GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-07-18 22:19:35 Windows 5.1.2600 Dodatek Service Pack 2 \Device\Harddisk0\DR0 -> \Device\00000074 SAMSUNG_HD160JJ rev.ZM100-41 149,05GB Running: fbip4xki.exe; Driver: C:\DOCUME~1\KRAWCZ~1\USTAWI~1\Temp\pgliyaoc.sys ---- System - GMER 2.1 ---- SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwAddBootEntry [0xEC4BEACC] SSDT \SystemRoot\system32\drivers\aswSP.sys ZwAllocateVirtualMemory [0xED46231C] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwAssignProcessToJobObject [0xEC4BF5AA] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwClose [0xEC505620] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateEvent [0xEC4CB6A0] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateEventPair [0xEC4CB6EC] SSDT \SystemRoot\system32\drivers\SbFw.sys ZwCreateFile [0xED3E9868] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateIoCompletion [0xEC4CB886] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateKey [0xEC504FD4] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateMutant [0xEC4CB60E] SSDT \SystemRoot\system32\drivers\SbFw.sys ZwCreateProcess [0xED3E8E90] SSDT \SystemRoot\system32\drivers\SbFw.sys ZwCreateProcessEx [0xED3E8D9C] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateSection [0xEC4CB730] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateSemaphore [0xEC4CB656] SSDT \SystemRoot\system32\drivers\SbFw.sys ZwCreateThread [0xED3E93FC] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateTimer [0xEC4CB840] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwDebugActiveProcess [0xEC4C0398] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwDeleteBootEntry [0xEC4BEB32] SSDT \SystemRoot\system32\drivers\SbFw.sys ZwDeleteFile [0xED3EA210] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwDeleteKey [0xEC505CE6] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwDeleteValueKey [0xEC505F9C] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwDuplicateObject [0xEC4C3BEA] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwEnumerateKey [0xEC505B51] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwEnumerateValueKey [0xEC5059BC] SSDT \SystemRoot\system32\drivers\aswSP.sys ZwFreeVirtualMemory [0xED4623F4] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwLoadDriver [0xEC4BE71E] SSDT \SystemRoot\system32\drivers\sbhips.sys ZwMapViewOfSection [0xF1F6B168] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwModifyBootEntry [0xEC4BEB98] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwNotifyChangeKey [0xEC4C3FE0] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwNotifyChangeMultipleKeys [0xEC4C0EDC] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenEvent [0xEC4CB6CA] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenEventPair [0xEC4CB70E] SSDT \SystemRoot\system32\drivers\SbFw.sys ZwOpenFile [0xED3E9B54] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenIoCompletion [0xEC4CB8AA] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenKey [0xEC505330] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenMutant [0xEC4CB634] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenProcess [0xEC4C34E2] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenSection [0xEC4CB7BE] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenSemaphore [0xEC4CB67E] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenThread [0xEC4C38CE] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenTimer [0xEC4CB864] SSDT \SystemRoot\system32\drivers\aswSP.sys ZwProtectVirtualMemory [0xED462574] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwQueryKey [0xEC505837] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwQueryObject [0xEC4C0CF4] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwQueryValueKey [0xEC505689] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwQueueApcThread [0xEC4C084A] SSDT \SystemRoot\system32\drivers\aswSP.sys ZwRenameKey [0xED46FD2C] SSDT \SystemRoot\system32\drivers\aswSP.sys ZwReplaceKey [0xED470698] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwRestoreKey [0xEC504617] SSDT \SystemRoot\system32\drivers\SbFw.sys ZwResumeThread [0xED3E94EC] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSetBootEntryOrder [0xEC4BEBFE] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSetBootOptions [0xEC4BEC64] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSetContextThread [0xEC4C0212] SSDT \SystemRoot\system32\drivers\SbFw.sys ZwSetInformationFile [0xED3E9E8C] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSetSystemInformation [0xEC4BE7B8] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSetSystemPowerState [0xEC4BE98A] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSetValueKey [0xEC505DED] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwShutdownSystem [0xEC4BE918] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSuspendProcess [0xEC4C0562] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSuspendThread [0xEC4C06C4] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSystemDebugControl [0xEC4BEA12] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwTerminateProcess [0xEC4C0050] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwTerminateThread [0xEC4C01F2] SSDT \SystemRoot\system32\drivers\aswSP.sys ZwUnloadDriver [0xED45F7BE] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwVdmControl [0xEC4BECCA] SSDT \SystemRoot\system32\drivers\SbFw.sys ZwWriteFile [0xED3E9DE0] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwWriteVirtualMemory [0xEC4BF606] INT 0x06 \??\C:\WINDOWS\system32\drivers\Haspnt.sys ED56216D INT 0x0E \??\C:\WINDOWS\system32\drivers\Haspnt.sys ED561FC2 INT 0x62 ? 8678ECB8 INT 0x73 ? 867BCCB8 INT 0x83 ? 867BCCB8 INT 0xB4 ? 863E4F00 ---- Kernel code sections - GMER 2.1 ---- .text ntkrnlpa.exe!ZwCallbackReturn + 2350 80501054 4 Bytes [CC, EA, 4B, EC] .text ntkrnlpa.exe!ZwCallbackReturn + 23B8 805010BC 16 Bytes [A0, B6, 4C, EC, EC, B6, 4C, ...] .text ntkrnlpa.exe!ZwCallbackReturn + 2400 80501104 5 Bytes [FC, 93, 3E, ED, 40] {CLD ; XCHG EBX, EAX; IN EAX, DX; INC EAX} .text ntkrnlpa.exe!ZwCallbackReturn + 2406 8050110A 2 Bytes [4C, EC] {DEC ESP; IN AL, DX} .text ntkrnlpa.exe!ZwCallbackReturn + 2420 80501124 12 Bytes [32, EB, 4B, EC, 10, A2, 3E, ...] {XOR CH, BL; DEC EBX; IN AL, DX; ADC [EDX+0x5ce6ed3e], AH; PUSH EAX; IN AL, DX} .text ... PAGE ntkrnlpa.exe!ZwReplyWaitReceivePortEx + 5EC 8059A312 4 Bytes CALL EC4C15AD \SystemRoot\system32\drivers\aswSnx.sys .sptd1 C:\WINDOWS\system32\drivers\sptd.sys entry point in ".sptd1" section [0xF74B6FEE] .text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xF2A473A0, 0x585395, 0xE8000020] .text C:\WINDOWS\system32\drivers\hardlock.sys section is writeable [0xB83FE400, 0x87EE2, 0xE8000020] .protect˙˙˙˙hardlockentry point in ".protect˙˙˙˙hardlockentry point in ".protect˙˙˙˙hardlockentry point in ".p" section [0xB84A2620] C:\WINDOWS\system32\drivers\hardlock.sys entry point in ".protect˙˙˙˙hardlockentry point in ".protect˙˙˙˙hardlockentry point in ".p" section [0xB84A2620] .protect˙˙˙˙hardlockunknown last code section [0xB84A2400, 0x5126, 0xE0000020] C:\WINDOWS\system32\drivers\hardlock.sys unknown last code section [0xB84A2400, 0x5126, 0xE0000020] ---- User code sections - GMER 2.1 ---- .text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[320] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8 .text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[320] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090 .text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[320] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694 .text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[320] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0 .text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[320] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234 .text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[320] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00130004 .text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[320] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0013011C .text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[320] kernel32.dll!SetUnhandledExceptionFilter 7C810386 8 Bytes [31, C0, C2, 04, 00, 90, 90, ...] {XOR EAX, EAX; RET 0x4; NOP ; NOP ; NOP } .text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[320] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 001304F0 .text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[320] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0013057C .text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[320] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 001303D8 .text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[320] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0013034C .text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[320] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00130464 .text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[320] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00130608 .text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[320] USER32.dll!SetWindowsHookExW 77D5E621 5 Bytes JMP 001307AC .text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[320] USER32.dll!SetWindowsHookExA 77D602B2 5 Bytes JMP 00130720 .text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[320] WS2_32.dll!socket 71A53B91 5 Bytes JMP 001308C4 .text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[320] WS2_32.dll!bind 71A53E00 5 Bytes JMP 00130838 .text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[320] WS2_32.dll!connect 71A5406A 5 Bytes JMP 00130950 .text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[320] WININET.dll!InternetConnectA 771B44DB 5 Bytes JMP 00130F54 .text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[320] WININET.dll!InternetOpenA 771B6D2A 5 Bytes JMP 00130D24 .text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[320] WININET.dll!InternetOpenUrlA 771B6FDD 5 Bytes JMP 00130E3C .text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[320] WININET.dll!InternetConnectW 771C5D4C 5 Bytes JMP 00130FE0 .text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[320] WININET.dll!InternetOpenW 771C6CF3 5 Bytes JMP 00130DB0 .text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[320] WININET.dll!InternetOpenUrlW 771C7304 5 Bytes JMP 00130EC8 .text C:\WINDOWS\system32\spoolsv.exe[504] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8 .text C:\WINDOWS\system32\spoolsv.exe[504] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090 .text C:\WINDOWS\system32\spoolsv.exe[504] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694 .text C:\WINDOWS\system32\spoolsv.exe[504] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0 .text C:\WINDOWS\system32\spoolsv.exe[504] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234 .text C:\WINDOWS\system32\spoolsv.exe[504] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00080004 .text C:\WINDOWS\system32\spoolsv.exe[504] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0008011C .text C:\WINDOWS\system32\spoolsv.exe[504] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000804F0 .text C:\WINDOWS\system32\spoolsv.exe[504] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0008057C .text C:\WINDOWS\system32\spoolsv.exe[504] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000803D8 .text C:\WINDOWS\system32\spoolsv.exe[504] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0008034C .text C:\WINDOWS\system32\spoolsv.exe[504] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00080464 .text C:\WINDOWS\system32\spoolsv.exe[504] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00080608 .text C:\WINDOWS\system32\spoolsv.exe[504] USER32.dll!SetWindowsHookExW 77D5E621 5 Bytes JMP 000807AC .text C:\WINDOWS\system32\spoolsv.exe[504] USER32.dll!SetWindowsHookExA 77D602B2 5 Bytes JMP 00080720 .text C:\WINDOWS\system32\spoolsv.exe[504] WS2_32.dll!socket 71A53B91 5 Bytes JMP 000808C4 .text C:\WINDOWS\system32\spoolsv.exe[504] WS2_32.dll!bind 71A53E00 5 Bytes JMP 00080838 .text C:\WINDOWS\system32\spoolsv.exe[504] WS2_32.dll!connect 71A5406A 5 Bytes JMP 00080950 .text C:\WINDOWS\System32\svchost.exe[772] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8 .text C:\WINDOWS\System32\svchost.exe[772] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090 .text C:\WINDOWS\System32\svchost.exe[772] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694 .text C:\WINDOWS\System32\svchost.exe[772] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0 .text C:\WINDOWS\System32\svchost.exe[772] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234 .text C:\WINDOWS\System32\svchost.exe[772] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00080004 .text C:\WINDOWS\System32\svchost.exe[772] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0008011C .text C:\WINDOWS\System32\svchost.exe[772] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000804F0 .text C:\WINDOWS\System32\svchost.exe[772] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0008057C .text C:\WINDOWS\System32\svchost.exe[772] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000803D8 .text C:\WINDOWS\System32\svchost.exe[772] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0008034C .text C:\WINDOWS\System32\svchost.exe[772] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00080464 .text C:\WINDOWS\System32\svchost.exe[772] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00080608 .text C:\WINDOWS\System32\svchost.exe[772] USER32.dll!SetWindowsHookExW 77D5E621 5 Bytes JMP 000807AC .text C:\WINDOWS\System32\svchost.exe[772] USER32.dll!SetWindowsHookExA 77D602B2 5 Bytes JMP 00080720 .text C:\WINDOWS\System32\svchost.exe[772] WS2_32.dll!socket 71A53B91 5 Bytes JMP 000808C4 .text C:\WINDOWS\System32\svchost.exe[772] WS2_32.dll!bind 71A53E00 5 Bytes JMP 00080838 .text C:\WINDOWS\System32\svchost.exe[772] WS2_32.dll!connect 71A5406A 5 Bytes JMP 00080950 .text C:\WINDOWS\System32\svchost.exe[828] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8 .text C:\WINDOWS\System32\svchost.exe[828] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090 .text C:\WINDOWS\System32\svchost.exe[828] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694 .text C:\WINDOWS\System32\svchost.exe[828] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0 .text C:\WINDOWS\System32\svchost.exe[828] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234 .text C:\WINDOWS\System32\svchost.exe[828] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00080004 .text C:\WINDOWS\System32\svchost.exe[828] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0008011C .text C:\WINDOWS\System32\svchost.exe[828] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000804F0 .text C:\WINDOWS\System32\svchost.exe[828] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0008057C .text C:\WINDOWS\System32\svchost.exe[828] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000803D8 .text C:\WINDOWS\System32\svchost.exe[828] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0008034C .text C:\WINDOWS\System32\svchost.exe[828] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00080464 .text C:\WINDOWS\System32\svchost.exe[828] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00080608 .text C:\WINDOWS\System32\svchost.exe[828] USER32.dll!SetWindowsHookExW 77D5E621 5 Bytes JMP 000807AC .text C:\WINDOWS\System32\svchost.exe[828] USER32.dll!SetWindowsHookExA 77D602B2 5 Bytes JMP 00080720 .text C:\WINDOWS\System32\svchost.exe[828] WS2_32.dll!socket 71A53B91 5 Bytes JMP 000808C4 .text C:\WINDOWS\System32\svchost.exe[828] WS2_32.dll!bind 71A53E00 5 Bytes JMP 00080838 .text C:\WINDOWS\System32\svchost.exe[828] WS2_32.dll!connect 71A5406A 5 Bytes JMP 00080950 .text C:\Program Files\AVAST Software\Avast\AvastUI.exe[856] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8 .text C:\Program Files\AVAST Software\Avast\AvastUI.exe[856] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090 .text C:\Program Files\AVAST Software\Avast\AvastUI.exe[856] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694 .text C:\Program Files\AVAST Software\Avast\AvastUI.exe[856] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0 .text C:\Program Files\AVAST Software\Avast\AvastUI.exe[856] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234 .text C:\Program Files\AVAST Software\Avast\AvastUI.exe[856] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00130004 .text C:\Program Files\AVAST Software\Avast\AvastUI.exe[856] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0013011C .text C:\Program Files\AVAST Software\Avast\AvastUI.exe[856] kernel32.dll!SetUnhandledExceptionFilter 7C810386 8 Bytes [31, C0, C2, 04, 00, 90, 90, ...] {XOR EAX, EAX; RET 0x4; NOP ; NOP ; NOP } .text C:\Program Files\AVAST Software\Avast\AvastUI.exe[856] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 001304F0 .text C:\Program Files\AVAST Software\Avast\AvastUI.exe[856] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0013057C .text C:\Program Files\AVAST Software\Avast\AvastUI.exe[856] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 001303D8 .text C:\Program Files\AVAST Software\Avast\AvastUI.exe[856] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0013034C .text C:\Program Files\AVAST Software\Avast\AvastUI.exe[856] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00130464 .text C:\Program Files\AVAST Software\Avast\AvastUI.exe[856] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00130608 .text C:\Program Files\AVAST Software\Avast\AvastUI.exe[856] USER32.dll!SetWindowsHookExW 77D5E621 5 Bytes JMP 001307AC .text C:\Program Files\AVAST Software\Avast\AvastUI.exe[856] USER32.dll!SetWindowsHookExA 77D602B2 5 Bytes JMP 00130720 .text C:\Program Files\AVAST Software\Avast\AvastUI.exe[856] WININET.dll!InternetConnectA 771B44DB 5 Bytes JMP 00130F54 .text C:\Program Files\AVAST Software\Avast\AvastUI.exe[856] WININET.dll!InternetOpenA 771B6D2A 5 Bytes JMP 00130D24 .text C:\Program Files\AVAST Software\Avast\AvastUI.exe[856] WININET.dll!InternetOpenUrlA 771B6FDD 5 Bytes JMP 00130E3C .text C:\Program Files\AVAST Software\Avast\AvastUI.exe[856] WININET.dll!InternetConnectW 771C5D4C 5 Bytes JMP 00130FE0 .text C:\Program Files\AVAST Software\Avast\AvastUI.exe[856] WININET.dll!InternetOpenW 771C6CF3 5 Bytes JMP 00130DB0 .text C:\Program Files\AVAST Software\Avast\AvastUI.exe[856] WININET.dll!InternetOpenUrlW 771C7304 5 Bytes JMP 00130EC8 .text C:\Program Files\AVAST Software\Avast\AvastUI.exe[856] WS2_32.dll!socket 71A53B91 5 Bytes JMP 001308C4 .text C:\Program Files\AVAST Software\Avast\AvastUI.exe[856] WS2_32.dll!bind 71A53E00 5 Bytes JMP 00130838 .text C:\Program Files\AVAST Software\Avast\AvastUI.exe[856] WS2_32.dll!connect 71A5406A 5 Bytes JMP 00130950 .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe[880] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8 .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe[880] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090 .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe[880] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694 .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe[880] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0 .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe[880] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234 .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe[880] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00130004 .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe[880] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0013011C .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe[880] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 001304F0 .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe[880] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0013057C .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe[880] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 001303D8 .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe[880] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0013034C .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe[880] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00130464 .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe[880] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00130608 .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe[880] USER32.dll!SetWindowsHookExW 77D5E621 5 Bytes JMP 001307AC .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe[880] USER32.dll!SetWindowsHookExA 77D602B2 5 Bytes JMP 00130720 .text C:\WINDOWS\system32\csrss.exe[1048] USER32.dll!SetWindowsHookExW 77D5E621 5 Bytes JMP 001607AC .text C:\WINDOWS\system32\csrss.exe[1048] USER32.dll!SetWindowsHookExA 77D602B2 5 Bytes JMP 00160720 .text C:\WINDOWS\system32\csrss.exe[1048] KERNEL32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001601A8 .text C:\WINDOWS\system32\csrss.exe[1048] KERNEL32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00160090 .text C:\WINDOWS\system32\csrss.exe[1048] KERNEL32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00160694 .text C:\WINDOWS\system32\csrss.exe[1048] KERNEL32.dll!CreateProcessW 7C802332 5 Bytes JMP 001602C0 .text C:\WINDOWS\system32\csrss.exe[1048] KERNEL32.dll!CreateProcessA 7C802367 5 Bytes JMP 00160234 .text C:\WINDOWS\system32\csrss.exe[1048] KERNEL32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00160004 .text C:\WINDOWS\system32\csrss.exe[1048] KERNEL32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0016011C .text C:\WINDOWS\system32\csrss.exe[1048] KERNEL32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 001604F0 .text C:\WINDOWS\system32\csrss.exe[1048] KERNEL32.dll!CreateThread 7C81082F 5 Bytes JMP 0016057C .text C:\WINDOWS\system32\csrss.exe[1048] KERNEL32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 001603D8 .text C:\WINDOWS\system32\csrss.exe[1048] KERNEL32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0016034C .text C:\WINDOWS\system32\csrss.exe[1048] KERNEL32.dll!WinExec 7C86114D 5 Bytes JMP 00160464 .text C:\WINDOWS\system32\csrss.exe[1048] KERNEL32.dll!SetThreadContext 7C862849 5 Bytes JMP 00160608 .text C:\WINDOWS\system32\wbem\unsecapp.exe[1064] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001401A8 .text C:\WINDOWS\system32\wbem\unsecapp.exe[1064] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00140090 .text C:\WINDOWS\system32\wbem\unsecapp.exe[1064] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00140694 .text C:\WINDOWS\system32\wbem\unsecapp.exe[1064] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001402C0 .text C:\WINDOWS\system32\wbem\unsecapp.exe[1064] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00140234 .text C:\WINDOWS\system32\wbem\unsecapp.exe[1064] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00140004 .text C:\WINDOWS\system32\wbem\unsecapp.exe[1064] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0014011C .text C:\WINDOWS\system32\wbem\unsecapp.exe[1064] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 001404F0 .text C:\WINDOWS\system32\wbem\unsecapp.exe[1064] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0014057C .text C:\WINDOWS\system32\wbem\unsecapp.exe[1064] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 001403D8 .text C:\WINDOWS\system32\wbem\unsecapp.exe[1064] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0014034C .text C:\WINDOWS\system32\wbem\unsecapp.exe[1064] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00140464 .text C:\WINDOWS\system32\wbem\unsecapp.exe[1064] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00140608 .text C:\WINDOWS\system32\wbem\unsecapp.exe[1064] USER32.dll!SetWindowsHookExW 77D5E621 5 Bytes JMP 001407AC .text C:\WINDOWS\system32\wbem\unsecapp.exe[1064] USER32.dll!SetWindowsHookExA 77D602B2 5 Bytes JMP 00140720 .text C:\WINDOWS\system32\wbem\unsecapp.exe[1064] WS2_32.dll!socket 71A53B91 5 Bytes JMP 001408C4 .text C:\WINDOWS\system32\wbem\unsecapp.exe[1064] WS2_32.dll!bind 71A53E00 5 Bytes JMP 00140838 .text C:\WINDOWS\system32\wbem\unsecapp.exe[1064] WS2_32.dll!connect 71A5406A 5 Bytes JMP 00140950 .text C:\WINDOWS\system32\winlogon.exe[1084] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000701A8 .text C:\WINDOWS\system32\winlogon.exe[1084] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00070090 .text C:\WINDOWS\system32\winlogon.exe[1084] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00070694 .text C:\WINDOWS\system32\winlogon.exe[1084] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000702C0 .text C:\WINDOWS\system32\winlogon.exe[1084] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00070234 .text C:\WINDOWS\system32\winlogon.exe[1084] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00070004 .text C:\WINDOWS\system32\winlogon.exe[1084] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0007011C .text C:\WINDOWS\system32\winlogon.exe[1084] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000704F0 .text C:\WINDOWS\system32\winlogon.exe[1084] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0007057C .text C:\WINDOWS\system32\winlogon.exe[1084] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000703D8 .text C:\WINDOWS\system32\winlogon.exe[1084] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0007034C .text C:\WINDOWS\system32\winlogon.exe[1084] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00070464 .text C:\WINDOWS\system32\winlogon.exe[1084] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00070608 .text C:\WINDOWS\system32\winlogon.exe[1084] USER32.dll!SetWindowsHookExW 77D5E621 5 Bytes JMP 000707AC .text C:\WINDOWS\system32\winlogon.exe[1084] USER32.dll!SetWindowsHookExA 77D602B2 5 Bytes JMP 00070720 .text C:\WINDOWS\system32\winlogon.exe[1084] WS2_32.dll!socket 71A53B91 5 Bytes JMP 000708C4 .text C:\WINDOWS\system32\winlogon.exe[1084] WS2_32.dll!bind 71A53E00 5 Bytes JMP 00070838 .text C:\WINDOWS\system32\winlogon.exe[1084] WS2_32.dll!connect 71A5406A 5 Bytes JMP 00070950 .text C:\WINDOWS\system32\services.exe[1128] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8 .text C:\WINDOWS\system32\services.exe[1128] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090 .text C:\WINDOWS\system32\services.exe[1128] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694 .text C:\WINDOWS\system32\services.exe[1128] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0 .text C:\WINDOWS\system32\services.exe[1128] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234 .text C:\WINDOWS\system32\services.exe[1128] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00080004 .text C:\WINDOWS\system32\services.exe[1128] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0008011C .text C:\WINDOWS\system32\services.exe[1128] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000804F0 .text C:\WINDOWS\system32\services.exe[1128] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0008057C .text C:\WINDOWS\system32\services.exe[1128] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000803D8 .text C:\WINDOWS\system32\services.exe[1128] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0008034C .text C:\WINDOWS\system32\services.exe[1128] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00080464 .text C:\WINDOWS\system32\services.exe[1128] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00080608 .text C:\WINDOWS\system32\services.exe[1128] USER32.dll!SetWindowsHookExW 77D5E621 5 Bytes JMP 000807AC .text C:\WINDOWS\system32\services.exe[1128] USER32.dll!SetWindowsHookExA 77D602B2 5 Bytes JMP 00080720 .text C:\WINDOWS\system32\services.exe[1128] WS2_32.dll!socket 71A53B91 5 Bytes JMP 000808C4 .text C:\WINDOWS\system32\services.exe[1128] WS2_32.dll!bind 71A53E00 5 Bytes JMP 00080838 .text C:\WINDOWS\system32\services.exe[1128] WS2_32.dll!connect 71A5406A 5 Bytes JMP 00080950 .text C:\WINDOWS\system32\lsass.exe[1140] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8 .text C:\WINDOWS\system32\lsass.exe[1140] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090 .text C:\WINDOWS\system32\lsass.exe[1140] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694 .text C:\WINDOWS\system32\lsass.exe[1140] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0 .text C:\WINDOWS\system32\lsass.exe[1140] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234 .text C:\WINDOWS\system32\lsass.exe[1140] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00080004 .text C:\WINDOWS\system32\lsass.exe[1140] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0008011C .text C:\WINDOWS\system32\lsass.exe[1140] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000804F0 .text C:\WINDOWS\system32\lsass.exe[1140] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0008057C .text C:\WINDOWS\system32\lsass.exe[1140] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000803D8 .text C:\WINDOWS\system32\lsass.exe[1140] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0008034C .text C:\WINDOWS\system32\lsass.exe[1140] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00080464 .text C:\WINDOWS\system32\lsass.exe[1140] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00080608 .text C:\WINDOWS\system32\lsass.exe[1140] USER32.dll!SetWindowsHookExW 77D5E621 5 Bytes JMP 000807AC .text C:\WINDOWS\system32\lsass.exe[1140] USER32.dll!SetWindowsHookExA 77D602B2 5 Bytes JMP 00080720 .text C:\WINDOWS\system32\lsass.exe[1140] WS2_32.dll!socket 71A53B91 5 Bytes JMP 000808C4 .text C:\WINDOWS\system32\lsass.exe[1140] WS2_32.dll!bind 71A53E00 5 Bytes JMP 00080838 .text C:\WINDOWS\system32\lsass.exe[1140] WS2_32.dll!connect 71A5406A 5 Bytes JMP 00080950 .text C:\WINDOWS\system32\nvsvc32.exe[1316] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8 .text C:\WINDOWS\system32\nvsvc32.exe[1316] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090 .text C:\WINDOWS\system32\nvsvc32.exe[1316] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694 .text C:\WINDOWS\system32\nvsvc32.exe[1316] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0 .text C:\WINDOWS\system32\nvsvc32.exe[1316] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234 .text C:\WINDOWS\system32\nvsvc32.exe[1316] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00130004 .text C:\WINDOWS\system32\nvsvc32.exe[1316] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0013011C .text C:\WINDOWS\system32\nvsvc32.exe[1316] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 001304F0 .text C:\WINDOWS\system32\nvsvc32.exe[1316] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0013057C .text C:\WINDOWS\system32\nvsvc32.exe[1316] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 001303D8 .text C:\WINDOWS\system32\nvsvc32.exe[1316] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0013034C .text C:\WINDOWS\system32\nvsvc32.exe[1316] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00130464 .text C:\WINDOWS\system32\nvsvc32.exe[1316] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00130608 .text C:\WINDOWS\system32\nvsvc32.exe[1316] USER32.dll!SetWindowsHookExW 77D5E621 5 Bytes JMP 001307AC .text C:\WINDOWS\system32\nvsvc32.exe[1316] USER32.dll!SetWindowsHookExA 77D602B2 5 Bytes JMP 00130720 .text C:\WINDOWS\system32\nvsvc32.exe[1316] WS2_32.dll!socket 71A53B91 5 Bytes JMP 001308C4 .text C:\WINDOWS\system32\nvsvc32.exe[1316] WS2_32.dll!bind 71A53E00 5 Bytes JMP 00130838 .text C:\WINDOWS\system32\nvsvc32.exe[1316] WS2_32.dll!connect 71A5406A 5 Bytes JMP 00130950 .text C:\Program Files\ShadowExplorer\sesvc.exe[1376] KERNEL32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8 .text C:\Program Files\ShadowExplorer\sesvc.exe[1376] KERNEL32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090 .text C:\Program Files\ShadowExplorer\sesvc.exe[1376] KERNEL32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694 .text C:\Program Files\ShadowExplorer\sesvc.exe[1376] KERNEL32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0 .text C:\Program Files\ShadowExplorer\sesvc.exe[1376] KERNEL32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234 .text C:\Program Files\ShadowExplorer\sesvc.exe[1376] KERNEL32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00130004 .text C:\Program Files\ShadowExplorer\sesvc.exe[1376] KERNEL32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0013011C .text C:\Program Files\ShadowExplorer\sesvc.exe[1376] KERNEL32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 001304F0 .text C:\Program Files\ShadowExplorer\sesvc.exe[1376] KERNEL32.dll!CreateThread 7C81082F 5 Bytes JMP 0013057C .text C:\Program Files\ShadowExplorer\sesvc.exe[1376] KERNEL32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 001303D8 .text C:\Program Files\ShadowExplorer\sesvc.exe[1376] KERNEL32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0013034C .text C:\Program Files\ShadowExplorer\sesvc.exe[1376] KERNEL32.dll!WinExec 7C86114D 5 Bytes JMP 00130464 .text C:\Program Files\ShadowExplorer\sesvc.exe[1376] KERNEL32.dll!SetThreadContext 7C862849 5 Bytes JMP 00130608 .text C:\Program Files\ShadowExplorer\sesvc.exe[1376] USER32.dll!SetWindowsHookExW 77D5E621 5 Bytes JMP 001307AC .text C:\Program Files\ShadowExplorer\sesvc.exe[1376] USER32.dll!SetWindowsHookExA 77D602B2 5 Bytes JMP 00130720 .text C:\Program Files\ShadowExplorer\sesvc.exe[1376] ws2_32.dll!socket 71A53B91 5 Bytes JMP 001308C4 .text C:\Program Files\ShadowExplorer\sesvc.exe[1376] ws2_32.dll!bind 71A53E00 5 Bytes JMP 00130838 .text C:\Program Files\ShadowExplorer\sesvc.exe[1376] ws2_32.dll!connect 71A5406A 5 Bytes JMP 00130950 .text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8 .text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090 .text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694 .text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0 .text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234 .text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00080004 .text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0008011C .text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000804F0 .text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0008057C .text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000803D8 .text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0008034C .text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00080464 .text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00080608 .text C:\WINDOWS\system32\svchost.exe[1380] USER32.dll!SetWindowsHookExW 77D5E621 5 Bytes JMP 000807AC .text C:\WINDOWS\system32\svchost.exe[1380] USER32.dll!SetWindowsHookExA 77D602B2 5 Bytes JMP 00080720 .text C:\WINDOWS\system32\svchost.exe[1380] WS2_32.dll!socket 71A53B91 5 Bytes JMP 000808C4 .text C:\WINDOWS\system32\svchost.exe[1380] WS2_32.dll!bind 71A53E00 5 Bytes JMP 00080838 .text C:\WINDOWS\system32\svchost.exe[1380] WS2_32.dll!connect 71A5406A 5 Bytes JMP 00080950 .text C:\Program Files\Java\jre7\bin\jqs.exe[1392] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8 .text C:\Program Files\Java\jre7\bin\jqs.exe[1392] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090 .text C:\Program Files\Java\jre7\bin\jqs.exe[1392] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694 .text C:\Program Files\Java\jre7\bin\jqs.exe[1392] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0 .text C:\Program Files\Java\jre7\bin\jqs.exe[1392] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234 .text C:\Program Files\Java\jre7\bin\jqs.exe[1392] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00130004 .text C:\Program Files\Java\jre7\bin\jqs.exe[1392] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0013011C .text C:\Program Files\Java\jre7\bin\jqs.exe[1392] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 001304F0 .text C:\Program Files\Java\jre7\bin\jqs.exe[1392] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0013057C .text C:\Program Files\Java\jre7\bin\jqs.exe[1392] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 001303D8 .text C:\Program Files\Java\jre7\bin\jqs.exe[1392] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0013034C .text C:\Program Files\Java\jre7\bin\jqs.exe[1392] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00130464 .text C:\Program Files\Java\jre7\bin\jqs.exe[1392] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00130608 .text C:\Program Files\Java\jre7\bin\jqs.exe[1392] WS2_32.dll!socket 71A53B91 5 Bytes JMP 001308C4 .text C:\Program Files\Java\jre7\bin\jqs.exe[1392] WS2_32.dll!bind 71A53E00 5 Bytes JMP 00130838 .text C:\Program Files\Java\jre7\bin\jqs.exe[1392] WS2_32.dll!connect 71A5406A 5 Bytes JMP 00130950 .text C:\Program Files\Java\jre7\bin\jqs.exe[1392] USER32.dll!SetWindowsHookExW 77D5E621 5 Bytes JMP 001307AC .text C:\Program Files\Java\jre7\bin\jqs.exe[1392] USER32.dll!SetWindowsHookExA 77D602B2 5 Bytes JMP 00130720 .text C:\WINDOWS\system32\svchost.exe[1448] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8 .text C:\WINDOWS\system32\svchost.exe[1448] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090 .text C:\WINDOWS\system32\svchost.exe[1448] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694 .text C:\WINDOWS\system32\svchost.exe[1448] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0 .text C:\WINDOWS\system32\svchost.exe[1448] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234 .text C:\WINDOWS\system32\svchost.exe[1448] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00080004 .text C:\WINDOWS\system32\svchost.exe[1448] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0008011C .text C:\WINDOWS\system32\svchost.exe[1448] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000804F0 .text C:\WINDOWS\system32\svchost.exe[1448] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0008057C .text C:\WINDOWS\system32\svchost.exe[1448] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000803D8 .text C:\WINDOWS\system32\svchost.exe[1448] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0008034C .text C:\WINDOWS\system32\svchost.exe[1448] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00080464 .text C:\WINDOWS\system32\svchost.exe[1448] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00080608 .text C:\WINDOWS\system32\svchost.exe[1448] USER32.dll!SetWindowsHookExW 77D5E621 5 Bytes JMP 000807AC .text C:\WINDOWS\system32\svchost.exe[1448] USER32.dll!SetWindowsHookExA 77D602B2 5 Bytes JMP 00080720 .text C:\WINDOWS\system32\svchost.exe[1448] WS2_32.dll!socket 71A53B91 5 Bytes JMP 000808C4 .text C:\WINDOWS\system32\svchost.exe[1448] WS2_32.dll!bind 71A53E00 5 Bytes JMP 00080838 .text C:\WINDOWS\system32\svchost.exe[1448] WS2_32.dll!connect 71A5406A 5 Bytes JMP 00080950 .text C:\WINDOWS\System32\svchost.exe[1572] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8 .text C:\WINDOWS\System32\svchost.exe[1572] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090 .text C:\WINDOWS\System32\svchost.exe[1572] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694 .text C:\WINDOWS\System32\svchost.exe[1572] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0 .text C:\WINDOWS\System32\svchost.exe[1572] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234 .text C:\WINDOWS\System32\svchost.exe[1572] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00080004 .text C:\WINDOWS\System32\svchost.exe[1572] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0008011C .text C:\WINDOWS\System32\svchost.exe[1572] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000804F0 .text C:\WINDOWS\System32\svchost.exe[1572] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0008057C .text C:\WINDOWS\System32\svchost.exe[1572] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000803D8 .text C:\WINDOWS\System32\svchost.exe[1572] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0008034C .text C:\WINDOWS\System32\svchost.exe[1572] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00080464 .text C:\WINDOWS\System32\svchost.exe[1572] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00080608 .text C:\WINDOWS\System32\svchost.exe[1572] USER32.dll!SetWindowsHookExW 77D5E621 5 Bytes JMP 000807AC .text C:\WINDOWS\System32\svchost.exe[1572] USER32.dll!SetWindowsHookExA 77D602B2 5 Bytes JMP 00080720 .text C:\WINDOWS\System32\svchost.exe[1572] WS2_32.dll!socket 71A53B91 5 Bytes JMP 000808C4 .text C:\WINDOWS\System32\svchost.exe[1572] WS2_32.dll!bind 71A53E00 5 Bytes JMP 00080838 .text C:\WINDOWS\System32\svchost.exe[1572] WS2_32.dll!connect 71A5406A 5 Bytes JMP 00080950 .text C:\WINDOWS\System32\svchost.exe[1572] WININET.dll!InternetConnectA 771B44DB 5 Bytes JMP 00080F54 .text C:\WINDOWS\System32\svchost.exe[1572] WININET.dll!InternetOpenA 771B6D2A 5 Bytes JMP 00080D24 .text C:\WINDOWS\System32\svchost.exe[1572] WININET.dll!InternetOpenUrlA 771B6FDD 5 Bytes JMP 00080E3C .text C:\WINDOWS\System32\svchost.exe[1572] WININET.dll!InternetConnectW 771C5D4C 5 Bytes JMP 00080FE0 .text C:\WINDOWS\System32\svchost.exe[1572] WININET.dll!InternetOpenW 771C6CF3 5 Bytes JMP 00080DB0 .text C:\WINDOWS\System32\svchost.exe[1572] WININET.dll!InternetOpenUrlW 771C7304 5 Bytes JMP 00080EC8 .text C:\WINDOWS\system32\svchost.exe[1700] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8 .text C:\WINDOWS\system32\svchost.exe[1700] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090 .text C:\WINDOWS\system32\svchost.exe[1700] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694 .text C:\WINDOWS\system32\svchost.exe[1700] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0 .text C:\WINDOWS\system32\svchost.exe[1700] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234 .text C:\WINDOWS\system32\svchost.exe[1700] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00080004 .text C:\WINDOWS\system32\svchost.exe[1700] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0008011C .text C:\WINDOWS\system32\svchost.exe[1700] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000804F0 .text C:\WINDOWS\system32\svchost.exe[1700] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0008057C .text C:\WINDOWS\system32\svchost.exe[1700] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000803D8 .text C:\WINDOWS\system32\svchost.exe[1700] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0008034C .text C:\WINDOWS\system32\svchost.exe[1700] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00080464 .text C:\WINDOWS\system32\svchost.exe[1700] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00080608 .text C:\WINDOWS\system32\svchost.exe[1700] USER32.dll!SetWindowsHookExW 77D5E621 5 Bytes JMP 000807AC .text C:\WINDOWS\system32\svchost.exe[1700] USER32.dll!SetWindowsHookExA 77D602B2 5 Bytes JMP 00080720 .text C:\WINDOWS\system32\svchost.exe[1700] WS2_32.dll!socket 71A53B91 5 Bytes JMP 000808C4 .text C:\WINDOWS\system32\svchost.exe[1700] WS2_32.dll!bind 71A53E00 5 Bytes JMP 00080838 .text C:\WINDOWS\system32\svchost.exe[1700] WS2_32.dll!connect 71A5406A 5 Bytes JMP 00080950 .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe[1732] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000301A8 .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe[1732] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00030090 .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe[1732] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00030694 .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe[1732] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000302C0 .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe[1732] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00030234 .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe[1732] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00030004 .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe[1732] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0003011C .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe[1732] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000304F0 .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe[1732] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0003057C .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe[1732] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000303D8 .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe[1732] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0003034C .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe[1732] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00030464 .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe[1732] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00030608 .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe[1732] USER32.dll!SetWindowsHookExW 77D5E621 5 Bytes JMP 000307AC .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe[1732] USER32.dll!SetWindowsHookExA 77D602B2 5 Bytes JMP 00030720 .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe[1732] WININET.dll!InternetConnectA 771B44DB 5 Bytes JMP 00030F54 .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe[1732] WININET.dll!InternetOpenA 771B6D2A 5 Bytes JMP 00030D24 .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe[1732] WININET.dll!InternetOpenUrlA 771B6FDD 5 Bytes JMP 00030E3C .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe[1732] WININET.dll!InternetConnectW 771C5D4C 5 Bytes JMP 00030FE0 .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe[1732] WININET.dll!InternetOpenW 771C6CF3 5 Bytes JMP 00030DB0 .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe[1732] WININET.dll!InternetOpenUrlW 771C7304 5 Bytes JMP 00030EC8 .text C:\WINDOWS\system32\svchost.exe[1808] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8 .text C:\WINDOWS\system32\svchost.exe[1808] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090 .text C:\WINDOWS\system32\svchost.exe[1808] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694 .text C:\WINDOWS\system32\svchost.exe[1808] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0 .text C:\WINDOWS\system32\svchost.exe[1808] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234 .text C:\WINDOWS\system32\svchost.exe[1808] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00080004 .text C:\WINDOWS\system32\svchost.exe[1808] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0008011C .text C:\WINDOWS\system32\svchost.exe[1808] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000804F0 .text C:\WINDOWS\system32\svchost.exe[1808] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0008057C .text C:\WINDOWS\system32\svchost.exe[1808] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000803D8 .text C:\WINDOWS\system32\svchost.exe[1808] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0008034C .text C:\WINDOWS\system32\svchost.exe[1808] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00080464 .text C:\WINDOWS\system32\svchost.exe[1808] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00080608 .text C:\WINDOWS\system32\svchost.exe[1808] USER32.dll!SetWindowsHookExW 77D5E621 5 Bytes JMP 000807AC .text C:\WINDOWS\system32\svchost.exe[1808] USER32.dll!SetWindowsHookExA 77D602B2 5 Bytes JMP 00080720 .text C:\WINDOWS\system32\svchost.exe[1808] WS2_32.dll!socket 71A53B91 5 Bytes JMP 000808C4 .text C:\WINDOWS\system32\svchost.exe[1808] WS2_32.dll!bind 71A53E00 5 Bytes JMP 00080838 .text C:\WINDOWS\system32\svchost.exe[1808] WS2_32.dll!connect 71A5406A 5 Bytes JMP 00080950 .text C:\WINDOWS\system32\svchost.exe[1808] WININET.dll!InternetConnectA 771B44DB 5 Bytes JMP 00080F54 .text C:\WINDOWS\system32\svchost.exe[1808] WININET.dll!InternetOpenA 771B6D2A 5 Bytes JMP 00080D24 .text C:\WINDOWS\system32\svchost.exe[1808] WININET.dll!InternetOpenUrlA 771B6FDD 5 Bytes JMP 00080E3C .text C:\WINDOWS\system32\svchost.exe[1808] WININET.dll!InternetConnectW 771C5D4C 5 Bytes JMP 00080FE0 .text C:\WINDOWS\system32\svchost.exe[1808] WININET.dll!InternetOpenW 771C6CF3 5 Bytes JMP 00080DB0 .text C:\WINDOWS\system32\svchost.exe[1808] WININET.dll!InternetOpenUrlW 771C7304 5 Bytes JMP 00080EC8 .text c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[1856] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000B01A8 .text c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[1856] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 000B0090 .text c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[1856] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 000B0694 .text c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[1856] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000B02C0 .text c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[1856] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 000B0234 .text c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[1856] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 000B0004 .text c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[1856] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 000B011C .text c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[1856] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000B04F0 .text c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[1856] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 000B057C .text c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[1856] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000B03D8 .text c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[1856] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 000B034C .text c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[1856] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 000B0464 .text c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[1856] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 000B0608 .text c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[1856] USER32.dll!SetWindowsHookExW 77D5E621 5 Bytes JMP 000B07AC .text c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[1856] USER32.dll!SetWindowsHookExA 77D602B2 5 Bytes JMP 000B0720 .text c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[1856] WS2_32.dll!socket 71A53B91 5 Bytes JMP 000B08C4 .text c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[1856] WS2_32.dll!bind 71A53E00 5 Bytes JMP 000B0838 .text c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe[1856] WS2_32.dll!connect 71A5406A 5 Bytes JMP 000B0950 .text C:\WINDOWS\Explorer.EXE[2036] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8 .text C:\WINDOWS\Explorer.EXE[2036] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090 .text C:\WINDOWS\Explorer.EXE[2036] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694 .text C:\WINDOWS\Explorer.EXE[2036] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0 .text C:\WINDOWS\Explorer.EXE[2036] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234 .text C:\WINDOWS\Explorer.EXE[2036] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00080004 .text C:\WINDOWS\Explorer.EXE[2036] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0008011C .text C:\WINDOWS\Explorer.EXE[2036] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000804F0 .text C:\WINDOWS\Explorer.EXE[2036] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0008057C .text C:\WINDOWS\Explorer.EXE[2036] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000803D8 .text C:\WINDOWS\Explorer.EXE[2036] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0008034C .text C:\WINDOWS\Explorer.EXE[2036] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00080464 .text C:\WINDOWS\Explorer.EXE[2036] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00080608 .text C:\WINDOWS\Explorer.EXE[2036] USER32.dll!SetWindowsHookExW 77D5E621 5 Bytes JMP 000807AC .text C:\WINDOWS\Explorer.EXE[2036] USER32.dll!SetWindowsHookExA 77D602B2 5 Bytes JMP 00080720 .text C:\WINDOWS\Explorer.EXE[2036] WININET.dll!InternetConnectA 771B44DB 5 Bytes JMP 00080F54 .text C:\WINDOWS\Explorer.EXE[2036] WININET.dll!InternetOpenA 771B6D2A 5 Bytes JMP 00080D24 .text C:\WINDOWS\Explorer.EXE[2036] WININET.dll!InternetOpenUrlA 771B6FDD 5 Bytes JMP 00080E3C .text C:\WINDOWS\Explorer.EXE[2036] WININET.dll!InternetConnectW 771C5D4C 5 Bytes JMP 00080FE0 .text C:\WINDOWS\Explorer.EXE[2036] WININET.dll!InternetOpenW 771C6CF3 5 Bytes JMP 00080DB0 .text C:\WINDOWS\Explorer.EXE[2036] WININET.dll!InternetOpenUrlW 771C7304 5 Bytes JMP 00080EC8 .text C:\WINDOWS\Explorer.EXE[2036] WS2_32.dll!socket 71A53B91 5 Bytes JMP 000808C4 .text C:\WINDOWS\Explorer.EXE[2036] WS2_32.dll!bind 71A53E00 5 Bytes JMP 00080838 .text C:\WINDOWS\Explorer.EXE[2036] WS2_32.dll!connect 71A5406A 5 Bytes JMP 00080950 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe[2108] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000701A8 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe[2108] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00070090 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe[2108] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00070694 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe[2108] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000702C0 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe[2108] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00070234 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe[2108] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00070004 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe[2108] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0007011C .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe[2108] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000704F0 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe[2108] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0007057C .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe[2108] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000703D8 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe[2108] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0007034C .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe[2108] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00070464 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe[2108] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00070608 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe[2108] WS2_32.dll!socket 71A53B91 5 Bytes JMP 000708C4 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe[2108] WS2_32.dll!bind 71A53E00 5 Bytes JMP 00070838 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe[2108] WS2_32.dll!connect 71A5406A 5 Bytes JMP 00070950 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe[2108] USER32.dll!SetWindowsHookExW 77D5E621 5 Bytes JMP 000707AC .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe[2108] USER32.dll!SetWindowsHookExA 77D602B2 5 Bytes JMP 00070720 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2148] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000B01A8 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2148] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 000B0090 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2148] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 000B0694 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2148] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000B02C0 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2148] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 000B0234 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2148] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 000B0004 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2148] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 000B011C .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2148] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000B04F0 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2148] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 000B057C .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2148] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000B03D8 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2148] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 000B034C .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2148] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 000B0464 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2148] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 000B0608 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2148] USER32.dll!SetWindowsHookExW 77D5E621 5 Bytes JMP 000B07AC .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2148] USER32.dll!SetWindowsHookExA 77D602B2 5 Bytes JMP 000B0720 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2148] WS2_32.dll!socket 71A53B91 5 Bytes JMP 000B08C4 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2148] WS2_32.dll!bind 71A53E00 5 Bytes JMP 000B0838 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2148] WS2_32.dll!connect 71A5406A 5 Bytes JMP 000B0950 .text C:\Program Files\Opera\opera.exe[2192] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 003C01F8 .text C:\Program Files\Opera\opera.exe[2192] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 003C03FC .text C:\Program Files\Opera\opera.exe[2192] KERNEL32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8 .text C:\Program Files\Opera\opera.exe[2192] KERNEL32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090 .text C:\Program Files\Opera\opera.exe[2192] KERNEL32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694 .text C:\Program Files\Opera\opera.exe[2192] KERNEL32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0 .text C:\Program Files\Opera\opera.exe[2192] KERNEL32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234 .text C:\Program Files\Opera\opera.exe[2192] KERNEL32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00130004 .text C:\Program Files\Opera\opera.exe[2192] KERNEL32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0013011C .text C:\Program Files\Opera\opera.exe[2192] KERNEL32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 001304F0 .text C:\Program Files\Opera\opera.exe[2192] KERNEL32.dll!CreateThread 7C81082F 5 Bytes JMP 0013057C .text C:\Program Files\Opera\opera.exe[2192] KERNEL32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 001303D8 .text C:\Program Files\Opera\opera.exe[2192] KERNEL32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0013034C .text C:\Program Files\Opera\opera.exe[2192] KERNEL32.dll!WinExec 7C86114D 5 Bytes JMP 00130464 .text C:\Program Files\Opera\opera.exe[2192] KERNEL32.dll!SetThreadContext 7C862849 5 Bytes JMP 00130608 .text C:\Program Files\Opera\opera.exe[2192] USER32.dll!SetWindowsHookExW 77D5E621 5 Bytes JMP 001307AC .text C:\Program Files\Opera\opera.exe[2192] USER32.dll!SetWindowsHookExA 77D602B2 5 Bytes JMP 00130720 .text C:\Program Files\Opera\opera.exe[2192] WS2_32.dll!socket 71A53B91 5 Bytes JMP 001308C4 .text C:\Program Files\Opera\opera.exe[2192] WS2_32.dll!bind 71A53E00 5 Bytes JMP 00130838 .text C:\Program Files\Opera\opera.exe[2192] WS2_32.dll!connect 71A5406A 5 Bytes JMP 00130950 .text C:\Program Files\Opera\opera.exe[2192] WININET.dll!InternetConnectA 771B44DB 5 Bytes JMP 00130F54 .text C:\Program Files\Opera\opera.exe[2192] WININET.dll!InternetOpenA 771B6D2A 5 Bytes JMP 00130D24 .text C:\Program Files\Opera\opera.exe[2192] WININET.dll!InternetOpenUrlA 771B6FDD 5 Bytes JMP 00130E3C .text C:\Program Files\Opera\opera.exe[2192] WININET.dll!InternetConnectW 771C5D4C 5 Bytes JMP 00130FE0 .text C:\Program Files\Opera\opera.exe[2192] WININET.dll!InternetOpenW 771C6CF3 5 Bytes JMP 00130DB0 .text C:\Program Files\Opera\opera.exe[2192] WININET.dll!InternetOpenUrlW 771C7304 5 Bytes JMP 00130EC8 .text C:\WINDOWS\system32\svchost.exe[2196] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8 .text C:\WINDOWS\system32\svchost.exe[2196] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090 .text C:\WINDOWS\system32\svchost.exe[2196] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694 .text C:\WINDOWS\system32\svchost.exe[2196] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0 .text C:\WINDOWS\system32\svchost.exe[2196] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234 .text C:\WINDOWS\system32\svchost.exe[2196] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00080004 .text C:\WINDOWS\system32\svchost.exe[2196] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0008011C .text C:\WINDOWS\system32\svchost.exe[2196] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000804F0 .text C:\WINDOWS\system32\svchost.exe[2196] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0008057C .text C:\WINDOWS\system32\svchost.exe[2196] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000803D8 .text C:\WINDOWS\system32\svchost.exe[2196] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0008034C .text C:\WINDOWS\system32\svchost.exe[2196] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00080464 .text C:\WINDOWS\system32\svchost.exe[2196] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00080608 .text C:\WINDOWS\system32\svchost.exe[2196] USER32.dll!SetWindowsHookExW 77D5E621 5 Bytes JMP 000807AC .text C:\WINDOWS\system32\svchost.exe[2196] USER32.dll!SetWindowsHookExA 77D602B2 5 Bytes JMP 00080720 .text C:\WINDOWS\system32\wscntfy.exe[2540] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000701A8 .text C:\WINDOWS\system32\wscntfy.exe[2540] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00070090 .text C:\WINDOWS\system32\wscntfy.exe[2540] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00070694 .text C:\WINDOWS\system32\wscntfy.exe[2540] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000702C0 .text C:\WINDOWS\system32\wscntfy.exe[2540] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00070234 .text C:\WINDOWS\system32\wscntfy.exe[2540] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00070004 .text C:\WINDOWS\system32\wscntfy.exe[2540] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0007011C .text C:\WINDOWS\system32\wscntfy.exe[2540] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000704F0 .text C:\WINDOWS\system32\wscntfy.exe[2540] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0007057C .text C:\WINDOWS\system32\wscntfy.exe[2540] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000703D8 .text C:\WINDOWS\system32\wscntfy.exe[2540] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0007034C .text C:\WINDOWS\system32\wscntfy.exe[2540] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00070464 .text C:\WINDOWS\system32\wscntfy.exe[2540] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00070608 .text C:\WINDOWS\system32\wscntfy.exe[2540] USER32.dll!SetWindowsHookExW 77D5E621 5 Bytes JMP 000707AC .text C:\WINDOWS\system32\wscntfy.exe[2540] USER32.dll!SetWindowsHookExA 77D602B2 5 Bytes JMP 00070720 .text C:\WINDOWS\system32\wbem\wmiprvse.exe[2712] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8 .text C:\WINDOWS\system32\wbem\wmiprvse.exe[2712] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090 .text C:\WINDOWS\system32\wbem\wmiprvse.exe[2712] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694 .text C:\WINDOWS\system32\wbem\wmiprvse.exe[2712] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0 .text C:\WINDOWS\system32\wbem\wmiprvse.exe[2712] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234 .text C:\WINDOWS\system32\wbem\wmiprvse.exe[2712] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00080004 .text C:\WINDOWS\system32\wbem\wmiprvse.exe[2712] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0008011C .text C:\WINDOWS\system32\wbem\wmiprvse.exe[2712] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000804F0 .text C:\WINDOWS\system32\wbem\wmiprvse.exe[2712] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0008057C .text C:\WINDOWS\system32\wbem\wmiprvse.exe[2712] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000803D8 .text C:\WINDOWS\system32\wbem\wmiprvse.exe[2712] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0008034C .text C:\WINDOWS\system32\wbem\wmiprvse.exe[2712] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00080464 .text C:\WINDOWS\system32\wbem\wmiprvse.exe[2712] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00080608 .text C:\WINDOWS\system32\wbem\wmiprvse.exe[2712] USER32.dll!SetWindowsHookExW 77D5E621 5 Bytes JMP 000807AC .text C:\WINDOWS\system32\wbem\wmiprvse.exe[2712] USER32.dll!SetWindowsHookExA 77D602B2 5 Bytes JMP 00080720 .text C:\WINDOWS\system32\wbem\wmiprvse.exe[2712] WS2_32.dll!socket 71A53B91 5 Bytes JMP 000808C4 .text C:\WINDOWS\system32\wbem\wmiprvse.exe[2712] WS2_32.dll!bind 71A53E00 5 Bytes JMP 00080838 .text C:\WINDOWS\system32\wbem\wmiprvse.exe[2712] WS2_32.dll!connect 71A5406A 5 Bytes JMP 00080950 .text C:\Documents and Settings\Krawczyki\Ustawienia lokalne\Dane aplikacji\Opera\Opera\temporary_downloads\fbip4xki.exe[2800] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8 .text C:\Documents and Settings\Krawczyki\Ustawienia lokalne\Dane aplikacji\Opera\Opera\temporary_downloads\fbip4xki.exe[2800] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090 .text C:\Documents and Settings\Krawczyki\Ustawienia lokalne\Dane aplikacji\Opera\Opera\temporary_downloads\fbip4xki.exe[2800] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694 .text C:\Documents and Settings\Krawczyki\Ustawienia lokalne\Dane aplikacji\Opera\Opera\temporary_downloads\fbip4xki.exe[2800] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0 .text C:\Documents and Settings\Krawczyki\Ustawienia lokalne\Dane aplikacji\Opera\Opera\temporary_downloads\fbip4xki.exe[2800] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234 .text C:\Documents and Settings\Krawczyki\Ustawienia lokalne\Dane aplikacji\Opera\Opera\temporary_downloads\fbip4xki.exe[2800] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00130004 .text C:\Documents and Settings\Krawczyki\Ustawienia lokalne\Dane aplikacji\Opera\Opera\temporary_downloads\fbip4xki.exe[2800] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0013011C .text C:\Documents and Settings\Krawczyki\Ustawienia lokalne\Dane aplikacji\Opera\Opera\temporary_downloads\fbip4xki.exe[2800] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 001304F0 .text C:\Documents and Settings\Krawczyki\Ustawienia lokalne\Dane aplikacji\Opera\Opera\temporary_downloads\fbip4xki.exe[2800] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0013057C .text C:\Documents and Settings\Krawczyki\Ustawienia lokalne\Dane aplikacji\Opera\Opera\temporary_downloads\fbip4xki.exe[2800] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 001303D8 .text C:\Documents and Settings\Krawczyki\Ustawienia lokalne\Dane aplikacji\Opera\Opera\temporary_downloads\fbip4xki.exe[2800] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0013034C .text C:\Documents and Settings\Krawczyki\Ustawienia lokalne\Dane aplikacji\Opera\Opera\temporary_downloads\fbip4xki.exe[2800] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00130464 .text C:\Documents and Settings\Krawczyki\Ustawienia lokalne\Dane aplikacji\Opera\Opera\temporary_downloads\fbip4xki.exe[2800] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00130608 .text C:\Documents and Settings\Krawczyki\Ustawienia lokalne\Dane aplikacji\Opera\Opera\temporary_downloads\fbip4xki.exe[2800] USER32.dll!SetWindowsHookExW 77D5E621 5 Bytes JMP 001307AC .text C:\Documents and Settings\Krawczyki\Ustawienia lokalne\Dane aplikacji\Opera\Opera\temporary_downloads\fbip4xki.exe[2800] USER32.dll!SetWindowsHookExA 77D602B2 5 Bytes JMP 00130720 .text C:\WINDOWS\System32\alg.exe[3064] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8 .text C:\WINDOWS\System32\alg.exe[3064] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090 .text C:\WINDOWS\System32\alg.exe[3064] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694 .text C:\WINDOWS\System32\alg.exe[3064] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0 .text C:\WINDOWS\System32\alg.exe[3064] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234 .text C:\WINDOWS\System32\alg.exe[3064] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00080004 .text C:\WINDOWS\System32\alg.exe[3064] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0008011C .text C:\WINDOWS\System32\alg.exe[3064] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000804F0 .text C:\WINDOWS\System32\alg.exe[3064] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0008057C .text C:\WINDOWS\System32\alg.exe[3064] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000803D8 .text C:\WINDOWS\System32\alg.exe[3064] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0008034C .text C:\WINDOWS\System32\alg.exe[3064] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00080464 .text C:\WINDOWS\System32\alg.exe[3064] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00080608 .text C:\WINDOWS\System32\alg.exe[3064] USER32.dll!SetWindowsHookExW 77D5E621 5 Bytes JMP 000807AC .text C:\WINDOWS\System32\alg.exe[3064] USER32.dll!SetWindowsHookExA 77D602B2 5 Bytes JMP 00080720 .text C:\WINDOWS\System32\alg.exe[3064] WS2_32.dll!socket 71A53B91 5 Bytes JMP 000808C4 .text C:\WINDOWS\System32\alg.exe[3064] WS2_32.dll!bind 71A53E00 5 Bytes JMP 00080838 .text C:\WINDOWS\System32\alg.exe[3064] WS2_32.dll!connect 71A5406A 5 Bytes JMP 00080950 .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe[3080] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8 .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe[3080] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090 .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe[3080] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694 .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe[3080] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0 .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe[3080] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234 .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe[3080] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00130004 .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe[3080] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0013011C .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe[3080] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 001304F0 .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe[3080] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0013057C .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe[3080] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 001303D8 .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe[3080] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0013034C .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe[3080] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00130464 .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe[3080] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00130608 .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe[3080] USER32.dll!SetWindowsHookExW 77D5E621 5 Bytes JMP 001307AC .text C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe[3080] USER32.dll!SetWindowsHookExA 77D602B2 5 Bytes JMP 00130720 ---- User IAT/EAT - GMER 2.1 ---- IAT C:\WINDOWS\system32\services.exe[1128] @ C:\WINDOWS\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 003D0002 IAT C:\WINDOWS\system32\services.exe[1128] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!CreateProcessW] 003D0000 ---- Devices - GMER 2.1 ---- Device \FileSystem\Ntfs \Ntfs 867BB1F8 Device \FileSystem\Fastfat \FatCdrom 864411F8 AttachedDevice \Driver\Tcpip \Device\Ip SbFw.sys AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.sys Device \Driver\usbohci \Device\USBPDO-0 8637F440 Device \Driver\usbehci \Device\USBPDO-1 8638E440 AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.sys AttachedDevice \Driver\Tcpip \Device\Tcp SbFw.sys AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 hotcore3.sys Device \Driver\Cdrom \Device\CdRom0 86398440 AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume2 hotcore3.sys Device \Driver\atapi \Device\Ide\IdePort0 8678E1F8 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 8678E1F8 Device \Driver\atapi \Device\Ide\IdePort1 8678E1F8 AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume3 hotcore3.sys Device \Driver\nvata \Device\00000074 867BC1F8 Device \Driver\NetBT \Device\NetBt_Wins_Export 859D21F8 Device \Driver\NetBT \Device\NetbiosSmb 859D21F8 Device \Driver\NetBT \Device\NetBT_Tcpip_{A707A918-E3F9-457A-AE74-E3DAB2A400A9} 859D21F8 AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.sys AttachedDevice \Driver\Tcpip \Device\Udp SbFw.sys AttachedDevice \Driver\Tcpip \Device\RawIp SbFw.sys AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.sys Device \Driver\usbohci \Device\USBFDO-0 8637F440 Device \Driver\usbehci \Device\USBFDO-1 8638E440 Device \Driver\nvata \Device\NvAta0 867BC1F8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 855A11F8 Device \Driver\nvata \Device\NvAta1 867BC1F8 Device \FileSystem\MRxSmb \Device\LanmanRedirector 855A11F8 Device \FileSystem\Fastfat \Fat 864411F8 AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys Device \FileSystem\Cdfs \Cdfs 8642C330 ---- Trace I/O - GMER 2.1 ---- Trace ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x867bc1f8]<< 867bc1f8 Trace 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86757ab8] 86757ab8 Trace 3 CLASSPNP.SYS[f761d05b] -> nt!IofCallDriver -> \Device\00000075[0x8674e938] 8674e938 Trace 5 ACPI.sys[f73df620] -> nt!IofCallDriver -> \Device\00000074[0x866fb030] 866fb030 Trace \Driver\nvata[0x8672ca08] -> IRP_MJ_CREATE -> 0x867bc1f8 867bc1f8 ---- EOF - GMER 2.1 ----