Komputer domowy, korzysta kilka osób i nie patrzą co instalują.
Zapewne dużo "dodatków" do programów i pewnie jakieś wirusy.
Proszę o sprawdzenie logów, bo ostatnio komputer ostro przymulił...
GMER:
- Kod: Zaznacz wszystko
GMER 2.1.19357 - http://www.gmer.net
Rootkit scan 2014-02-02 13:11:53
Windows 6.1.7600 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST3160815AS rev.3.AAC 149,05GB
Running: gmer.exe; Driver: C:\Users\DOMOWY\AppData\Local\Temp\pxrdafow.sys
---- User code sections - GMER 2.1 ----
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076eef760 5 bytes JMP 000000014a260460
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076eef7b0 5 bytes JMP 000000014a260450
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076eef910 5 bytes JMP 000000014a260370
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076eef960 5 bytes JMP 000000014a260470
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076eef970 5 bytes JMP 000000014a2603e0
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076eefa20 5 bytes JMP 000000014a260320
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076eefa50 5 bytes JMP 000000014a2603b0
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076eefa70 5 bytes JMP 000000014a260390
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076eefab0 5 bytes JMP 000000014a2602e0
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076eefb30 5 bytes JMP 000000014a2602d0
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076eefb50 5 bytes JMP 000000014a260310
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076eefb90 5 bytes JMP 000000014a2603c0
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076eefbe0 5 bytes JMP 000000014a2603f0
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076eefd40 5 bytes JMP 000000014a260230
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076eeff00 5 bytes JMP 000000014a260480
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076eeff30 5 bytes JMP 000000014a2603a0
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef0010 5 bytes JMP 000000014a2602f0
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef0020 5 bytes JMP 000000014a260350
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef0080 5 bytes JMP 000000014a260290
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef0110 5 bytes JMP 000000014a2602b0
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef0130 5 bytes JMP 000000014a2603d0
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef0140 5 bytes JMP 000000014a260330
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef01b0 5 bytes JMP 000000014a260410
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef01e0 5 bytes JMP 000000014a260240
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef04a0 5 bytes JMP 000000014a2601e0
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef0560 5 bytes JMP 000000014a260250
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef0590 5 bytes JMP 000000014a260490
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef05a0 5 bytes JMP 000000014a2604a0
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef05d0 5 bytes JMP 000000014a260300
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef05e0 5 bytes JMP 000000014a260360
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef0640 5 bytes JMP 000000014a2602a0
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef0690 5 bytes JMP 000000014a2602c0
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef06c0 5 bytes JMP 000000014a260380
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef06d0 5 bytes JMP 000000014a260340
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef09c0 5 bytes JMP 000000014a260440
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef0bc0 5 bytes JMP 000000014a260260
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef0bd0 5 bytes JMP 000000014a260270
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef0be0 5 bytes JMP 000000014a260400
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef0da0 5 bytes JMP 000000014a2601f0
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef0db0 5 bytes JMP 000000014a260210
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef0e20 5 bytes JMP 000000014a260200
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef0e80 5 bytes JMP 000000014a260420
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef0e90 5 bytes JMP 000000014a260430
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef0ea0 5 bytes JMP 000000014a260220
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef0f80 5 bytes JMP 000000014a260280
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076eef760 5 bytes JMP 0000000077050460
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076eef7b0 5 bytes JMP 0000000077050450
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076eef910 5 bytes JMP 0000000077050370
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076eef960 5 bytes JMP 0000000077050470
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076eef970 5 bytes JMP 00000000770503e0
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076eefa20 5 bytes JMP 0000000077050320
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076eefa50 5 bytes JMP 00000000770503b0
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076eefa70 5 bytes JMP 0000000077050390
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076eefab0 5 bytes JMP 00000000770502e0
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076eefb30 5 bytes JMP 00000000770502d0
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076eefb50 5 bytes JMP 0000000077050310
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076eefb90 5 bytes JMP 00000000770503c0
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076eefbe0 5 bytes JMP 00000000770503f0
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076eefd40 5 bytes JMP 0000000077050230
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076eeff00 5 bytes JMP 0000000077050480
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076eeff30 5 bytes JMP 00000000770503a0
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef0010 5 bytes JMP 00000000770502f0
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef0020 5 bytes JMP 0000000077050350
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef0080 5 bytes JMP 0000000077050290
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef0110 5 bytes JMP 00000000770502b0
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef0130 5 bytes JMP 00000000770503d0
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef0140 5 bytes JMP 0000000077050330
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef01b0 5 bytes JMP 0000000077050410
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef01e0 5 bytes JMP 0000000077050240
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef04a0 5 bytes JMP 00000000770501e0
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef0560 5 bytes JMP 0000000077050250
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef0590 5 bytes JMP 0000000077050490
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef05a0 5 bytes JMP 00000000770504a0
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef05d0 5 bytes JMP 0000000077050300
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef05e0 5 bytes JMP 0000000077050360
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef0640 5 bytes JMP 00000000770502a0
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef0690 5 bytes JMP 00000000770502c0
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef06c0 5 bytes JMP 0000000077050380
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef06d0 5 bytes JMP 0000000077050340
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef09c0 5 bytes JMP 0000000077050440
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef0bc0 5 bytes JMP 0000000077050260
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef0bd0 5 bytes JMP 0000000077050270
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef0be0 5 bytes JMP 0000000077050400
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef0da0 5 bytes JMP 00000000770501f0
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef0db0 5 bytes JMP 0000000077050210
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef0e20 5 bytes JMP 0000000077050200
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef0e80 5 bytes JMP 0000000077050420
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef0e90 5 bytes JMP 0000000077050430
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef0ea0 5 bytes JMP 0000000077050220
.text C:\Windows\system32\wininit.exe[492] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef0f80 5 bytes JMP 0000000077050280
.text C:\Windows\system32\wininit.exe[492] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cdf25d 1 byte [62]
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076eef760 5 bytes JMP 0000000100120460
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076eef7b0 5 bytes JMP 0000000100120450
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076eef910 5 bytes JMP 0000000100120370
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076eef960 5 bytes JMP 0000000100120470
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076eef970 5 bytes JMP 00000001001203e0
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076eefa20 5 bytes JMP 0000000100120320
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076eefa50 5 bytes JMP 00000001001203b0
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076eefa70 5 bytes JMP 0000000100120390
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076eefab0 5 bytes JMP 00000001001202e0
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076eefb30 5 bytes JMP 00000001001202d0
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076eefb50 5 bytes JMP 0000000100120310
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076eefb90 5 bytes JMP 00000001001203c0
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076eefbe0 5 bytes JMP 00000001001203f0
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076eefd40 5 bytes JMP 0000000100120230
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076eeff00 5 bytes JMP 0000000100120480
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076eeff30 5 bytes JMP 00000001001203a0
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef0010 5 bytes JMP 00000001001202f0
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef0020 5 bytes JMP 0000000100120350
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef0080 5 bytes JMP 0000000100120290
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef0110 5 bytes JMP 00000001001202b0
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef0130 5 bytes JMP 00000001001203d0
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef0140 5 bytes JMP 0000000100120330
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef01b0 5 bytes JMP 0000000100120410
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef01e0 5 bytes JMP 0000000100120240
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef04a0 5 bytes JMP 00000001001201e0
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef0560 5 bytes JMP 0000000100120250
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef0590 5 bytes JMP 0000000100120490
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef05a0 5 bytes JMP 00000001001204a0
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef05d0 5 bytes JMP 0000000100120300
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef05e0 5 bytes JMP 0000000100120360
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef0640 5 bytes JMP 00000001001202a0
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef0690 5 bytes JMP 00000001001202c0
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef06c0 5 bytes JMP 0000000100120380
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef06d0 5 bytes JMP 0000000100120340
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef09c0 5 bytes JMP 0000000100120440
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef0bc0 5 bytes JMP 0000000100120260
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef0bd0 5 bytes JMP 0000000100120270
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef0be0 5 bytes JMP 0000000100120400
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef0da0 5 bytes JMP 00000001001201f0
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef0db0 5 bytes JMP 0000000100120210
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef0e20 5 bytes JMP 0000000100120200
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef0e80 5 bytes JMP 0000000100120420
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef0e90 5 bytes JMP 0000000100120430
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef0ea0 5 bytes JMP 0000000100120220
.text C:\Windows\system32\csrss.exe[504] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef0f80 5 bytes JMP 0000000100120280
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076eef760 5 bytes JMP 0000000100070460
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076eef7b0 5 bytes JMP 0000000100070450
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076eef910 5 bytes JMP 0000000100070370
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076eef960 5 bytes JMP 0000000100070470
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076eef970 5 bytes JMP 00000001000703e0
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076eefa20 5 bytes JMP 0000000100070320
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076eefa50 5 bytes JMP 00000001000703b0
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076eefa70 5 bytes JMP 0000000100070390
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076eefab0 5 bytes JMP 00000001000702e0
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076eefb30 5 bytes JMP 00000001000702d0
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076eefb50 5 bytes JMP 0000000100070310
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076eefb90 5 bytes JMP 00000001000703c0
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076eefbe0 5 bytes JMP 00000001000703f0
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076eefd40 5 bytes JMP 0000000100070230
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076eeff00 5 bytes JMP 0000000100070480
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076eeff30 5 bytes JMP 00000001000703a0
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef0010 5 bytes JMP 00000001000702f0
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef0020 5 bytes JMP 0000000100070350
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef0080 5 bytes JMP 0000000100070290
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef0110 5 bytes JMP 00000001000702b0
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef0130 5 bytes JMP 00000001000703d0
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef0140 5 bytes JMP 0000000100070330
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef01b0 5 bytes JMP 0000000100070410
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef01e0 5 bytes JMP 0000000100070240
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef04a0 5 bytes JMP 00000001000701e0
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef0560 5 bytes JMP 0000000100070250
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef0590 5 bytes JMP 0000000100070490
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef05a0 5 bytes JMP 00000001000704a0
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef05d0 5 bytes JMP 0000000100070300
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef05e0 5 bytes JMP 0000000100070360
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef0640 5 bytes JMP 00000001000702a0
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef0690 5 bytes JMP 00000001000702c0
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef06c0 5 bytes JMP 0000000100070380
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef06d0 5 bytes JMP 0000000100070340
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef09c0 5 bytes JMP 0000000100070440
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef0bc0 5 bytes JMP 0000000100070260
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef0bd0 5 bytes JMP 0000000100070270
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef0be0 5 bytes JMP 0000000100070400
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef0da0 5 bytes JMP 00000001000701f0
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef0db0 5 bytes JMP 0000000100070210
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef0e20 5 bytes JMP 0000000100070200
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef0e80 5 bytes JMP 0000000100070420
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef0e90 5 bytes JMP 0000000100070430
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef0ea0 5 bytes JMP 0000000100070220
.text C:\Windows\system32\services.exe[540] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef0f80 5 bytes JMP 0000000100070280
.text C:\Windows\system32\services.exe[540] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cdf25d 1 byte [62]
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076eef760 5 bytes JMP 0000000077050460
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076eef7b0 5 bytes JMP 0000000077050450
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076eef910 5 bytes JMP 0000000077050370
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076eef960 5 bytes JMP 0000000077050470
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076eef970 5 bytes JMP 00000000770503e0
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076eefa20 5 bytes JMP 0000000077050320
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076eefa50 5 bytes JMP 00000000770503b0
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076eefa70 5 bytes JMP 0000000077050390
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076eefab0 5 bytes JMP 00000000770502e0
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076eefb30 5 bytes JMP 00000000770502d0
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076eefb50 5 bytes JMP 0000000077050310
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076eefb90 5 bytes JMP 00000000770503c0
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076eefbe0 5 bytes JMP 00000000770503f0
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076eefd40 5 bytes JMP 0000000077050230
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076eeff00 5 bytes JMP 0000000077050480
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076eeff30 5 bytes JMP 00000000770503a0
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef0010 5 bytes JMP 00000000770502f0
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef0020 5 bytes JMP 0000000077050350
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef0080 5 bytes JMP 0000000077050290
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef0110 5 bytes JMP 00000000770502b0
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef0130 5 bytes JMP 00000000770503d0
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef0140 5 bytes JMP 0000000077050330
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef01b0 5 bytes JMP 0000000077050410
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef01e0 5 bytes JMP 0000000077050240
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef04a0 5 bytes JMP 00000000770501e0
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef0560 5 bytes JMP 0000000077050250
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef0590 5 bytes JMP 0000000077050490
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef05a0 5 bytes JMP 00000000770504a0
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef05d0 5 bytes JMP 0000000077050300
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef05e0 5 bytes JMP 0000000077050360
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef0640 5 bytes JMP 00000000770502a0
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef0690 5 bytes JMP 00000000770502c0
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef06c0 5 bytes JMP 0000000077050380
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef06d0 5 bytes JMP 0000000077050340
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef09c0 5 bytes JMP 0000000077050440
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef0bc0 5 bytes JMP 0000000077050260
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef0bd0 5 bytes JMP 0000000077050270
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef0be0 5 bytes JMP 0000000077050400
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef0da0 5 bytes JMP 00000000770501f0
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef0db0 5 bytes JMP 0000000077050210
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef0e20 5 bytes JMP 0000000077050200
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef0e80 5 bytes JMP 0000000077050420
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef0e90 5 bytes JMP 0000000077050430
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef0ea0 5 bytes JMP 0000000077050220
.text C:\Windows\system32\lsass.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef0f80 5 bytes JMP 0000000077050280
.text C:\Windows\system32\lsass.exe[556] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cdf25d 1 byte [62]
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076eef760 5 bytes JMP 0000000077050460
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076eef7b0 5 bytes JMP 0000000077050450
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076eef910 5 bytes JMP 0000000077050370
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076eef960 5 bytes JMP 0000000077050470
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076eef970 5 bytes JMP 00000000770503e0
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076eefa20 5 bytes JMP 0000000077050320
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076eefa50 5 bytes JMP 00000000770503b0
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076eefa70 5 bytes JMP 0000000077050390
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076eefab0 5 bytes JMP 00000000770502e0
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076eefb30 5 bytes JMP 00000000770502d0
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076eefb50 5 bytes JMP 0000000077050310
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076eefb90 5 bytes JMP 00000000770503c0
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076eefbe0 5 bytes JMP 00000000770503f0
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076eefd40 5 bytes JMP 0000000077050230
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076eeff00 5 bytes JMP 0000000077050480
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076eeff30 5 bytes JMP 00000000770503a0
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef0010 5 bytes JMP 00000000770502f0
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef0020 5 bytes JMP 0000000077050350
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef0080 5 bytes JMP 0000000077050290
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef0110 5 bytes JMP 00000000770502b0
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef0130 5 bytes JMP 00000000770503d0
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef0140 5 bytes JMP 0000000077050330
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef01b0 5 bytes JMP 0000000077050410
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef01e0 5 bytes JMP 0000000077050240
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef04a0 5 bytes JMP 00000000770501e0
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef0560 5 bytes JMP 0000000077050250
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef0590 5 bytes JMP 0000000077050490
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef05a0 5 bytes JMP 00000000770504a0
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef05d0 5 bytes JMP 0000000077050300
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef05e0 5 bytes JMP 0000000077050360
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef0640 5 bytes JMP 00000000770502a0
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef0690 5 bytes JMP 00000000770502c0
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef06c0 5 bytes JMP 0000000077050380
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef06d0 5 bytes JMP 0000000077050340
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef09c0 5 bytes JMP 0000000077050440
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef0bc0 5 bytes JMP 0000000077050260
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef0bd0 5 bytes JMP 0000000077050270
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef0be0 5 bytes JMP 0000000077050400
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef0da0 5 bytes JMP 00000000770501f0
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef0db0 5 bytes JMP 0000000077050210
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef0e20 5 bytes JMP 0000000077050200
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef0e80 5 bytes JMP 0000000077050420
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef0e90 5 bytes JMP 0000000077050430
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef0ea0 5 bytes JMP 0000000077050220
.text C:\Windows\system32\lsm.exe[564] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef0f80 5 bytes JMP 0000000077050280
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076eef760 5 bytes JMP 0000000077050460
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076eef7b0 5 bytes JMP 0000000077050450
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076eef910 5 bytes JMP 0000000077050370
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076eef960 5 bytes JMP 0000000077050470
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076eef970 5 bytes JMP 00000000770503e0
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076eefa20 5 bytes JMP 0000000077050320
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076eefa50 5 bytes JMP 00000000770503b0
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076eefa70 5 bytes JMP 0000000077050390
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076eefab0 5 bytes JMP 00000000770502e0
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076eefb30 5 bytes JMP 00000000770502d0
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076eefb50 5 bytes JMP 0000000077050310
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076eefb90 5 bytes JMP 00000000770503c0
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076eefbe0 5 bytes JMP 00000000770503f0
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076eefd40 5 bytes JMP 0000000077050230
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076eeff00 5 bytes JMP 0000000077050480
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076eeff30 5 bytes JMP 00000000770503a0
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef0010 5 bytes JMP 00000000770502f0
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef0020 5 bytes JMP 0000000077050350
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef0080 5 bytes JMP 0000000077050290
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef0110 5 bytes JMP 00000000770502b0
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef0130 5 bytes JMP 00000000770503d0
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef0140 5 bytes JMP 0000000077050330
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef01b0 5 bytes JMP 0000000077050410
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef01e0 5 bytes JMP 0000000077050240
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef04a0 5 bytes JMP 00000000770501e0
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef0560 5 bytes JMP 0000000077050250
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef0590 5 bytes JMP 0000000077050490
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef05a0 5 bytes JMP 00000000770504a0
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef05d0 5 bytes JMP 0000000077050300
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef05e0 5 bytes JMP 0000000077050360
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef0640 5 bytes JMP 00000000770502a0
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef0690 5 bytes JMP 00000000770502c0
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef06c0 5 bytes JMP 0000000077050380
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef06d0 5 bytes JMP 0000000077050340
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef09c0 5 bytes JMP 0000000077050440
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef0bc0 5 bytes JMP 0000000077050260
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef0bd0 5 bytes JMP 0000000077050270
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef0be0 5 bytes JMP 0000000077050400
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef0da0 5 bytes JMP 00000000770501f0
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef0db0 5 bytes JMP 0000000077050210
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef0e20 5 bytes JMP 0000000077050200
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef0e80 5 bytes JMP 0000000077050420
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef0e90 5 bytes JMP 0000000077050430
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef0ea0 5 bytes JMP 0000000077050220
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef0f80 5 bytes JMP 0000000077050280
.text C:\Windows\system32\winlogon.exe[628] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cdf25d 1 byte [62]
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076eef760 5 bytes JMP 0000000077050460
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076eef7b0 5 bytes JMP 0000000077050450
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076eef910 5 bytes JMP 0000000077050370
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076eef960 5 bytes JMP 0000000077050470
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076eef970 5 bytes JMP 00000000770503e0
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076eefa20 5 bytes JMP 0000000077050320
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076eefa50 5 bytes JMP 00000000770503b0
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076eefa70 5 bytes JMP 0000000077050390
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076eefab0 5 bytes JMP 00000000770502e0
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076eefb30 5 bytes JMP 00000000770502d0
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076eefb50 5 bytes JMP 0000000077050310
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076eefb90 5 bytes JMP 00000000770503c0
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076eefbe0 5 bytes JMP 00000000770503f0
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076eefd40 5 bytes JMP 0000000077050230
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076eeff00 5 bytes JMP 0000000077050480
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076eeff30 5 bytes JMP 00000000770503a0
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef0010 5 bytes JMP 00000000770502f0
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef0020 5 bytes JMP 0000000077050350
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef0080 5 bytes JMP 0000000077050290
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef0110 5 bytes JMP 00000000770502b0
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef0130 5 bytes JMP 00000000770503d0
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef0140 5 bytes JMP 0000000077050330
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef01b0 5 bytes JMP 0000000077050410
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef01e0 5 bytes JMP 0000000077050240
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef04a0 5 bytes JMP 00000000770501e0
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef0560 5 bytes JMP 0000000077050250
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef0590 5 bytes JMP 0000000077050490
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef05a0 5 bytes JMP 00000000770504a0
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef05d0 5 bytes JMP 0000000077050300
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef05e0 5 bytes JMP 0000000077050360
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef0640 5 bytes JMP 00000000770502a0
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef0690 5 bytes JMP 00000000770502c0
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef06c0 5 bytes JMP 0000000077050380
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef06d0 5 bytes JMP 0000000077050340
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef09c0 5 bytes JMP 0000000077050440
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef0bc0 5 bytes JMP 0000000077050260
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef0bd0 5 bytes JMP 0000000077050270
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef0be0 5 bytes JMP 0000000077050400
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef0da0 5 bytes JMP 00000000770501f0
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef0db0 5 bytes JMP 0000000077050210
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef0e20 5 bytes JMP 0000000077050200
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef0e80 5 bytes JMP 0000000077050420
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef0e90 5 bytes JMP 0000000077050430
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef0ea0 5 bytes JMP 0000000077050220
.text C:\Windows\system32\svchost.exe[716] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef0f80 5 bytes JMP 0000000077050280
.text C:\Windows\system32\svchost.exe[716] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cdf25d 1 byte [62]
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076eef760 5 bytes JMP 0000000077050460
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076eef7b0 5 bytes JMP 0000000077050450
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076eef910 5 bytes JMP 0000000077050370
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076eef960 5 bytes JMP 0000000077050470
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076eef970 5 bytes JMP 00000000770503e0
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076eefa20 5 bytes JMP 0000000077050320
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076eefa50 5 bytes JMP 00000000770503b0
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076eefa70 5 bytes JMP 0000000077050390
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076eefab0 5 bytes JMP 00000000770502e0
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076eefb30 5 bytes JMP 00000000770502d0
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076eefb50 5 bytes JMP 0000000077050310
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076eefb90 5 bytes JMP 00000000770503c0
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076eefbe0 5 bytes JMP 00000000770503f0
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076eefd40 5 bytes JMP 0000000077050230
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076eeff00 5 bytes JMP 0000000077050480
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076eeff30 5 bytes JMP 00000000770503a0
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef0010 5 bytes JMP 00000000770502f0
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef0020 5 bytes JMP 0000000077050350
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef0080 5 bytes JMP 0000000077050290
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef0110 5 bytes JMP 00000000770502b0
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef0130 5 bytes JMP 00000000770503d0
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef0140 5 bytes JMP 0000000077050330
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef01b0 5 bytes JMP 0000000077050410
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef01e0 5 bytes JMP 0000000077050240
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef04a0 5 bytes JMP 00000000770501e0
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef0560 5 bytes JMP 0000000077050250
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef0590 5 bytes JMP 0000000077050490
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef05a0 5 bytes JMP 00000000770504a0
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef05d0 5 bytes JMP 0000000077050300
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef05e0 5 bytes JMP 0000000077050360
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef0640 5 bytes JMP 00000000770502a0
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef0690 5 bytes JMP 00000000770502c0
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef06c0 5 bytes JMP 0000000077050380
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef06d0 5 bytes JMP 0000000077050340
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef09c0 5 bytes JMP 0000000077050440
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef0bc0 5 bytes JMP 0000000077050260
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef0bd0 5 bytes JMP 0000000077050270
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef0be0 5 bytes JMP 0000000077050400
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef0da0 5 bytes JMP 00000000770501f0
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef0db0 5 bytes JMP 0000000077050210
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef0e20 5 bytes JMP 0000000077050200
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef0e80 5 bytes JMP 0000000077050420
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef0e90 5 bytes JMP 0000000077050430
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef0ea0 5 bytes JMP 0000000077050220
.text C:\Windows\system32\svchost.exe[816] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef0f80 5 bytes JMP 0000000077050280
.text C:\Windows\system32\svchost.exe[816] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cdf25d 1 byte [62]
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076eef760 5 bytes JMP 0000000077050460
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076eef7b0 5 bytes JMP 0000000077050450
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076eef910 5 bytes JMP 0000000077050370
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076eef960 5 bytes JMP 0000000077050470
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076eef970 5 bytes JMP 00000000770503e0
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076eefa20 5 bytes JMP 0000000077050320
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076eefa50 5 bytes JMP 00000000770503b0
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076eefa70 5 bytes JMP 0000000077050390
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076eefab0 5 bytes JMP 00000000770502e0
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076eefb30 5 bytes JMP 00000000770502d0
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076eefb50 5 bytes JMP 0000000077050310
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076eefb90 5 bytes JMP 00000000770503c0
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076eefbe0 5 bytes JMP 00000000770503f0
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076eefd40 5 bytes JMP 0000000077050230
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076eeff00 5 bytes JMP 0000000077050480
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076eeff30 5 bytes JMP 00000000770503a0
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef0010 5 bytes JMP 00000000770502f0
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef0020 5 bytes JMP 0000000077050350
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef0080 5 bytes JMP 0000000077050290
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef0110 5 bytes JMP 00000000770502b0
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef0130 5 bytes JMP 00000000770503d0
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef0140 5 bytes JMP 0000000077050330
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef01b0 5 bytes JMP 0000000077050410
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef01e0 5 bytes JMP 0000000077050240
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef04a0 5 bytes JMP 00000000770501e0
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef0560 5 bytes JMP 0000000077050250
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef0590 5 bytes JMP 0000000077050490
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef05a0 5 bytes JMP 00000000770504a0
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef05d0 5 bytes JMP 0000000077050300
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef05e0 5 bytes JMP 0000000077050360
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef0640 5 bytes JMP 00000000770502a0
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef0690 5 bytes JMP 00000000770502c0
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef06c0 5 bytes JMP 0000000077050380
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef06d0 5 bytes JMP 0000000077050340
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef09c0 5 bytes JMP 0000000077050440
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef0bc0 5 bytes JMP 0000000077050260
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef0bd0 5 bytes JMP 0000000077050270
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef0be0 5 bytes JMP 0000000077050400
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef0da0 5 bytes JMP 00000000770501f0
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef0db0 5 bytes JMP 0000000077050210
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef0e20 5 bytes JMP 0000000077050200
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef0e80 5 bytes JMP 0000000077050420
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef0e90 5 bytes JMP 0000000077050430
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef0ea0 5 bytes JMP 0000000077050220
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef0f80 5 bytes JMP 0000000077050280
.text C:\Windows\system32\atiesrxx.exe[880] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cdf25d 1 byte [62]
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076eef760 5 bytes JMP 0000000100070460
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076eef7b0 5 bytes JMP 0000000100070450
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076eef910 5 bytes JMP 0000000100070370
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076eef960 5 bytes JMP 0000000100070470
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076eef970 5 bytes JMP 00000001000703e0
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076eefa20 5 bytes JMP 0000000100070320
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076eefa50 5 bytes JMP 00000001000703b0
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076eefa70 5 bytes JMP 0000000100070390
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076eefab0 5 bytes JMP 00000001000702e0
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076eefb30 5 bytes JMP 00000001000702d0
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076eefb50 5 bytes JMP 0000000100070310
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076eefb90 5 bytes JMP 00000001000703c0
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076eefbe0 5 bytes JMP 00000001000703f0
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076eefd40 5 bytes JMP 0000000100070230
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076eeff00 5 bytes JMP 0000000100070480
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076eeff30 5 bytes JMP 00000001000703a0
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef0010 5 bytes JMP 00000001000702f0
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef0020 5 bytes JMP 0000000100070350
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef0080 5 bytes JMP 0000000100070290
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef0110 5 bytes JMP 00000001000702b0
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef0130 5 bytes JMP 00000001000703d0
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef0140 5 bytes JMP 0000000100070330
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef01b0 5 bytes JMP 0000000100070410
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef01e0 5 bytes JMP 0000000100070240
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef04a0 5 bytes JMP 00000001000701e0
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef0560 5 bytes JMP 0000000100070250
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef0590 5 bytes JMP 0000000100070490
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef05a0 5 bytes JMP 00000001000704a0
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef05d0 5 bytes JMP 0000000100070300
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef05e0 5 bytes JMP 0000000100070360
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef0640 5 bytes JMP 00000001000702a0
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef0690 5 bytes JMP 00000001000702c0
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef06c0 5 bytes JMP 0000000100070380
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef06d0 5 bytes JMP 0000000100070340
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef09c0 5 bytes JMP 0000000100070440
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef0bc0 5 bytes JMP 0000000100070260
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef0bd0 5 bytes JMP 0000000100070270
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef0be0 5 bytes JMP 0000000100070400
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef0da0 5 bytes JMP 00000001000701f0
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef0db0 5 bytes JMP 0000000100070210
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef0e20 5 bytes JMP 0000000100070200
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef0e80 5 bytes JMP 0000000100070420
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef0e90 5 bytes JMP 0000000100070430
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef0ea0 5 bytes JMP 0000000100070220
.text C:\Windows\System32\svchost.exe[944] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef0f80 5 bytes JMP 0000000100070280
.text C:\Windows\System32\svchost.exe[944] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cdf25d 1 byte [62]
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076eef760 5 bytes JMP 0000000077050460
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076eef7b0 5 bytes JMP 0000000077050450
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076eef910 5 bytes JMP 0000000077050370
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076eef960 5 bytes JMP 0000000077050470
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076eef970 5 bytes JMP 00000000770503e0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076eefa20 5 bytes JMP 0000000077050320
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076eefa50 5 bytes JMP 00000000770503b0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076eefa70 5 bytes JMP 0000000077050390
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076eefab0 5 bytes JMP 00000000770502e0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076eefb30 5 bytes JMP 00000000770502d0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076eefb50 5 bytes JMP 0000000077050310
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076eefb90 5 bytes JMP 00000000770503c0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076eefbe0 5 bytes JMP 00000000770503f0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076eefd40 5 bytes JMP 0000000077050230
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076eeff00 5 bytes JMP 0000000077050480
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076eeff30 5 bytes JMP 00000000770503a0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef0010 5 bytes JMP 00000000770502f0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef0020 5 bytes JMP 0000000077050350
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef0080 5 bytes JMP 0000000077050290
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef0110 5 bytes JMP 00000000770502b0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef0130 5 bytes JMP 00000000770503d0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef0140 5 bytes JMP 0000000077050330
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef01b0 5 bytes JMP 0000000077050410
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef01e0 5 bytes JMP 0000000077050240
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef04a0 5 bytes JMP 00000000770501e0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef0560 5 bytes JMP 0000000077050250
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef0590 5 bytes JMP 0000000077050490
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef05a0 5 bytes JMP 00000000770504a0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef05d0 5 bytes JMP 0000000077050300
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef05e0 5 bytes JMP 0000000077050360
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef0640 5 bytes JMP 00000000770502a0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef0690 5 bytes JMP 00000000770502c0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef06c0 5 bytes JMP 0000000077050380
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef06d0 5 bytes JMP 0000000077050340
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef09c0 5 bytes JMP 0000000077050440
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef0bc0 5 bytes JMP 0000000077050260
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef0bd0 5 bytes JMP 0000000077050270
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef0be0 5 bytes JMP 0000000077050400
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef0da0 5 bytes JMP 00000000770501f0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef0db0 5 bytes JMP 0000000077050210
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef0e20 5 bytes JMP 0000000077050200
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef0e80 5 bytes JMP 0000000077050420
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef0e90 5 bytes JMP 0000000077050430
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef0ea0 5 bytes JMP 0000000077050220
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef0f80 5 bytes JMP 0000000077050280
.text C:\Windows\System32\svchost.exe[984] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cdf25d 1 byte [62]
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076eef760 5 bytes JMP 0000000077050460
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076eef7b0 5 bytes JMP 0000000077050450
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076eef910 5 bytes JMP 0000000077050370
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076eef960 5 bytes JMP 0000000077050470
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076eef970 5 bytes JMP 00000000770503e0
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076eefa20 5 bytes JMP 0000000077050320
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076eefa50 5 bytes JMP 00000000770503b0
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076eefa70 5 bytes JMP 0000000077050390
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076eefab0 5 bytes JMP 00000000770502e0
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076eefb30 5 bytes JMP 00000000770502d0
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076eefb50 5 bytes JMP 0000000077050310
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076eefb90 5 bytes JMP 00000000770503c0
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076eefbe0 5 bytes JMP 00000000770503f0
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076eefd40 5 bytes JMP 0000000077050230
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076eeff00 5 bytes JMP 0000000077050480
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076eeff30 5 bytes JMP 00000000770503a0
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef0010 5 bytes JMP 00000000770502f0
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef0020 5 bytes JMP 0000000077050350
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef0080 5 bytes JMP 0000000077050290
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef0110 5 bytes JMP 00000000770502b0
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef0130 5 bytes JMP 00000000770503d0
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef0140 5 bytes JMP 0000000077050330
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef01b0 5 bytes JMP 0000000077050410
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef01e0 5 bytes JMP 0000000077050240
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef04a0 5 bytes JMP 00000000770501e0
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef0560 5 bytes JMP 0000000077050250
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef0590 5 bytes JMP 0000000077050490
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef05a0 5 bytes JMP 00000000770504a0
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef05d0 5 bytes JMP 0000000077050300
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef05e0 5 bytes JMP 0000000077050360
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef0640 5 bytes JMP 00000000770502a0
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef0690 5 bytes JMP 00000000770502c0
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef06c0 5 bytes JMP 0000000077050380
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef06d0 5 bytes JMP 0000000077050340
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef09c0 5 bytes JMP 0000000077050440
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef0bc0 5 bytes JMP 0000000077050260
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef0bd0 5 bytes JMP 0000000077050270
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef0be0 5 bytes JMP 0000000077050400
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef0da0 5 bytes JMP 00000000770501f0
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef0db0 5 bytes JMP 0000000077050210
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef0e20 5 bytes JMP 0000000077050200
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef0e80 5 bytes JMP 0000000077050420
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef0e90 5 bytes JMP 0000000077050430
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef0ea0 5 bytes JMP 0000000077050220
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef0f80 5 bytes JMP 0000000077050280
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cdf25d 1 byte [62]
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076eef760 5 bytes JMP 0000000077050460
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076eef7b0 5 bytes JMP 0000000077050450
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076eef910 5 bytes JMP 0000000077050370
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076eef960 5 bytes JMP 0000000077050470
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076eef970 5 bytes JMP 00000000770503e0
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076eefa20 5 bytes JMP 0000000077050320
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076eefa50 5 bytes JMP 00000000770503b0
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076eefa70 5 bytes JMP 0000000077050390
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076eefab0 5 bytes JMP 00000000770502e0
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076eefb30 5 bytes JMP 00000000770502d0
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076eefb50 5 bytes JMP 0000000077050310
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076eefb90 5 bytes JMP 00000000770503c0
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076eefbe0 5 bytes JMP 00000000770503f0
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076eefd40 5 bytes JMP 0000000077050230
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076eeff00 5 bytes JMP 0000000077050480
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076eeff30 5 bytes JMP 00000000770503a0
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef0010 5 bytes JMP 00000000770502f0
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef0020 5 bytes JMP 0000000077050350
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef0080 5 bytes JMP 0000000077050290
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef0110 5 bytes JMP 00000000770502b0
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef0130 5 bytes JMP 00000000770503d0
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef0140 5 bytes JMP 0000000077050330
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef01b0 5 bytes JMP 0000000077050410
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef01e0 5 bytes JMP 0000000077050240
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef04a0 5 bytes JMP 00000000770501e0
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef0560 5 bytes JMP 0000000077050250
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef0590 5 bytes JMP 0000000077050490
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef05a0 5 bytes JMP 00000000770504a0
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef05d0 5 bytes JMP 0000000077050300
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef05e0 5 bytes JMP 0000000077050360
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef0640 5 bytes JMP 00000000770502a0
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef0690 5 bytes JMP 00000000770502c0
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef06c0 5 bytes JMP 0000000077050380
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef06d0 5 bytes JMP 0000000077050340
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef09c0 5 bytes JMP 0000000077050440
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef0bc0 5 bytes JMP 0000000077050260
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef0bd0 5 bytes JMP 0000000077050270
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef0be0 5 bytes JMP 0000000077050400
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef0da0 5 bytes JMP 00000000770501f0
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef0db0 5 bytes JMP 0000000077050210
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef0e20 5 bytes JMP 0000000077050200
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef0e80 5 bytes JMP 0000000077050420
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef0e90 5 bytes JMP 0000000077050430
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef0ea0 5 bytes JMP 0000000077050220
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef0f80 5 bytes JMP 0000000077050280
.text C:\Windows\system32\AUDIODG.EXE[416] C:\Windows\System32\kernel32.dll!GetBinaryTypeW + 189 0000000076cdf25d 1 byte [62]
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076eef760 5 bytes JMP 0000000077050460
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076eef7b0 5 bytes JMP 0000000077050450
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076eef910 5 bytes JMP 0000000077050370
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076eef960 5 bytes JMP 0000000077050470
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076eef970 5 bytes JMP 00000000770503e0
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076eefa20 5 bytes JMP 0000000077050320
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076eefa50 5 bytes JMP 00000000770503b0
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076eefa70 5 bytes JMP 0000000077050390
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076eefab0 5 bytes JMP 00000000770502e0
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076eefb30 5 bytes JMP 00000000770502d0
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076eefb50 5 bytes JMP 0000000077050310
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076eefb90 5 bytes JMP 00000000770503c0
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076eefbe0 5 bytes JMP 00000000770503f0
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076eefd40 5 bytes JMP 0000000077050230
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076eeff00 5 bytes JMP 0000000077050480
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076eeff30 5 bytes JMP 00000000770503a0
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef0010 5 bytes JMP 00000000770502f0
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef0020 5 bytes JMP 0000000077050350
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef0080 5 bytes JMP 0000000077050290
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef0110 5 bytes JMP 00000000770502b0
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef0130 5 bytes JMP 00000000770503d0
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef0140 5 bytes JMP 0000000077050330
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef01b0 5 bytes JMP 0000000077050410
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef01e0 5 bytes JMP 0000000077050240
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef04a0 5 bytes JMP 00000000770501e0
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef0560 5 bytes JMP 0000000077050250
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef0590 5 bytes JMP 0000000077050490
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef05a0 5 bytes JMP 00000000770504a0
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef05d0 5 bytes JMP 0000000077050300
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef05e0 5 bytes JMP 0000000077050360
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef0640 5 bytes JMP 00000000770502a0
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef0690 5 bytes JMP 00000000770502c0
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef06c0 5 bytes JMP 0000000077050380
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef06d0 5 bytes JMP 0000000077050340
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef09c0 5 bytes JMP 0000000077050440
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef0bc0 5 bytes JMP 0000000077050260
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef0bd0 5 bytes JMP 0000000077050270
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef0be0 5 bytes JMP 0000000077050400
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef0da0 5 bytes JMP 00000000770501f0
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef0db0 5 bytes JMP 0000000077050210
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef0e20 5 bytes JMP 0000000077050200
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef0e80 5 bytes JMP 0000000077050420
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef0e90 5 bytes JMP 0000000077050430
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef0ea0 5 bytes JMP 0000000077050220
.text C:\Windows\system32\svchost.exe[424] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef0f80 5 bytes JMP 0000000077050280
.text C:\Windows\system32\svchost.exe[424] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cdf25d 1 byte [62]
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076eef760 5 bytes JMP 0000000077050460
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076eef7b0 5 bytes JMP 0000000077050450
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076eef910 5 bytes JMP 0000000077050370
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076eef960 5 bytes JMP 0000000077050470
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076eef970 5 bytes JMP 00000000770503e0
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076eefa20 5 bytes JMP 0000000077050320
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076eefa50 5 bytes JMP 00000000770503b0
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076eefa70 5 bytes JMP 0000000077050390
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076eefab0 5 bytes JMP 00000000770502e0
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076eefb30 5 bytes JMP 00000000770502d0
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076eefb50 5 bytes JMP 0000000077050310
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076eefb90 5 bytes JMP 00000000770503c0
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076eefbe0 5 bytes JMP 00000000770503f0
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076eefd40 5 bytes JMP 0000000077050230
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076eeff00 5 bytes JMP 0000000077050480
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076eeff30 5 bytes JMP 00000000770503a0
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef0010 5 bytes JMP 00000000770502f0
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef0020 5 bytes JMP 0000000077050350
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef0080 5 bytes JMP 0000000077050290
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef0110 5 bytes JMP 00000000770502b0
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef0130 5 bytes JMP 00000000770503d0
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef0140 5 bytes JMP 0000000077050330
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef01b0 5 bytes JMP 0000000077050410
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef01e0 5 bytes JMP 0000000077050240
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef04a0 5 bytes JMP 00000000770501e0
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef0560 5 bytes JMP 0000000077050250
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef0590 5 bytes JMP 0000000077050490
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef05a0 5 bytes JMP 00000000770504a0
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef05d0 5 bytes JMP 0000000077050300
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef05e0 5 bytes JMP 0000000077050360
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef0640 5 bytes JMP 00000000770502a0
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef0690 5 bytes JMP 00000000770502c0
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef06c0 5 bytes JMP 0000000077050380
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef06d0 5 bytes JMP 0000000077050340
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef09c0 5 bytes JMP 0000000077050440
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef0bc0 5 bytes JMP 0000000077050260
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef0bd0 5 bytes JMP 0000000077050270
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef0be0 5 bytes JMP 0000000077050400
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef0da0 5 bytes JMP 00000000770501f0
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef0db0 5 bytes JMP 0000000077050210
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef0e20 5 bytes JMP 0000000077050200
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef0e80 5 bytes JMP 0000000077050420
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef0e90 5 bytes JMP 0000000077050430
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef0ea0 5 bytes JMP 0000000077050220
.text C:\Windows\system32\atieclxx.exe[1120] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef0f80 5 bytes JMP 0000000077050280
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076eef760 5 bytes JMP 0000000077050460
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076eef7b0 5 bytes JMP 0000000077050450
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076eef910 5 bytes JMP 0000000077050370
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076eef960 5 bytes JMP 0000000077050470
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076eef970 5 bytes JMP 00000000770503e0
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076eefa20 5 bytes JMP 0000000077050320
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076eefa50 5 bytes JMP 00000000770503b0
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076eefa70 5 bytes JMP 0000000077050390
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076eefab0 5 bytes JMP 00000000770502e0
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076eefb30 5 bytes JMP 00000000770502d0
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076eefb50 5 bytes JMP 0000000077050310
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076eefb90 5 bytes JMP 00000000770503c0
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076eefbe0 5 bytes JMP 00000000770503f0
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076eefd40 5 bytes JMP 0000000077050230
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076eeff00 5 bytes JMP 0000000077050480
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076eeff30 5 bytes JMP 00000000770503a0
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef0010 5 bytes JMP 00000000770502f0
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef0020 5 bytes JMP 0000000077050350
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef0080 5 bytes JMP 0000000077050290
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef0110 5 bytes JMP 00000000770502b0
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef0130 5 bytes JMP 00000000770503d0
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef0140 5 bytes JMP 0000000077050330
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef01b0 5 bytes JMP 0000000077050410
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef01e0 5 bytes JMP 0000000077050240
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef04a0 5 bytes JMP 00000000770501e0
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef0560 5 bytes JMP 0000000077050250
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef0590 5 bytes JMP 0000000077050490
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef05a0 5 bytes JMP 00000000770504a0
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef05d0 5 bytes JMP 0000000077050300
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef05e0 5 bytes JMP 0000000077050360
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef0640 5 bytes JMP 00000000770502a0
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef0690 5 bytes JMP 00000000770502c0
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef06c0 5 bytes JMP 0000000077050380
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef06d0 5 bytes JMP 0000000077050340
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef09c0 5 bytes JMP 0000000077050440
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef0bc0 5 bytes JMP 0000000077050260
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef0bd0 5 bytes JMP 0000000077050270
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef0be0 5 bytes JMP 0000000077050400
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef0da0 5 bytes JMP 00000000770501f0
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef0db0 5 bytes JMP 0000000077050210
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef0e20 5 bytes JMP 0000000077050200
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef0e80 5 bytes JMP 0000000077050420
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef0e90 5 bytes JMP 0000000077050430
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef0ea0 5 bytes JMP 0000000077050220
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef0f80 5 bytes JMP 0000000077050280
.text C:\Windows\system32\svchost.exe[1220] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cdf25d 1 byte [62]
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076eef760 5 bytes JMP 0000000077050460
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076eef7b0 5 bytes JMP 0000000077050450
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076eef910 5 bytes JMP 0000000077050370
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076eef960 5 bytes JMP 0000000077050470
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076eef970 5 bytes JMP 00000000770503e0
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076eefa20 5 bytes JMP 0000000077050320
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076eefa50 5 bytes JMP 00000000770503b0
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076eefa70 5 bytes JMP 0000000077050390
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076eefab0 5 bytes JMP 00000000770502e0
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076eefb30 5 bytes JMP 00000000770502d0
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076eefb50 5 bytes JMP 0000000077050310
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076eefb90 5 bytes JMP 00000000770503c0
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076eefbe0 5 bytes JMP 00000000770503f0
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076eefd40 5 bytes JMP 0000000077050230
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076eeff00 5 bytes JMP 0000000077050480
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076eeff30 5 bytes JMP 00000000770503a0
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef0010 5 bytes JMP 00000000770502f0
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef0020 5 bytes JMP 0000000077050350
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef0080 5 bytes JMP 0000000077050290
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef0110 5 bytes JMP 00000000770502b0
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef0130 5 bytes JMP 00000000770503d0
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef0140 5 bytes JMP 0000000077050330
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef01b0 5 bytes JMP 0000000077050410
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef01e0 5 bytes JMP 0000000077050240
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef04a0 5 bytes JMP 00000000770501e0
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef0560 5 bytes JMP 0000000077050250
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef0590 5 bytes JMP 0000000077050490
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef05a0 5 bytes JMP 00000000770504a0
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef05d0 5 bytes JMP 0000000077050300
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef05e0 5 bytes JMP 0000000077050360
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef0640 5 bytes JMP 00000000770502a0
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef0690 5 bytes JMP 00000000770502c0
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef06c0 5 bytes JMP 0000000077050380
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef06d0 5 bytes JMP 0000000077050340
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef09c0 5 bytes JMP 0000000077050440
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef0bc0 5 bytes JMP 0000000077050260
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef0bd0 5 bytes JMP 0000000077050270
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef0be0 5 bytes JMP 0000000077050400
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef0da0 5 bytes JMP 00000000770501f0
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef0db0 5 bytes JMP 0000000077050210
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef0e20 5 bytes JMP 0000000077050200
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef0e80 5 bytes JMP 0000000077050420
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef0e90 5 bytes JMP 0000000077050430
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef0ea0 5 bytes JMP 0000000077050220
.text C:\Windows\system32\Dwm.exe[1476] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef0f80 5 bytes JMP 0000000077050280
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076eef760 5 bytes JMP 0000000077050460
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076eef7b0 5 bytes JMP 0000000077050450
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076eef910 5 bytes JMP 0000000077050370
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076eef960 5 bytes JMP 0000000077050470
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076eef970 5 bytes JMP 00000000770503e0
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076eefa20 5 bytes JMP 0000000077050320
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076eefa50 5 bytes JMP 00000000770503b0
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076eefa70 5 bytes JMP 0000000077050390
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076eefab0 5 bytes JMP 00000000770502e0
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076eefb30 5 bytes JMP 00000000770502d0
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076eefb50 5 bytes JMP 0000000077050310
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076eefb90 5 bytes JMP 00000000770503c0
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076eefbe0 5 bytes JMP 00000000770503f0
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076eefd40 5 bytes JMP 0000000077050230
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076eeff00 5 bytes JMP 0000000077050480
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076eeff30 5 bytes JMP 00000000770503a0
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef0010 5 bytes JMP 00000000770502f0
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef0020 5 bytes JMP 0000000077050350
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef0080 5 bytes JMP 0000000077050290
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef0110 5 bytes JMP 00000000770502b0
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef0130 5 bytes JMP 00000000770503d0
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef0140 5 bytes JMP 0000000077050330
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef01b0 5 bytes JMP 0000000077050410
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef01e0 5 bytes JMP 0000000077050240
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef04a0 5 bytes JMP 00000000770501e0
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef0560 5 bytes JMP 0000000077050250
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef0590 5 bytes JMP 0000000077050490
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef05a0 5 bytes JMP 00000000770504a0
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef05d0 5 bytes JMP 0000000077050300
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef05e0 5 bytes JMP 0000000077050360
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef0640 5 bytes JMP 00000000770502a0
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef0690 5 bytes JMP 00000000770502c0
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef06c0 5 bytes JMP 0000000077050380
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef06d0 5 bytes JMP 0000000077050340
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef09c0 5 bytes JMP 0000000077050440
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef0bc0 5 bytes JMP 0000000077050260
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef0bd0 5 bytes JMP 0000000077050270
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef0be0 5 bytes JMP 0000000077050400
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef0da0 5 bytes JMP 00000000770501f0
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef0db0 5 bytes JMP 0000000077050210
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef0e20 5 bytes JMP 0000000077050200
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef0e80 5 bytes JMP 0000000077050420
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef0e90 5 bytes JMP 0000000077050430
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef0ea0 5 bytes JMP 0000000077050220
.text C:\Windows\Explorer.EXE[1484] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef0f80 5 bytes JMP 0000000077050280
.text C:\Windows\Explorer.EXE[1484] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cdf25d 1 byte [62]
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076eef760 5 bytes JMP 0000000100060460
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076eef7b0 5 bytes JMP 0000000100060450
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076eef910 5 bytes JMP 0000000100060370
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076eef960 5 bytes JMP 0000000100060470
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076eef970 5 bytes JMP 00000001000603e0
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076eefa20 5 bytes JMP 0000000100060320
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076eefa50 5 bytes JMP 00000001000603b0
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076eefa70 5 bytes JMP 0000000100060390
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076eefab0 5 bytes JMP 00000001000602e0
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076eefb30 5 bytes JMP 00000001000602d0
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076eefb50 5 bytes JMP 0000000100060310
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076eefb90 5 bytes JMP 00000001000603c0
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076eefbe0 5 bytes JMP 00000001000603f0
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076eefd40 5 bytes JMP 0000000100060230
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076eeff00 5 bytes JMP 0000000100060480
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076eeff30 5 bytes JMP 00000001000603a0
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef0010 5 bytes JMP 00000001000602f0
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef0020 5 bytes JMP 0000000100060350
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef0080 5 bytes JMP 0000000100060290
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef0110 5 bytes JMP 00000001000602b0
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef0130 5 bytes JMP 00000001000603d0
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef0140 5 bytes JMP 0000000100060330
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef01b0 5 bytes JMP 0000000100060410
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef01e0 5 bytes JMP 0000000100060240
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef04a0 5 bytes JMP 00000001000601e0
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef0560 5 bytes JMP 0000000100060250
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef0590 5 bytes JMP 0000000100060490
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef05a0 5 bytes JMP 00000001000604a0
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef05d0 5 bytes JMP 0000000100060300
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef05e0 5 bytes JMP 0000000100060360
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef0640 5 bytes JMP 00000001000602a0
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef0690 5 bytes JMP 00000001000602c0
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef06c0 5 bytes JMP 0000000100060380
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef06d0 5 bytes JMP 0000000100060340
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef09c0 5 bytes JMP 0000000100060440
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef0bc0 5 bytes JMP 0000000100060260
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef0bd0 5 bytes JMP 0000000100060270
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef0be0 5 bytes JMP 0000000100060400
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef0da0 5 bytes JMP 00000001000601f0
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef0db0 5 bytes JMP 0000000100060210
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef0e20 5 bytes JMP 0000000100060200
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef0e80 5 bytes JMP 0000000100060420
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef0e90 5 bytes JMP 0000000100060430
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef0ea0 5 bytes JMP 0000000100060220
.text C:\Windows\system32\taskhost.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef0f80 5 bytes JMP 0000000100060280
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076eef760 5 bytes JMP 0000000077050460
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076eef7b0 5 bytes JMP 0000000077050450
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076eef910 5 bytes JMP 0000000077050370
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076eef960 5 bytes JMP 0000000077050470
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076eef970 5 bytes JMP 00000000770503e0
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076eefa20 5 bytes JMP 0000000077050320
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076eefa50 5 bytes JMP 00000000770503b0
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076eefa70 5 bytes JMP 0000000077050390
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076eefab0 5 bytes JMP 00000000770502e0
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076eefb30 5 bytes JMP 00000000770502d0
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076eefb50 5 bytes JMP 0000000077050310
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076eefb90 5 bytes JMP 00000000770503c0
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076eefbe0 5 bytes JMP 00000000770503f0
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076eefd40 5 bytes JMP 0000000077050230
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076eeff00 5 bytes JMP 0000000077050480
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076eeff30 5 bytes JMP 00000000770503a0
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef0010 5 bytes JMP 00000000770502f0
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef0020 5 bytes JMP 0000000077050350
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef0080 5 bytes JMP 0000000077050290
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef0110 5 bytes JMP 00000000770502b0
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef0130 5 bytes JMP 00000000770503d0
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef0140 5 bytes JMP 0000000077050330
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef01b0 5 bytes JMP 0000000077050410
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef01e0 5 bytes JMP 0000000077050240
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef04a0 5 bytes JMP 00000000770501e0
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef0560 5 bytes JMP 0000000077050250
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef0590 5 bytes JMP 0000000077050490
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef05a0 5 bytes JMP 00000000770504a0
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef05d0 5 bytes JMP 0000000077050300
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef05e0 5 bytes JMP 0000000077050360
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef0640 5 bytes JMP 00000000770502a0
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef0690 5 bytes JMP 00000000770502c0
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef06c0 5 bytes JMP 0000000077050380
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef06d0 5 bytes JMP 0000000077050340
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef09c0 5 bytes JMP 0000000077050440
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef0bc0 5 bytes JMP 0000000077050260
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef0bd0 5 bytes JMP 0000000077050270
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef0be0 5 bytes JMP 0000000077050400
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef0da0 5 bytes JMP 00000000770501f0
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef0db0 5 bytes JMP 0000000077050210
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef0e20 5 bytes JMP 0000000077050200
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef0e80 5 bytes JMP 0000000077050420
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef0e90 5 bytes JMP 0000000077050430
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef0ea0 5 bytes JMP 0000000077050220
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef0f80 5 bytes JMP 0000000077050280
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cdf25d 1 byte [62]
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076eef760 5 bytes JMP 0000000077050460
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076eef7b0 5 bytes JMP 0000000077050450
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076eef910 5 bytes JMP 0000000077050370
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076eef960 5 bytes JMP 0000000077050470
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076eef970 5 bytes JMP 00000000770503e0
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076eefa20 5 bytes JMP 0000000077050320
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076eefa50 5 bytes JMP 00000000770503b0
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076eefa70 5 bytes JMP 0000000077050390
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076eefab0 5 bytes JMP 00000000770502e0
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076eefb30 5 bytes JMP 00000000770502d0
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076eefb50 5 bytes JMP 0000000077050310
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076eefb90 5 bytes JMP 00000000770503c0
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076eefbe0 5 bytes JMP 00000000770503f0
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076eefd40 5 bytes JMP 0000000077050230
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076eeff00 5 bytes JMP 0000000077050480
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076eeff30 5 bytes JMP 00000000770503a0
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef0010 5 bytes JMP 00000000770502f0
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef0020 5 bytes JMP 0000000077050350
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef0080 5 bytes JMP 0000000077050290
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef0110 5 bytes JMP 00000000770502b0
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef0130 5 bytes JMP 00000000770503d0
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef0140 5 bytes JMP 0000000077050330
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef01b0 5 bytes JMP 0000000077050410
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef01e0 5 bytes JMP 0000000077050240
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef04a0 5 bytes JMP 00000000770501e0
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef0560 5 bytes JMP 0000000077050250
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef0590 5 bytes JMP 0000000077050490
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef05a0 5 bytes JMP 00000000770504a0
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef05d0 5 bytes JMP 0000000077050300
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef05e0 5 bytes JMP 0000000077050360
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef0640 5 bytes JMP 00000000770502a0
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef0690 5 bytes JMP 00000000770502c0
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef06c0 5 bytes JMP 0000000077050380
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef06d0 5 bytes JMP 0000000077050340
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef09c0 5 bytes JMP 0000000077050440
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef0bc0 5 bytes JMP 0000000077050260
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef0bd0 5 bytes JMP 0000000077050270
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef0be0 5 bytes JMP 0000000077050400
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef0da0 5 bytes JMP 00000000770501f0
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef0db0 5 bytes JMP 0000000077050210
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef0e20 5 bytes JMP 0000000077050200
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef0e80 5 bytes JMP 0000000077050420
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef0e90 5 bytes JMP 0000000077050430
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef0ea0 5 bytes JMP 0000000077050220
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef0f80 5 bytes JMP 0000000077050280
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cdf25d 1 byte [62]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1916] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076bbb0e5 1 byte [62]
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076eef760 5 bytes JMP 0000000077050460
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076eef7b0 5 bytes JMP 0000000077050450
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076eef910 5 bytes JMP 0000000077050370
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076eef960 5 bytes JMP 0000000077050470
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076eef970 5 bytes JMP 00000000770503e0
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076eefa20 5 bytes JMP 0000000077050320
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076eefa50 5 bytes JMP 00000000770503b0
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076eefa70 5 bytes JMP 0000000077050390
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076eefab0 5 bytes JMP 00000000770502e0
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076eefb30 5 bytes JMP 00000000770502d0
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076eefb50 5 bytes JMP 0000000077050310
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076eefb90 5 bytes JMP 00000000770503c0
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076eefbe0 5 bytes JMP 00000000770503f0
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076eefd40 5 bytes JMP 0000000077050230
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076eeff00 5 bytes JMP 0000000077050480
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076eeff30 5 bytes JMP 00000000770503a0
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef0010 5 bytes JMP 00000000770502f0
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef0020 5 bytes JMP 0000000077050350
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef0080 5 bytes JMP 0000000077050290
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef0110 5 bytes JMP 00000000770502b0
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef0130 5 bytes JMP 00000000770503d0
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef0140 5 bytes JMP 0000000077050330
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef01b0 5 bytes JMP 0000000077050410
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef01e0 5 bytes JMP 0000000077050240
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef04a0 5 bytes JMP 00000000770501e0
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef0560 5 bytes JMP 0000000077050250
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef0590 5 bytes JMP 0000000077050490
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef05a0 5 bytes JMP 00000000770504a0
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef05d0 5 bytes JMP 0000000077050300
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef05e0 5 bytes JMP 0000000077050360
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef0640 5 bytes JMP 00000000770502a0
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef0690 5 bytes JMP 00000000770502c0
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef06c0 5 bytes JMP 0000000077050380
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef06d0 5 bytes JMP 0000000077050340
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef09c0 5 bytes JMP 0000000077050440
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef0bc0 5 bytes JMP 0000000077050260
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef0bd0 5 bytes JMP 0000000077050270
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef0be0 5 bytes JMP 0000000077050400
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef0da0 5 bytes JMP 00000000770501f0
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef0db0 5 bytes JMP 0000000077050210
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef0e20 5 bytes JMP 0000000077050200
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef0e80 5 bytes JMP 0000000077050420
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef0e90 5 bytes JMP 0000000077050430
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef0ea0 5 bytes JMP 0000000077050220
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef0f80 5 bytes JMP 0000000077050280
.text C:\Windows\system32\svchost.exe[1976] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cdf25d 1 byte [62]
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076eef760 5 bytes JMP 0000000077050460
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076eef7b0 5 bytes JMP 0000000077050450
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076eef910 5 bytes JMP 0000000077050370
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076eef960 5 bytes JMP 0000000077050470
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076eef970 5 bytes JMP 00000000770503e0
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076eefa20 5 bytes JMP 0000000077050320
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076eefa50 5 bytes JMP 00000000770503b0
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076eefa70 5 bytes JMP 0000000077050390
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076eefab0 5 bytes JMP 00000000770502e0
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076eefb30 5 bytes JMP 00000000770502d0
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076eefb50 5 bytes JMP 0000000077050310
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076eefb90 5 bytes JMP 00000000770503c0
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076eefbe0 5 bytes JMP 00000000770503f0
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076eefd40 5 bytes JMP 0000000077050230
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076eeff00 5 bytes JMP 0000000077050480
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076eeff30 5 bytes JMP 00000000770503a0
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef0010 5 bytes JMP 00000000770502f0
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef0020 5 bytes JMP 0000000077050350
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef0080 5 bytes JMP 0000000077050290
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef0110 5 bytes JMP 00000000770502b0
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef0130 5 bytes JMP 00000000770503d0
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef0140 5 bytes JMP 0000000077050330
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef01b0 5 bytes JMP 0000000077050410
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef01e0 5 bytes JMP 0000000077050240
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef04a0 5 bytes JMP 00000000770501e0
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef0560 5 bytes JMP 0000000077050250
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef0590 5 bytes JMP 0000000077050490
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef05a0 5 bytes JMP 00000000770504a0
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef05d0 5 bytes JMP 0000000077050300
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef05e0 5 bytes JMP 0000000077050360
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef0640 5 bytes JMP 00000000770502a0
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef0690 5 bytes JMP 00000000770502c0
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef06c0 5 bytes JMP 0000000077050380
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef06d0 5 bytes JMP 0000000077050340
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef09c0 5 bytes JMP 0000000077050440
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef0bc0 5 bytes JMP 0000000077050260
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef0bd0 5 bytes JMP 0000000077050270
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef0be0 5 bytes JMP 0000000077050400
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef0da0 5 bytes JMP 00000000770501f0
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef0db0 5 bytes JMP 0000000077050210
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef0e20 5 bytes JMP 0000000077050200
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef0e80 5 bytes JMP 0000000077050420
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef0e90 5 bytes JMP 0000000077050430
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef0ea0 5 bytes JMP 0000000077050220
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef0f80 5 bytes JMP 0000000077050280
.text C:\Windows\system32\dmwu.exe[1388] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076cdf25d 1 byte [62]
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000076ec2ca0 5 bytes JMP 000000010042075c
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000076ed4430 5 bytes JMP 00000001004203a4
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076eef760 5 bytes JMP 0000000077050460
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076eef7b0 5 bytes JMP 0000000077050450
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000076eef830 5 bytes JMP 0000000100420b14
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000076eef890 5 bytes JMP 0000000100420ecc
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076eef910 5 bytes JMP 0000000077050370
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076eef960 5 bytes JMP 0000000077050470
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076eef970 5 bytes JMP 000000010042163c
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076eefa20 5 bytes JMP 0000000077050320
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076eefa50 5 bytes JMP 00000000770503b0
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076eefa70 5 bytes JMP 0000000077050390
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076eefab0 5 bytes JMP 00000000770502e0
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076eefb30 5 bytes JMP 00000000770502d0
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076eefb50 5 bytes JMP 0000000077050310
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076eefb90 5 bytes JMP 00000000770503c0
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000076eefbb0 5 bytes JMP 0000000100421284
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076eefbe0 5 bytes JMP 00000000770503f0
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076eefd40 5 bytes JMP 0000000077050230
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076eeff00 5 bytes JMP 0000000077050480
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076eeff30 5 bytes JMP 00000000770503a0
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef0010 5 bytes JMP 00000000770502f0
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef0020 5 bytes JMP 0000000077050350
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef0080 5 bytes JMP 0000000077050290
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef0110 5 bytes JMP 00000000770502b0
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef0130 5 bytes JMP 00000000770503d0
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef0140 5 bytes JMP 0000000077050330
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef01b0 5 bytes JMP 0000000077050410
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef01e0 5 bytes JMP 0000000077050240
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef04a0 5 bytes JMP 00000000770501e0
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef0560 5 bytes JMP 0000000077050250
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef0590 5 bytes JMP 0000000077050490
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef05a0 5 bytes JMP 00000000770504a0
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef05d0 5 bytes JMP 0000000077050300
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef05e0 5 bytes JMP 0000000077050360
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef0640 5 bytes JMP 00000000770502a0
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef0690 5 bytes JMP 00000000770502c0
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef06c0 5 bytes JMP 0000000077050380
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef06d0 5 bytes JMP 0000000077050340
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef09c0 5 bytes JMP 0000000077050440
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef0bc0 5 bytes JMP 0000000077050260
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef0bd0 5 bytes JMP 0000000077050270
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef0be0 5 bytes JMP 00000001004219f4
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef0da0 5 bytes JMP 00000000770501f0
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef0db0 5 bytes JMP 0000000077050210
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef0e20 5 bytes JMP 0000000077050200
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef0e80 5 bytes JMP 0000000077050420
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef0e90 5 bytes JMP 0000000077050430
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef0ea0 5 bytes JMP 0000000077050220
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef0f80 5 bytes JMP 0000000077050280
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 0000000076cdf25d 1 byte [62]
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe936e00 5 bytes JMP 000007ff7e951dac
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe936f2c 5 bytes JMP 000007ff7e950ecc
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe937220 5 bytes JMP 000007ff7e951284
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe93739c 5 bytes JMP 000007ff7e95163c
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe937538 5 bytes JMP 000007ff7e9519f4
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe9375e8 5 bytes JMP 000007ff7e9503a4
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe93790c 5 bytes JMP 000007ff7e95075c
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[1536] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe937ab4 5 bytes JMP 000007ff7e950b14
.text C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[1296] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007709fa50 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[1296] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007709fae8 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[1296] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007709fc40 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[1296] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 000000007709ffc8 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[1296] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 00000000770a18b0 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[1296] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 00000000770bc46a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[1296] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 00000000770c11e7 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[1296] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 0000000076bbb0e5 1 byte [62]
.text C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[1296] C:\Windows\syswow64\USER32.dll!SetWinEventHook 0000000075a8f0e6 5 bytes JMP 00000001002501f8
.text C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[1296] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000075a93907 5 bytes JMP 00000001002503fc
.text C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[1296] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 0000000075a98364 5 bytes JMP 0000000100250600
.text C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[1296] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000075aa06b3 5 bytes JMP 0000000100250804
.text C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[1296] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 0000000075ab0efc 5 bytes JMP 0000000100250a08
.text C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[1296] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075215181 5 bytes JMP 0000000100261014
.text C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[1296] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075215254 5 bytes JMP 0000000100260804
.text C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[1296] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000752153d5 5 bytes JMP 0000000100260a08
.text C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[1296] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000752154c2 5 bytes JMP 0000000100260c0c
.text C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[1296] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000752155e2 5 bytes JMP 0000000100260e10
.text C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[1296] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007521567c 5 bytes JMP 00000001002601f8
.text C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[1296] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007521589f 5 bytes JMP 00000001002603fc
.text C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[1296] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075215a22 5 bytes JMP 0000000100260600
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[1444] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007709fa50 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[1444] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007709fae8 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[1444] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007709fc40 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[1444] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 000000007709ffc8 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[1444] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 00000000770a18b0 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[1444] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 00000000770bc46a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[1444] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 00000000770c11e7 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[1444] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 0000000076bbb0e5 1 byte [62]
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[1444] C:\Windows\syswow64\USER32.dll!SetWinEventHook 0000000075a8f0e6 5 bytes JMP 00000001002401f8
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[1444] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000075a93907 5 bytes JMP 00000001002403fc
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[1444] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 0000000075a98364 5 bytes JMP 0000000100240600
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[1444] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000075aa06b3 5 bytes JMP 0000000100240804
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[1444] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 0000000075ab0efc 5 bytes JMP 0000000100240a08
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[1444] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075215181 5 bytes JMP 0000000100251014
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[1444] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075215254 5 bytes JMP 0000000100250804
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[1444] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000752153d5 5 bytes JMP 0000000100250a08
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[1444] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000752154c2 5 bytes JMP 0000000100250c0c
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[1444] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000752155e2 5 bytes JMP 0000000100250e10
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[1444] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007521567c 5 bytes JMP 00000001002501f8
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[1444] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007521589f 5 bytes JMP 00000001002503fc
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[1444] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075215a22 5 bytes JMP 0000000100250600
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[1444] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075bc1465 2 bytes [BC, 75]
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[1444] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075bc14bb 2 bytes [BC, 75]
.text ... * 2
.text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[332] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007709fa50 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[332] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007709fae8 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[332] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007709fc40 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[332] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 000000007709ffc8 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[332] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 00000000770a18b0 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[332] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 00000000770bc46a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[332] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 00000000770c11e7 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[332] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 0000000076bbb0e5 1 byte [62]
.text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[332] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075215181 5 bytes JMP 0000000100251014
.text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[332] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075215254 5 bytes JMP 0000000100250804
.text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[332] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000752153d5 5 bytes JMP 0000000100250a08
.text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[332] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000752154c2 5 bytes JMP 0000000100250c0c
.text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[332] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000752155e2 5 bytes JMP 0000000100250e10
.text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[332] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007521567c 5 bytes JMP 00000001002501f8
.text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[332] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007521589f 5 bytes JMP 00000001002503fc
.text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[332] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075215a22 5 bytes JMP 0000000100250600
.text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[332] C:\Windows\syswow64\USER32.dll!SetWinEventHook 0000000075a8f0e6 5 bytes JMP 00000001002601f8
.text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[332] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000075a93907 5 bytes JMP 00000001002603fc
.text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[332] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 0000000075a98364 5 bytes JMP 0000000100260600
.text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[332] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000075aa06b3 5 bytes JMP 0000000100260804
.text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[332] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 0000000075ab0efc 5 bytes JMP 0000000100260a08
.text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[332] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075bc1465 2 bytes [BC, 75]
.text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[332] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075bc14bb 2 bytes [BC, 75]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe[2352] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007709fa50 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe[2352] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007709fae8 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe[2352] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007709fc40 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe[2352] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 000000007709ffc8 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe[2352] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 00000000770a18b0 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe[2352] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 00000000770bc46a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe[2352] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 00000000770c11e7 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe[2352] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 0000000076bbb0e5 1 byte [62]
.text C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe[2352] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075215181 5 bytes JMP 0000000100241014
.text C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe[2352] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075215254 5 bytes JMP 0000000100240804
.text C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe[2352] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000752153d5 5 bytes JMP 0000000100240a08
.text C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe[2352] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000752154c2 5 bytes JMP 0000000100240c0c
.text C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe[2352] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000752155e2 5 bytes JMP 0000000100240e10
.text C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe[2352] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007521567c 5 bytes JMP 00000001002401f8
.text C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe[2352] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007521589f 5 bytes JMP 00000001002403fc
.text C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe[2352] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075215a22 5 bytes JMP 0000000100240600
.text C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe[2352] C:\Windows\syswow64\USER32.dll!SetWinEventHook 0000000075a8f0e6 5 bytes JMP 00000001002501f8
.text C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe[2352] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000075a93907 5 bytes JMP 00000001002503fc
.text C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe[2352] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 0000000075a98364 5 bytes JMP 0000000100250600
.text C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe[2352] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000075aa06b3 5 bytes JMP 0000000100250804
.text C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe[2352] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 0000000075ab0efc 5 bytes JMP 0000000100250a08
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000076ec2ca0 5 bytes JMP 000000010024075c
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000076ed4430 5 bytes JMP 00000001002403a4
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076eef760 5 bytes JMP 0000000077050460
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076eef7b0 5 bytes JMP 0000000077050450
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000076eef830 5 bytes JMP 0000000100240b14
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000076eef890 5 bytes JMP 0000000100240ecc
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076eef910 5 bytes JMP 0000000077050370
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076eef960 5 bytes JMP 0000000077050470
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076eef970 5 bytes JMP 000000010024163c
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076eefa20 5 bytes JMP 0000000077050320
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076eefa50 5 bytes JMP 00000000770503b0
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076eefa70 5 bytes JMP 0000000077050390
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076eefab0 5 bytes JMP 00000000770502e0
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076eefb30 5 bytes JMP 00000000770502d0
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076eefb50 5 bytes JMP 0000000077050310
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076eefb90 5 bytes JMP 00000000770503c0
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000076eefbb0 5 bytes JMP 0000000100241284
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076eefbe0 5 bytes JMP 00000000770503f0
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076eefd40 5 bytes JMP 0000000077050230
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076eeff00 5 bytes JMP 0000000077050480
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076eeff30 5 bytes JMP 00000000770503a0
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef0010 5 bytes JMP 00000000770502f0
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef0020 5 bytes JMP 0000000077050350
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef0080 5 bytes JMP 0000000077050290
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef0110 5 bytes JMP 00000000770502b0
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef0130 5 bytes JMP 00000000770503d0
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef0140 5 bytes JMP 0000000077050330
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef01b0 5 bytes JMP 0000000077050410
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef01e0 5 bytes JMP 0000000077050240
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef04a0 5 bytes JMP 00000000770501e0
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef0560 5 bytes JMP 0000000077050250
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef0590 5 bytes JMP 0000000077050490
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef05a0 5 bytes JMP 00000000770504a0
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef05d0 5 bytes JMP 0000000077050300
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef05e0 5 bytes JMP 0000000077050360
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef0640 5 bytes JMP 00000000770502a0
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef0690 5 bytes JMP 00000000770502c0
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef06c0 5 bytes JMP 0000000077050380
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef06d0 5 bytes JMP 0000000077050340
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef09c0 5 bytes JMP 0000000077050440
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef0bc0 5 bytes JMP 0000000077050260
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef0bd0 5 bytes JMP 0000000077050270
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef0be0 5 bytes JMP 00000001002419f4
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef0da0 5 bytes JMP 00000000770501f0
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef0db0 5 bytes JMP 0000000077050210
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef0e20 5 bytes JMP 0000000077050200
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef0e80 5 bytes JMP 0000000077050420
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef0e90 5 bytes JMP 0000000077050430
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef0ea0 5 bytes JMP 0000000077050220
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef0f80 5 bytes JMP 0000000077050280
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 0000000076cdf25d 1 byte [62]
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe936e00 5 bytes JMP 000007ff7e951dac
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe936f2c 5 bytes JMP 000007ff7e950ecc
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe937220 5 bytes JMP 000007ff7e951284
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe93739c 5 bytes JMP 000007ff7e95163c
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe937538 5 bytes JMP 000007ff7e9519f4
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe9375e8 5 bytes JMP 000007ff7e9503a4
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe93790c 5 bytes JMP 000007ff7e95075c
.text C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe937ab4 5 bytes JMP 000007ff7e950b14
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[2628] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007709fa50 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[2628] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007709fae8 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[2628] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007709fc40 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[2628] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 000000007709ffc8 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[2628] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 00000000770a18b0 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[2628] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 00000000770bc46a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[2628] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 00000000770c11e7 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[2628] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 0000000076bbb0e5 1 byte [62]
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[2628] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075215181 5 bytes JMP 00000001002c1014
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[2628] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075215254 5 bytes JMP 00000001002c0804
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[2628] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000752153d5 5 bytes JMP 00000001002c0a08
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[2628] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000752154c2 5 bytes JMP 00000001002c0c0c
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[2628] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000752155e2 5 bytes JMP 00000001002c0e10
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[2628] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007521567c 5 bytes JMP 00000001002c01f8
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[2628] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007521589f 5 bytes JMP 00000001002c03fc
.text C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe[2628] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075215a22 5 bytes JMP 00000001002c0600
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007709fa50 5 bytes JMP 0000000100030600
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007709fae8 5 bytes JMP 0000000100030804
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007709fc40 5 bytes JMP 0000000100030c0c
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 000000007709ffc8 5 bytes JMP 0000000100030a08
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 00000000770a18b0 5 bytes JMP 0000000100030e10
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 00000000770bc46a 5 bytes JMP 00000001000301f8
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 00000000770c11e7 5 bytes JMP 00000001000303fc
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 0000000076bbb0e5 1 byte [62]
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\Windows\syswow64\USER32.dll!SetWinEventHook 0000000075a8f0e6 5 bytes JMP 00000001002601f8
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000075a93907 5 bytes JMP 00000001002603fc
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 0000000075a98364 5 bytes JMP 0000000100260600
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000075aa06b3 5 bytes JMP 0000000100260804
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 0000000075ab0efc 5 bytes JMP 0000000100260a08
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075215181 5 bytes JMP 0000000100281014
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075215254 5 bytes JMP 0000000100280804
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000752153d5 5 bytes JMP 0000000100280a08
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000752154c2 5 bytes JMP 0000000100280c0c
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000752155e2 5 bytes JMP 0000000100280e10
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007521567c 5 bytes JMP 00000001002801f8
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007521589f 5 bytes JMP 00000001002803fc
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075215a22 5 bytes JMP 0000000100280600
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\ProgramData\TVersity\Media Server\avcodec-52.dll!init_vlc_sparse + 217 000000006ad82671 4 bytes [C0, 2D, 91, 00]
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\ProgramData\TVersity\Media Server\avcodec-52.dll!init_vlc_sparse + 232 000000006ad82680 4 bytes [C0, 2D, 91, 00]
.text ... * 7
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\ProgramData\TVersity\Media Server\avcodec-52.dll!avcodec_get_chroma_sub_sample + 8 000000006ae63fa8 4 bytes [40, 31, 91, 00]
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\ProgramData\TVersity\Media Server\avcodec-52.dll!avcodec_get_pix_fmt_name + 14 000000006ae63fd2 4 bytes [40, 31, 91, 00]
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\ProgramData\TVersity\Media Server\avcodec-52.dll!avcodec_pix_fmt_string + 94 000000006ae64046 4 bytes [40, 31, 91, 00]
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\ProgramData\TVersity\Media Server\avcodec-52.dll!ff_is_hwaccel_pix_fmt + 10 000000006ae6408a 4 bytes [47, 31, 91, 00]
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\ProgramData\TVersity\Media Server\avcodec-52.dll!ff_fill_linesize + 36 000000006ae641b8 4 bytes [40, 31, 91, 00]
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\ProgramData\TVersity\Media Server\avcodec-52.dll!ff_fill_linesize + 150 000000006ae6422a 4 bytes [4A, 31, 91, 00]
.text ... * 7
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\ProgramData\TVersity\Media Server\avcodec-52.dll!ff_fill_pointer + 82 000000006ae643e6 4 bytes [46, 31, 91, 00]
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\ProgramData\TVersity\Media Server\avcodec-52.dll!ff_fill_pointer + 138 000000006ae6441e 4 bytes [46, 31, 91, 00]
.text ... * 2
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\ProgramData\TVersity\Media Server\avcodec-52.dll!avpicture_layout + 503 000000006ae64737 4 bytes [45, 31, 91, 00]
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\ProgramData\TVersity\Media Server\avcodec-52.dll!avpicture_layout + 554 000000006ae6476a 4 bytes [46, 31, 91, 00]
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\ProgramData\TVersity\Media Server\avcodec-52.dll!avcodec_get_pix_fmt_loss + 97 000000006ae64959 4 bytes [40, 31, 91, 00]
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\ProgramData\TVersity\Media Server\avcodec-52.dll!avcodec_get_pix_fmt_loss + 108 000000006ae64964 4 bytes [40, 31, 91, 00]
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\ProgramData\TVersity\Media Server\avcodec-52.dll!avcodec_find_best_pix_fmt + 57 000000006ae64af9 4 bytes [45, 31, 91, 00]
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\ProgramData\TVersity\Media Server\avcodec-52.dll!avcodec_find_best_pix_fmt + 91 000000006ae64b1b 4 bytes [44, 31, 91, 00]
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\ProgramData\TVersity\Media Server\avcodec-52.dll!ff_get_plane_bytewidth + 122 000000006ae64cf2 4 bytes [45, 31, 91, 00]
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\ProgramData\TVersity\Media Server\avcodec-52.dll!av_picture_copy + 352 000000006ae64e6c 4 bytes [46, 31, 91, 00]
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\ProgramData\TVersity\Media Server\avcodec-52.dll!av_picture_copy + 567 000000006ae64f43 4 bytes [45, 31, 91, 00]
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\ProgramData\TVersity\Media Server\avcodec-52.dll!av_picture_crop + 68 000000006ae65614 4 bytes [40, 31, 91, 00]
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\ProgramData\TVersity\Media Server\avcodec-52.dll!av_picture_pad + 617 000000006ae658e1 4 bytes [40, 31, 91, 00]
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\ProgramData\TVersity\Media Server\avcodec-52.dll!ff_ivi_create_huff_from_desc + 209 000000006ae7d195 4 bytes [C0, 2D, 91, 00]
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\ProgramData\TVersity\Media Server\avcodec-52.dll!ff_ivi_create_huff_from_desc + 342 000000006ae7d21a 4 bytes [C0, 2D, 91, 00]
.text ... * 5
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\ProgramData\TVersity\Media Server\avcodec-52.dll!ff_estimate_p_frame_motion + 996 000000006aeb9754 4 bytes [C0, 2B, 91, 00]
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\ProgramData\TVersity\Media Server\avcodec-52.dll!ff_rle_encode + 734 000000006af4aff6 4 bytes [C1, 2B, 91, 00]
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\ProgramData\TVersity\Media Server\avcodec-52.dll!ff_rle_encode + 931 000000006af4b0bb 4 bytes [C0, 2B, 91, 00]
.text ... * 2
.text C:\ProgramData\TVersity\Media Server\MediaServer.exe[2692] C:\ProgramData\TVersity\Media Server\avcodec-52.dll!avcodec_align_dimensions + 21 000000006afb4965 4 bytes [45, 31, 91, 00]
.text C:\Windows\SysWOW64\rundll32.exe[2780] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007709fa50 5 bytes JMP 0000000100030600
.text C:\Windows\SysWOW64\rundll32.exe[2780] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007709fae8 5 bytes JMP 0000000100030804
.text C:\Windows\SysWOW64\rundll32.exe[2780] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007709fc40 5 bytes JMP 0000000100030c0c
.text C:\Windows\SysWOW64\rundll32.exe[2780] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 000000007709ffc8 5 bytes JMP 0000000100030a08
.text C:\Windows\SysWOW64\rundll32.exe[2780] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 00000000770a18b0 5 bytes JMP 0000000100030e10
.text C:\Windows\SysWOW64\rundll32.exe[2780] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 00000000770bc46a 5 bytes JMP 00000001000301f8
.text C:\Windows\SysWOW64\rundll32.exe[2780] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 00000000770c11e7 5 bytes JMP 00000001000303fc
.text C:\Windows\SysWOW64\rundll32.exe[2780] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 0000000076bbb0e5 1 byte [62]
.text C:\Windows\SysWOW64\rundll32.exe[2780] C:\Windows\syswow64\USER32.dll!SetWinEventHook 0000000075a8f0e6 5 bytes JMP 00000001000f01f8
.text C:\Windows\SysWOW64\rundll32.exe[2780] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000075a93907 5 bytes JMP 00000001000f03fc
.text C:\Windows\SysWOW64\rundll32.exe[2780] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 0000000075a98364 5 bytes JMP 00000001000f0600
.text C:\Windows\SysWOW64\rundll32.exe[2780] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000075aa06b3 5 bytes JMP 00000001000f0804
.text C:\Windows\SysWOW64\rundll32.exe[2780] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 0000000075ab0efc 5 bytes JMP 00000001000f0a08
.text C:\Windows\SysWOW64\rundll32.exe[2780] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075215181 5 bytes JMP 0000000100101014
.text C:\Windows\SysWOW64\rundll32.exe[2780] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075215254 5 bytes JMP 0000000100100804
.text C:\Windows\SysWOW64\rundll32.exe[2780] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000752153d5 5 bytes JMP 0000000100100a08
.text C:\Windows\SysWOW64\rundll32.exe[2780] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000752154c2 5 bytes JMP 0000000100100c0c
.text C:\Windows\SysWOW64\rundll32.exe[2780] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000752155e2 5 bytes JMP 0000000100100e10
.text C:\Windows\SysWOW64\rundll32.exe[2780] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007521567c 5 bytes JMP 00000001001001f8
.text C:\Windows\SysWOW64\rundll32.exe[2780] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007521589f 5 bytes JMP 00000001001003fc
.text C:\Windows\SysWOW64\rundll32.exe[2780] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075215a22 5 bytes JMP 0000000100100600
.text C:\Windows\SysWOW64\rundll32.exe[2780] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathW + 26 00000000746c13c6 2 bytes [6C, 74]
.text C:\Windows\SysWOW64\rundll32.exe[2780] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathW + 74 00000000746c13f6 2 bytes [6C, 74]
.text C:\Windows\SysWOW64\rundll32.exe[2780] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathW + 257 00000000746c14ad 2 bytes [6C, 74]
.text C:\Windows\SysWOW64\rundll32.exe[2780] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathW + 303 00000000746c14db 2 bytes [6C, 74]
.text ... * 2
.text C:\Windows\SysWOW64\rundll32.exe[2780] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathA + 79 00000000746c1577 2 bytes [6C, 74]
.text C:\Windows\SysWOW64\rundll32.exe[2780] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathA + 175 00000000746c15d7 2 bytes [6C, 74]
.text C:\Windows\SysWOW64\rundll32.exe[2780] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathA + 620 00000000746c1794 2 bytes [6C, 74]
.text C:\Windows\SysWOW64\rundll32.exe[2780] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathA + 921 00000000746c18c1 2 bytes [6C, 74]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2792] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007709fa50 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2792] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007709fae8 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2792] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007709fc40 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2792] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 000000007709ffc8 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2792] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 00000000770a18b0 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2792] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 00000000770bc46a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2792] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 00000000770c11e7 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2792] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 0000000076bbb0e5 1 byte [62]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2792] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075215181 5 bytes JMP 0000000100211014
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2792] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075215254 5 bytes JMP 0000000100210804
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2792] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000752153d5 5 bytes JMP 0000000100210a08
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2792] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000752154c2 5 bytes JMP 0000000100210c0c
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2792] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000752155e2 5 bytes JMP 0000000100210e10
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2792] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007521567c 5 bytes JMP 00000001002101f8
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2792] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007521589f 5 bytes JMP 00000001002103fc
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2792] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075215a22 5 bytes JMP 0000000100210600
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2792] C:\Windows\syswow64\USER32.dll!SetWinEventHook 0000000075a8f0e6 5 bytes JMP 00000001002201f8
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2792] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000075a93907 5 bytes JMP 00000001002203fc
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2792] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 0000000075a98364 5 bytes JMP 0000000100220600
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2792] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000075aa06b3 5 bytes JMP 0000000100220804
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2792] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 0000000075ab0efc 5 bytes JMP 0000000100220a08
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2792] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075bc1465 2 bytes [BC, 75]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2792] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075bc14bb 2 bytes [BC, 75]
.text ... * 2
.text C:\Program Files\AVAST Software\Avast\AvastUI.exe[2856] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076bbb0e5 1 byte [62]
.text C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[2864] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007709fa50 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[2864] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007709fae8 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[2864] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007709fc40 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[2864] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 000000007709ffc8 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[2864] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 00000000770a18b0 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[2864] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 00000000770bc46a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[2864] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 00000000770c11e7 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[2864] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 0000000076bbb0e5 1 byte [62]
.text C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[2864] C:\Windows\syswow64\USER32.dll!SetWinEventHook 0000000075a8f0e6 5 bytes JMP 00000001002401f8
.text C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[2864] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000075a93907 5 bytes JMP 00000001002403fc
.text C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[2864] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 0000000075a98364 5 bytes JMP 0000000100240600
.text C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[2864] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000075aa06b3 5 bytes JMP 0000000100240804
.text C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[2864] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 0000000075ab0efc 5 bytes JMP 0000000100240a08
.text C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[2864] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075215181 5 bytes JMP 0000000100251014
.text C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[2864] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075215254 5 bytes JMP 0000000100250804
.text C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[2864] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000752153d5 5 bytes JMP 0000000100250a08
.text C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[2864] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000752154c2 5 bytes JMP 0000000100250c0c
.text C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[2864] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000752155e2 5 bytes JMP 0000000100250e10
.text C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[2864] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007521567c 5 bytes JMP 00000001002501f8
.text C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[2864] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007521589f 5 bytes JMP 00000001002503fc
.text C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[2864] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075215a22 5 bytes JMP 0000000100250600
.text C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe[2908] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007709fa50 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe[2908] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007709fae8 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe[2908] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007709fc40 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe[2908] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 000000007709ffc8 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe[2908] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 00000000770a18b0 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe[2908] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 00000000770bc46a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe[2908] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 00000000770c11e7 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe[2908] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 0000000076bbb0e5 1 byte [62]
.text C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe[2908] C:\Windows\syswow64\USER32.dll!SetWinEventHook 0000000075a8f0e6 5 bytes JMP 00000001001e01f8
.text C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe[2908] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000075a93907 5 bytes JMP 00000001001e03fc
.text C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe[2908] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 0000000075a98364 5 bytes JMP 00000001001e0600
.text C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe[2908] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000075aa06b3 5 bytes JMP 00000001001e0804
.text C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe[2908] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 0000000075ab0efc 5 bytes JMP 00000001001e0a08
.text C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe[2908] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075215181 5 bytes JMP 00000001001f1014
.text C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe[2908] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075215254 5 bytes JMP 00000001001f0804
.text C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe[2908] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000752153d5 5 bytes JMP 00000001001f0a08
.text C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe[2908] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000752154c2 5 bytes JMP 00000001001f0c0c
.text C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe[2908] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000752155e2 5 bytes JMP 00000001001f0e10
.text C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe[2908] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007521567c 5 bytes JMP 00000001001f01f8
.text C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe[2908] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007521589f 5 bytes JMP 00000001001f03fc
.text C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe[2908] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075215a22 5 bytes JMP 00000001001f0600
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2936] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007709fa50 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2936] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007709fae8 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2936] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007709fc40 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2936] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 000000007709ffc8 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2936] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 00000000770a18b0 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2936] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 00000000770bc46a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2936] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 00000000770c11e7 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2936] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 0000000076bbb0e5 1 byte [62]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2936] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075215181 5 bytes JMP 0000000100251014
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2936] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075215254 5 bytes JMP 0000000100250804
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2936] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000752153d5 5 bytes JMP 0000000100250a08
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2936] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000752154c2 5 bytes JMP 0000000100250c0c
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2936] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000752155e2 5 bytes JMP 0000000100250e10
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2936] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007521567c 5 bytes JMP 00000001002501f8
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2936] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007521589f 5 bytes JMP 00000001002503fc
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2936] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075215a22 5 bytes JMP 0000000100250600
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2936] C:\Windows\syswow64\USER32.dll!SetWinEventHook 0000000075a8f0e6 5 bytes JMP 00000001002601f8
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2936] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000075a93907 5 bytes JMP 00000001002603fc
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2936] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 0000000075a98364 5 bytes JMP 0000000100260600
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2936] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000075aa06b3 5 bytes JMP 0000000100260804
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2936] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 0000000075ab0efc 5 bytes JMP 0000000100260a08
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000076ec2ca0 5 bytes JMP 000000010042075c
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000076ed4430 5 bytes JMP 00000001004203a4
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076eef760 5 bytes JMP 0000000100060460
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076eef7b0 5 bytes JMP 0000000100060450
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000076eef830 5 bytes JMP 0000000100420b14
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000076eef890 5 bytes JMP 0000000100420ecc
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076eef910 5 bytes JMP 0000000100060370
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076eef960 5 bytes JMP 0000000100060470
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076eef970 5 bytes JMP 000000010042163c
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076eefa20 5 bytes JMP 0000000100060320
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076eefa50 5 bytes JMP 00000001000603b0
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076eefa70 5 bytes JMP 0000000100060390
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076eefab0 5 bytes JMP 00000001000602e0
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076eefb30 5 bytes JMP 00000001000602d0
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076eefb50 5 bytes JMP 0000000100060310
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076eefb90 5 bytes JMP 00000001000603c0
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000076eefbb0 5 bytes JMP 0000000100421284
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076eefbe0 5 bytes JMP 00000001000603f0
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076eefd40 5 bytes JMP 0000000100060230
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076eeff00 5 bytes JMP 0000000100060480
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076eeff30 5 bytes JMP 00000001000603a0
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef0010 5 bytes JMP 00000001000602f0
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef0020 5 bytes JMP 0000000100060350
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef0080 5 bytes JMP 0000000100060290
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef0110 5 bytes JMP 00000001000602b0
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef0130 5 bytes JMP 00000001000603d0
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef0140 5 bytes JMP 0000000100060330
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef01b0 5 bytes JMP 0000000100060410
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef01e0 5 bytes JMP 0000000100060240
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef04a0 5 bytes JMP 00000001000601e0
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef0560 5 bytes JMP 0000000100060250
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef0590 5 bytes JMP 0000000100060490
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef05a0 5 bytes JMP 00000001000604a0
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef05d0 5 bytes JMP 0000000100060300
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef05e0 5 bytes JMP 0000000100060360
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef0640 5 bytes JMP 00000001000602a0
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef0690 5 bytes JMP 00000001000602c0
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef06c0 5 bytes JMP 0000000100060380
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef06d0 5 bytes JMP 0000000100060340
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef09c0 5 bytes JMP 0000000100060440
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef0bc0 5 bytes JMP 0000000100060260
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef0bd0 5 bytes JMP 0000000100060270
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef0be0 5 bytes JMP 00000001004219f4
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef0da0 5 bytes JMP 00000001000601f0
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef0db0 5 bytes JMP 0000000100060210
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef0e20 5 bytes JMP 0000000100060200
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef0e80 5 bytes JMP 0000000100060420
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef0e90 5 bytes JMP 0000000100060430
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef0ea0 5 bytes JMP 0000000100060220
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef0f80 5 bytes JMP 0000000100060280
.text C:\Windows\splwow64.exe[2532] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 0000000076cdf25d 1 byte [62]
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe936e00 5 bytes JMP 000007ff7e951dac
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe936f2c 5 bytes JMP 000007ff7e950ecc
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe937220 5 bytes JMP 000007ff7e951284
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe93739c 5 bytes JMP 000007ff7e95163c
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe937538 5 bytes JMP 000007ff7e9519f4
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe9375e8 5 bytes JMP 000007ff7e9503a4
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe93790c 5 bytes JMP 000007ff7e95075c
.text C:\Windows\splwow64.exe[2532] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe937ab4 5 bytes JMP 000007ff7e950b14
.text C:\Users\DOMOWY\Desktop\gmer\gmer.exe[3424] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007709fa50 5 bytes JMP 0000000100030600
.text C:\Users\DOMOWY\Desktop\gmer\gmer.exe[3424] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007709fae8 5 bytes JMP 0000000100030804
.text C:\Users\DOMOWY\Desktop\gmer\gmer.exe[3424] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007709fc40 5 bytes JMP 0000000100030c0c
.text C:\Users\DOMOWY\Desktop\gmer\gmer.exe[3424] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 000000007709ffc8 5 bytes JMP 0000000100030a08
.text C:\Users\DOMOWY\Desktop\gmer\gmer.exe[3424] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 00000000770a18b0 5 bytes JMP 0000000100030e10
.text C:\Users\DOMOWY\Desktop\gmer\gmer.exe[3424] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 00000000770bc46a 5 bytes JMP 00000001000301f8
.text C:\Users\DOMOWY\Desktop\gmer\gmer.exe[3424] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 00000000770c11e7 5 bytes JMP 00000001000303fc
.text C:\Users\DOMOWY\Desktop\gmer\gmer.exe[3424] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 0000000076bbb0e5 1 byte [62]
.text C:\Users\DOMOWY\Desktop\gmer\gmer.exe[3424] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075215181 5 bytes JMP 00000001001d1014
.text C:\Users\DOMOWY\Desktop\gmer\gmer.exe[3424] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075215254 5 bytes JMP 00000001001d0804
.text C:\Users\DOMOWY\Desktop\gmer\gmer.exe[3424] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000752153d5 5 bytes JMP 00000001001d0a08
.text C:\Users\DOMOWY\Desktop\gmer\gmer.exe[3424] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000752154c2 5 bytes JMP 00000001001d0c0c
.text C:\Users\DOMOWY\Desktop\gmer\gmer.exe[3424] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000752155e2 5 bytes JMP 00000001001d0e10
.text C:\Users\DOMOWY\Desktop\gmer\gmer.exe[3424] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007521567c 5 bytes JMP 00000001001d01f8
.text C:\Users\DOMOWY\Desktop\gmer\gmer.exe[3424] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007521589f 5 bytes JMP 00000001001d03fc
.text C:\Users\DOMOWY\Desktop\gmer\gmer.exe[3424] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075215a22 5 bytes JMP 00000001001d0600
.text C:\Users\DOMOWY\Desktop\gmer\gmer.exe[3424] C:\Windows\syswow64\USER32.dll!SetWinEventHook 0000000075a8f0e6 5 bytes JMP 00000001001f01f8
.text C:\Users\DOMOWY\Desktop\gmer\gmer.exe[3424] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000075a93907 5 bytes JMP 00000001001f03fc
.text C:\Users\DOMOWY\Desktop\gmer\gmer.exe[3424] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 0000000075a98364 5 bytes JMP 00000001001f0600
.text C:\Users\DOMOWY\Desktop\gmer\gmer.exe[3424] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000075aa06b3 5 bytes JMP 00000001001f0804
.text C:\Users\DOMOWY\Desktop\gmer\gmer.exe[3424] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 0000000075ab0efc 5 bytes JMP 00000001001f0a08
---- Processes - GMER 2.1 ----
Library C:\Program Files\AVAST Software\Avast\setup\avast.setup (*** suspicious ***) @ C:\Program Files\AVAST Software\Avast\setup\avast.setup [2564] 0000000000be0000
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Type 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@DisplayName aswFsBlk
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Group FSFilter Activity Monitor
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@DependOnService FltMgr?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Description avast! mini-filter driver (aswFsBlk)
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Tag 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances@DefaultInstance aswFsBlk Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance@Altitude 388400
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance@Flags 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Type 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@ImagePath \??\C:\Windows\system32\drivers\aswMonFlt.sys
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@DisplayName aswMonFlt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Group FSFilter Anti-Virus
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@DependOnService FltMgr?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Description avast! mini-filter driver (aswMonFlt)
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances@DefaultInstance aswMonFlt Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance@Altitude 320700
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance@Flags 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@DisplayName aswRdr
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Group PNP_TDI
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@DependOnService tcpip?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Description avast! WFP Redirect driver
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@ImagePath \SystemRoot\System32\Drivers\aswrdr2.sys
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters@MSIgnoreLSPDefault
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters@WSIgnoreLSPDefault nl_lsp.dll,imon.dll,xfire_lsp.dll,mslsp.dll,mssplsp.dll,cwhook.dll,spi.dll,bmnet.dll,winsflt.dll
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Start 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@DisplayName aswRvrt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Description avast! Revert
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@BootCounter 179
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@TickCounter 5457035
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@SystemRoot \Device\Harddisk0\Partition2\Windows
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@ImproperShutdown 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Type 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@DisplayName aswSnx
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Group FSFilter Virtualization
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@DependOnService FltMgr?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Description avast! virtualization driver (aswSnx)
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Tag 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances@DefaultInstance aswSnx Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance@Altitude 137600
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance@Flags 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters@ProgramFolder \DosDevices\C:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@DisplayName aswSP
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@Description avast! Self Protection
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@BehavShield 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@ProgramFolder \DosDevices\C:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@ProgramFilesFolder \DosDevices\C:\Program Files
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@GadgetFolder \DosDevices\C:\Program Files\Windows Sidebar\Shared Gadgets\aswSidebar.gadget
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@DisplayName avast! Network Shield Support
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Group PNP_TDI
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@DependOnService tcpip?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Description avast! Network Shield TDI driver
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Tag 9
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Start 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@DisplayName aswVmm
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Description avast! VM Monitor
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Type 32
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ImagePath "C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@DisplayName avast! Antivirus
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Group ShellSvcGroup
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@DependOnService aswMonFlt?RpcSS?
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@WOW64 1
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ObjectName LocalSystem
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ServiceSidType 1
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Description Instaluje i zarz?dza us?ugami antywirusowymi programu avast! na tym komputerze, co obejmuje rezydentny skaner, kwarantann? oraz harmonogram zada?.
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Type 2
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Start 2
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@DisplayName aswFsBlk
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Group FSFilter Activity Monitor
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@DependOnService FltMgr?
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Description avast! mini-filter driver (aswFsBlk)
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Tag 2
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances@DefaultInstance aswFsBlk Instance
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance@Altitude 388400
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance@Flags 0
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Type 2
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Start 2
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@ImagePath \??\C:\Windows\system32\drivers\aswMonFlt.sys
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@DisplayName aswMonFlt
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Group FSFilter Anti-Virus
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@DependOnService FltMgr?
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Description avast! mini-filter driver (aswMonFlt)
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances@DefaultInstance aswMonFlt Instance
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance@Altitude 320700
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance@Flags 0
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@DisplayName aswRdr
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Group PNP_TDI
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@DependOnService tcpip?
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Description avast! WFP Redirect driver
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@ImagePath \SystemRoot\System32\Drivers\aswrdr2.sys
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters@MSIgnoreLSPDefault
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters@WSIgnoreLSPDefault nl_lsp.dll,imon.dll,xfire_lsp.dll,mslsp.dll,mssplsp.dll,cwhook.dll,spi.dll,bmnet.dll,winsflt.dll
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@Start 0
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@DisplayName aswRvrt
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@Description avast! Revert
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@BootCounter 179
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@TickCounter 5457035
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@SystemRoot \Device\Harddisk0\Partition2\Windows
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@ImproperShutdown 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Type 2
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@DisplayName aswSnx
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Group FSFilter Virtualization
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@DependOnService FltMgr?
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Description avast! virtualization driver (aswSnx)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Tag 2
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances@DefaultInstance aswSnx Instance
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance@Altitude 137600
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance@Flags 0
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters@ProgramFolder \DosDevices\C:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@DisplayName aswSP
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@Description avast! Self Protection
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@BehavShield 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@ProgramFolder \DosDevices\C:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@ProgramFilesFolder \DosDevices\C:\Program Files
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@GadgetFolder \DosDevices\C:\Program Files\Windows Sidebar\Shared Gadgets\aswSidebar.gadget
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@DisplayName avast! Network Shield Support
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Group PNP_TDI
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@DependOnService tcpip?
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Description avast! Network Shield TDI driver
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Tag 9
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@Start 0
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@DisplayName aswVmm
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@Description avast! VM Monitor
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Type 32
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Start 2
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ImagePath "C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@DisplayName avast! Antivirus
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Group ShellSvcGroup
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@DependOnService aswMonFlt?RpcSS?
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@WOW64 1
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ObjectName LocalSystem
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ServiceSidType 1
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Description Instaluje i zarz?dza us?ugami antywirusowymi programu avast! na tym komputerze, co obejmuje rezydentny skaner, kwarantann? oraz harmonogram zada?.
---- EOF - GMER 2.1 ----
OTL:
- Kod: Zaznacz wszystko
OTL logfile created on: 2014-02-02 13:13:01 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\DOMOWY\Desktop
64bit- Professional (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd
4,00 Gb Total Physical Memory | 2,12 Gb Available Physical Memory | 53,00% Memory free
8,00 Gb Paging File | 5,82 Gb Available in Paging File | 72,78% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 49,95 Gb Total Space | 10,47 Gb Free Space | 20,96% Space Free | Partition Type: NTFS
Drive D: | 99,00 Gb Total Space | 40,20 Gb Free Space | 40,61% Space Free | Partition Type: NTFS
Drive E: | 149,04 Gb Total Space | 80,43 Gb Free Space | 53,96% Space Free | Partition Type: NTFS
Computer Name: DOM-DOMOWY | User Name: DOMOWY | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
[color=#E56717]========== Processes (SafeList) ==========[/color]
PRC - [2014-02-02 12:38:34 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\DOMOWY\Desktop\OTL.exe
PRC - [2014-01-03 19:17:06 | 000,275,568 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2013-12-29 11:12:42 | 000,943,408 | ---- | M] () -- C:\Windows\SysWOW64\jmdp\stij.exe
PRC - [2013-12-10 22:38:23 | 001,862,536 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe
PRC - [2013-05-09 09:58:30 | 004,858,968 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2013-05-09 09:58:30 | 000,046,808 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2013-03-22 05:07:18 | 000,093,072 | ---- | M] (TomTom) -- C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
PRC - [2012-12-18 15:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012-08-15 18:08:34 | 000,231,768 | ---- | M] (SweetIM Technologies Ltd.) -- C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe
PRC - [2012-07-03 09:04:58 | 000,507,312 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
PRC - [2011-07-29 20:31:40 | 001,249,064 | ---- | M] () -- C:\ProgramData\TVersity\Media Server\MediaServer.exe
PRC - [2010-04-05 20:55:01 | 000,116,104 | ---- | M] () -- C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
PRC - [2010-04-02 09:18:54 | 001,185,112 | ---- | M] (CANON INC.) -- C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
PRC - [2010-03-25 14:39:22 | 000,490,280 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Nero\Update\NASvc.exe
PRC - [2010-03-11 14:06:06 | 000,193,824 | ---- | M] (Protexis Inc.) -- C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
[color=#E56717]========== Modules (No Company Name) ==========[/color]
MOD - [2014-01-03 19:17:05 | 003,559,024 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
MOD - [2013-12-29 11:12:44 | 001,150,256 | ---- | M] () -- C:\Windows\SysWOW64\jmdp\lmrn.dll
MOD - [2013-12-29 11:12:42 | 000,943,408 | ---- | M] () -- C:\Windows\SysWOW64\jmdp\stij.exe
MOD - [2013-12-10 22:38:22 | 016,242,056 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll
MOD - [2009-06-17 11:40:16 | 007,745,536 | ---- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll
MOD - [2009-06-17 11:40:16 | 002,121,728 | ---- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll
MOD - [2009-06-17 11:40:16 | 000,135,168 | ---- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll
MOD - [2007-04-09 09:42:00 | 000,148,480 | ---- | M] () -- C:\Windows\SysWOW64\OemSpiE.dll
MOD - [2007-03-27 13:11:30 | 000,105,472 | ---- | M] () -- C:\Windows\SysWOW64\APOMngr.dll
MOD - [2007-03-15 11:09:00 | 000,067,072 | ---- | M] () -- C:\Windows\SysWOW64\CmdRtr.dll
[color=#E56717]========== Services (SafeList) ==========[/color]
SRV:[b]64bit:[/b] - [2013-12-29 11:12:40 | 001,833,776 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\dmwu.exe -- (IBUpdaterService)
SRV:[b]64bit:[/b] - [2013-05-09 09:58:30 | 000,046,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV:[b]64bit:[/b] - [2012-12-19 20:56:00 | 000,240,640 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:[b]64bit:[/b] - [2009-07-14 02:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:[b]64bit:[/b] - [2009-07-14 02:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2014-01-03 19:17:05 | 000,119,408 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013-12-10 22:38:23 | 000,257,416 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013-08-25 13:58:22 | 000,008,192 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysWOW64\srvany.exe -- (KMService)
SRV - [2013-03-22 05:07:18 | 000,093,072 | ---- | M] (TomTom) [Auto | Running] -- C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe -- (TomTomHOMEService)
SRV - [2012-12-18 15:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012-10-03 15:51:04 | 000,725,400 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2011-07-29 20:31:40 | 001,249,064 | ---- | M] () [Auto | Running] -- C:\ProgramData\TVersity\Media Server\MediaServer.exe -- (TVersityMediaServer)
SRV - [2010-04-05 20:55:01 | 000,116,104 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE -- (IJPLMSVC)
SRV - [2010-03-25 14:39:22 | 000,490,280 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate)
SRV - [2010-03-25 10:25:22 | 030,969,208 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- E:\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)
SRV - [2010-03-18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010-03-11 14:06:06 | 000,193,824 | ---- | M] (Protexis Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)
SRV - [2010-02-19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2009-07-16 17:04:16 | 000,316,664 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2009-06-10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
[color=#E56717]========== Driver Services (SafeList) ==========[/color]
DRV:[b]64bit:[/b] - [2013-07-15 10:31:50 | 001,030,952 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswSnx.sys -- (aswSnx)
DRV:[b]64bit:[/b] - [2013-07-15 10:31:50 | 000,378,944 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswSP.sys -- (aswSP)
DRV:[b]64bit:[/b] - [2013-07-15 10:31:50 | 000,189,936 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\aswVmm.sys -- (aswVmm)
DRV:[b]64bit:[/b] - [2013-05-09 09:59:07 | 000,072,016 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr2.sys -- (aswRdr)
DRV:[b]64bit:[/b] - [2013-05-09 09:59:07 | 000,065,336 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\aswRvrt.sys -- (aswRvrt)
DRV:[b]64bit:[/b] - [2013-05-09 09:59:07 | 000,064,288 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswTdi.sys -- (aswTdi)
DRV:[b]64bit:[/b] - [2013-05-09 09:59:06 | 000,080,816 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV:[b]64bit:[/b] - [2013-05-09 09:59:06 | 000,033,400 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV:[b]64bit:[/b] - [2012-12-19 21:48:48 | 011,278,336 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:[b]64bit:[/b] - [2012-12-19 20:32:54 | 000,552,960 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:[b]64bit:[/b] - [2012-11-06 12:11:52 | 000,096,256 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)
DRV:[b]64bit:[/b] - [2012-06-27 15:18:52 | 000,026,112 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys -- (pccsmcfd)
DRV:[b]64bit:[/b] - [2012-06-11 14:17:44 | 000,027,136 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ccdcmbox64.sys -- (nmwcdc)
DRV:[b]64bit:[/b] - [2012-06-11 14:17:44 | 000,019,968 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ccdcmbx64.sys -- (nmwcd)
DRV:[b]64bit:[/b] - [2012-06-11 14:17:44 | 000,009,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser_lowerfltjx64.sys -- (UsbserFilt)
DRV:[b]64bit:[/b] - [2012-06-11 14:17:44 | 000,009,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser_lowerfltx64.sys -- (upperdev)
DRV:[b]64bit:[/b] - [2010-11-15 13:29:02 | 000,533,280 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SRS_HDAL_amd64.sys -- (SRS_HDAL_Service)
DRV:[b]64bit:[/b] - [2009-08-13 22:10:18 | 000,073,984 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xusb21.sys -- (xusb21)
DRV:[b]64bit:[/b] - [2009-07-14 02:52:21 | 000,106,576 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:[b]64bit:[/b] - [2009-07-14 02:52:21 | 000,028,752 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:[b]64bit:[/b] - [2009-07-14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:[b]64bit:[/b] - [2009-07-14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:[b]64bit:[/b] - [2009-07-14 02:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:[b]64bit:[/b] - [2009-07-14 02:47:48 | 000,023,104 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:[b]64bit:[/b] - [2009-07-14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:[b]64bit:[/b] - [2009-07-14 01:06:32 | 000,032,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser.sys -- (usbser)
DRV:[b]64bit:[/b] - [2009-06-10 21:35:42 | 000,187,392 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:[b]64bit:[/b] - [2009-06-10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:[b]64bit:[/b] - [2009-06-10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:[b]64bit:[/b] - [2009-06-10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:[b]64bit:[/b] - [2009-06-10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:[b]64bit:[/b] - [2007-11-26 04:16:32 | 000,086,016 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\jraid.sys -- (JRAID)
DRV:[b]64bit:[/b] - [2007-06-13 09:55:56 | 001,272,320 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\P17.sys -- (P17)
DRV:[b]64bit:[/b] - [2007-04-17 11:51:50 | 000,014,112 | ---- | M] (InterVideo) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\regi.sys -- (regi)
DRV:[b]64bit:[/b] - [2007-04-17 11:51:50 | 000,014,112 | ---- | M] (InterVideo) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\regi.sys -- (6077757b)
DRV - [2009-07-14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2008-04-23 09:42:20 | 000,075,096 | ---- | M] (Your Corporation) [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\MSI\DualCoreCenter\RushTop64.sys -- (RushTopDevice2)
DRV - [2008-02-27 07:22:28 | 000,040,248 | ---- | M] (MICRO-STAR INT'L CO., LTD.) [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\MSI\DualCoreCenter\NTGLM7X64.sys -- (DualCoreCenter)
[color=#E56717]========== Standard Registry (SafeList) ==========[/color]
[color=#E56717]========== Internet Explorer ==========[/color]
IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
IE - HKLM\..\SearchScopes,DefaultScope = {EEE6C360-6118-11DC-9C72-001320C79847}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2280857462-3087976840-2291809120-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/
IE - HKU\S-1-5-21-2280857462-3087976840-2291809120-1001\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - SOFTWARE\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}\InprocServer32 File not found
IE - HKU\S-1-5-21-2280857462-3087976840-2291809120-1001\..\URLSearchHook: {ff65fdbc-5683-4dfd-9113-1fcb5b0a3447} - No CLSID value found
IE - HKU\S-1-5-21-2280857462-3087976840-2291809120-1001\..\SearchScopes,DefaultScope = {899D6A72-6F1E-4AC7-AB09-06AD785AE3DD}
IE - HKU\S-1-5-21-2280857462-3087976840-2291809120-1001\..\SearchScopes\{899D6A72-6F1E-4AC7-AB09-06AD785AE3DD}: "URL" = http://www.google.com/search?hl=pl&q={searchTerms}
IE - HKU\S-1-5-21-2280857462-3087976840-2291809120-1001\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://mysearch.sweetpacks.com?src=6&q={searchTerms}&barid=&
IE - HKU\S-1-5-21-2280857462-3087976840-2291809120-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2280857462-3087976840-2291809120-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
[color=#E56717]========== FireFox ==========[/color]
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.pl/"
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:26.0
FF - prefs.js..extensions.enabledItems: {7b13ec3e-999a-4b70-b9cb-2617b8323822}:3.3.3.2
FF - prefs.js..keyword.URL: "http://mysearch.sweetpacks.com?src=6&barid=&&st=23&q="
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll File not found
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.15.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.15.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: E:\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: E:\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.7: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\DOMOWY\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\DOMOWY\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-07-14 12:53:20 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 26.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2014-01-03 19:16:59 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 26.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2014-01-03 19:17:00 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 12.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012-04-22 21:28:34 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 12.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
[2011-08-11 11:14:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\DOMOWY\AppData\Roaming\mozilla\Extensions
[2011-08-11 11:14:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\DOMOWY\AppData\Roaming\mozilla\Extensions\home2@tomtom.com
[2013-10-24 17:31:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\DOMOWY\AppData\Roaming\mozilla\Firefox\Profiles\8g1wrw59.default\extensions
[2013-06-17 15:05:11 | 000,001,294 | ---- | M] () -- C:\Users\DOMOWY\AppData\Roaming\mozilla\firefox\profiles\8g1wrw59.default\searchplugins\delta.xml
[2013-09-17 13:05:19 | 000,002,120 | ---- | M] () -- C:\Users\DOMOWY\AppData\Roaming\mozilla\firefox\profiles\8g1wrw59.default\searchplugins\MyStart.xml
[2014-02-02 12:42:31 | 000,001,595 | ---- | M] () -- C:\Users\DOMOWY\AppData\Roaming\mozilla\firefox\profiles\8g1wrw59.default\searchplugins\Sweetpacks Search.xml
[2014-01-03 19:16:59 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2014-01-03 19:16:59 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions
[2014-01-03 19:17:06 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2011-07-11 22:48:12 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
[color=#E56717]========== Chrome ==========[/color]
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&xssi=t&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter},
CHR - homepage: http://www.google.pl/
CHR - Extension: Dokumenty Google = C:\Users\DOMOWY\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\
CHR - Extension: Dokumenty Google = C:\Users\DOMOWY\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\
CHR - Extension: Dysk Google = C:\Users\DOMOWY\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\
CHR - Extension: Dysk Google = C:\Users\DOMOWY\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Users\DOMOWY\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: YouTube = C:\Users\DOMOWY\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Szukaj w Google = C:\Users\DOMOWY\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Szukaj w Google = C:\Users\DOMOWY\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: Tampermonkey = C:\Users\DOMOWY\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdgffkkebhmkfjojejmpbldmpobfkfo\3.5.3630.77_0\
CHR - Extension: Tampermonkey = C:\Users\DOMOWY\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdgffkkebhmkfjojejmpbldmpobfkfo\3.6.3737.80_0\
CHR - Extension: Tampermonkey = C:\Users\DOMOWY\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdgffkkebhmkfjojejmpbldmpobfkfo\3.6.3737_0\
CHR - Extension: MonoChrome = C:\Users\DOMOWY\AppData\Local\Google\Chrome\User Data\Default\Extensions\idnlphmmcijokifloflhecnkkhbpdnnk\1.2_0\
CHR - Extension: Google Wallet = C:\Users\DOMOWY\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0\
CHR - Extension: Google Wallet = C:\Users\DOMOWY\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\
CHR - Extension: Google Wallet = C:\Users\DOMOWY\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_1\
CHR - Extension: Google Wallet = C:\Users\DOMOWY\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_2\
CHR - Extension: Google Wallet = C:\Users\DOMOWY\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_3\
CHR - Extension: Gmail = C:\Users\DOMOWY\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
CHR - Extension: Gmail = C:\Users\DOMOWY\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\
O1 HOSTS File: ([2013-06-18 16:31:00 | 000,000,854 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 activate.adobe.com
O2:[b]64bit:[/b] - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - E:\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - E:\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (SweetPacks Browser Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll File not found
O2 - BHO: (Yontoo) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files (x86)\Yontoo\YontooIEClient.dll (Yontoo LLC)
O3:[b]64bit:[/b] - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O3:[b]64bit:[/b] - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll File not found
O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll File not found
O3:[b]64bit:[/b] - HKU\S-1-5-21-2280857462-3087976840-2291809120-1001\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll File not found
O3 - HKU\S-1-5-21-2280857462-3087976840-2291809120-1001\..\Toolbar\WebBrowser: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O3 - HKU\S-1-5-21-2280857462-3087976840-2291809120-1001\..\Toolbar\WebBrowser: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll File not found
O4:[b]64bit:[/b] - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:[b]64bit:[/b] - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [20131121] C:\Program Files\AVAST Software\Avast\setup\emupdate\c5047cbb-4e08-44d4-b6bd-8d7593c75028.exe (AVAST Software)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [BCSSync] E:\Office14\BCSSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [CanonSolutionMenuEx] C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE (CANON INC.)
O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe ()
O4 - HKLM..\Run: [P17RunE] C:\Windows\SysWow64\P17RunE.dll (Creative Technology Ltd.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [Sweetpacks Communicator] C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe (SweetIM Technologies Ltd.)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-2280857462-3087976840-2291809120-1001..\Run: [AdobeBridge] File not found
O4 - HKU\S-1-5-21-2280857462-3087976840-2291809120-1001..\Run: [EA Core] "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent File not found
O4 - HKU\S-1-5-21-2280857462-3087976840-2291809120-1001..\Run: [Facebook Update] C:\Users\DOMOWY\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - HKU\S-1-5-21-2280857462-3087976840-2291809120-1001..\Run: [Steam] D:\Steam\Steam.exe (Valve Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\DOMOWY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Media Player.lnk = File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\S-1-5-21-2280857462-3087976840-2291809120-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8:[b]64bit:[/b] - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O8:[b]64bit:[/b] - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\DOMOWY\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8:[b]64bit:[/b] - Extra context menu item: Search the Web - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\menuext.html File not found
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\DOMOWY\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Search the Web - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\menuext.html File not found
O9 - Extra Button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: &Notatki połączone programu OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - E:\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Notatki połączone programu OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - E:\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O13[b]64bit:[/b] - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 10.15.2)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CD31060B-E1D9-49F0-967E-EEDC64C2476D}: DhcpNameServer = 192.168.1.1
O18:[b]64bit:[/b] - Protocol\Handler\ms-help - No CLSID value found
O20:[b]64bit:[/b] - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:[b]64bit:[/b] - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - E:\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{46f97aba-f5a1-11e1-947f-002185124066}\Shell - "" = AutoRun
O33 - MountPoints2\{46f97aba-f5a1-11e1-947f-002185124066}\Shell\AutoRun\command - "" = H:\unlock.exe autoplay=true
O33 - MountPoints2\{986e0126-3d0a-11e0-9707-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{986e0126-3d0a-11e0-9707-806e6f6e6963}\Shell\AutoRun\command - "" = F:\Setup.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:[b]64bit:[/b] - HKLM\..comfile [open] -- "%1" %*
O35:[b]64bit:[/b] - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:[b]64bit:[/b] - HKLM\...com [@ = comfile] -- "%1" %*
O37:[b]64bit:[/b] - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
[2014-02-02 12:38:34 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\DOMOWY\Desktop\OTL.exe
[2014-02-02 12:37:21 | 000,000,000 | ---D | C] -- C:\Users\DOMOWY\Desktop\gmer
[2014-02-02 12:35:03 | 000,623,224 | ---- | C] (Duplex Secure Ltd.) -- C:\Users\DOMOWY\Desktop\SPTDinst-v186-x64.exe
[2014-02-01 14:48:03 | 000,000,000 | ---D | C] -- C:\Users\DOMOWY\Desktop\Nowy folder (4)
[2014-02-01 14:21:59 | 000,000,000 | ---D | C] -- C:\Users\DOMOWY\Desktop\Nowy folder (3)
[2014-01-04 21:34:59 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\ljkb
[2014-01-04 21:34:59 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\jmdp
[2014-01-03 21:16:14 | 000,000,000 | ---D | C] -- C:\Users\DOMOWY\Desktop\2014_01_03
[2014-01-03 19:16:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
[2014-02-02 12:47:30 | 000,020,032 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2014-02-02 12:47:30 | 000,020,032 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2014-02-02 12:42:31 | 000,001,044 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2014-02-02 12:42:05 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2014-02-02 12:41:59 | 3220,578,304 | -HS- | M] () -- C:\hiberfil.sys
[2014-02-02 12:38:34 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\DOMOWY\Desktop\OTL.exe
[2014-02-02 12:38:01 | 000,000,930 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2014-02-02 12:37:13 | 000,370,943 | ---- | M] () -- C:\Users\DOMOWY\Desktop\gmer.zip
[2014-02-02 12:35:04 | 000,623,224 | ---- | M] (Duplex Secure Ltd.) -- C:\Users\DOMOWY\Desktop\SPTDinst-v186-x64.exe
[2014-02-02 12:35:00 | 001,671,632 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2014-02-02 12:35:00 | 000,741,182 | ---- | M] () -- C:\Windows\SysNative\perfh015.dat
[2014-02-02 12:35:00 | 000,654,946 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2014-02-02 12:35:00 | 000,155,778 | ---- | M] () -- C:\Windows\SysNative\perfc015.dat
[2014-02-02 12:35:00 | 000,121,818 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2014-02-02 12:31:00 | 000,001,048 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2014-02-01 22:37:01 | 000,000,932 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2280857462-3087976840-2291809120-1001UA.job
[2014-02-01 16:37:00 | 000,000,910 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2280857462-3087976840-2291809120-1001Core.job
[2014-01-28 20:05:47 | 000,002,189 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2014-01-17 15:49:33 | 000,321,923 | ---- | M] () -- C:\Users\DOMOWY\tumblr_mstkdtJcUv1s2p528o1_1280.jpg
[2014-01-17 15:02:24 | 000,040,271 | ---- | M] () -- C:\Users\DOMOWY\tumblr_mrxbnryOWQ1qjfkapo1_500.jpg
[2014-01-16 20:14:31 | 000,048,473 | ---- | M] () -- C:\Users\DOMOWY\1533677_613844958653251_717245275_n.jpg
[2014-01-16 19:06:19 | 000,049,475 | ---- | M] () -- C:\Users\DOMOWY\10.jpg
[2014-01-16 19:06:12 | 000,047,696 | ---- | M] () -- C:\Users\DOMOWY\9.jpg
[2014-01-16 19:06:07 | 000,052,015 | ---- | M] () -- C:\Users\DOMOWY\8.jpg
[2014-01-16 19:05:58 | 000,048,661 | ---- | M] () -- C:\Users\DOMOWY\7.jpg
[2014-01-16 19:05:56 | 000,050,738 | ---- | M] () -- C:\Users\DOMOWY\6.jpg
[2014-01-16 19:05:49 | 000,058,123 | ---- | M] () -- C:\Users\DOMOWY\5.jpg
[2014-01-16 19:05:43 | 000,051,527 | ---- | M] () -- C:\Users\DOMOWY\4.jpg
[2014-01-16 19:05:39 | 000,049,124 | ---- | M] () -- C:\Users\DOMOWY\3.jpg
[2014-01-16 19:05:31 | 000,050,596 | ---- | M] () -- C:\Users\DOMOWY\2.jpg
[2014-01-16 19:05:26 | 000,053,101 | ---- | M] () -- C:\Users\DOMOWY\1.jpg
[2014-01-10 22:22:57 | 000,059,239 | ---- | M] () -- C:\Users\DOMOWY\1601107_447443115382565_1125909447_n.jpg
[1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[color=#E56717]========== Files Created - No Company Name ==========[/color]
[2014-02-02 12:37:16 | 000,370,943 | ---- | C] () -- C:\Users\DOMOWY\Desktop\gmer.zip
[2014-01-17 15:49:27 | 000,321,923 | ---- | C] () -- C:\Users\DOMOWY\tumblr_mstkdtJcUv1s2p528o1_1280.jpg
[2014-01-17 15:02:19 | 000,040,271 | ---- | C] () -- C:\Users\DOMOWY\tumblr_mrxbnryOWQ1qjfkapo1_500.jpg
[2014-01-16 20:14:30 | 000,048,473 | ---- | C] () -- C:\Users\DOMOWY\1533677_613844958653251_717245275_n.jpg
[2014-01-16 19:06:17 | 000,049,475 | ---- | C] () -- C:\Users\DOMOWY\10.jpg
[2014-01-16 19:06:11 | 000,047,696 | ---- | C] () -- C:\Users\DOMOWY\9.jpg
[2014-01-16 19:06:05 | 000,052,015 | ---- | C] () -- C:\Users\DOMOWY\8.jpg
[2014-01-16 19:05:58 | 000,048,661 | ---- | C] () -- C:\Users\DOMOWY\7.jpg
[2014-01-16 19:05:53 | 000,050,738 | ---- | C] () -- C:\Users\DOMOWY\6.jpg
[2014-01-16 19:05:49 | 000,058,123 | ---- | C] () -- C:\Users\DOMOWY\5.jpg
[2014-01-16 19:05:43 | 000,051,527 | ---- | C] () -- C:\Users\DOMOWY\4.jpg
[2014-01-16 19:05:36 | 000,049,124 | ---- | C] () -- C:\Users\DOMOWY\3.jpg
[2014-01-16 19:05:31 | 000,050,596 | ---- | C] () -- C:\Users\DOMOWY\2.jpg
[2014-01-16 19:05:24 | 000,053,101 | ---- | C] () -- C:\Users\DOMOWY\1.jpg
[2014-01-10 22:22:56 | 000,059,239 | ---- | C] () -- C:\Users\DOMOWY\1601107_447443115382565_1125909447_n.jpg
[2013-12-23 22:57:54 | 000,000,966 | ---- | C] () -- C:\Users\DOMOWY\block.bat
[2013-08-25 13:59:13 | 000,008,192 | ---- | C] () -- C:\Windows\SysWow64\srvany.exe
[2013-07-14 12:39:50 | 000,217,088 | ---- | C] () -- C:\Windows\NVGfxOgl.dll
[2013-04-15 14:30:14 | 001,646,154 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2013-04-10 19:01:50 | 000,000,132 | ---- | C] () -- C:\Users\DOMOWY\AppData\Roaming\Preferencje Adobe CS5 dla formatu PNG
[2012-12-03 16:47:52 | 000,000,193 | ---- | C] () -- C:\Windows\WORDPAD.INI
[2012-06-11 17:50:16 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2012-06-11 17:50:16 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2012-05-02 13:58:10 | 000,029,184 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll
[2012-01-27 21:30:34 | 000,000,213 | -H-- | C] () -- C:\Users\DOMOWY\.picasa.ini
[2012-01-14 21:24:18 | 000,006,144 | ---- | C] () -- C:\Users\DOMOWY\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012-01-10 19:48:08 | 000,044,032 | -H-- | C] () -- C:\Users\DOMOWY\photothumb.db
[2011-02-20 22:40:52 | 000,000,088 | RHS- | C] () -- C:\ProgramData\2ABB18C617.sys
[2011-02-20 22:40:51 | 000,002,828 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys
[color=#E56717]========== ZeroAccess Check ==========[/color]
[2009-07-14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2010-07-27 15:59:11 | 014,162,944 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2010-07-27 15:03:24 | 012,867,584 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009-07-14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009-07-14 02:15:20 | 000,605,696 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009-07-14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
[color=#E56717]========== LOP Check ==========[/color]
[2012-03-24 20:47:35 | 000,000,000 | ---D | M] -- C:\Users\DOMOWY\AppData\Roaming\.minecraft
[2012-01-31 21:31:53 | 000,000,000 | ---D | M] -- C:\Users\DOMOWY\AppData\Roaming\Ashampoo
[2013-06-17 15:04:58 | 000,000,000 | ---D | M] -- C:\Users\DOMOWY\AppData\Roaming\BabSolution
[2013-06-17 15:04:33 | 000,000,000 | ---D | M] -- C:\Users\DOMOWY\AppData\Roaming\Babylon
[2012-03-29 18:03:20 | 000,000,000 | ---D | M] -- C:\Users\DOMOWY\AppData\Roaming\BESTplayer
[2011-03-13 22:07:50 | 000,000,000 | ---D | M] -- C:\Users\DOMOWY\AppData\Roaming\BlackBean
[2011-09-04 12:19:42 | 000,000,000 | ---D | M] -- C:\Users\DOMOWY\AppData\Roaming\Canon
[2012-05-05 09:35:51 | 000,000,000 | ---D | M] -- C:\Users\DOMOWY\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2011-10-31 20:52:21 | 000,000,000 | ---D | M] -- C:\Users\DOMOWY\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
[2011-05-01 16:54:28 | 000,000,000 | ---D | M] -- C:\Users\DOMOWY\AppData\Roaming\COWON
[2011-02-20 19:28:14 | 000,000,000 | ---D | M] -- C:\Users\DOMOWY\AppData\Roaming\DAEMON Tools Lite
[2012-10-31 15:59:02 | 000,000,000 | ---D | M] -- C:\Users\DOMOWY\AppData\Roaming\DVDVideoSoft
[2012-10-31 15:58:48 | 000,000,000 | ---D | M] -- C:\Users\DOMOWY\AppData\Roaming\DVDVideoSoftIEHelpers
[2011-10-22 17:46:05 | 000,000,000 | ---D | M] -- C:\Users\DOMOWY\AppData\Roaming\EurekaLog
[2013-04-24 16:36:15 | 000,000,000 | ---D | M] -- C:\Users\DOMOWY\AppData\Roaming\foobar2000
[2012-01-05 14:17:02 | 000,000,000 | ---D | M] -- C:\Users\DOMOWY\AppData\Roaming\Gadu-Gadu 10
[2013-01-17 15:57:33 | 000,000,000 | ---D | M] -- C:\Users\DOMOWY\AppData\Roaming\GG
[2012-04-21 18:33:05 | 000,000,000 | ---D | M] -- C:\Users\DOMOWY\AppData\Roaming\gtk-2.0
[2012-01-21 20:40:39 | 000,000,000 | ---D | M] -- C:\Users\DOMOWY\AppData\Roaming\Happy Artist Studio
[2012-11-02 12:34:33 | 000,000,000 | ---D | M] -- C:\Users\DOMOWY\AppData\Roaming\ipla
[2013-01-31 15:59:23 | 000,000,000 | ---D | M] -- C:\Users\DOMOWY\AppData\Roaming\IVONA ControlCenter
[2013-02-10 22:24:12 | 000,000,000 | ---D | M] -- C:\Users\DOMOWY\AppData\Roaming\LG Electronics
[2013-04-16 17:20:19 | 000,000,000 | ---D | M] -- C:\Users\DOMOWY\AppData\Roaming\NCdownloader
[2012-10-31 15:58:29 | 000,000,000 | ---D | M] -- C:\Users\DOMOWY\AppData\Roaming\OpenCandy
[2011-06-18 10:11:07 | 000,000,000 | ---D | M] -- C:\Users\DOMOWY\AppData\Roaming\OpenFM
[2013-12-22 15:16:15 | 000,000,000 | ---D | M] -- C:\Users\DOMOWY\AppData\Roaming\Origin
[2012-12-23 17:46:55 | 000,000,000 | ---D | M] -- C:\Users\DOMOWY\AppData\Roaming\PC Suite
[2011-11-01 20:44:30 | 000,000,000 | ---D | M] -- C:\Users\DOMOWY\AppData\Roaming\Ph03nixNewMedia
[2012-03-02 20:13:27 | 000,000,000 | ---D | M] -- C:\Users\DOMOWY\AppData\Roaming\PhotoScape
[2012-11-24 11:59:10 | 000,000,000 | ---D | M] -- C:\Users\DOMOWY\AppData\Roaming\Rovio
[2012-02-15 14:02:07 | 000,000,000 | ---D | M] -- C:\Users\DOMOWY\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2012-04-22 21:28:38 | 000,000,000 | ---D | M] -- C:\Users\DOMOWY\AppData\Roaming\Thunderbird
[2011-08-11 11:14:11 | 000,000,000 | ---D | M] -- C:\Users\DOMOWY\AppData\Roaming\TomTom
[2012-10-31 15:59:05 | 000,000,000 | ---D | M] -- C:\Users\DOMOWY\AppData\Roaming\TuneUp Software
[2011-07-29 09:52:59 | 000,000,000 | ---D | M] -- C:\Users\DOMOWY\AppData\Roaming\Unity
[2014-01-31 22:08:18 | 000,000,000 | ---D | M] -- C:\Users\DOMOWY\AppData\Roaming\uTorrent
[color=#E56717]========== Purity Check ==========[/color]
[color=#E56717]========== Alternate Data Streams ==========[/color]
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:3B07E6F4
< End of report >
EXTRAS:
- Kod: Zaznacz wszystko
OTL Extras logfile created on: 2014-02-02 13:13:01 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\DOMOWY\Desktop
64bit- Professional (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd
4,00 Gb Total Physical Memory | 2,12 Gb Available Physical Memory | 53,00% Memory free
8,00 Gb Paging File | 5,82 Gb Available in Paging File | 72,78% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 49,95 Gb Total Space | 10,47 Gb Free Space | 20,96% Space Free | Partition Type: NTFS
Drive D: | 99,00 Gb Total Space | 40,20 Gb Free Space | 40,61% Space Free | Partition Type: NTFS
Drive E: | 149,04 Gb Total Space | 80,43 Gb Free Space | 53,96% Space Free | Partition Type: NTFS
Computer Name: DOM-DOMOWY | User Name: DOMOWY | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
[color=#E56717]========== Extra Registry (SafeList) ==========[/color]
[color=#E56717]========== File Associations ==========[/color]
[b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
[HKEY_USERS\S-1-5-21-2280857462-3087976840-2291809120-1001\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
[color=#E56717]========== Shell Spawning ==========[/color]
[b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "E:\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "E:\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] -- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- D:\photoshop\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [TVersity] -- "C:\ProgramData\TVersity\Media Server\GUILaunch.exe" -type "folder" -url "%1" -title "" -tags "" ()
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "E:\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "E:\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] -- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- D:\photoshop\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [TVersity] -- "C:\ProgramData\TVersity\Media Server\GUILaunch.exe" -type "folder" -url "%1" -title "" -tags "" ()
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[color=#E56717]========== Security Center Settings ==========[/color]
[b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
[b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
[color=#E56717]========== Firewall Settings ==========[/color]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[color=#E56717]========== Authorized Applications List ==========[/color]
[color=#E56717]========== Vista Active Open Ports Exception List ==========[/color]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0C437E58-7010-4726-942E-3932AA44E7FB}" = rport=137 | protocol=17 | dir=out | app=system |
"{0F939737-207C-4A71-9187-FA10026BE629}" = lport=10243 | protocol=6 | dir=in | app=system |
"{16ABFC8F-0581-43A3-95C5-94BE04B4D5C6}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{291B170B-40D1-42D5-A1FD-14FC7D1F8849}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{2B2ECCE7-4CAB-47AD-AC28-F0FE970E8886}" = lport=2869 | protocol=6 | dir=in | app=system |
"{2FA1EDC1-C9D8-48AA-99C3-27A6AAD01820}" = rport=10243 | protocol=6 | dir=out | app=system |
"{3ABF0657-AB1C-4A5E-A361-478775068848}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{63821CF2-CDF7-44B4-BAC9-C655CDE406F0}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{68BC82DC-0729-4BF8-A8B8-C8F76723BAD9}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{88CA36C4-C360-4F24-8BF1-AEACAA165984}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{94490ACD-4092-4841-896C-7D2075F8E8BC}" = lport=445 | protocol=6 | dir=in | app=system |
"{95CD1BFE-5ED6-431A-A8DD-4EC2444F7C03}" = lport=139 | protocol=6 | dir=in | app=system |
"{95E6DA66-2645-4C20-BC6A-4F6D1D3F7933}" = rport=445 | protocol=6 | dir=out | app=system |
"{B167095C-3CBF-423F-9206-FE39E5C04637}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{CCFE722A-B3F2-4B2B-A635-A485C0F1A0A6}" = lport=137 | protocol=17 | dir=in | app=system |
"{D275A62A-56B2-438D-867A-36509CD01905}" = lport=6004 | protocol=17 | dir=in | app=e:\office14\outlook.exe |
"{DF89553D-DCB1-4E0A-A022-4AE39D157B08}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{E39CABB9-CC75-4F76-82D7-277EA3B157EE}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{E84F2876-B12F-4BE4-AB2A-235D7B7712BD}" = lport=138 | protocol=17 | dir=in | app=system |
"{E96EEDF9-607B-401E-AB95-02EEAB0C02E7}" = rport=139 | protocol=6 | dir=out | app=system |
"{F543CD69-2E88-4CE2-9BAC-EE05BC66C238}" = rport=138 | protocol=17 | dir=out | app=system |
"{FFBCD9A1-EA1B-4244-96B9-F9B9DBAAB3CA}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
[color=#E56717]========== Vista Active Application Exception List ==========[/color]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{033815F2-2FCB-4324-8966-7E4E056BD81C}" = protocol=6 | dir=in | app=e:\office14\groove.exe |
"{0708E5BA-C716-44DF-98F1-85EB2CF16A33}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{077790FE-8F1C-47B2-89EF-E5274FACE51A}" = protocol=6 | dir=in | app=d:\steam\steamapps\common\call of duty black ops\blackopsmp.exe |
"{0A0DB5CB-46AA-4767-82DA-F72D2BB6D5AA}" = protocol=6 | dir=in | app=d:\steam\steamapps\common\call of duty black ops\blackops.exe |
"{0DC3A056-3941-419F-8C45-23B6991ED65D}" = protocol=6 | dir=in | app=c:\program files (x86)\sweetim\communicator\sweetpacksupdatemanager.exe |
"{0F7A60C2-C433-4468-8A70-FEF2FCE6DB6A}" = protocol=6 | dir=in | app=c:\windows\syswow64\msiexec.exe |
"{0F9A97F8-BBBC-49D5-8947-FA17989143F1}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{14BDC9ED-B97C-4E48-9001-730CB913E757}" = protocol=17 | dir=in | app=c:\windows\syswow64\arfc\wrtc.exe |
"{1B5AE0EA-3EDC-4418-9190-B218E6A56788}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{1B9E050C-4431-4D89-901F-D6A9137E11A9}" = protocol=6 | dir=in | app=d:\steam\steam.exe |
"{1E39A978-88B9-487E-B122-7A04D20D5AEC}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{1F6C4805-E803-4489-A551-C7E00CBC1C3C}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{222F2C59-D35A-44D3-99BD-7F2FD2A6800E}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{2DDAD3CE-DE9A-42CF-A341-5BA3E647FBFC}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{317CA4D8-D67E-4BD2-8B4F-FC50E1199B3C}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{320E534C-F53A-472B-BEA4-1FB269E9F5E1}" = dir=in | app=c:\programdata\tversity\media server\mediaserver.exe |
"{39DF8164-840B-4625-872B-7575909A7207}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{46FBE7CB-C88E-4CC8-B75D-0122EB60B0D3}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{53FA021F-3B7F-4A61-9B8F-4D8BE1B6B8A6}" = protocol=17 | dir=in | app=d:\steam\steam.exe |
"{585AC0E9-B255-407D-8225-F0F454417269}" = protocol=17 | dir=in | app=c:\program files (x86)\sweetim\communicator\sweetpacksupdatemanager.exe |
"{5F5D9EBB-D808-4868-AD74-7DE30175F5A2}" = protocol=6 | dir=in | app=d:\steam\steamapps\common\euro truck simulator 2\bin\win_x86\eurotrucks2.exe |
"{621BD2BB-7512-411E-B4A6-77F2DE38A9E0}" = protocol=17 | dir=in | app=c:\windows\syswow64\arfc\wrtc.exe |
"{6AD35698-85BF-4CF9-80E1-805EE29A15AF}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe |
"{6B624BB8-4601-43ED-B847-F2EDEC406EC0}" = protocol=6 | dir=in | app=c:\windows\system32\dmwu.exe |
"{6EE43E78-975A-4D9C-B243-B4D5FBD34DB8}" = protocol=17 | dir=in | app=e:\office14\onenote.exe |
"{7385E28E-6421-412E-935E-FE120C3116E7}" = dir=in | app=c:\users\domowy\appdata\local\facebook\video\skype\facebookvideocalling.exe |
"{7EA0BAEC-D7B8-4632-9E0A-1005B3017ACC}" = protocol=6 | dir=in | app=e:\office14\onenote.exe |
"{815FC527-7D56-47E3-BD12-3ECF82047543}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{84D46ACF-9676-4CC0-B53E-C963F9AA25B2}" = protocol=6 | dir=in | app=c:\windows\system32\dmwu.exe |
"{86EAD3C0-219B-4F71-BAD3-FFCD0440973C}" = protocol=17 | dir=in | app=c:\users\domowy\appdata\roaming\utorrent\utorrent.exe |
"{94D96AB9-B038-44C6-8132-BC9B2C65D622}" = protocol=17 | dir=in | app=c:\windows\syswow64\msiexec.exe |
"{98445DC6-E2F0-4FA0-A68E-44C01C94D621}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{9999F1DD-BE16-4B14-B68C-F752941E37BA}" = protocol=17 | dir=in | app=c:\windows\system32\dmwu.exe |
"{A105B9CF-ED33-450F-BB27-B474F8B09C39}" = protocol=6 | dir=in | app=d:\office14\groove.exe |
"{A55A9CDB-2098-41A1-98EC-8DC3B1B2F33B}" = protocol=6 | dir=in | app=c:\users\domowy\appdata\roaming\utorrent\utorrent.exe |
"{A8C8ED52-9959-45C1-B573-651340C3AD74}" = protocol=6 | dir=in | app=c:\windows\syswow64\arfc\wrtc.exe |
"{AACF9334-0011-41A0-B7CB-B90E740ACF8F}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{BBD5653B-5D71-44D7-9091-EC9BA08CB279}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{BC3B61BD-C7BF-471E-8296-B2C049392412}" = protocol=17 | dir=in | app=e:\office14\groove.exe |
"{C43E21D9-B77D-49E6-BDE2-2D70729232E8}" = protocol=6 | dir=out | app=system |
"{C94A8C4B-079B-49FC-B205-BC547673C9CC}" = protocol=17 | dir=in | app=d:\steam\steamapps\common\call of duty black ops\blackops.exe |
"{CB9B92B9-515B-4628-BE7F-32969C46ED48}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{E45B64C4-B18D-42EA-992A-54631BF465C8}" = protocol=17 | dir=in | app=d:\steam\steamapps\common\euro truck simulator 2\bin\win_x86\eurotrucks2.exe |
"{E5DA112C-7313-4C4B-B9F4-6C69B80BE99B}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{E8A031F9-333F-4053-A448-1DEA389AF6A5}" = protocol=6 | dir=in | app=c:\windows\syswow64\arfc\wrtc.exe |
"{E916DBD4-3A3F-4DAC-B806-A62B24175297}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{EA5AB2CA-F445-421A-B627-D3D056A25986}" = protocol=17 | dir=in | app=d:\steam\steamapps\common\call of duty black ops\blackopsmp.exe |
"{EE391852-D1DA-49BF-8B68-B00F60BBFC00}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{EF139244-913E-4C10-80B3-3592544B279E}" = protocol=17 | dir=in | app=c:\windows\system32\dmwu.exe |
"TCP Query User{159244E8-B90D-4A68-93F3-2D2DD9A18ED7}C:\program files (x86)\winamp\winamp.exe" = protocol=6 | dir=in | app=c:\program files (x86)\winamp\winamp.exe |
"TCP Query User{4341D622-ED52-4959-89AE-02642EFABCE5}C:\program files (x86)\mozilla firefox\plugin-container.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\plugin-container.exe |
"TCP Query User{6C880420-23DC-4FDE-B51C-B054FAFE7780}C:\users\domowy\appdata\local\temp\9edd.tmp\kmservice.exe" = protocol=6 | dir=in | app=c:\users\domowy\appdata\local\temp\9edd.tmp\kmservice.exe |
"TCP Query User{703DBDA1-B39B-4648-87CB-1F11315B69DA}C:\program files (x86)\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\eadm\core.exe |
"TCP Query User{76205996-B025-4EAA-A0D5-4BE4D605C19F}C:\program files (x86)\wapster\wapster aqq\aqq.exe" = protocol=6 | dir=in | app=c:\program files (x86)\wapster\wapster aqq\aqq.exe |
"TCP Query User{942CB92F-734F-416A-BF3D-F747784637FC}C:\program files (x86)\1clickdownload\1clickdownloader.exe" = protocol=6 | dir=in | app=c:\program files (x86)\1clickdownload\1clickdownloader.exe |
"TCP Query User{9D37B583-B4D1-47B7-82C7-48A32E6A273A}C:\program files (x86)\counter-strike non-steam\counter-strike 1.6\hl.exe" = protocol=6 | dir=in | app=c:\program files (x86)\counter-strike non-steam\counter-strike 1.6\hl.exe |
"TCP Query User{9E6C91D8-F4F3-40A8-877D-DDDEEF080E63}C:\program files (x86)\gadu-gadu 10\gg.exe" = protocol=6 | dir=in | app=c:\program files (x86)\gadu-gadu 10\gg.exe |
"TCP Query User{A04B0A17-FE1E-41AC-B249-B1ED97AE56E3}C:\program files (x86)\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\eadm\core.exe |
"TCP Query User{CA593450-1DBC-44E3-8701-A331BBF1D887}C:\program files (x86)\wapster\wapster aqq\aqq.exe" = protocol=6 | dir=in | app=c:\program files (x86)\wapster\wapster aqq\aqq.exe |
"TCP Query User{D965C51F-EC90-4215-B88E-28FD363CDECA}C:\program files (x86)\gadu-gadu 10\gg.exe" = protocol=6 | dir=in | app=c:\program files (x86)\gadu-gadu 10\gg.exe |
"TCP Query User{DEE0A5DF-C593-4039-AE52-CCC091D4593B}E:\worms revolution\wormsrevolution.exe" = protocol=6 | dir=in | app=e:\worms revolution\wormsrevolution.exe |
"TCP Query User{EF756B21-4358-4C2F-B245-B28BD6E96D3A}D:\steam\steam.exe" = protocol=6 | dir=in | app=d:\steam\steam.exe |
"TCP Query User{F7C66ADA-0258-49B9-8149-F083D9179BB6}C:\program files (x86)\videolan\vlc\vlc.exe" = protocol=6 | dir=in | app=c:\program files (x86)\videolan\vlc\vlc.exe |
"UDP Query User{2E61269C-CDE7-438A-B648-EA346D17E487}C:\users\domowy\appdata\local\temp\9edd.tmp\kmservice.exe" = protocol=17 | dir=in | app=c:\users\domowy\appdata\local\temp\9edd.tmp\kmservice.exe |
"UDP Query User{4094E907-7E15-43B0-9F9E-F5A4FBA35910}C:\program files (x86)\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\eadm\core.exe |
"UDP Query User{474042E1-8D5F-41B9-98B2-D64E1991F75C}C:\program files (x86)\wapster\wapster aqq\aqq.exe" = protocol=17 | dir=in | app=c:\program files (x86)\wapster\wapster aqq\aqq.exe |
"UDP Query User{49E8CAF5-EF90-4447-AFCC-02BDF3EC8FC5}C:\program files (x86)\wapster\wapster aqq\aqq.exe" = protocol=17 | dir=in | app=c:\program files (x86)\wapster\wapster aqq\aqq.exe |
"UDP Query User{5EF7BBA7-330D-49A6-A943-0FDFB1D3E458}C:\program files (x86)\1clickdownload\1clickdownloader.exe" = protocol=17 | dir=in | app=c:\program files (x86)\1clickdownload\1clickdownloader.exe |
"UDP Query User{614C3EE4-A9C0-4E5D-929B-8B3C6185376D}C:\program files (x86)\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\eadm\core.exe |
"UDP Query User{6E375877-C333-41CB-B6EA-277450290C87}C:\program files (x86)\counter-strike non-steam\counter-strike 1.6\hl.exe" = protocol=17 | dir=in | app=c:\program files (x86)\counter-strike non-steam\counter-strike 1.6\hl.exe |
"UDP Query User{72FA9A41-BFC8-45C1-A700-35CC16DE32AC}E:\worms revolution\wormsrevolution.exe" = protocol=17 | dir=in | app=e:\worms revolution\wormsrevolution.exe |
"UDP Query User{80EA4633-2694-42F6-B9AF-A93833F84F61}C:\program files (x86)\videolan\vlc\vlc.exe" = protocol=17 | dir=in | app=c:\program files (x86)\videolan\vlc\vlc.exe |
"UDP Query User{898F1535-E538-4D18-9E0F-412F8331E269}C:\program files (x86)\gadu-gadu 10\gg.exe" = protocol=17 | dir=in | app=c:\program files (x86)\gadu-gadu 10\gg.exe |
"UDP Query User{D7EF38CB-4C62-4016-93B4-FEE6DCAE35DA}D:\steam\steam.exe" = protocol=17 | dir=in | app=d:\steam\steam.exe |
"UDP Query User{E451FAAB-782C-4423-BBAA-3B91BFB9509A}C:\program files (x86)\mozilla firefox\plugin-container.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\plugin-container.exe |
"UDP Query User{EAB70873-A86C-4504-BDEA-C885AA354DDE}C:\program files (x86)\gadu-gadu 10\gg.exe" = protocol=17 | dir=in | app=c:\program files (x86)\gadu-gadu 10\gg.exe |
"UDP Query User{F6464261-7AA1-479F-A1A4-F2FBF43EA64C}C:\program files (x86)\winamp\winamp.exe" = protocol=17 | dir=in | app=c:\program files (x86)\winamp\winamp.exe |
[color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP495_series" = Canon MP495 series MP Drivers
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{4975DE61-6BF6-B9BC-1FDE-C04C5EC78E4C}" = AMD Media Foundation Decoders
"{4D533F05-A3F6-F8A9-F1F6-FA6812089D36}" = AMD Drag and Drop Transcoding
"{4D668D4F-FAA2-4726-834C-31F4614F312E}" = MSVC80_x64_v2
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{5E03A267-415E-5383-FA8F-3CE4145663B9}" = AMD Catalyst Install Manager
"{680EDA59-9266-44B4-949E-0C24F65DFF82}" = Microsoft_VC100_CRT_SP1_x64
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{89EE4A30-080F-2C95-6F78-C98D18FBD74D}" = AMD Accelerated Video Transcoding
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{8E5DA9A6-7A9F-3A6F-BC5C-D6CBCA6A29C7}" = Microsoft .NET Framework 4 Extended PLK Language Pack
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0415-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (Polish) 2010
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{9CF11D16-ECEB-90A5-A028-CA9E068D848B}" = ccc-utility64
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{A49402DD-2781-3782-B0CF-52BDA349E3F3}" = Microsoft .NET Framework 4 Client Profile PLK Language Pack
"{AB071C8B-873C-459F-ACA9-9EBE03C3E89B}" = MSVC90_x64
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA Oprogramowanie systemu PhysX 9.10.0514
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"62BBD193ADFDBB228C7E1ADB56463F5732FF7F6F" = Pakiet sterowników systemu Windows - Nokia pccsmcfd LegacyDriver (05/31/2012 7.1.2.0)
"KLiteCodecPack64_is1" = K-Lite Codec Pack (64-bit) v4.4.4
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile PLK Language Pack" = Polski pakiet językowy dla programu Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended PLK Language Pack" = Polski pakiet językowy dla programu Microsoft .NET Framework 4 Extended
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{017F8447-2A1D-0DDB-B5D7-CA2BFACE2886}" = CCC Help French
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{054E9A1C-3EA2-C657-E787-FD8DCF5C3D3B}" = CCC Help Czech
"{08C8666B-C502-4AB3-B4CB-D74AC42D14FE}" = Nero BackItUp 10 Help (CHM)
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0906982B-A432-4C06-8F01-C01BE1143779}" = Nokia Connectivity Cable Driver
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{0F44DC3F-6E62-4961-A14B-95323C512F9B}_is1" = NCDownloader
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{15FEDA5F-141C-4127-8D7E-B962D1742728}" = Adobe Photoshop CS5
"{16987E99-C95C-4513-9239-7B44A0A71DB5}" = Nero SoundTrax 10 Help (CHM)
"{1DE2BD51-0300-772D-5E18-F337D95D5687}" = CCC Help German
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2147FAC7-7D35-4A2E-BEE4-BC0DAE54C0E5}" = SBK®X Superbike World Championship
"{224E8FEB-5C1F-077F-6FC5-602AC1AE644D}" = CCC Help Danish
"{237CCB62-8454-43E3-B158-3ACD0134852E}" = High-Definition Video Playback 10
"{2436F2A8-4B7E-4B6C-AE4E-604C84AA6A4F}" = Nero Core Components 10
"{2624B969-7135-4EB1-B0F6-2D8C397B45F7}_is1" = Media Player Classic - Home Cinema v1.5.0.2827
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{26A24AE4-039D-4CA4-87B4-2F83217015FF}" = Java 7 Update 15
"{275E9C49-C72F-D754-DEB7-77F10A9C00D8}" = CCC Help Japanese
"{277C1559-4CF7-44FF-8D07-98AA9C13AABD}" = Nero Multimedia Suite 10
"{2FDB98BE-6E6D-4543-A5FD-C4ABB6214FC9}" = Quick JPEG Image Resize and Crop
"{30049739-BE95-6591-B504-E6D7057D49CC}" = CCC Help Spanish
"{329411A0-19F3-4740-874F-17400B126F27}" = Nero Vision 10 Help (CHM)
"{33643918-7957-4839-92C7-EA96CB621A98}" = Nero Express 10 Help (CHM)
"{34490F4E-48D0-492E-8249-B48BECF0537C}" = Nero DiscSpeed 10
"{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}" = JMB36X Raid Configurer
"{3DE92282-CB49-434F-81BF-94E5B380E889}" = The Sims™ 3 Cztery pory roku
"{3F1EB155-F96E-EB7B-2EF2-7375490E0FA9}" = CCC Help English
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4B023D7B-9E67-795D-FB31-B5E1F6DCA451}" = CCC Help Italian
"{4DFF1415-4C29-44A8-BFD4-2BCE249C4991}" = SpPhones
"{523B2B1B-D8DB-4B41-90FF-C4D799E2758A}" = Nero ControlCenter 10 Help (CHM)
"{555868C6-49FB-484F-BB43-8980651A1B00}" = Nero BurnRights 10 Help (CHM)
"{55F6C486-8C75-2A72-DAFE-CE78A624C9F7}" = CCC Help Russian
"{560F47F7-EB23-44B1-AAFC-667F1CD8FE5C}" = Sp5
"{5AF23993-7152-1620-E43F-1B4542FB4F84}" = CCC Help Thai
"{5C1F18D2-F6B7-4242-B803-B5A78648185D}" = Corel WinDVD 2010
"{63326924-3CAF-C858-3A8F-8598C87019D7}" = Catalyst Control Center
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{63822E89-11AA-F8EC-D433-F72A85799EC0}" = CCC Help Greek
"{63AA3EAB-23BB-48B2-9AD0-44F878075604}" = Nero 10 Menu TemplatePack Basic
"{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update
"{65F8E0A6-A290-4D47-B391-D6353D756854}" = Pro Evolution Soccer 2013 DEMO
"{66049135-9659-4AAD-9169-9CCA269EBB3E}" = Nero InfoTool 10 Help (CHM)
"{66361420-4905-AEB8-17AE-172FDD164A7E}" = CCC Help Polish
"{6C3959C6-943E-44B3-BAAD-570B04B134E5}" = SpCommon
"{6C5F4CF4-6EFA-4B4E-95E7-3A6D5DF0C0C8}" = SBK®X Superbike World Championship
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6DFB899F-17A2-48F0-A533-ED8D6866CF38}" = Nero Control Center 10
"{70550193-1C22-445C-8FA4-564E155DB1A7}" = Nero Express 10
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{769F2A4B-84A3-9486-ADD2-9E5AB4B4E1E3}" = Catalyst Control Center InstallProxy
"{7A295D8F-484B-4FFB-89AB-C1FD497591FE}" = Nero WaveEditor 10 Help (CHM)
"{7A5D731D-B4B3-490E-B339-75685712BAAB}" = Nero Burning ROM 10
"{82EF29B1-9B60-4142-A155-0599216DD053}" = LightScribe System Software
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8773DD1C-5FB2-95B5-5A93-0EFEAC900A4D}" = CCC Help Norwegian
"{889DF117-14D1-44EE-9F31-C5FB5D47F68B}" = Yontoo 1.10.02
"{8CCBB0BF-9CC1-1A65-BB93-56012A460EE6}" = CCC Help Portuguese
"{8DF41A9F-FE13-43E8-A003-5F9B55A011EE}" = Facebook Video Calling 2.0.0.447
"{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}" = TomTom HOME Visual Studio Merge Modules
"{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0015-0415-0000-0000000FF1CE}" = Microsoft Office Access MUI (Polish) 2010
"{90140000-0016-0415-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Polish) 2010
"{90140000-0018-0415-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Polish) 2010
"{90140000-0019-0415-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Polish) 2010
"{90140000-001A-0415-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Polish) 2010
"{90140000-001B-0415-0000-0000000FF1CE}" = Microsoft Office Word MUI (Polish) 2010
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0415-0000-0000000FF1CE}" = Microsoft Office Proof (Polish) 2010
"{90140000-002C-0415-0000-0000000FF1CE}" = Microsoft Office Proofing (Polish) 2010
"{90140000-0044-0415-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (Polish) 2010
"{90140000-006E-0415-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Polish) 2010
"{90140000-00A1-0415-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (Polish) 2010
"{90140000-00BA-0415-0000-0000000FF1CE}" = Microsoft Office Groove MUI (Polish) 2010
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{92E25238-61A3-4ACD-A407-3C480EEF47A7}" = Nero RescueAgent 10 Help (CHM)
"{943CFD7D-5336-47AF-9418-E02473A5A517}" = Nero BurnRights 10
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B6B24BE-80E7-46C4-9FA5-B167D5E0F345}" = Nero BurningROM 10 Help (CHM)
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A0A3CE05-96CB-52E9-434E-074F3BB7807E}" = CCC Help Turkish
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9C64319-932F-D02B-B14C-FFFC3EC49E77}" = CCC Help Chinese Standard
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.6)
"{ACC9AC0E-8B6E-4393-AF52-E43CF31BA7AC}" = Trickshot
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{AF6ECA04-F2CC-11D3-9D68-0020781864F1}" = International CueClub
"{B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}" = NVIDIA PhysX
"{BA77F9D2-CD35-41EB-9BC9-769879DFF8A6}" = PC Connectivity Solution
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = The Sims™ 3
"{C09DB932-7619-7B56-30E3-C0454811D6D7}" = CCC Help Korean
"{C18A0418-442A-4186-AF98-D08F5054A2FC}" = Nero DiscSpeed 10 Help (CHM)
"{C22A4697-BD77-ACB1-744F-1FD0A0BFF798}" = CCC Help Swedish
"{C3273C55-E1E4-41FF-8D69-0158090DB8D8}" = Nero CoverDesigner 10 Help (CHM)
"{C3580AC4-C827-4332-B935-9A282ED5BB97}" = Nero Dolby Files 10
"{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}" = PlayReady PC Runtime x86
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D24DB8B9-BB6C-4334-9619-BA1C650E13D3}" = Microsoft Primary Interoperability Assemblies 2005
"{D4B457B2-260F-C561-CA87-703BD3B724CA}" = Catalyst Control Center Graphics Previews Common
"{D6CDB506-297D-AE70-0EF6-DE5185F961BE}" = CCC Help Chinese Traditional
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DB7C1D4A-08BA-4C7E-A8AA-B7F9BB372DCF}" = Nero Recode 10 Help (CHM)
"{DF8195AF-8E6F-4487-A0EE-196F7E3F4B8A}" = jetAudio Basic VX
"{E2F0AF23-FE2F-4222-9A43-55E63CC41EF1}" = Catalyst Control Center - Branding
"{E337E787-CF61-4B7B-B84F-509202A54023}" = Nero RescueAgent 10
"{E3B64CC5-C011-40C0-92BC-7316CD5E5688}" = Microsoft_VC100_CRT_SP1_x86
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E415C943-37E5-473F-8BAE-043C56734124}" = Sp5TTInt
"{EA8FA6BE-29BE-4AF2-9352-841F83215EB0}" = Update Manager for SweetPacks 1.1
"{EC5F4C1B-F838-4CB7-8561-8F809296428B}" = TomTom HOME
"{ECFD508E-68A2-91B2-46DD-1D03D783D94B}" = Catalyst Control Center Localization All
"{EDCDFAD5-DF80-4600-A493-E9DAD6810230}" = Nero WaveEditor 10
"{EDE361D5-35A5-DA7D-3462-C3DABD24029B}" = CCC Help Hungarian
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F1E7DD6A-AE2D-D706-BEB3-937F76CA6AE9}" = CCC Help Finnish
"{F26DE8EF-F2CF-40DC-8CDA-CC0D82D11B36}" = The Sims™ 3 Studenckie życie
"{F412B4AF-388C-4FF5-9B2F-33DB1C536953}" = Nero InfoTool 10
"{F467862A-D9CA-47ED-8D81-B4B3C9399272}" = Nero MediaHub 10 Help (CHM)
"{F56F54DD-BCB2-1221-2CB7-E983A5CF9D15}" = CCC Help Dutch
"{F5CB822F-B365-43D1-BCC0-4FDA1A2017A7}" = Nero 10 Movie ThemePack Basic
"{F6117F9C-ADB5-4590-9BE4-12C7BEC28702}" = Nero StartSmart 10 Help (CHM)
"{FCF00A6E-FB58-477A-ABE9-232907105521}" = Nero CoverDesigner 10
"{FD4B33E1-24AE-4535-AA7B-162B30FB57CD}" = Sp5Intl
"1ClickDownloader" = 1ClickDownloader
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"AudioCS" = Creative Audio Console
"avast" = avast! Free Antivirus
"Canon_IJ_Network_UTILITY" = Canon IJ Network Tool
"CANONIJPLM100" = Canon Inkjet Printer/Scanner/Fax Extended Survey Program
"CanonMyPrinter" = Canon My Printer
"CanonSolutionMenuEX" = Canon Solution Menu EX
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"DirectShowPack" = DirectShow Pack (remove only)
"Driver Cleaner" = Driver Cleaner 3
"Easy-PhotoPrint EX" = Canon Easy-PhotoPrint EX
"Easy-WebPrint EX" = Canon Easy-WebPrint EX
"ffdshow" = ffdshow (remove only)
"foobar2000" = foobar2000 v1.1.5
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.11.34.1015
"Google Chrome" = Google Chrome
"Mozilla Firefox 26.0 (x86 pl)" = Mozilla Firefox 26.0 (x86 pl)
"Mozilla Thunderbird 12.0.1 (x86 pl)" = Mozilla Thunderbird 12.0.1 (x86 pl)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MP Navigator EX 4.0" = Canon MP Navigator EX 4.0
"Office14.PROPLUS" = Microsoft Office Professional Plus 2010
"Open Codecs" = Xiph.Org Open Codecs 0.85.17777
"Origin" = Origin
"QuicktimeAlt_is1" = QuickTime Alternative 3.2.2
"R1JJRDI=_is1" = GRID 2 (c) Codemasters version 1
"RealAlt_is1" = Real Alternative 2.0.1 Lite
"Rejestracja użytkownika drukarki Canon MP495 series" = Rejestracja użytkownika drukarki Canon MP495 series
"SCANIA Truck Driving Simulator" = SCANIA Truck Driving Simulator 1.0.0
"Steam App 227300" = Euro Truck Simulator 2
"Steam App 42710" = Call of Duty: Black Ops - Multiplayer
"TVersity Codec Pack" = TVersity Codec Pack 1.7
"TVersity Media Server" = TVersity Media Server 1.9.7
"UltraISO_is1" = UltraISO Premium V8.51
"VLC media player" = VLC media player 1.1.7
"Winamp" = Winamp
"WinRAR archiver" = WinRAR archiver
"WNLT" = IB Updater Service
[color=#E56717]========== HKEY_USERS Uninstall List ==========[/color]
[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
[color=#E56717]========== HKEY_USERS Uninstall List ==========[/color]
[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
[color=#E56717]========== HKEY_USERS Uninstall List ==========[/color]
[HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
[color=#E56717]========== HKEY_USERS Uninstall List ==========[/color]
[HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
[color=#E56717]========== HKEY_USERS Uninstall List ==========[/color]
[HKEY_USERS\S-1-5-21-2280857462-3087976840-2291809120-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"UnityWebPlayer" = Unity Web Player
"uTorrent" = µTorrent
"Winamp Detect" = Detektor Winampa
[color=#E56717]========== Last 20 Event Log Errors ==========[/color]
[ Application Events ]
Error - 2012-12-05 13:16:15 | Computer Name = DOM-DOMOWY | Source = SideBySide | ID = 16842815
Description = Nie można wygenerować kontekstu aktywacji dla "c:\program files (x86)\WapSter\wapster
aqq\System\DelZip179.dll". Błąd w pliku manifestu lub w pliku zasad "c:\program
files (x86)\WapSter\wapster aqq\System\DelZip179.dll" w wierszu 8. Wartość "*" atrybutu
"language" elementu "assemblyIdentity" jest nieprawidłowa.
Error - 2012-12-06 15:53:31 | Computer Name = DOM-DOMOWY | Source = SideBySide | ID = 16842815
Description = Nie można wygenerować kontekstu aktywacji dla "c:\program files (x86)\WapSter\wapster
aqq\System\DelZip179.dll". Błąd w pliku manifestu lub w pliku zasad "c:\program
files (x86)\WapSter\wapster aqq\System\DelZip179.dll" w wierszu 8. Wartość "*" atrybutu
"language" elementu "assemblyIdentity" jest nieprawidłowa.
Error - 2012-12-07 13:34:22 | Computer Name = DOM-DOMOWY | Source = SideBySide | ID = 16842815
Description = Nie można wygenerować kontekstu aktywacji dla "c:\program files (x86)\WapSter\wapster
aqq\System\DelZip179.dll". Błąd w pliku manifestu lub w pliku zasad "c:\program
files (x86)\WapSter\wapster aqq\System\DelZip179.dll" w wierszu 8. Wartość "*" atrybutu
"language" elementu "assemblyIdentity" jest nieprawidłowa.
Error - 2012-12-07 17:37:48 | Computer Name = DOM-DOMOWY | Source = Application Error | ID = 1000
Description = Nazwa aplikacji powodującej błąd: firefox.exe, wersja: 17.0.1.4715,
sygnatura czasowa: 0x50b71a4b Nazwa modułu powodującego błąd: xul.dll, wersja: 17.0.1.4715,
sygnatura czasowa: 0x50b7198b Kod wyjątku: 0xc0000005 Przesunięcie błędu: 0x00144ed8
Identyfikator
procesu powodującego błąd: 0xc58 Godzina uruchomienia aplikacji powodującej błąd:
0x01cdd4bd40a34a5f Ścieżka aplikacji powodującej błąd: C:\Program Files (x86)\Mozilla
Firefox\firefox.exe Ścieżka modułu powodującego błąd: C:\Program Files (x86)\Mozilla
Firefox\xul.dll Identyfikator raportu: 57f8459b-40b6-11e2-b84b-002185124066
Error - 2012-12-08 10:44:37 | Computer Name = DOM-DOMOWY | Source = SideBySide | ID = 16842815
Description = Nie można wygenerować kontekstu aktywacji dla "c:\program files (x86)\WapSter\wapster
aqq\System\DelZip179.dll". Błąd w pliku manifestu lub w pliku zasad "c:\program
files (x86)\WapSter\wapster aqq\System\DelZip179.dll" w wierszu 8. Wartość "*" atrybutu
"language" elementu "assemblyIdentity" jest nieprawidłowa.
Error - 2012-12-09 11:43:27 | Computer Name = DOM-DOMOWY | Source = SideBySide | ID = 16842815
Description = Nie można wygenerować kontekstu aktywacji dla "c:\program files (x86)\WapSter\wapster
aqq\System\DelZip179.dll". Błąd w pliku manifestu lub w pliku zasad "c:\program
files (x86)\WapSter\wapster aqq\System\DelZip179.dll" w wierszu 8. Wartość "*" atrybutu
"language" elementu "assemblyIdentity" jest nieprawidłowa.
Error - 2012-12-10 08:17:36 | Computer Name = DOM-DOMOWY | Source = SideBySide | ID = 16842815
Description = Nie można wygenerować kontekstu aktywacji dla "c:\program files (x86)\WapSter\wapster
aqq\System\DelZip179.dll". Błąd w pliku manifestu lub w pliku zasad "c:\program
files (x86)\WapSter\wapster aqq\System\DelZip179.dll" w wierszu 8. Wartość "*" atrybutu
"language" elementu "assemblyIdentity" jest nieprawidłowa.
Error - 2012-12-11 11:40:04 | Computer Name = DOM-DOMOWY | Source = SideBySide | ID = 16842815
Description = Nie można wygenerować kontekstu aktywacji dla "c:\program files (x86)\WapSter\wapster
aqq\System\DelZip179.dll". Błąd w pliku manifestu lub w pliku zasad "c:\program
files (x86)\WapSter\wapster aqq\System\DelZip179.dll" w wierszu 8. Wartość "*" atrybutu
"language" elementu "assemblyIdentity" jest nieprawidłowa.
Error - 2012-12-12 14:29:48 | Computer Name = DOM-DOMOWY | Source = SideBySide | ID = 16842815
Description = Nie można wygenerować kontekstu aktywacji dla "c:\program files (x86)\WapSter\wapster
aqq\System\DelZip179.dll". Błąd w pliku manifestu lub w pliku zasad "c:\program
files (x86)\WapSter\wapster aqq\System\DelZip179.dll" w wierszu 8. Wartość "*" atrybutu
"language" elementu "assemblyIdentity" jest nieprawidłowa.
Error - 2012-12-13 08:19:03 | Computer Name = DOM-DOMOWY | Source = SideBySide | ID = 16842815
Description = Nie można wygenerować kontekstu aktywacji dla "c:\program files (x86)\WapSter\wapster
aqq\System\DelZip179.dll". Błąd w pliku manifestu lub w pliku zasad "c:\program
files (x86)\WapSter\wapster aqq\System\DelZip179.dll" w wierszu 8. Wartość "*" atrybutu
"language" elementu "assemblyIdentity" jest nieprawidłowa.
[ System Events ]
Error - 2014-01-31 16:31:01 | Computer Name = DOM-DOMOWY | Source = volsnap | ID = 393252
Description = Wykonywanie kopii w tle woluminu C: zostało przerwane, ponieważ nie
można powiększyć magazynu kopii w tle z powodu limitu wprowadzonego przez użytkownika.
Error - 2014-02-01 03:57:38 | Computer Name = DOM-DOMOWY | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi regi z powodu następującego błędu: %%2
Error - 2014-02-02 06:02:42 | Computer Name = DOM-DOMOWY | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi regi z powodu następującego błędu: %%2
Error - 2014-02-02 06:07:49 | Computer Name = DOM-DOMOWY | Source = EventLog | ID = 6008
Description = Poprzednie zamknięcie systemu przy 11:05:13 na ?2014-?02-?02 było
nieoczekiwane.
Error - 2014-02-02 06:07:59 | Computer Name = DOM-DOMOWY | Source = BugCheck | ID = 1001
Description =
Error - 2014-02-02 06:08:51 | Computer Name = DOM-DOMOWY | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi regi z powodu następującego błędu: %%2
Error - 2014-02-02 06:09:36 | Computer Name = DOM-DOMOWY | Source = Service Control Manager | ID = 7009
Description = Upłynął limit czasu (30000 ms) podczas oczekiwania na połączenie się
z usługą TVersity Media Server.
Error - 2014-02-02 06:12:19 | Computer Name = DOM-DOMOWY | Source = volsnap | ID = 393252
Description = Wykonywanie kopii w tle woluminu C: zostało przerwane, ponieważ nie
można powiększyć magazynu kopii w tle z powodu limitu wprowadzonego przez użytkownika.
Error - 2014-02-02 07:40:18 | Computer Name = DOM-DOMOWY | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi regi z powodu następującego błędu: %%2
Error - 2014-02-02 07:42:29 | Computer Name = DOM-DOMOWY | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi regi z powodu następującego błędu: %%2
< End of report >
