, Inc.)
IAT C:\Program Files\Google\Chrome\Application\chrome.exe[1336] @ C:\Windows\system32\RPCRT4.dll [KERNEL32.dll!CreateNamedPipeW] 00010010
IAT C:\Program Files\Google\Chrome\Application\chrome.exe[5312] @ C:\Windows\system32\RPCRT4.dll [KERNEL32.dll!CreateNamedPipeW] 00010010
IAT C:\Program Files\Google\Chrome\Application\chrome.exe[5608] @ C:\Windows\system32\RPCRT4.dll [KERNEL32.dll!CreateNamedPipeW] 00010010
IAT C:\Program Files\Google\Chrome\Application\chrome.exe[6076] @ C:\Windows\system32\RPCRT4.dll [KERNEL32.dll!CreateNamedPipeW] 00010010
IAT C:\Program Files\Google\Chrome\Application\chrome.exe[6080] @ C:\Windows\system32\RPCRT4.dll [KERNEL32.dll!CreateNamedPipeW] 00010010

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs 85F971F8

AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (McAfee Link Driver/McAfee, Inc.)

Device \Driver\netbt \Device\NetBT_Tcpip_{17B0A7E8-76DC-4830-A97E-F19826EFB500} 87DCA500
Device \Driver\volmgr \Device\VolMgrControl 85F921F8
Device \Driver\usbohci \Device\USBPDO-0 86ECD1F8
Device \Driver\usbehci \Device\USBPDO-1 86ED11F8
Device \Driver\usbohci \Device\USBPDO-2 86ECD1F8
Device \Driver\usbehci \Device\USBPDO-3 86ED11F8
Device \Driver\PCI_PNP5526 \Device\00000060 spqy.sys
Device \Driver\sptd \Device\2027709535 spqy.sys

AttachedDevice \Driver\tdx \Device\Tcp mfewfpk.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)

Device \Driver\volmgr \Device\HarddiskVolume1 85F921F8
Device \Driver\volmgr \Device\HarddiskVolume2 85F921F8
Device \Driver\cdrom \Device\CdRom0 861861F8
Device \Driver\atapi \Device\Ide\IdePort0 85F941F8
Device \Driver\atapi \Device\Ide\IdePort1 85F941F8
Device \Driver\atapi \Device\Ide\IdePort2 85F941F8
Device \Driver\atapi \Device\Ide\IdePort3 85F941F8
Device \Driver\atapi \Device\Ide\IdePort4 85F941F8
Device \Driver\atapi \Device\Ide\IdePort5 85F941F8
Device \Driver\atapi \Device\Ide\IdePort6 85F941F8
Device \Driver\atapi \Device\Ide\IdePort7 85F941F8
Device \Driver\atapi \Device\Ide\IdePort8 85F941F8
Device \Driver\msahci \Device\Ide\PciIde1Channel0 85F951F8
Device \Driver\msahci \Device\Ide\PciIde1Channel1 85F951F8
Device \Driver\msahci \Device\Ide\PciIde1Channel2 85F951F8
Device \Driver\msahci \Device\Ide\PciIde1Channel3 85F951F8
Device \Driver\msahci \Device\Ide\PciIde1Channel4 85F951F8
Device \Driver\msahci \Device\Ide\PciIde1Channel5 85F951F8
Device \Driver\atapi \Device\Ide\IdeDeviceP4T0L0-7 85F941F8
Device \Driver\atapi \Device\Ide\IdeDeviceP5T0L0-8 85F941F8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-c 85F941F8
Device \Driver\volmgr \Device\HarddiskVolume3 85F921F8
Device \Driver\cdrom \Device\CdRom1 861861F8
Device \Driver\USBSTOR \Device\00000080 87B141F8
Device \Driver\volmgr \Device\HarddiskVolume4 85F921F8
Device \Driver\cdrom \Device\CdRom2 861861F8
Device \Driver\USBSTOR \Device\00000081 87B141F8
Device \Driver\volmgr \Device\HarddiskVolume5 85F921F8
Device \Driver\cdrom \Device\CdRom3 861861F8
Device \Driver\netbt \Device\NetBt_Wins_Export 87DCA500
Device \Driver\Smb \Device\NetbiosSmb 87E2A1F8
Device \Driver\iScsiPrt \Device\RaidPort0 86F081F8

AttachedDevice \Driver\tdx \Device\Udp mfewfpk.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)

Device \Driver\PCI_PNP5526 \Device\0000005f spqy.sys
Device \Driver\netbt \Device\NetBT_Tcpip_{4A0AD53C-C22A-4659-B72F-E817C3D62778} 87DCA500
Device \Driver\usbohci \Device\USBFDO-0 86ECD1F8
Device \Driver\usbehci \Device\USBFDO-1 86ED11F8
Device \Driver\usbohci \Device\USBFDO-2 86ECD1F8
Device \Driver\usbehci \Device\USBFDO-3 86ED11F8
Device \Driver\USBSTOR \Device\0000007f 87B141F8
Device \Driver\a07k40yf \Device\Scsi\a07k40yf1PortbPath0Target0Lun0 86EA81F8
Device \Driver\a07k40yf \Device\Scsi\a07k40yf1 86EA81F8
Device \FileSystem\cdfs \Cdfs 859141F8

---- Processes - GMER 1.0.15 ----

Process PING.EXE (*** hidden *** ) 6048

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000272b00026
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000272b00026@0022a64c4d7a 0x84 0x4D 0xD9 0x1E ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x38 0x0F 0x98 0x02 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xF1 0x1D 0x03 0x8B ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Pro\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xD8 0xF6 0x15 0x44 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xC7 0x91 0xF6 0x10 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002@hdf12 0x1A 0xF9 0xB9 0x45 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0@hdf12 0xD6 0xB2 0x2A 0x6D ...
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\000272b00026 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\000272b00026@0022a64c4d7a 0x84 0x4D 0xD9 0x1E ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x38 0x0F 0x98 0x02 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xF1 0x1D 0x03 0x8B ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Pro\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xD8 0xF6 0x15 0x44 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xC7 0x91 0xF6 0x10 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002@hdf12 0x1A 0xF9 0xB9 0x45 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0@hdf12 0xD6 0xB2 0x2A 0x6D ...

---- Files - GMER 1.0.15 ----

File C:\Users\Alex\Desktop\Remix Stuff\Degrees Of Motion - Shine On (Remix Stems) (Part 1) [www.acapellas4all.com]\Degrees Of Motion - Shine On (Remix Stems 135 bpm) (Part 2) [www.acapellas4all.com]\Degrees Of Motion - Shine On (Remix Stems 135 bpm) (Part 2) [www.acapellas4all.com]\P0 0 T0.90 1 Organ_01.wav 19218004 bytes
File C:\Users\Alex\Desktop\Remix Stuff\Degrees Of Motion - Shine On (Remix Stems) (Part 1) [www.acapellas4all.com]\Degrees Of Motion - Shine On (Remix Stems 135 bpm) (Part 2) [www.acapellas4all.com]\Degrees Of Motion - Shine On (Remix Stems 135 bpm) (Part 2) [www.acapellas4all.com]\P0 0 T0.90 1 Piano_01 L.wav 47954264 bytes

File C:\Users\Alex\Desktop\Remix Stuff\Degrees Of Motion - Shine On (Remix Stems) (Part 1) [www.acapellas4all.com]\Degrees Of Motion - Shine On (Remix Stems 135 bpm) (Part 2) [www.acapellas4all.com]\Degrees Of Motion - Shine On (Remix Stems 135 bpm) (Part 2) [www.acapellas4all.com]\P0 0 T0.90 1 Piano_01 R.wav 48189044 bytes
File C:\Users\Alex\Desktop\Remix Stuff\Degrees Of Motion - Shine On (Remix Stems) (Part 1) [www.acapellas4all.com]\Degrees Of Motion - Shine On (Remix Stems 135 bpm) (Part 3) [www.acapellas4all.com]\Degrees Of Motion - Shine On (Remix Stems 135 bpm) (Part 3) [www.acapellas4all.com]\P0 0 T0.90 1 Gunther_01.wav 627232 bytes
File C:\Users\Alex\Desktop\Remix Stuff\Degrees Of Motion - Shine On (Remix Stems) (Part 1) [www.acapellas4all.com]\Degrees Of Motion - Shine On (Remix Stems 135 bpm) (Part 3) [www.acapellas4all.com]\Degrees Of Motion - Shine On (Remix Stems 135 bpm) (Part 3) [www.acapellas4all.com]\P0 0 T0.90 1 hey Hey MMMM sample_01.wav 313612 bytes
File C:\Users\Alex\Desktop\Remix Stuff\Degrees Of Motion - Shine On (Remix Stems) (Part 1) [www.acapellas4all.com]\Degrees Of Motion - Shine On (Remix Stems 135 bpm) (Part 3) [www.acapellas4all.com]\Degrees Of Motion - Shine On (Remix Stems 135 bpm) (Part 3) [www.acapellas4all.com]\P0 0 T0.90 1 Juno_01.wav 313748 bytes
File C:\Users\Alex\Desktop\Remix Stuff\Degrees Of Motion - Shine On (Remix Stems) (Part 1) [www.acapellas4all.com]\Degrees Of Motion - Shine On (Remix Stems 135 bpm) (Part 3) [www.acapellas4all.com]\Degrees Of Motion - Shine On (Remix Stems 135 bpm) (Part 3) [www.acapellas4all.com]\P0 0 T0.90 1 Kit Git Wid it Sample_01.wav 1254184 bytes
File C:\Users\Alex\Desktop\Remix Stuff\Degrees Of Motion - Shine On (Remix Stems) (Part 1) [www.acapellas4all.com]\Degrees Of Motion - Shine On (Remix Stems 135 bpm) (Part 3) [www.acapellas4all.com]\Degrees Of Motion - Shine On (Remix Stems 135 bpm) (Part 3) [www.acapellas4all.com]\P0 0 T0.90 1 Kit West_01.wav 2890796 bytes
File C:\Users\Alex\Desktop\Remix Stuff\Degrees Of Motion - Shine On (Remix Stems) (Part 1) [www.acapellas4all.com]\Degrees Of Motion - Shine On (Remix Stems 135 bpm) (Part 3) [www.acapellas4all.com]\Degrees Of Motion - Shine On (Remix Stems 135 bpm) (Part 3) [www.acapellas4all.com]\P0 0 T0.90 1 Let It Shine Sample Loop_01.wav 627268 bytes
File C:\Users\Alex\Desktop\Remix Stuff\Degrees Of Motion - Shine On (Remix Stems) (Part 1) [www.acapellas4all.com]\Degrees Of Motion - Shine On (Remix Stems 135 bpm) (Part 3) [www.acapellas4all.com]\Degrees Of Motion - Shine On (Remix Stems 135 bpm) (Part 3) [www.acapellas4all.com]\P0 0 T0.90 1 Loop Bass_01.wav 629632 bytes
File C:\Users\Alex\Desktop\Remix Stuff\Degrees Of Motion - Shine On (Remix Stems) (Part 1) [www.acapellas4all.com]\Degrees Of Motion - Shine On (Remix Stems 135 bpm) (Part 3) [www.acapellas4all.com]\Degrees Of Motion - Shine On (Remix Stems 135 bpm) (Part 3) [www.acapellas4all.com]\P0 0 T0.90 1 LV Comp_01.wav 28105324 bytes
File C:\Users\Alex\Desktop\Remix Stuff\Degrees Of Motion - Shine On (Remix Stems) (Part 1) [www.acapellas4all.com]\Degrees Of Motion - Shine On (Remix Stems 135 bpm) (Part 3) [www.acapellas4all.com]\Degrees Of Motion - Shine On (Remix Stems 135 bpm) (Part 3) [www.acapellas4all.com]\P0 0 T0.90 1 Pads_01 L.wav 49435844 bytes
File C:\Users\Alex\Desktop\Remix Stuff\Degrees Of Motion - Shine On (Remix Stems) (Part 1) [www.acapellas4all.com]\Degrees Of Motion - Shine On (Remix Stems 135 bpm) (Part 3) [www.acapellas4all.com]\Degrees Of Motion - Shine On (Remix Stems 135 bpm) (Part 3) [www.acapellas4all.com]\P0 0 T0.90 1 Pads_01 R.wav 49436016 bytes
File C:\Users\Alex\Desktop\Remix Stuff\Degrees Of Motion - Shine On (Remix Stems) (Part 1) [www.acapellas4all.com]\Degrees Of Motion - Shine On (Remix Stems 135 bpm) (Part 4) [www.acapellas4all.com]\Degrees Of Motion - Shine On (Remix Stems 135 bpm) (Part 4) [www.acapellas4all.com]\P0 0 T0.90 1 BGV_01 L.wav 8794280 bytes
File C:\Users\Alex\Desktop\Remix Stuff\Degrees Of Motion - Shine On (Remix Stems) (Part 1) [www.acapellas4all.com]\Degrees Of Motion - Shine On (Remix Stems 135 bpm) (Part 4) [www.acapellas4all.com]\Degrees Of Motion - Shine On (Remix Stems 135 bpm) (Part 4) [www.acapellas4all.com]\P0 0 T0.90 1 BGV_01 R.wav 8885072 bytes
File C:\Users\Alex\Desktop\Remix Stuff\Degrees Of Motion - Shine On (Remix Stems) (Part 1) [www.acapellas4all.com]\Degrees Of Motion - Shine On (Remix Stems 135 bpm) (Part 4) [www.acapellas4all.com]\Degrees Of Motion - Shine On (Remix Stems 135 bpm) (Part 4) [www.acapellas4all.com]\P0 0 T0.90 1 Duo Q&A_01.wav 16500624 bytes
File C:\Users\Alex\Desktop\Remix Stuff\Degrees Of Motion - Shine On (Remix Stems) (Part 1) [www.acapellas4all.com]\Degrees Of Motion - Shine On (Remix Stems 135 bpm) (Part 4) [www.acapellas4all.com]\Degrees Of Motion - Shine On (Remix Stems 135 bpm) (Part 4) [www.acapellas4all.com]\P0 0 T0.90 1 Outro Loop Chorus BGV_01 L.wav 14251124 bytes
File C:\Users\Alex\Desktop\Remix Stuff\Degrees Of Motion - Shine On (Remix Stems) (Part 1) [www.acapellas4all.com]\Degrees Of Motion - Shine On (Remix Stems 135 bpm) (Part 4) [www.acapellas4all.com]\Degrees Of Motion - Shine On (Remix Stems 135 bpm) (Part 4) [www.acapellas4all.com]\P0 0 T0.90 1 Outro Loop Chorus BGV_01 R.wav 15378260 bytes
File C:\Users\Alex\Desktop\Remix Stuff\Degrees Of Motion - Shine On (Remix Stems) (Part 1) [www.acapellas4all.com]\Degrees Of Motion - Shine On (Remix Stems 135 bpm) (Part 4) [www.acapellas4all.com]\Degrees Of Motion - Shine On (Remix Stems 135 bpm) (Part 4) [www.acapellas4all.com]\P0 0 T0.90 1 Reg Strings_01.wav 47088732 bytes
File C:\Windows\$NtUninstallKB20339$\2328075041 0 bytes
File C:\Windows\$NtUninstallKB20339$\2402992201 0 bytes
File C:\Windows\$NtUninstallKB20339$\2402992201\@ 2048 bytes
File C:\Windows\$NtUninstallKB20339$\2402992201\Desktop.ini 4608 bytes
File C:\Windows\$NtUninstallKB20339$\2402992201\L 0 bytes
File C:\Windows\$NtUninstallKB20339$\2402992201\L\00000004.@ 740 bytes
File C:\Windows\$NtUninstallKB20339$\2402992201\L\1afb2d56 118 bytes
File C:\Windows\$NtUninstallKB20339$\2402992201\L\201d3dde 310 bytes
File C:\Windows\$NtUninstallKB20339$\2402992201\L\qnbwvoto 66560 bytes
File C:\Windows\$NtUninstallKB20339$\2402992201\U 0 bytes
File C:\Windows\$NtUninstallKB20339$\2402992201\U\00000004.@ 1536 bytes
File C:\Windows\$NtUninstallKB20339$\2402992201\U\00000008.@ 232960 bytes
File C:\Windows\$NtUninstallKB20339$\2402992201\U\000000cb.@ 1584 bytes
File C:\Windows\$NtUninstallKB20339$\2402992201\U\80000000.@ 12288 bytes
File C:\Windows\$NtUninstallKB20339$\2402992201\U\80000032.@ 93696 bytes

---- EOF - GMER 1.0.15 ----

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-06-08 15:31:56
-----------------------------
15:31:56.932 OS Version: Windows 6.0.6002 Service Pack 2
15:31:56.932 Number of processors: 3 586 0x203
15:31:56.936 ComputerName: LESLEY UserName: Alex
15:31:59.264 Initialize success
15:32:32.320 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP4T0L0-7
15:32:32.325 Disk 0 Vendor: Hitachi_HDT721032SLA380 ST2OA31B Size: 305245MB BusType: 3
15:32:32.623 Disk 0 MBR read successfully
15:32:32.628 Disk 0 MBR scan
15:32:32.633 Disk 0 Windows VISTA default MBR code
15:32:32.771 Disk 0 Partition 1 00 27 Hidden NTFS WinRE NTFS 14336 MB offset 2048
15:32:32.945 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 145453 MB offset 29362176
15:32:33.073 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 145454 MB offset 327249920
15:32:33.893 Disk 0 scanning sectors +625139712
15:32:34.633 Disk 0 scanning C:\Windows\system32\drivers
15:33:07.127 File: C:\Windows\system32\drivers\smb.sys **SUSPICIOUS**
15:33:12.277 Disk 0 trace - called modules:
15:33:12.289 ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x87d9b698]<<
15:33:12.289 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86259620]
15:33:12.291 3 CLASSPNP.SYS[8b19f8b3] -> nt!IofCallDriver -> [0x87d6d140]
15:33:12.292 \Driver\00001277[0x883faae8] -> IRP_MJ_CREATE -> 0x87d9b698
15:33:12.292 Scan finished successfully
15:47:18.328 Disk 0 MBR has been saved successfully to "C:\Users\Alex\Desktop\MBR.dat"
15:47:18.342 The log file has been saved successfully to "C:\Users\Alex\Desktop\aswMBR.txt"

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.19222 BrowserJavaVersion: 1.6.0_29
Run by Alex at 15:52:19 on 2012-06-08
Microsoft&#174; Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.3070.1334 [GMT 1:00]
.
AV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\ATKFUSService.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\atieclxx.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Program Files\ASUS\GamerOSD\ATKFastUserSwitching.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
C:\Windows\System32\ASDR.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork
c:\PROGRA~1\mcafee\SITEAD~1\mcsacore.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\mfevtps.exe
C:\Program Files\Nero\Update\NASvc.exe
C:\Windows\system32\rundll32.exe
C:\Program Files\Secunia\PSI\PSIA.exe
C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe
C:\Program Files\O2 Assistant\bin\sprtsvc.exe
C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\O2 Assistant\bin\tgsrvc.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\svchost.exe -k bthaudiosvc
C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Secunia\PSI\sua.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Windows\system32\rundll32.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
c:\PROGRA~1\mcafee\SITEAD~1\saui.exe
C:\Program Files\Common Files\McAfee\Core\mchost.exe
C:\Program Files\DAEMON Tools Pro\DTProShellHlp.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uSearch Bar = Preserve
uStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=1&o=vp32&d=1009&m=aspire_x1300
uDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=1&o=vp32&d=1009&m=aspire_x1300
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=1&o=vp32&d=1009&m=aspire_x1300
mSearchAssistant = hxxp://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=bc2f4454000000000000001f16f0d136&tlver=1.4.19.19&affID=17160
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {27B4851A-3207-45A2-B947-BE8AFE6163AB} - No File
BHO: DivX Plus Web Player HTML5 <video>: {326e768d-4182-46fd-9c16-1449a49795f4} - c:\program files\divx\divx plus web player\ie\divxhtml5\DivXHTML5.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\common files\mcafee\systemcore\ScriptSn.20120607130930.dll
BHO: ShowBarObj Class: {83a2f9b1-01a2-4aa5-87d1-45b6b8505e96} - c:\program files\acer\empowering technology\edatasecurity\x86\ActiveToolBand.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: {99079a25-328f-4bd4-be04-00955acaa0a7} - No File
BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - c:\program files\windows live\companion\companioncore.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - No File
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: Acer eDataSecurity Management: {5cbe3b7c-1e47-477e-a7dd-396db0476e29} - c:\program files\acer\empowering technology\edatasecurity\x86\eDStoolbar.dll
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
TB: {99079a25-328f-4bd4-be04-00955acaa0a7} - No File
TB: !{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - No File
uRun: [AdobeBridge]
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\ipoint.exe"
mRun: [mcui_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: EnableLinkedConnections = 1 (0x1)
IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - c:\program files\pokerstars\PokerStarsUpdate.exe
IE: {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - c:\program files\bodog poker\BPGame.exe
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - c:\program files\windows live\companion\companioncore.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
LSP: mswsock.dll
TCP: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{4A0AD53C-C22A-4659-B72F-E817C3D62778} : DhcpNameServer = 192.168.1.254
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\progra~1\mcafee\msc\McSnIePl.dll
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
AppInit_DLLs: c:\progra~1\google\google~1\GoogleDesktopNetwork3.dll
.
============= SERVICES / DRIVERS ===============
.
R0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2010-11-9 464304]
R1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\drivers\mfenlfk.sys [2010-11-9 64912]
R1 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [2010-11-9 169608]
R1 RtlProt;Realtke RtlProt WLAN Utility Protocol Driver;c:\windows\system32\drivers\RtlProt.sys [2009-10-10 15360]
R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-12-6 163328]
R2 AMD FUEL Service;AMD FUEL Service;c:\program files\ati technologies\ati.ace\fuel\Fuel.Service.exe [2011-12-5 291840]
R2 AODDriver4.01;AODDriver4.01;c:\program files\ati technologies\ati.ace\fuel\i386\aoddriver2.sys [2011-6-24 39424]
R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-21 21504]
R2 HFGService;Handsfree Headset Service;c:\windows\system32\svchost.exe -k bthaudiosvc [2008-1-21 21504]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-2-6 654408]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~1\mcafee\sitead~1\mcsacore.exe [2010-2-27 95200]
R2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\common files\mcafee\mcsvchost\McSvHost.exe [2010-11-9 214904]
R2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\common files\mcafee\mcsvchost\McSvHost.exe [2010-11-9 214904]
R2 McProxy;McAfee Proxy Service;c:\program files\common files\mcafee\mcsvchost\McSvHost.exe [2010-11-9 214904]
R2 McShield;McAfee McShield;c:\program files\common files\mcafee\systemcore\mcshield.exe [2010-11-9 166288]
R2 mfefire;McAfee Firewall Core Service;c:\program files\common files\mcafee\systemcore\mfefire.exe [2010-11-9 161632]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [2010-11-9 151880]
R2 NAUpdate;Nero Update;c:\program files\nero\update\NASvc.exe [2010-3-25 490280]
R2 Secunia PSI Agent;Secunia PSI Agent;c:\program files\secunia\psi\psia.exe [2011-1-10 993848]
R2 Secunia Update Agent;Secunia Update Agent;c:\program files\secunia\psi\sua.exe [2011-1-10 399416]
R2 sprtsvc_O2DA;SupportSoft Sprocket Service (O2DA);c:\program files\o2 assistant\bin\sprtsvc.exe [2010-4-23 206120]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\nvidia corporation\3d vision\nvSCPAPISvr.exe [2010-3-16 240232]
R2 tgsrvc_O2DA;SupportSoft Repair Service (O2DA);c:\program files\o2 assistant\bin\tgsrvc.exe [2010-4-23 185640]
R3 amdiox86;AMD IO Driver;c:\windows\system32\drivers\amdiox86.sys [2011-6-29 37944]
R3 amdkmdag;amdkmdag;c:\windows\system32\drivers\atikmdag.sys [2011-12-6 9067008]
R3 amdkmdap;amdkmdap;c:\windows\system32\drivers\atikmpag.sys [2011-12-6 264192]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdLH3.sys [2011-5-29 100368]
R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2010-11-9 57600]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-2-6 22344]
R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2010-11-9 180848]
R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2010-11-9 340920]
R3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2010-9-1 15544]
R3 RTL8187;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8187.sys [2008-6-27 335872]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-8-4 135664]
S3 BthAudioHF;BthAudioHF Service;c:\windows\system32\drivers\BthAudioHF.sys [2010-2-5 48024]
S3 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr.sys [2011-8-31 39272]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2011-5-13 1492840]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [2011-3-5 36608]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-8-4 135664]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\2.0.181\McCHSvc.exe [2010-1-15 227232]
S3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2010-11-9 59456]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2010-11-9 87656]
S3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\drivers\ss_bbus.sys [2011-3-5 90112]
S3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\drivers\ss_bmdfl.sys [2011-3-5 14976]
S3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\drivers\ss_bmdm.sys [2011-3-5 121856]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
S4 ETService;Empowering Technology Service;c:\program files\acer\empowering technology\service\ETService.exe [2009-1-9 24576]
S4 GoogleDesktopManager-092308-165331;Google Desktop Manager 5.8.809.23506;c:\program files\google\google desktop search\GoogleDesktop.exe [2009-1-9 30192]
S4 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\newtech infosystems\nti backup now 5\BackupSvc.exe [2008-9-23 50424]
S4 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\newtech infosystems\nti backup now 5\SchedulerSvc.exe [2008-9-23 144632]
S4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\windows live\mesh\wlcrasvc.exe [2010-9-22 51040]
.
=============== Created Last 30 ================
.
2012-06-04 06:26:37 -------- d-----w- c:\users\alex\appdata\local\Ilivid Player
2012-06-04 06:25:39 -------- d-----w- c:\program files\iLivid
2012-05-29 18:24:15 -------- d-----w- c:\program files\SEGA
2012-05-22 11:50:56 -------- d-----w- c:\users\alex\D-Fend Reloaded
2012-05-22 11:50:54 -------- d-----w- c:\program files\D-Fend Reloaded
2012-05-10 14:40:35 -------- d-----w- c:\program files\CarbonPoker
.
==================== Find3M ====================
.
2012-04-06 10:27:06 338432 ----a-w- c:\windows\system32\REX Shared Library.dll
2012-04-06 10:27:05 406528 ----a-w- c:\windows\system32\ReWire.dll
2012-04-04 14:56:40 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-04-03 08:16:12 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-04-03 08:16:11 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-04-02 13:36:21 2044928 ----a-w- c:\windows\system32\win32k.sys
2012-03-30 12:39:11 905600 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-03-20 23:28:50 53120 ----a-w- c:\windows\system32\drivers\partmgr.sys
2012-03-20 12:11:32 151880 ----a-w- c:\windows\system32\mfevtps.exe
.
============= FINISH: 15:53:40.53 ===============